June 2022 - Kernel - mailweb.openeuler.org

[PATCH openEuler-5.10 01/49] io_uring: always use original task when preparing req identity
by Zheng Zengkai 14 Jun '22

14 Jun '22

From: Jens Axboe <axboe(a)kernel.dk> stable inclusion from stable-v5.10.116 commit 29f077d070519a88a793fbc70f1e6484dc6d9e35 category: bugfix bugzilla: 186865,https://gitee.com/src-openeuler/kernel/issues/I593SI CVE: CVE-2022-1786 -------------------------------- If the ring is setup with IORING_SETUP_IOPOLL and we have more than one task doing submissions on a ring, we can up in a situation where we assign the context from the current task rather than the request originator. Always use req->task rather than assume it's the same as current. No upstream patch exists for this issue, as only older kernels with the non-native workers have this problem. Reported-by: Kyle Zeng <zengyhkyle(a)gmail.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Guo Xuenan <guoxuenan(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- fs/io_uring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index 2ed0da75000e..cadd491edc6f 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -1156,7 +1156,7 @@ static inline void __io_req_init_async(struct io_kiocb *req) */ static inline void io_req_init_async(struct io_kiocb *req) { - struct io_uring_task *tctx = current->io_uring; + struct io_uring_task *tctx = req->task->io_uring; if (req->flags & REQ_F_WORK_INITIALIZED) return; -- 2.20.1

1 48

[openEuler-5.10 00/19] Backport 5.10.107 LTS
by Zheng Zengkai 14 Jun '22

14 Jun '22

Backport 5.10.107 LTS patches from upstream kselftest/vm: fix tests build with old libc sfc: extend the locking on mcdi->seqno tcp: make tcp_read_sock() more robust nl80211: Update bss channel on channel switch for P2P_CLIENT drm/vrr: Set VRR capable prop only if it is attached to connector iwlwifi: don't advertise TWT support atm: firestream: check the return value of ioremap() in fs_init() can: rcar_canfd: rcar_canfd_channel_probe(): register the CAN device when fully ready ARM: 9178/1: fix unmet dependency on BITREVERSE for HAVE_ARCH_BITREVERSE MIPS: smp: fill in sibling and core maps earlier mac80211: refuse aggregations sessions before authorized ARM: dts: rockchip: fix a typo on rk3288 crypto-controller ARM: dts: rockchip: reorder rk322x hmdi clocks arm64: dts: agilex: use the compatible "intel,socfpga-agilex-hsotg" arm64: dts: rockchip: reorder rk3399 hdmi clocks arm64: dts: rockchip: fix rk3399-puma eMMC HS400 signal integrity xfrm: Fix xfrm migrate issues when address family changes xfrm: Check if_id in xfrm_migrate Revert "xfrm: state and policy should fail if XFRMA_IF_ID 0" Already merged(3) arm64: kvm: Fix copy-and-paste error in bhb templates for v5.10 stable io_uring: return back safer resurrect sctp: fix the processing for INIT chunk Total patches: 22 - 3 = 19 Alexander Lobakin (1): MIPS: smp: fill in sibling and core maps earlier Chengming Zhou (1): kselftest/vm: fix tests build with old libc Corentin Labbe (1): ARM: dts: rockchip: fix a typo on rk3288 crypto-controller Dinh Nguyen (1): arm64: dts: agilex: use the compatible "intel,socfpga-agilex-hsotg" Eric Dumazet (1): tcp: make tcp_read_sock() more robust Golan Ben Ami (1): iwlwifi: don't advertise TWT support Jakob Unterwurzacher (1): arm64: dts: rockchip: fix rk3399-puma eMMC HS400 signal integrity Jia-Ju Bai (1): atm: firestream: check the return value of ioremap() in fs_init() Johannes Berg (1): mac80211: refuse aggregations sessions before authorized Julian Braha (1): ARM: 9178/1: fix unmet dependency on BITREVERSE for HAVE_ARCH_BITREVERSE Kai Lueke (1): Revert "xfrm: state and policy should fail if XFRMA_IF_ID 0" Lad Prabhakar (1): can: rcar_canfd: rcar_canfd_channel_probe(): register the CAN device when fully ready Manasi Navare (1): drm/vrr: Set VRR capable prop only if it is attached to connector Niels Dossche (1): sfc: extend the locking on mcdi->seqno Sascha Hauer (2): arm64: dts: rockchip: reorder rk3399 hdmi clocks ARM: dts: rockchip: reorder rk322x hmdi clocks Sreeramya Soratkal (1): nl80211: Update bss channel on channel switch for P2P_CLIENT Yan Yan (2): xfrm: Check if_id in xfrm_migrate xfrm: Fix xfrm migrate issues when address family changes arch/arm/boot/dts/rk322x.dtsi | 4 +-- arch/arm/boot/dts/rk3288.dtsi | 2 +- arch/arm64/boot/dts/intel/socfpga_agilex.dtsi | 4 +-- arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 6 +++++ arch/arm64/boot/dts/rockchip/rk3399.dtsi | 6 ++--- arch/mips/kernel/smp.c | 6 ++--- drivers/atm/firestream.c | 2 ++ drivers/gpu/drm/drm_connector.c | 3 +++ drivers/net/can/rcar/rcar_canfd.c | 6 ++--- drivers/net/ethernet/sfc/mcdi.c | 2 +- .../wireless/intel/iwlwifi/iwl-nvm-parse.c | 3 +-- .../net/wireless/intel/iwlwifi/mvm/mac80211.c | 1 - include/net/xfrm.h | 5 ++-- lib/Kconfig | 1 - net/ipv4/tcp.c | 10 ++++--- net/key/af_key.c | 2 +- net/mac80211/agg-tx.c | 10 ++++++- net/wireless/nl80211.c | 3 ++- net/xfrm/xfrm_policy.c | 14 +++++----- net/xfrm/xfrm_state.c | 15 ++++++++--- net/xfrm/xfrm_user.c | 27 ++++++------------- tools/testing/selftests/vm/userfaultfd.c | 1 + 22 files changed, 76 insertions(+), 57 deletions(-) -- 2.20.1

1 19

[PATCH openEuler-1.0-LTS 1/9] HID: add hid_is_usb() function to make it simpler for USB detection
by Yongqiang Liu 14 Jun '22

14 Jun '22

From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> stable inclusion from linux-4.19.221 commit b1efa723b986a84f84a95b6907cffe3a357338c9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5BTIG CVE: CVE-2022-20132 -------------------------------- commit f83baa0cb6cfc92ebaf7f9d3a99d7e34f2e77a8a upstream. A number of HID drivers already call hid_is_using_ll_driver() but only for the detection of if this is a USB device or not. Make this more obvious by creating hid_is_usb() and calling the function that way. Also converts the existing hid_is_using_ll_driver() functions to use the new call. Cc: Jiri Kosina <jikos(a)kernel.org> Cc: Benjamin Tissoires <benjamin.tissoires(a)redhat.com> Cc: linux-input(a)vger.kernel.org Cc: stable(a)vger.kernel.org Tested-by: Benjamin Tissoires <benjamin.tissoires(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Benjamin Tissoires <benjamin.tissoires(a)redhat.com> Link: https://lore.kernel.org/r/20211201183503.2373082-1-gregkh@linuxfoundation.o… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Rui Xiang <rui.xiang(a)huawei.com> Reviewed-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/hid/hid-asus.c | 2 +- drivers/hid/wacom_sys.c | 2 +- include/linux/hid.h | 5 +++++ 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c index 88a5672f42cd..800b2364e29e 100644 --- a/drivers/hid/hid-asus.c +++ b/drivers/hid/hid-asus.c @@ -622,7 +622,7 @@ static int asus_probe(struct hid_device *hdev, const struct hid_device_id *id) if (drvdata->quirks & QUIRK_IS_MULTITOUCH) drvdata->tp = &asus_i2c_tp; - if (drvdata->quirks & QUIRK_T100_KEYBOARD) { + if ((drvdata->quirks & QUIRK_T100_KEYBOARD) && hid_is_usb(hdev)) { struct usb_interface *intf = to_usb_interface(hdev->dev.parent); if (intf->altsetting->desc.bInterfaceNumber == T100_TPAD_INTF) { diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c index 3038c975e417..101b5ae2c3a7 100644 --- a/drivers/hid/wacom_sys.c +++ b/drivers/hid/wacom_sys.c @@ -2154,7 +2154,7 @@ static void wacom_update_name(struct wacom *wacom, const char *suffix) if ((features->type == HID_GENERIC) && !strcmp("Wacom HID", features->name)) { char *product_name = wacom->hdev->name; - if (hid_is_using_ll_driver(wacom->hdev, &usb_hid_driver)) { + if (hid_is_usb(wacom->hdev)) { struct usb_interface *intf = to_usb_interface(wacom->hdev->dev.parent); struct usb_device *dev = interface_to_usbdev(intf); product_name = dev->product; diff --git a/include/linux/hid.h b/include/linux/hid.h index bbbe6c0e0e26..7f321909ec58 100644 --- a/include/linux/hid.h +++ b/include/linux/hid.h @@ -832,6 +832,11 @@ static inline bool hid_is_using_ll_driver(struct hid_device *hdev, return hdev->ll_driver == driver; } +static inline bool hid_is_usb(struct hid_device *hdev) +{ + return hid_is_using_ll_driver(hdev, &usb_hid_driver); +} + #define PM_HINT_FULLON 1<<5 #define PM_HINT_NORMAL 1<<1 -- 2.25.1

1 8

[PATCH openEuler-5.10-LTS 01/42] netfilter: nf_tables: sanitize nft_set_desc_concat_parse()
by Zheng Zengkai 14 Jun '22

14 Jun '22

From: Pablo Neira Ayuso <pablo(a)netfilter.org> stable inclusion from stable-v5.10.120 commit c0aff1faf66b6b7a19103f83e6a5d0fdc64b9048 category: bugfix bugzilla: 186913 https://gitee.com/src-openeuler/kernel/issues/I5B69E CVE: CVE-2022-1972 -------------------------------- commit fecf31ee395b0295f2d7260aa29946b7605f7c85 upstream. Add several sanity checks for nft_set_desc_concat_parse(): - validate desc->field_count not larger than desc->field_len array. - field length cannot be larger than desc->field_len (ie. U8_MAX) - total length of the concatenation cannot be larger than register array. Joint work with Florian Westphal. Fixes: f3a2181e16f1 ("netfilter: nf_tables: Support for sets with multiple ranged fields") Reported-by: <zhangziming.zzm(a)antgroup.com> Reviewed-by: Stefano Brivio <sbrivio(a)redhat.com> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- net/netfilter/nf_tables_api.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index fdd1da9ecea9..164b686bb4c9 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -4047,6 +4047,9 @@ static int nft_set_desc_concat_parse(const struct nlattr *attr, u32 len; int err; + if (desc->field_count >= ARRAY_SIZE(desc->field_len)) + return -E2BIG; + err = nla_parse_nested_deprecated(tb, NFTA_SET_FIELD_MAX, attr, nft_concat_policy, NULL); if (err < 0) @@ -4056,9 +4059,8 @@ static int nft_set_desc_concat_parse(const struct nlattr *attr, return -EINVAL; len = ntohl(nla_get_be32(tb[NFTA_SET_FIELD_LEN])); - - if (len * BITS_PER_BYTE / 32 > NFT_REG32_COUNT) - return -E2BIG; + if (!len || len > U8_MAX) + return -EINVAL; desc->field_len[desc->field_count++] = len; @@ -4069,7 +4071,8 @@ static int nft_set_desc_concat(struct nft_set_desc *desc, const struct nlattr *nla) { struct nlattr *attr; - int rem, err; + u32 num_regs = 0; + int rem, err, i; nla_for_each_nested(attr, nla, rem) { if (nla_type(attr) != NFTA_LIST_ELEM) @@ -4080,6 +4083,12 @@ static int nft_set_desc_concat(struct nft_set_desc *desc, return err; } + for (i = 0; i < desc->field_count; i++) + num_regs += DIV_ROUND_UP(desc->field_len[i], sizeof(u32)); + + if (num_regs > NFT_REG32_COUNT) + return -E2BIG; + return 0; } -- 2.20.1

1 41

[PATCH openEuler-5.10 00/19] Backport 5.10.107 LTS
by Zheng Zengkai 14 Jun '22

14 Jun '22

Backport 5.10.107 LTS patches from upstream kselftest/vm: fix tests build with old libc sfc: extend the locking on mcdi->seqno tcp: make tcp_read_sock() more robust nl80211: Update bss channel on channel switch for P2P_CLIENT drm/vrr: Set VRR capable prop only if it is attached to connector iwlwifi: don't advertise TWT support atm: firestream: check the return value of ioremap() in fs_init() can: rcar_canfd: rcar_canfd_channel_probe(): register the CAN device when fully ready ARM: 9178/1: fix unmet dependency on BITREVERSE for HAVE_ARCH_BITREVERSE MIPS: smp: fill in sibling and core maps earlier mac80211: refuse aggregations sessions before authorized ARM: dts: rockchip: fix a typo on rk3288 crypto-controller ARM: dts: rockchip: reorder rk322x hmdi clocks arm64: dts: agilex: use the compatible "intel,socfpga-agilex-hsotg" arm64: dts: rockchip: reorder rk3399 hdmi clocks arm64: dts: rockchip: fix rk3399-puma eMMC HS400 signal integrity xfrm: Fix xfrm migrate issues when address family changes xfrm: Check if_id in xfrm_migrate Revert "xfrm: state and policy should fail if XFRMA_IF_ID 0" Already merged(3) arm64: kvm: Fix copy-and-paste error in bhb templates for v5.10 stable io_uring: return back safer resurrect sctp: fix the processing for INIT chunk Total patches: 22 - 3 = 19 Alexander Lobakin (1): MIPS: smp: fill in sibling and core maps earlier Chengming Zhou (1): kselftest/vm: fix tests build with old libc Corentin Labbe (1): ARM: dts: rockchip: fix a typo on rk3288 crypto-controller Dinh Nguyen (1): arm64: dts: agilex: use the compatible "intel,socfpga-agilex-hsotg" Eric Dumazet (1): tcp: make tcp_read_sock() more robust Golan Ben Ami (1): iwlwifi: don't advertise TWT support Jakob Unterwurzacher (1): arm64: dts: rockchip: fix rk3399-puma eMMC HS400 signal integrity Jia-Ju Bai (1): atm: firestream: check the return value of ioremap() in fs_init() Johannes Berg (1): mac80211: refuse aggregations sessions before authorized Julian Braha (1): ARM: 9178/1: fix unmet dependency on BITREVERSE for HAVE_ARCH_BITREVERSE Kai Lueke (1): Revert "xfrm: state and policy should fail if XFRMA_IF_ID 0" Lad Prabhakar (1): can: rcar_canfd: rcar_canfd_channel_probe(): register the CAN device when fully ready Manasi Navare (1): drm/vrr: Set VRR capable prop only if it is attached to connector Niels Dossche (1): sfc: extend the locking on mcdi->seqno Sascha Hauer (2): arm64: dts: rockchip: reorder rk3399 hdmi clocks ARM: dts: rockchip: reorder rk322x hmdi clocks Sreeramya Soratkal (1): nl80211: Update bss channel on channel switch for P2P_CLIENT Yan Yan (2): xfrm: Check if_id in xfrm_migrate xfrm: Fix xfrm migrate issues when address family changes arch/arm/boot/dts/rk322x.dtsi | 4 +-- arch/arm/boot/dts/rk3288.dtsi | 2 +- arch/arm64/boot/dts/intel/socfpga_agilex.dtsi | 4 +-- arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 6 +++++ arch/arm64/boot/dts/rockchip/rk3399.dtsi | 6 ++--- arch/mips/kernel/smp.c | 6 ++--- drivers/atm/firestream.c | 2 ++ drivers/gpu/drm/drm_connector.c | 3 +++ drivers/net/can/rcar/rcar_canfd.c | 6 ++--- drivers/net/ethernet/sfc/mcdi.c | 2 +- .../wireless/intel/iwlwifi/iwl-nvm-parse.c | 3 +-- .../net/wireless/intel/iwlwifi/mvm/mac80211.c | 1 - include/net/xfrm.h | 5 ++-- lib/Kconfig | 1 - net/ipv4/tcp.c | 10 ++++--- net/key/af_key.c | 2 +- net/mac80211/agg-tx.c | 10 ++++++- net/wireless/nl80211.c | 3 ++- net/xfrm/xfrm_policy.c | 14 +++++----- net/xfrm/xfrm_state.c | 15 ++++++++--- net/xfrm/xfrm_user.c | 27 ++++++------------- tools/testing/selftests/vm/userfaultfd.c | 1 + 22 files changed, 76 insertions(+), 57 deletions(-) -- 2.20.1

1 19

[PATCH openEuler-1.0-LTS] netfilter: nf_tables: disallow non-stateful expression in sets earlier
by Yongqiang Liu 14 Jun '22

14 Jun '22

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v5.19-rc1 commit 520778042ccca019f3ffa136dd0ca565c486cedd category: bugfix bugzilla: 186905, https://gitee.com/src-openeuler/kernel/issues/I5B3QZ CVE: CVE-2022-1966 -------------------------------- Since 3e135cd499bf ("netfilter: nft_dynset: dynamic stateful expression instantiation"), it is possible to attach stateful expressions to set elements. cd5125d8f518 ("netfilter: nf_tables: split set destruction in deactivate and destroy phase") introduces conditional destruction on the object to accomodate transaction semantics. nft_expr_init() calls expr->ops->init() first, then check for NFT_STATEFUL_EXPR, this stills allows to initialize a non-stateful lookup expressions which points to a set, which might lead to UAF since the set is not properly detached from the set->binding for this case. Anyway, this combination is non-sense from nf_tables perspective. This patch fixes this problem by checking for NFT_STATEFUL_EXPR before expr->ops->init() is called. The reporter provides a KASAN splat and a poc reproducer (similar to those autogenerated by syzbot to report use-after-free errors). It is unknown to me if they are using syzbot or if they use similar automated tool to locate the bug that they are reporting. For the record, this is the KASAN splat. [ 85.431824] ================================================================== [ 85.432901] BUG: KASAN: use-after-free in nf_tables_bind_set+0x81b/0xa20 [ 85.433825] Write of size 8 at addr ffff8880286f0e98 by task poc/776 [ 85.434756] [ 85.434999] CPU: 1 PID: 776 Comm: poc Tainted: G W 5.18.0+ #2 [ 85.436023] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 Fixes: 0b2d8a7b638b ("netfilter: nf_tables: add helper functions for expression handling") Reported-and-tested-by: Aaron Adams <edg-e(a)nccgroup.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> conflict: net/netfilter/nf_tables_api.c net/netfilter/nft_dynset.c Signed-off-by: Lu Wei <luwei32(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/netfilter/nf_tables_api.c | 16 ++++++++++------ net/netfilter/nft_dynset.c | 3 --- 2 files changed, 10 insertions(+), 9 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 9cc8e92f4b00..ab68076d2cba 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -2167,27 +2167,31 @@ struct nft_expr *nft_expr_init(const struct nft_ctx *ctx, err = nf_tables_expr_parse(ctx, nla, &info); if (err < 0) - goto err1; + goto err_expr_parse; + + err = -EOPNOTSUPP; + if (!(info.ops->type->flags & NFT_EXPR_STATEFUL)) + goto err_expr_stateful; err = -ENOMEM; expr = kzalloc(info.ops->size, GFP_KERNEL); if (expr == NULL) - goto err2; + goto err_expr_stateful; err = nf_tables_newexpr(ctx, &info, expr); if (err < 0) - goto err3; + goto err_expr_new; return expr; -err3: +err_expr_new: kfree(expr); -err2: +err_expr_stateful: owner = info.ops->type->owner; if (info.ops->type->release_ops) info.ops->type->release_ops(info.ops); module_put(owner); -err1: +err_expr_parse: return ERR_PTR(err); } diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c index 4e544044fc2d..cc076d535e14 100644 --- a/net/netfilter/nft_dynset.c +++ b/net/netfilter/nft_dynset.c @@ -193,9 +193,6 @@ static int nft_dynset_init(const struct nft_ctx *ctx, return PTR_ERR(priv->expr); err = -EOPNOTSUPP; - if (!(priv->expr->ops->type->flags & NFT_EXPR_STATEFUL)) - goto err1; - if (priv->expr->ops->type->flags & NFT_EXPR_GC) { if (set->flags & NFT_SET_TIMEOUT) goto err1; -- 2.25.1

1 0

[PATCH OLK-5.10 v2] eulerfs: fix potential sbi->persisters free error
by gouhao＠uniontech.com 14 Jun '22

14 Jun '22

From: Gou Hao <gouhao(a)uniontech.com> uniontech inclusion category: bugfix bugzilla: NA CVE: NA ------------------- After alloc the sbi->persisters memory, dep_init will call dep_fini when error happened.Because sbi->persisters is not set to 0, -> dep_fini() can be called with sbi->persisters[] uninitialized, thus kthread_stop() can be called with random value. Signed-off-by: Gou Hao <gouhao(a)uniontech.com> --- fs/eulerfs/dep.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/eulerfs/dep.c b/fs/eulerfs/dep.c index ec014bbf3700..a41471c5f2ec 100644 --- a/fs/eulerfs/dep.c +++ b/fs/eulerfs/dep.c @@ -718,7 +718,7 @@ int dep_init(struct super_block *sb) for_each_possible_cpu(cpu) init_llist_head(per_cpu_ptr(sbi->persistee_list, cpu)); - sbi->persisters = kmalloc(sizeof(struct task_struct *) * + sbi->persisters = kzalloc(sizeof(struct task_struct *) * persisters_per_socket * num_sockets, GFP_KERNEL); if (!sbi->persisters) { -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 1/2] Revert "NFSv4: Handle the special Linux file open access mode"
by Yongqiang Liu 14 Jun '22

14 Jun '22

From: ChenXiaoSong <chenxiaosong2(a)huawei.com> mainline inclusion from mainline-v5.18-rc2 commit ab0fc21bc7105b54bafd85bd8b82742f9e68898a category: bugfix bugzilla: 186890, https://gitee.com/openeuler/kernel/issues/I5BZTX CVE: NA -------------------------------- This reverts commit 44942b4e457beda00981f616402a1a791e8c616e. After secondly opening a file with O_ACCMODE|O_DIRECT flags, nfs4_valid_open_stateid() will dereference NULL nfs4_state when lseek(). Reproducer: 1. mount -t nfs -o vers=4.2 $server_ip:/ /mnt/ 2. fd = open("/mnt/file", O_ACCMODE|O_DIRECT|O_CREAT) 3. close(fd) 4. fd = open("/mnt/file", O_ACCMODE|O_DIRECT) 5. lseek(fd) Reported-by: Lyu Tao <tao.lyu(a)epfl.ch> Signed-off-by: ChenXiaoSong <chenxiaosong2(a)huawei.com> Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: ChenXiaoSong <chenxiaosong2(a)huawei.com> Reviewed-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/nfs/inode.c | 1 - fs/nfs/nfs4file.c | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c index db52430dfbd7..053e78d777f1 100644 --- a/fs/nfs/inode.c +++ b/fs/nfs/inode.c @@ -1103,7 +1103,6 @@ int nfs_open(struct inode *inode, struct file *filp) nfs_fscache_open_file(inode, filp); return 0; } -EXPORT_SYMBOL_GPL(nfs_open); /* * This function is called whenever some part of NFS notices that diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c index e053a883d08d..09d65a654c2b 100644 --- a/fs/nfs/nfs4file.c +++ b/fs/nfs/nfs4file.c @@ -49,7 +49,7 @@ nfs4_file_open(struct inode *inode, struct file *filp) return err; if ((openflags & O_ACCMODE) == 3) - return nfs_open(inode, filp); + openflags--; /* We can't create new files here */ openflags &= ~(O_CREAT|O_EXCL); -- 2.25.1

1 1

openEuler kernel SIG例会&技术分享
by openEuler conference 14 Jun '22

14 Jun '22

您好！ Kernel SIG 邀请您参加 2022-06-17 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler kernel SIG例会&技术分享会议内容： openEuler kernel 技术分享：执行实体创建与切换会议链接：https://us06web.zoom.us/j/82875828076?pwd=cWVmcGtITlJlM0RxcXYzcDlXZjVJUT09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2022-06-17 14:00, The subject of the conference is openEuler kernel SIG例会&技术分享, Summary: openEuler kernel 技术分享：执行实体创建与切换 You can join the meeting at https://us06web.zoom.us/j/82875828076?pwd=cWVmcGtITlJlM0RxcXYzcDlXZjVJUT09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS] nvme: Assign subsys instance from first ctrl
by Chen Taotao 09 Jun '22

09 Jun '22

mainline inclusion from mainline-5.3.0-rc3 commit 733e4b69d508d03c20adfdcf4bd27abc60fae9cc category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5986O CVE: NA -------------------------------- The namespace disk names must be unique for the lifetime of the subsystem. This was accomplished by using their parent subsystems' instances which were allocated independently from the controllers connected to that subsystem. This allowed name prefixes assigned to namespaces to match a controller from an unrelated subsystem, and has created confusion among users examining device nodes. Ensure a namespace's subsystem instance never clashes with a controller instance of another subsystem by transferring the instance ownership to the parent subsystem from the first controller discovered in that subsystem. Reviewed-by: Logan Gunthorpe <logang(a)deltatee.com> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Minwoo Im <minwoo.im(a)samsung.com> Reviewed-by: Hannes Reinecke <hare(a)suse.com> Reviewed-off-by: Sagi Grimberg <sagi(a)grimberg.me> Signed-off-by: Sagi Grimberg <sagi(a)grimberg.me> Signed-off-by: Chen Taotao <chentt10(a)chinatelecom.cn> Signed-off-by: Ctyun Kernel <ctyuncommiter01(a)chinatelecom.cn> --- drivers/nvme/host/core.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index 164ec45da..0b47c8fd8 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -89,7 +89,6 @@ EXPORT_SYMBOL_GPL(nvme_reset_wq); struct workqueue_struct *nvme_delete_wq; EXPORT_SYMBOL_GPL(nvme_delete_wq); -static DEFINE_IDA(nvme_subsystems_ida); static LIST_HEAD(nvme_subsystems); static DEFINE_MUTEX(nvme_subsystems_lock); @@ -2350,7 +2349,8 @@ static void nvme_release_subsystem(struct device *dev) struct nvme_subsystem *subsys = container_of(dev, struct nvme_subsystem, dev); - ida_simple_remove(&nvme_subsystems_ida, subsys->instance); + if (subsys->instance >= 0) + ida_simple_remove(&nvme_instance_ida, subsys->instance); kfree(subsys); } @@ -2461,12 +2461,8 @@ static int nvme_init_subsystem(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) subsys = kzalloc(sizeof(*subsys), GFP_KERNEL); if (!subsys) return -ENOMEM; - ret = ida_simple_get(&nvme_subsystems_ida, 0, 0, GFP_KERNEL); - if (ret < 0) { - kfree(subsys); - return ret; - } - subsys->instance = ret; + + subsys->instance = -1; mutex_init(&subsys->lock); kref_init(&subsys->ref); INIT_LIST_HEAD(&subsys->ctrls); @@ -2481,7 +2477,7 @@ static int nvme_init_subsystem(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) subsys->dev.class = nvme_subsys_class; subsys->dev.release = nvme_release_subsystem; subsys->dev.groups = nvme_subsys_attrs_groups; - dev_set_name(&subsys->dev, "nvme-subsys%d", subsys->instance); + dev_set_name(&subsys->dev, "nvme-subsys%d", ctrl->instance); device_initialize(&subsys->dev); mutex_lock(&nvme_subsystems_lock); @@ -2514,6 +2510,8 @@ static int nvme_init_subsystem(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) list_add_tail(&subsys->entry, &nvme_subsystems); } + if (!found) + subsys->instance = ctrl->instance; ctrl->subsys = subsys; mutex_unlock(&nvme_subsystems_lock); @@ -3840,7 +3838,9 @@ static void nvme_free_ctrl(struct device *dev) container_of(dev, struct nvme_ctrl, ctrl_device); struct nvme_subsystem *subsys = ctrl->subsys; - ida_simple_remove(&nvme_instance_ida, ctrl->instance); + if (subsys && ctrl->instance != subsys->instance) + ida_simple_remove(&nvme_instance_ida, ctrl->instance); + kfree(ctrl->effects); nvme_mpath_uninit(ctrl); __free_page(ctrl->discard_page); @@ -4102,7 +4102,6 @@ int __init nvme_core_init(void) void nvme_core_exit(void) { - ida_destroy(&nvme_subsystems_ida); class_destroy(nvme_subsys_class); class_destroy(nvme_class); unregister_chrdev_region(nvme_chr_devt, NVME_MINORS); -- 2.27.0

1 0