- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 1/2] of: overlay: fix for_each_child.cocci warnings
by Yongqiang Liu 08 Jun '23

08 Jun '23

From: kernel test robot <lkp(a)intel.com> mainline inclusion from mainline-v5.13-rc1 commit c4d74f0f978ed5ceee62cd3f6708081042e582a1 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I73DDA CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------ Function "for_each_child_of_node" should have of_node_put() before goto. Generated by: scripts/coccinelle/iterators/for_each_child.cocci Fixes: 82c2d81361ec ("coccinelle: iterators: Add for_each_child.cocci script") CC: Sumera Priyadarsini <sylphrenadin(a)gmail.com> Reported-by: kernel test robot <lkp(a)intel.com> Signed-off-by: kernel test robot <lkp(a)intel.com> Signed-off-by: Julia Lawall <julia.lawall(a)inria.fr> Reviewed-by: Frank Rowand <frank.rowand(a)sony.com> Tested-by: Frank Rowand <frank.rowand(a)sony.com> Link: https://lore.kernel.org/r/alpine.DEB.2.22.394.2103221918450.2918@hadrien Signed-off-by: Rob Herring <robh(a)kernel.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> Reviewed-by: xuqiang <xuqiang36(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/of/overlay.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c index a77bfeac867d..b0a765fcef2f 100644 --- a/drivers/of/overlay.c +++ b/drivers/of/overlay.c @@ -713,6 +713,7 @@ static int init_overlay_changeset(struct overlay_changeset *ovcs, if (!fragment->target) { of_node_put(fragment->overlay); ret = -EINVAL; + of_node_put(node); goto err_free_fragments; } -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/2] fs: hfsplus: fix UAF issue in hfsplus_put_super
by Yongqiang Liu 08 Jun '23

08 Jun '23

From: Dongliang Mu <mudongliangabcd(a)gmail.com> stable inclusion from stable-v4.19.273 commit e226f1fdcee1ca6e68233b132718deb578a84e38 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I79LIO CVE: CVE-2023-2985 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 07db5e247ab5858439b14dd7cc1fe538b9efcf32 upstream. The current hfsplus_put_super first calls hfs_btree_close on sbi->ext_tree, then invokes iput on sbi->hidden_dir, resulting in an use-after-free issue in hfsplus_release_folio. As shown in hfsplus_fill_super, the error handling code also calls iput before hfs_btree_close. To fix this error, we move all iput calls before hfsplus_btree_close. Note that this patch is tested on Syzbot. Link: https://lkml.kernel.org/r/20230226124948.3175736-1-mudongliangabcd@gmail.com Reported-by: syzbot+57e3e98f7e3b80f64d56(a)syzkaller.appspotmail.com Tested-by: Dongliang Mu <mudongliangabcd(a)gmail.com> Signed-off-by: Dongliang Mu <mudongliangabcd(a)gmail.com> Cc: Bart Van Assche <bvanassche(a)acm.org> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: Muchun Song <songmuchun(a)bytedance.com> Cc: Roman Gushchin <roman.gushchin(a)linux.dev> Cc: "Theodore Ts'o" <tytso(a)mit.edu> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/hfsplus/super.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c index eb4535eba95d..3b1356b10a47 100644 --- a/fs/hfsplus/super.c +++ b/fs/hfsplus/super.c @@ -294,11 +294,11 @@ static void hfsplus_put_super(struct super_block *sb) hfsplus_sync_fs(sb, 1); } + iput(sbi->alloc_file); + iput(sbi->hidden_dir); hfs_btree_close(sbi->attr_tree); hfs_btree_close(sbi->cat_tree); hfs_btree_close(sbi->ext_tree); - iput(sbi->alloc_file); - iput(sbi->hidden_dir); kfree(sbi->s_vhdr_buf); kfree(sbi->s_backup_vhdr_buf); unload_nls(sbi->nls); -- 2.25.1

1 1

[PATCH openEuler-22.03-LTS-SP2 00/35] xfs: fixes patchs and backport patchs
by Long Li 08 Jun '23

08 Jun '23

Allison Henderson (1): xfs: increase rename inode reservation ChenXiaoSong (1): xfs: fix NULL pointer dereference in xfs_getbmap() Darrick J. Wong (6): xfs: check return codes when flushing block devices xfs: fix maxlevels comparisons in the btree staging code xfs: shut down filesystem if we xfs_trans_cancel with deferred work items xfs: don't expose internal symlink metadata buffers to the vfs xfs: fix negative array access in xfs_getbmap iomap: iomap: fix memory corruption when recording errors during writeback Dave Chinner (13): xfs: remove xfs_blkdev_issue_flush xfs: AIL should be log centric xfs: shutdown in intent recovery has non-intent items in the AIL xfs: log shutdown triggers should only shut down the log xfs: xfs_do_force_shutdown needs to block racing shutdowns xfs: xfs_trans_commit() path must check for log shutdown xfs: shutdown during log recovery needs to mark the log shutdown xfs: remove XFS_PREALLOC_SYNC xfs: fallocate() should call file_modified() xfs: sb verifier doesn't handle uncached sb buffer xfs: write page faults in iomap are not buffered writes iomap: write iomap validity checks xfs: use iomap_valid method to detect stale cached iomaps Gao Xiang (1): xfs: account extra freespace btree splits for multiple allocations Guo Xuenan (3): Revert "[Huawei] xfs: fix uaf when leaf dir bestcount not match with dir data blocks" xfs: fix exception caused by unexpected illegal bestcount in leaf dir xfs: force shutdown xfs when xfs_attr_inactive fails Long Li (4): xfs: fix ag count overflow during growfs xfs: fix hung when transaction commit fail in xfs_inactive_ifree xfs: fix a UAF when inode item push xfs: fix a UAF in xfs_iflush_abort_clean Shida Zhang (1): xfs: trim the mapp array accordingly in xfs_da_grow_inode_int Wu Guanghao (1): xfs: fix the problem of mount failure caused by not refreshing mp->m_sb Ye Bin (2): xfs: fix BUG_ON in xfs_getbmap() xfs: fix dead loop when do mount with IO fault injection Zhang Yi (2): xfs: factor out __xfs_da3_node_read() xfs: atomic drop extent entries when inactiving attr fs/iomap/apply.c | 14 +++- fs/iomap/buffered-io.c | 29 ++++++++- fs/xfs/libxfs/xfs_alloc.c | 9 ++- fs/xfs/libxfs/xfs_alloc.h | 1 + fs/xfs/libxfs/xfs_bmap.c | 7 +- fs/xfs/libxfs/xfs_btree_staging.c | 4 +- fs/xfs/libxfs/xfs_da_btree.c | 7 +- fs/xfs/libxfs/xfs_da_btree.h | 15 ++++- fs/xfs/libxfs/xfs_dir2_leaf.c | 21 ++---- fs/xfs/libxfs/xfs_ialloc.c | 1 + fs/xfs/libxfs/xfs_sb.c | 2 +- fs/xfs/libxfs/xfs_trans_resv.c | 4 +- fs/xfs/xfs_aops.c | 2 +- fs/xfs/xfs_attr_inactive.c | 66 ++++++++++++++----- fs/xfs/xfs_bmap_util.c | 34 +++++----- fs/xfs/xfs_buf.c | 7 +- fs/xfs/xfs_buf.h | 7 +- fs/xfs/xfs_buf_item.c | 20 ++++++ fs/xfs/xfs_buf_item_recover.c | 24 +++++++ fs/xfs/xfs_file.c | 49 ++++++++------ fs/xfs/xfs_fsops.c | 9 ++- fs/xfs/xfs_inode.c | 5 +- fs/xfs/xfs_inode_item.c | 11 +++- fs/xfs/xfs_iomap.c | 105 ++++++++++++++++++++++++------ fs/xfs/xfs_iomap.h | 7 +- fs/xfs/xfs_iops.c | 34 +--------- fs/xfs/xfs_log.c | 68 +++++++++++++------ fs/xfs/xfs_log_cil.c | 4 +- fs/xfs/xfs_log_priv.h | 11 ++++ fs/xfs/xfs_log_recover.c | 56 ++++++---------- fs/xfs/xfs_mount.c | 1 + fs/xfs/xfs_pnfs.c | 12 ++-- fs/xfs/xfs_super.c | 7 -- fs/xfs/xfs_super.h | 1 - fs/xfs/xfs_symlink.c | 27 +++++--- fs/xfs/xfs_trans.c | 61 ++++++++++++----- fs/xfs/xfs_trans_ail.c | 30 ++++----- fs/xfs/xfs_trans_priv.h | 3 +- include/linux/iomap.h | 39 +++++++++-- 39 files changed, 549 insertions(+), 265 deletions(-) -- 2.31.1

2 36

[PATCH OLK-5.10 0/5] A set of patch for uploading openEuler
by Yihang Li 08 Jun '23

08 Jun '23

From: xiabing <xiabing12(a)h-partners.com> Arnd Bergmann (1): scsi: hisi_sas: Work around build failure in suspend function Qi Liu (1): scsi: hisi_sas: Add slave_destroy interface for v3 hw Xiang Chen (1): scsi: sd: try more retries of START_STOP when resuming scsi device Yihang Li (2): scsi: hisi_sas: Block requests before take debugfs snapshot scsi: hisi_sas: Check usage count only when the runtime PM status is RPM_SUSPENDING drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 31 +++++++++++++++++++++----- drivers/scsi/sd.c | 24 +++++++++++++++----- 2 files changed, 43 insertions(+), 12 deletions(-) -- 2.30.0

2 6

[PATCH openEuler-22.03-LTS 0/4] io_uring: fix the problem of
by Li Lingfeng 08 Jun '23

08 Jun '23

patch1: arch: setup PF_IO_WORKER threads like PF_KTHREAD pre patch of patch4 patch2: arch: ensure parisc/powerpc handle PF_IO_WORKER in copy_thread() fix patch of patch1 patch3: kernel: don't call do_exit() for PF_IO_WORKER threads fix the segfault patch4: x86/process: setup io_threads more like normal user space threads allow io worker to exit Jens Axboe (3): arch: setup PF_IO_WORKER threads like PF_KTHREAD arch: ensure parisc/powerpc handle PF_IO_WORKER in copy_thread() kernel: don't call do_exit() for PF_IO_WORKER threads Stefan Metzmacher (1): x86/process: setup io_threads more like normal user space threads arch/alpha/kernel/process.c | 2 +- arch/arc/kernel/process.c | 2 +- arch/arm/kernel/process.c | 2 +- arch/arm64/kernel/process.c | 2 +- arch/csky/kernel/process.c | 2 +- arch/h8300/kernel/process.c | 2 +- arch/hexagon/kernel/process.c | 2 +- arch/ia64/kernel/process.c | 2 +- arch/m68k/kernel/process.c | 2 +- arch/microblaze/kernel/process.c | 2 +- arch/mips/kernel/process.c | 2 +- arch/nds32/kernel/process.c | 2 +- arch/nios2/kernel/process.c | 2 +- arch/openrisc/kernel/process.c | 2 +- arch/parisc/kernel/process.c | 2 +- arch/powerpc/kernel/process.c | 2 +- arch/riscv/kernel/process.c | 2 +- arch/s390/kernel/process.c | 2 +- arch/sh/kernel/process_32.c | 2 +- arch/sparc/kernel/process_32.c | 2 +- arch/sparc/kernel/process_64.c | 2 +- arch/um/kernel/process.c | 2 +- arch/x86/kernel/process.c | 17 +++++++++++++++++ arch/xtensa/kernel/process.c | 2 +- kernel/signal.c | 10 +++++++++- 25 files changed, 49 insertions(+), 24 deletions(-) -- 2.31.1

2 5

[PATCH openEuler-22.03-LTS v2] nbd: get config_lock before sock_shutdown
by Zhong Jinghua 08 Jun '23

08 Jun '23

From: Zhong Jinghua <zhongjinghua(a)huaweicloud.com> Offering: HULK hulk inclusion category: bugfix bugzilla: 188799, https://gitee.com/openeuler/kernel/issues/I79QWO CVE: NA ---------------------------------------- Config->socks in sock_shutdown may trigger a UAF problem. The reason is that sock_shutdown does not hold the config_lock, so that nbd_ioctl can release config->socks at this time. T0: NBD_SET_SOCK T1: NBD_DO_IT T0 T1 nbd_ioctl mutex_lock(&nbd->config_lock) // get lock __nbd_ioctl nbd_start_device_ioctl nbd_start_device mutex_unlock(&nbd->config_lock) // relase lock wait_event_interruptible (kill, enter sock_shutdown) sock_shutdown nbd_ioctl mutex_lock(&nbd->config_lock) // get lock __nbd_ioctl nbd_add_socket krealloc kfree(p) //config->socks is NULL nbd_sock *nsock = config->socks // error Fix it by moving config_lock up before sock_shutdown. Signed-off-by: Zhong Jinghua <zhongjinghua(a)huawei.com> --- v2: adapt drivers/block/nbd.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index ebcdb6025be3..ba98fdaaa35a 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -1406,11 +1406,16 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd, struct block_device *b mutex_unlock(&nbd->config_lock); ret = wait_event_interruptible(config->recv_wq, atomic_read(&config->recv_threads) == 0); + + /* + * recv_work in flush_workqueue will not get this lock, because nbd_open + * will hold nbd->config_refs + */ + mutex_lock(&nbd->config_lock); if (ret) sock_shutdown(nbd); flush_workqueue(nbd->recv_workq); - mutex_lock(&nbd->config_lock); nbd_bdev_reset(bdev); /* user requested, ignore socket errors */ if (test_bit(NBD_RT_DISCONNECT_REQUESTED, &config->runtime_flags)) -- 2.31.1

2 1

[PATCH v3 OLK-5.10 0/4] support ACPI for MPAM 2.0
by Yu Liao 08 Jun '23

08 Jun '23

This patch series support ACPI for MPAM 2.0. Erik Kaneda (1): ACPICA: ACPI 6.4: PPTT: add new version of subtable type 1 Hesham Almatary (1): ACPICA: Add support for Arm's MPAM ACPI table version 2 Yu Liao (2): ACPI / PPTT: Find PPTT processor node by cache id ACPI/MPAM: Adapt to Arm's MPAM ACPI table version 2 arch/arm64/kernel/mpam/mpam_device.c | 2 +- drivers/acpi/arm64/Makefile | 2 +- drivers/acpi/arm64/mpam.c | 19 ++- drivers/acpi/arm64/mpam_v2.c | 176 +++++++++++++++++++++++++++ drivers/acpi/pptt.c | 55 +++++++++ include/acpi/actbl2.h | 118 ++++++++++++++++++ include/linux/acpi.h | 5 + include/linux/arm_mpam.h | 2 +- 8 files changed, 373 insertions(+), 6 deletions(-) create mode 100644 drivers/acpi/arm64/mpam_v2.c -- 2.25.1

2 5

[PATCH OLK-5.10 v2] fs: hfsplus: fix UAF issue in hfsplus_put_super
by Long Li 08 Jun '23

08 Jun '23

From: Dongliang Mu <mudongliangabcd(a)gmail.com> stable inclusion from stable-v5.10.167 commit ef7d71d7bd57b8b7fe514e459927696c1c6d1047 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I79LIO CVE: CVE-2023-2985 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 07db5e247ab5858439b14dd7cc1fe538b9efcf32 upstream. The current hfsplus_put_super first calls hfs_btree_close on sbi->ext_tree, then invokes iput on sbi->hidden_dir, resulting in an use-after-free issue in hfsplus_release_folio. As shown in hfsplus_fill_super, the error handling code also calls iput before hfs_btree_close. To fix this error, we move all iput calls before hfsplus_btree_close. Note that this patch is tested on Syzbot. Link: https://lkml.kernel.org/r/20230226124948.3175736-1-mudongliangabcd@gmail.com Reported-by: syzbot+57e3e98f7e3b80f64d56(a)syzkaller.appspotmail.com Tested-by: Dongliang Mu <mudongliangabcd(a)gmail.com> Signed-off-by: Dongliang Mu <mudongliangabcd(a)gmail.com> Cc: Bart Van Assche <bvanassche(a)acm.org> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: Muchun Song <songmuchun(a)bytedance.com> Cc: Roman Gushchin <roman.gushchin(a)linux.dev> Cc: "Theodore Ts'o" <tytso(a)mit.edu> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> --- fs/hfsplus/super.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c index 807119ae5adf..7648f64a17a8 100644 --- a/fs/hfsplus/super.c +++ b/fs/hfsplus/super.c @@ -295,11 +295,11 @@ static void hfsplus_put_super(struct super_block *sb) hfsplus_sync_fs(sb, 1); } + iput(sbi->alloc_file); + iput(sbi->hidden_dir); hfs_btree_close(sbi->attr_tree); hfs_btree_close(sbi->cat_tree); hfs_btree_close(sbi->ext_tree); - iput(sbi->alloc_file); - iput(sbi->hidden_dir); kfree(sbi->s_vhdr_buf); kfree(sbi->s_backup_vhdr_buf); unload_nls(sbi->nls); -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS v8 0/2] smart grid scheduler
by Wang ShaoBo 08 Jun '23

08 Jun '23

v8: 处理了下格式问题，调度部分小有修改。 v7: 修复了commit message拼词错误和补丁格式问题。 v6: 自动模式下逃逸改为禁止，当前环境测试，功能OK，收益OK，直接使用根分组收益较小建议新建分组,建议使用mask屏蔽level0。 v5: 调度部分已完成评审完成代码修改，逃逸部分仍然使用pelt. 内存策略调整模块已经按照review已将进行修改. v4: fix KABI add 'cpu.affinity_domain_mask' add some statistics v3: 修改了patchwork错误，但是KABI还有个问题待解决。 v2: formal version 1. Hui Tang (1): sched: Introduce smart grid scheduling strategy for cfs Wang ShaoBo (1): sched: smart grid: init sched_grid_qos structure on QOS purpose fs/proc/array.c | 13 + include/linux/sched.h | 18 ++ include/linux/sched/grid_qos.h | 92 +++++++ include/linux/sched/sysctl.h | 4 + init/Kconfig | 13 + kernel/fork.c | 9 + kernel/sched/Makefile | 1 + kernel/sched/core.c | 147 +++++++++++ kernel/sched/fair.c | 437 ++++++++++++++++++++++++++++++++- kernel/sched/grid/Makefile | 2 + kernel/sched/grid/internal.h | 6 + kernel/sched/grid/power.c | 27 ++ kernel/sched/grid/qos.c | 143 +++++++++++ kernel/sched/grid/stat.c | 32 +++ kernel/sched/sched.h | 50 ++++ kernel/sysctl.c | 9 + mm/mempolicy.c | 12 +- 17 files changed, 1012 insertions(+), 3 deletions(-) create mode 100644 include/linux/sched/grid_qos.h create mode 100644 kernel/sched/grid/Makefile create mode 100644 kernel/sched/grid/internal.h create mode 100644 kernel/sched/grid/power.c create mode 100644 kernel/sched/grid/qos.c create mode 100644 kernel/sched/grid/stat.c -- 2.25.1

2 3

[PATCH OLK-5.10 0/2] bugfix the lost interruption problem after live migration
by liulongfang 08 Jun '23

08 Jun '23

From: JiangShui Yang <yangjiangshui(a)h-partners.com> The problem of service interruption and loss may be triggered during live migration. In order to ensure normal business, it is necessary to resend an interrupt in the live migration driver. And in the QM service driver, it is guaranteed that the retransmission interrupt can be received normally. Longfang Liu (2): crypto: hisilicon/qm - fix EQ/AEQ interrupt issue vfio/migration: bugfix lost interruption after live migration .../hisilicon/migration/acc_vf_migration.c | 66 +++++++---- .../hisilicon/migration/acc_vf_migration.h | 2 + drivers/crypto/hisilicon/qm.c | 107 +++++++----------- include/linux/hisi_acc_qm.h | 1 + 4 files changed, 86 insertions(+), 90 deletions(-) -- 2.30.0

1 2