July 2023 - Kernel - mailweb.openeuler.org

[PATCH openEuler-22.03-LTS] binder: fix UAF caused by faulty buffer cleanup
by Longlong Xia 26 Jul '23

26 Jul '23

From: Carlos Llamas <cmllamas(a)google.com> stable inclusion from stable-v5.10.182 commit 2218752325a98861dfb10f59a9b0270d6d4abe21 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7L0Z9 CVE: CVE-2023-21255 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit bdc1c5fac982845a58d28690cdb56db8c88a530d upstream. In binder_transaction_buffer_release() the 'failed_at' offset indicates the number of objects to clean up. However, this function was changed by commit 44d8047f1d87 ("binder: use standard functions to allocate fds"), to release all the objects in the buffer when 'failed_at' is zero. This introduced an issue when a transaction buffer is released without any objects having been processed so far. In this case, 'failed_at' is indeed zero yet it is misinterpreted as releasing the entire buffer. This leads to use-after-free errors where nodes are incorrectly freed and subsequently accessed. Such is the case in the following KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in binder_thread_read+0xc40/0x1f30 Read of size 8 at addr ffff4faf037cfc58 by task poc/474 CPU: 6 PID: 474 Comm: poc Not tainted 6.3.0-12570-g7df047b3f0aa #5 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x48/0x60 print_report+0xf8/0x5b8 kasan_report+0xb8/0xfc __asan_load8+0x9c/0xb8 binder_thread_read+0xc40/0x1f30 binder_ioctl+0xd9c/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] Allocated by task 474: kasan_save_stack+0x3c/0x64 kasan_set_track+0x2c/0x40 kasan_save_alloc_info+0x24/0x34 __kasan_kmalloc+0xb8/0xbc kmalloc_trace+0x48/0x5c binder_new_node+0x3c/0x3a4 binder_transaction+0x2b58/0x36f0 binder_thread_write+0x8e0/0x1b78 binder_ioctl+0x14a0/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] Freed by task 475: kasan_save_stack+0x3c/0x64 kasan_set_track+0x2c/0x40 kasan_save_free_info+0x38/0x5c __kasan_slab_free+0xe8/0x154 __kmem_cache_free+0x128/0x2bc kfree+0x58/0x70 binder_dec_node_tmpref+0x178/0x1fc binder_transaction_buffer_release+0x430/0x628 binder_transaction+0x1954/0x36f0 binder_thread_write+0x8e0/0x1b78 binder_ioctl+0x14a0/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] ================================================================== In order to avoid these issues, let's always calculate the intended 'failed_at' offset beforehand. This is renamed and wrapped in a helper function to make it clear and convenient. Fixes: 32e9f56a96d8 ("binder: don't detect sender/target during buffer cleanup") Reported-by: Zi Fan Tan <zifantan(a)google.com> Cc: stable(a)vger.kernel.org Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Acked-by: Todd Kjos <tkjos(a)google.com> Link: https://lore.kernel.org/r/20230505203020.4101154-1-cmllamas@google.com [cmllamas: resolve trivial conflict due to missing commit 9864bb4801331] Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Longlong Xia <xialonglong1(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Reviewed-by: tong tiangen <tongtiangen(a)huawei.com> Reviewed-by: Nanyong Sun <sunnanyong(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> --- drivers/android/binder.c | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index d73b0df55967..98c785ebfa5d 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -2302,24 +2302,23 @@ static void binder_deferred_fd_close(int fd) static void binder_transaction_buffer_release(struct binder_proc *proc, struct binder_thread *thread, struct binder_buffer *buffer, - binder_size_t failed_at, + binder_size_t off_end_offset, bool is_failure) { int debug_id = buffer->debug_id; - binder_size_t off_start_offset, buffer_offset, off_end_offset; + binder_size_t off_start_offset, buffer_offset; binder_debug(BINDER_DEBUG_TRANSACTION, "%d buffer release %d, size %zd-%zd, failed at %llx\n", proc->pid, buffer->debug_id, buffer->data_size, buffer->offsets_size, - (unsigned long long)failed_at); + (unsigned long long)off_end_offset); if (buffer->target_node) binder_dec_node(buffer->target_node, 1, 0); off_start_offset = ALIGN(buffer->data_size, sizeof(void *)); - off_end_offset = is_failure && failed_at ? failed_at : - off_start_offset + buffer->offsets_size; + for (buffer_offset = off_start_offset; buffer_offset < off_end_offset; buffer_offset += sizeof(binder_size_t)) { struct binder_object_header *hdr; @@ -2479,6 +2478,21 @@ static void binder_transaction_buffer_release(struct binder_proc *proc, } } +/* Clean up all the objects in the buffer */ +static inline void binder_release_entire_buffer(struct binder_proc *proc, + struct binder_thread *thread, + struct binder_buffer *buffer, + bool is_failure) +{ + binder_size_t off_end_offset; + + off_end_offset = ALIGN(buffer->data_size, sizeof(void *)); + off_end_offset += buffer->offsets_size; + + binder_transaction_buffer_release(proc, thread, buffer, + off_end_offset, is_failure); +} + static int binder_translate_binder(struct flat_binder_object *fp, struct binder_transaction *t, struct binder_thread *thread) @@ -3949,7 +3963,7 @@ binder_free_buf(struct binder_proc *proc, binder_node_inner_unlock(buf_node); } trace_binder_transaction_buffer_release(buffer); - binder_transaction_buffer_release(proc, thread, buffer, 0, is_failure); + binder_release_entire_buffer(proc, thread, buffer, is_failure); binder_alloc_free_buf(&proc->alloc, buffer); } -- 2.25.1

2 1

[PATCH 1/1] binder: fix UAF caused by faulty buffer cleanup
by Longlong Xia 26 Jul '23

26 Jul '23

From: Carlos Llamas <cmllamas(a)google.com> stable inclusion from stable-v5.10.182 commit 2218752325a98861dfb10f59a9b0270d6d4abe21 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7L0Z9 CVE: CVE-2023-21255 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit bdc1c5fac982845a58d28690cdb56db8c88a530d upstream. In binder_transaction_buffer_release() the 'failed_at' offset indicates the number of objects to clean up. However, this function was changed by commit 44d8047f1d87 ("binder: use standard functions to allocate fds"), to release all the objects in the buffer when 'failed_at' is zero. This introduced an issue when a transaction buffer is released without any objects having been processed so far. In this case, 'failed_at' is indeed zero yet it is misinterpreted as releasing the entire buffer. This leads to use-after-free errors where nodes are incorrectly freed and subsequently accessed. Such is the case in the following KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in binder_thread_read+0xc40/0x1f30 Read of size 8 at addr ffff4faf037cfc58 by task poc/474 CPU: 6 PID: 474 Comm: poc Not tainted 6.3.0-12570-g7df047b3f0aa #5 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x48/0x60 print_report+0xf8/0x5b8 kasan_report+0xb8/0xfc __asan_load8+0x9c/0xb8 binder_thread_read+0xc40/0x1f30 binder_ioctl+0xd9c/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] Allocated by task 474: kasan_save_stack+0x3c/0x64 kasan_set_track+0x2c/0x40 kasan_save_alloc_info+0x24/0x34 __kasan_kmalloc+0xb8/0xbc kmalloc_trace+0x48/0x5c binder_new_node+0x3c/0x3a4 binder_transaction+0x2b58/0x36f0 binder_thread_write+0x8e0/0x1b78 binder_ioctl+0x14a0/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] Freed by task 475: kasan_save_stack+0x3c/0x64 kasan_set_track+0x2c/0x40 kasan_save_free_info+0x38/0x5c __kasan_slab_free+0xe8/0x154 __kmem_cache_free+0x128/0x2bc kfree+0x58/0x70 binder_dec_node_tmpref+0x178/0x1fc binder_transaction_buffer_release+0x430/0x628 binder_transaction+0x1954/0x36f0 binder_thread_write+0x8e0/0x1b78 binder_ioctl+0x14a0/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] ================================================================== In order to avoid these issues, let's always calculate the intended 'failed_at' offset beforehand. This is renamed and wrapped in a helper function to make it clear and convenient. Fixes: 32e9f56a96d8 ("binder: don't detect sender/target during buffer cleanup") Reported-by: Zi Fan Tan <zifantan(a)google.com> Cc: stable(a)vger.kernel.org Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Acked-by: Todd Kjos <tkjos(a)google.com> Link: https://lore.kernel.org/r/20230505203020.4101154-1-cmllamas@google.com [cmllamas: resolve trivial conflict due to missing commit 9864bb4801331] Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Longlong Xia <xialonglong1(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Reviewed-by: tong tiangen <tongtiangen(a)huawei.com> Reviewed-by: Nanyong Sun <sunnanyong(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> --- drivers/android/binder.c | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index d73b0df55967..98c785ebfa5d 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -2302,24 +2302,23 @@ static void binder_deferred_fd_close(int fd) static void binder_transaction_buffer_release(struct binder_proc *proc, struct binder_thread *thread, struct binder_buffer *buffer, - binder_size_t failed_at, + binder_size_t off_end_offset, bool is_failure) { int debug_id = buffer->debug_id; - binder_size_t off_start_offset, buffer_offset, off_end_offset; + binder_size_t off_start_offset, buffer_offset; binder_debug(BINDER_DEBUG_TRANSACTION, "%d buffer release %d, size %zd-%zd, failed at %llx\n", proc->pid, buffer->debug_id, buffer->data_size, buffer->offsets_size, - (unsigned long long)failed_at); + (unsigned long long)off_end_offset); if (buffer->target_node) binder_dec_node(buffer->target_node, 1, 0); off_start_offset = ALIGN(buffer->data_size, sizeof(void *)); - off_end_offset = is_failure && failed_at ? failed_at : - off_start_offset + buffer->offsets_size; + for (buffer_offset = off_start_offset; buffer_offset < off_end_offset; buffer_offset += sizeof(binder_size_t)) { struct binder_object_header *hdr; @@ -2479,6 +2478,21 @@ static void binder_transaction_buffer_release(struct binder_proc *proc, } } +/* Clean up all the objects in the buffer */ +static inline void binder_release_entire_buffer(struct binder_proc *proc, + struct binder_thread *thread, + struct binder_buffer *buffer, + bool is_failure) +{ + binder_size_t off_end_offset; + + off_end_offset = ALIGN(buffer->data_size, sizeof(void *)); + off_end_offset += buffer->offsets_size; + + binder_transaction_buffer_release(proc, thread, buffer, + off_end_offset, is_failure); +} + static int binder_translate_binder(struct flat_binder_object *fp, struct binder_transaction *t, struct binder_thread *thread) @@ -3949,7 +3963,7 @@ binder_free_buf(struct binder_proc *proc, binder_node_inner_unlock(buf_node); } trace_binder_transaction_buffer_release(buffer); - binder_transaction_buffer_release(proc, thread, buffer, 0, is_failure); + binder_release_entire_buffer(proc, thread, buffer, is_failure); binder_alloc_free_buf(&proc->alloc, buffer); } -- 2.25.1

1 0

[PATCH] Wayca: Add SAS features description doc
by Yihang Li 26 Jul '23

26 Jul '23

From: xiabing <xiabing12(a)h-partners.com> --- ...-Kunpeng-基础IO-SAS模块特性介绍.md | 389 ++++++++++++++++++ 1 file changed, 389 insertions(+) create mode 100644 WayCa-Kunpeng-底软/Wayca-Kunpeng-基础IO/Wayca-Kunpeng-基础IO-SAS模块特性介绍.md diff --git a/WayCa-Kunpeng-底软/Wayca-Kunpeng-基础IO/Wayca-Kunpeng-基础IO-SAS模块特性介绍.md b/WayCa-Kunpeng-底软/Wayca-Kunpeng-基础IO/Wayca-Kunpeng-基础IO-SAS模块特性介绍.md new file mode 100644 index 0000000..9e8cc2c --- /dev/null +++ b/WayCa-Kunpeng-底软/Wayca-Kunpeng-基础IO/Wayca-Kunpeng-基础IO-SAS模块特性介绍.md @@ -0,0 +1,389 @@ +# openEuler WayCa SIG 鲲鹏基础IO SAS模块介绍 +# 一、SAS驱动简介 +SAS驱动是适配920系列处理器SAS控制器的驱动模块。SAS（Serial Attached SCSI）即串行SCSI技术，一种磁盘连接技术。SAS控制器用于磁盘与内存之间进行交互。 + +## 源码获取路径 +- Linux kernel仓库：https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ +- openEuler 仓库：https://gitee.com/openeuler/kernel.git +- 源码路径：driver/scsi/hisi_sas + +## 功能描述 +对于鲲鹏920系列SAS模块，支持的特性如下： +- 兼容SAS3.0协议，同时向下兼容SAS2.0和SAS1.0 +-支持SSP/SMP/STP +-支持连接SATA盘（非AHCI方式） +-支持SATA协议定义的NCQ +-支持最多1024个设备 +-支持最多并发4096个IO +-支持宽端口（最多每个端口8个PHY）和窄端口模式 +-支持SAS链接速率12/6/3/1.5Gbit/s自协商， SATA链接速率6/3/1.5Gbit/s自协商 +-支持热插拔 +-支持SAS DIF +-支持SAS MSI中断模式及中断聚合 +-支持逻辑侧单个IO或整个盘的IO的abort +-支持错误以RAS方式上报 +-支持DFX +-支持BIST +-支持直连LED +-支持SAS runtime PM + +## 规格描述 + +本节主要描述用户可见、可感知的规格，以及规格描述、主线支持版本的列表 + +| 规格名称 | 规格描述 | 主线支持版本 | 备注 | +| ------------ | ------------ | ------------ | ------------ | +| 兼容SATA盘 | 非AHCI方式，可以直连SATA盘或expander连接SATA盘 | Linux Kernel 4.13 | 基本功能 | +| 支持SSP/SMP/STP | 支持直连或expander 连接SAS盘和SATA盘 | Linux Kernel 4.13 | 基本功能 | +| 支持最多1024个设备 | 支持最大设备数为1024个 | Linux Kernel 4.13 | 基本功能 | +| 支持最多4096个IO | 支持最多4096个IO | Linux Kernel 4.13 | 基本功能 | +| 支持DIF | 支持SAS DIF特性 | Linux Kernel 4.21 | - | +| 支持DIX | 支持SAS DIX特性 | Linux Kernel 5.1 | 依赖于DIF | +| 中断聚合 | 支持SAS MSI中断聚合 | Linux Kernel 4.21 | - | +| 支持错误以RAS方式上报 | 支持错误以RAS方式上报 | Linux Kernel 5.2 | - | +| 支持DFX | 以debugfs方式实现 | Linux Kernel 4.22 （Basic） Linux Kernel 5.5 (Enhance) | - | +| 支持BIST | 码流环回功能 | Linux Kernel 5.4 | - | +| 支持LED | 直连LED点灯 | Linux Kernel 4.18 | - | +| 支持SAS controller runtime PM | 支持SAS控制器的SAS controller runtime PM | Linux Kernel 4.16 | - | +## 内核config选项 +SAS驱动涉及的内核配置选项：CONFIG_SCSI_HISI_SAS和CONFIG_SCSI_HISI_SAS_PCI。对于鲲鹏920系列处理器使能，需要同时配置CONFIG_SCSI_HISI_SAS和CONFIG_SCSI_HISI_SAS_PCI。 +## 加载依赖 +模块编译后，会生成两个KO文件：hisi_sas_main.ko、hisi_sas_v3_hw.ko。先加载hisi_sas_main.ko，再加载hisi_sas_v3_hw.ko。 +## 模块参数 +SAS驱动模块当前包含四个模块参数，针对hisi_sas_main.ko的模块参数是：debugfs_enable、debugfs_dump_count，针对hisi_sas_v3_hw.ko的模块参数是：prot_mask、intr_conv。 + +| 模块参数 | 含义 | 默认值 | 设置 | +| ------------ | ------------ | ------------ | ------------ | +| debugfs_enable | 是否使能debugfs | 1 | debugfs_enable=1使能debugfs功能 debugfs_enable=0不使能debugfs功能 | +|debugfs_dump_count|debugfs dump次数设置|1|debugfs_dump_count = n (0<=n<=50)| +| prot_mask | DIF/DIX类型设置 | 0 | n: 设置DIF/DIX类型； 0: 不使能DIF/DIX | +| intr_conv | 是否使能中断聚合 | 0 | intr_conv =1使能中断聚合 intr_conv =0不使能中断聚合 | + + +# 二、特性详解 + +## 特性1：中断聚合 +- 特性介绍 + +上层的每个IO下发在底层驱动是通过DQ队列（即发送队列）发送给SAS控制器，IO完成后通过CQ队列返回。CQ队列的返回以中断方式触发。当IO产生比较频繁时，对应中断产生会很频繁，此时通过将部分中断一起上报可以提升性能。SAS驱动支持两种类型的中断聚合： + +1.中断聚合类型1： + +所有CQ队列（即CQ0-CQ15）的中断全部在CQ0上产生。 + +2.中断聚合类型2： + +在规定时间内对本队列产生的中断进行聚合，如果在规定时间内聚合到指定数量则产生一次中断，如果在规定时间内没有聚合到指定数量的中断，在规定时间达到时产生中断。 + +- 涉及代码与使能 + +| commitid | subject |openeuler OLK-5.10 enabled(Y/N) | +| ------------ | ------------ | ------------ | +| 37359798ec44 |scsi: hisi_sas: Add support for interrupt coalescing for v3 hw | Y | +| c3566f9a617d |scsi: hisi_sas: Create separate host attributes per HBA | Y | +| 488cf558e3d7 |scsi: hisi_sas: Add support for interrupt converge for v3 hw | Y | + +- 示例 + +使能中断聚合类型1： + +默认不使能中断聚合类型1，用户可以通过模块参数使能。 +```cpp +insmod hisi_sas_v3_hw.ko intr_conv=1 +``` +使能中断聚合类型2（配置中断聚合时间和次数）： +```cpp +echo 8 > /sys/devices/pci0000:74/0000:74:02.0/host0/scsi_host/host0/intr_coal_count +//设置中断聚合次数为8次 +echo 1000 > /sys/devices/pci0000:74/0000:74:02.0/host0/scsi_host/host0/intr_coal_ticks +//设置中断聚合时间为1ms +``` +查看中断聚合状态： + +对于中断聚合类型1，可通过PCI设备SYSFS接口目录下intr_conv_v3_hw接口查询中断聚合类型1是否使能； +对于中断聚合类型2，输入的中断聚合时间和中断聚合次数，其中任意参数为0，则表示不使能中断聚合类型2。 + + + + +## 特性2：DIF/DIX功能 +- 特性介绍 + +为了保证从硬盘到控制器再到应用程序之间的数据完整性，Linux内核和存储厂商共同推出了DIF+DIX来保证从应用程序到磁盘之间的完整IO路径上的“端对端”数据保护。 + +DIF(Data Integrity Field)允许提供在主机适配器和磁盘之间交换额外的保护信息。DIX(Data Integrity Extension)提供应用程序到主机适配器之间的保护信息。在传输过程中在数据IO后追加一些额外的信息，来检查数据的完整性，这些额外信息即为完整性保护信息。对于磁盘，会在原来扇区大小（512字节或者4K字节）后增加8字节来存储扇区数据的保护信息。 + +用户可通过模块参数prot_mask决定DIF/DIX支持模式。通过sg_utils工具，可以查询SAS盘的DIF支持情况、格式化为支持的DIF格式或恢复为普通盘。 + + +- 涉及代码与使能 + +| commitid | subject |openeuler OLK-5.10 enabled(Y/N) | +| ------------ | ------------ | ------------ | +| 6db831f4ef76 | scsi: hisi_sas: Make sg_tablesize consistent value | Y | +| 6e1b731b5352 | scsi: hisi_sas: Relocate some code to reduce complexity | Y | +| d6a9000b81be | scsi: hisi_sas: Add support for DIF feature for v2 hw | Y | +| b3cce125cb1e | scsi: hisi_sas: Add support for DIX feature for v3 hw | Y | + +- 示例 + +配置DIF/DIX支持模式 + +```c +insmod hisi_sas_v3_hw.ko prot_mask=0x70 +//支持DIX0/DIX1/DIX2/DIX3 +insmod hisi_sas_v3_hw.ko prot_mask=0x77 +//支持DIF1/DIF2/DIF3，支持DIX0/DIX1/DIX2/DIX3 +``` + +查询SAS盘对DIF的支持 +```c +sg_vpd --page=ei --long /dev/sdx |grep SPT +``` +格式化DIF SAS盘 +```c +sg_format --format --fmtpinfo=2 /dev/sdx //对于DIF1格式的盘 +sg_format --format --fmtpinfo=3 --pfu=1 /dev/sdx //对于DIF3格式的盘 +``` +恢复DIF盘为正常盘 +```c +sg_format -F -s 512 /dev/sdx +``` + +- 功能限制 + +EXT2文件系统由于其下发I/O数据存在并发性，导致数据与CRC之间不匹配，因此EXT2文件系统格式不支持DIF功能。 + + +## 特性3：debug调测功能 +- 特性介绍 + +debug调测功能为用户提供异常场景下自动或手动dump寄存器及部分IO数据的能力。SAS控制器驱动通过debugfs目录提供debug调测功能接口。其debugfs目录路径是：/sys/kernel/debug/hisi_sas，在该目录下会生成以SAS控制器BDF号命名的子目录。 + +- dump功能 + +自动dump功能在SAS控制器出现严重错误时（如internal abort命令超时）触发。 +手动dump可以在debugfs目录中通过命令 echo 1 > trigger_dump 对debugfs信息进行手动dump，完成dump后会在/sys/kernel/debug/hisi_sas/BDF_number/dump目录下生成相应信息。 + +- debugfs dump接口展示 + +![debugfs dump接口展示](http://image.huawei.com/tiny-lts/v1/images/adb310517372e6815b81e1… +- FIFO功能 + +FIFO功能是在接收硬件发出的触发信号后，收集相应的链路信息，并通过debugfs接口呈现给用户。FIFO功能为每个PHY提供7个配置接口以及1个展示dump数据的接口。 + +| 接口名称 | 接口描述 | 接口配置 | +| ------------ | ------------ | ------------ | +| signal_sel | 通过signal_sel可以选择一个指定的信号组 | b0000: 速率协商打包信号组 b0001: 12G tx train本端训练对端的调整方式，以及与HiLink的交互信号 b0010: 12G tx train对端训练本端的调整方式 b0011: sas_phy_ctrl_dfx0 b0100: sas_phy_ctrl_dfx1 b0101: sas_pcs_dfx0 other: 速率协商打包信号组 | +| dump_msk | 选择debug信号组需要dump的数据 | - | +| dump_mode | 配置信号触发后数据写入模式 | b001: 一直dump（无需配置trigger/ trigger_msk/trigger_mode接口） b010: 触发条件触发后，再dump32个数据就停止 b100: 触发条件触发后，不再dump | +| trigger_mode | 配置触发模式 | b001: 当cfg_dfx_trigger_msk对应的bit为1的debug信号发生跳变时触发（无需配置trigger接口） b010: 当debug信号等于cfg_dfx_trigger（cfg_dfx_trigger_msk对应的bit为1）时触发 b100: 当debug信号不等于cfg_dfx_trigger（cfg_dfx_trigger_msk对应的bit为1）时触发trigger | +| trigger | 通过trigger指定当前的信号组中触发信号的有效触发电平 | - | +| trigger_msk | 通过trigger_msk选择屏蔽一部分触发信号 | - | +| update_config | 更新接口配置 | b001:更新FIFO配置参数 | +| fifo_data | 展示根据用户配置dump的数据 | NA | + + +- 涉及代码与使能 + +| commitid | subject |openeuler OLK-5.10 enabled(Y/N) | +| ------------ | ------------ | ------------ | +| cd96fe600cc4 | scsi: hisi_sas: Add trace FIFO debugfs support | Y | +| 35160421b63d | scsi: hisi_sas: Don't create debugfs dump folder twice | Y | +| d28ed83b7693 | scsi: hisi_sas: Add timestamp for a debugfs dump | Y | +| 35ea630b2bad | scsi: hisi_sas: Add debugfs file structure for CQ | Y | +| 1b54c4db725d | scsi: hisi_sas: Add debugfs file structure for DQ | Y | +| c61163981076 | scsi: hisi_sas: Add debugfs file structure for registers | Y | +| 1f66e1fd26bd | scsi: hisi_sas: Add debugfs file structure for port | Y | +| e15f2e2dff5b | scsi: hisi_sas: Add debugfs file structure for IOST | Y | +| 0161d55f23a1 | scsi: hisi_sas: Add debugfs file structure for ITCT | Y | +| b714dd8f36dc | scsi: hisi_sas: Add debugfs file structure for IOST cache | Y | +| 357e4fc7a933 | scsi: hisi_sas: Add debugfs file structure for ITCT cache | Y | +| a70e33eae363 | scsi: hisi_sas: Allocate memory for multiple dumps of debugfs | Y | +| 905ab01faf5f | scsi: hisi_sas: Add module parameter for debugfs dump count | Y | +| 8f6432986e61 | scsi: hisi_sas: Add ability to have multiple debugfs dumps | Y | +| cabe7c10c97a | scsi: hisi_sas: Delete the debugfs folder of hisi_sas when the probe fails | Y | +| f873b66119f2 | scsi: hisi_sas: Record the phy down event in debugfs | Y | +| 26f84f9bc3ba | scsi: hisi_sas: Code style cleanup | Y | +| b601577df68a | scsi: hisi_sas: Add missing newlines | Y | +| ca06f2cd01d0 | scsi: hisi_sas: Make phy index variable name consistent | Y | +| caeddc0453b9 | scsi: hisi_sas: Do not modify upper fields of PROG_PHY_LINK_RATE reg | Y | +| 4b3a1f1feda6 | scsi: hisi_sas: Modify macro name for OOB phy linkrate | Y | +| 623a4b6d5c2a | scsi: hisi_sas: Move debugfs code to v3 hw driver | Y | +| 1dbe61bf7d76 | scsi: hisi_sas: Enable debugfs support by default | Y | +| ef63464bcf8f | scsi: hisi_sas: Create root and device debugfs directories | Y | +| eb1c2b72b769 | scsi: hisi_sas: Alloc debugfs snapshot buffer memory for all registers | Y | +| 49159a5e4175 | scsi: hisi_sas: Take debugfs snapshot for all regs | Y | +| caefac199676 | scsi: hisi_sas: Debugfs global register create file and add file operations | Y | +| 971afae7cf4f | scsi: hisi_sas: Add debugfs CQ file and add file operations | Y | +| 148e379f60c5 | scsi: hisi_sas: Add debugfs DQ file and add file operations | Y | +| 1afb4b852479 | scsi: hisi_sas: Add debugfs IOST file and add file operations | Y | +| 5979f33b982d | scsi: hisi_sas: Add debugfs ITCT file and add file operations | Y | +| 7c5e13636391 | scsi: hisi_sas: Add manual trigger for debugfs dump | Y | +| 61a6ebf3f584 | scsi: hisi_sas: Add debugfs for port registers | Y | +| bbe0a7b348b3 | scsi: hisi_sas: Snapshot HW cache of IOST and ITCT at debugfs | Y | +| b0b3e4290e28 | scsi: hisi_sas: Snapshot AXI and RAS register at debugfs | Y | +| 7105e68afaec | scsi: hisi_sas: add debugfs auto-trigger for internal abort time out | Y | +| 7ec7082c57ec | scsi: hisi_sas: Add hisi_sas_debugfs_alloc() to centralise allocation | Y | + +- 示例 + +```c +echo 0 > /sys/kernel/debug/hisi_sas/0000:30:04.0/fifo/0/signal_sel +//指定为速率协商打包信号组 +echo 0x7ff > /sys/kernel/debug/hisi_sas/0000:30:04.0/fifo/0/dump_msk +//指定需要监测的BIT +echo 1 > /sys/kernel/debug/hisi_sas/0000:30:04.0/fifo/0/dump_mode +//指定数据写入模式为一直dump +echo 1 > /sys/kernel/debug/hisi_sas/0000:30:04.0/fifo/0/update_config +//更新接口配置 +echo 12.0 Gbit > /sys/class/sas_phy/phy-4:0/maximum_linkrate +//触发速率重新协商 +cat /sys/kernel/debug/hisi_sas/0000:30:04.0/fifo/0/fifo_data +//展示dump信息 +``` + +## 特性4：BIST功能 +- 特性介绍 + +鲲鹏920系列处理器SAS支持环回码流功能，此功能通过设置链接速率、码型、PHY ID、环回类型等参数让控制器产生对应的码流，从而通过产生的码流检验链路的质量以及控制器链路层和PHY层的逻辑速率的正确性。 + +- BIST功能接口展示 + +BIST功能依赖于debugfs，因此要使能BIST功能需要提前使能debugfs。在BIST使能后会生成如下文件。 +![图片说明](http://image.huawei.com/tiny-lts/v1/images/04fb39cd3444fde201f75bf7e35cb19a_767x814.png) + +对于SAS BIST，组网要求与正常SAS控制器使用不一样：除remote模式外，其它模式不连接任何设备；remote模式需外接SAS环回头。 + +- 涉及代码与使能 + +| commitid | subject |openeuler OLK-5.10 enabled(Y/N) | +| ------------ | ------------ | ------------ | +|97b151e75861|scsi: hisi_sas: Add BIST support for phy loopback|Y| +|65a3b8bd5694|scsi: hisi_sas: Set the BIST init value before enabling BIST|Y| +| 981cc23e741a | scsi: hisi_sas: Add BIST support for fixed code pattern | Y | +| 2c4d582322ff | scsi: hisi_sas: Add BIST support for phy FFE | Y | + +- 示例 +```c +echo 1 > /sys/kernel/debug/hisi_sas/0000:30:04.0/bist/phy_id +//设置需要检测的PHY为phy1 +echo 3.0 Gbit > /sys/kernel/debug/hisi_sas/0000:30:04.0/bist/link_rate +//重新设置phy1的链路速率 +echo 1 > /sys/kernel/debug/hisi_sas/0000:30:04.0/bist/enable +//使能BIST +echo 0 > /sys/kernel/debug/hisi_sas/0000:30:04.0/bist/enable +//关闭BIST +cat /sys/kernel/debug/hisi_sas/0000:30:04.0/bist/cnt +//查看phy1的误码数量 +``` + +- 测试限制 + + 对于serdes方式，当前serdes工作模式并不是环回，会一直产生误码； + 对于码型为FIXED_DATA时, 不会有误码产生，不需要关注； + 可以通过误码注入，检查是否产生误码； + 由于协商速率要求，测试第一次需要将速率设置为大于等于3.0Gbit，后续可自由设置。 + + +## 特性5：runtime PM +- 特性介绍 + +SAS驱动支持SCSI设备的runtime PM。用户可以通过sysfs接口使能SCSI设备的runtime PM，并设置设备处于空闲状态达到用户指定时间N秒后，自动进入runtime PM状态，当用户给处于runtime PM状态的SCSI设备发送业务时，能够自动唤醒SCSI设备；当SCSI设备再次空闲N秒后自动进入runtime PM状态。 + +驱动支持SAS 控制器的runtime PM。用户可以通过sysfs接口使能SAS 控制器的runtime PM，当SAS 控制器连接的所有SCSI设备都进入runtime PM状态后，SAS 控制器会进入runtime PM状态；只要有一个SCSI设备不是runtime PM状态，SAS 控制器不会进入runtime PM状态。SAS 控制器进入runtime PM状态后，用户可对已进入runtime PM状态的SCSI设备下发业务，唤醒SCSI设备和SAS 控制器，当没有业务时SAS控制器和SCSI设备又会自动进入runtime PM状态。 + +- 用户接口及说明 + +| Runtime PM SYSFS用户接口 | 接口类型 | 含义及取值 | 默认值 | +| ------------ | ------------ | ------------ | ------------ | +| control | rw | 设置是否自动runtime PM auto: 允许设备runtime PM on: 不允许设备runtime PM | scsi设备:on scsi控制器:auto | +| runtime_status | r | 表示设备当前runtime状态 suspended: 进入suspended状态 active: 唤醒状态 suspending：正在suspending过程中 resuming: 正在唤醒过程中 unsupported: 不支持runtime PM | active | +| runtime_suspended_time | r | 设备处于suspended状态的时间 | NA | +| runtime_active_time | r | 设备处于active状态的时间 | NA | +| autosuspend_delay_ms | rw |若用户使能自动runtime PM，此项设置进入runtime PM状态前设备空闲的时间 -1: 一直不休眠 n: 设备空闲n秒后自动进入休眠| -1 | + +- 涉及代码与使能 + +驱动支持SCSI设备的runtime PM + +| commitid | subject |openeuler OLK-5.10 enabled(Y/N) | +| ------------ | ------------ | ------------ | +| 6c459ea1542b | scsi: hisi_sas: Switch to new framework to support suspend and resume | Y | +| 65ff4aef7e9b | scsi: hisi_sas: Add controller runtime PM support for v3 hw | Y | +| e06596d5000c | scsi: hisi_sas: Add check for methods _PS0 and _PR0 | Y | +| 16fd4a7c5917 | scsi: hisi_sas: Add device link between SCSI devices and hisi_hba | Y | +| b14a37e011d8 | scsi: hisi_sas: Filter out new PHY up events during suspend | Y | +| 69f4ec1edb13 | scsi: hisi_sas: Recover PHY state according to the status before reset | Y | +| 027e508aea45 | scsi: hisi_sas_v3_hw: Don't use PCI helper functions | Y | +| 71c8f15e1dbc | scsi: hisi_sas_v3_hw: Remove extra function calls for runtime pm | Y | +| 17b5e4d14837 | scsi: hisi_sas_v3_hw: Drop PCI Wakeup calls from .resume | Y | +| 027e508aea45 | scsi: hisi_sas_v3_hw: Don't use PCI helper functions | Y | +| 71c8f15e1dbcd | scsi: hisi_sas_v3_hw: Remove extra function calls for runtime pm | Y | +| 17b5e4d14837 | scsi: hisi_sas_v3_hw: Drop PCI Wakeup calls from .resume | Y | + +驱动支持SAS 控制器的runtime PM + +| commitid | subject |openeuler OLK-5.10 enabled(Y/N) | +| ------------ | ------------ | ------------ | +| d6e366685981 | PM: runtime: Drop pm_runtime_clean_up_links() | Y | +| e0e398e20463 |PM: runtime: Drop runtime PM references to supplier on link removal| Y | +| 9226c504e364 |PM: runtime: Resume the device earlier in __device_release_driver()| Y | +| fbefe22811c3 |scsi: libsas: Don't always drain event workqueue for HA resume | Y | +| 6cc739087784 |scsi: Revert "scsi: hisi_sas: Filter out new PHY up events during suspend" | Y | +| 97f410093984 |scsi: hisi_sas: Add more logs for runtime suspend/resume | Y | +| 29e2bac87421 |scsi: hisi_sas: Fix some issues related to asd_sas_port->phy_list | Y | +| 6e1fcab00a23 |scsi: block: pm: Always set request queue runtime active in blk_post_runtime_resume() | Y | +| 42159d3c8d87 |scsi: libsas: Add spin_lock/unlock() to protect asd_sas_port->phy_list | Y | +| 133b688b2d03 |scsi: mvsas: Add spin_lock/unlock() to protect asd_sas_port->phy_list | Y | +| e31e18128eb9 |scsi: libsas: Insert PORTE_BROADCAST_RCVD event for resuming host | Y | +| 0da7ca4c4fd9 |scsi: libsas: Resume host while sending SMP I/Os | Y | +| 4ea775abbb5c |scsi: libsas: Add flag SAS_HA_RESUMING | Y | +| 1bc35475c6bf |scsi: libsas: Refactor sas_queue_deferred_work() | Y | +| bf19aea4607c |scsi: libsas: Defer works of new phys during suspend | Y | +| 307d9f49cce9 |scsi: libsas: Keep host active while processing events | Y | +| 36c6b7613ef1 |scsi: hisi_sas: Initialise devices in .slave_alloc callback | Y | +| 046ab7d0f594 |scsi: hisi_sas: Wait for phyup in hisi_sas_control_phy()|Y| + +- 示例 + +```c +SCSI设备设置进入runtime PM状态 +echo auto > /sys/devices/pci0000:b4/0000:b4:02.0/host6/port-6:0/end_device-6:0/target6:0:0/6:0:0:0/power/control +//使能SCSI设备自动runtime PM +echo 5000 > /sys/devices/pci0000:b4/0000:b4:02.0/host6/port-6:0/end_device-6:0/target6:0:0/6:0:0:0/power/autosuspend_delay_ms +//设置SCSI设备进入runtime PM状态前设备空闲的时间为5s + +SAS控制器设置进入runtime PM状态 +echo auto > /sys/devices/pci0000:b4/0000:b4:02.0/power/control +//使能SAS控制器自动runtime PM +echo 2000 > /sys/devices/pci0000:b4/0000:b4:02.0/power/autosuspend_delay_ms +//设置SAS控制器进入runtime PM状态前设备空闲的时间为2s + +``` + + + + + + + + + + + + + + + + + + + + + + + + + + -- 2.30.0

1 0

openEuler Kernel SIG 双周例会
by openEuler conference 26 Jul '23

26 Jul '23

您好！ Kernel SIG 邀请您参加 2023-07-28 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG 双周例会会议内容： 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可直接回复邮件，或直接录入会议看板）会议链接：https://us06web.zoom.us/j/85789825222?pwd=bVcrNXVhVW9ObzVQWjVKdTlBNm14Zz09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2023-07-28 14:00, The subject of the conference is openEuler Kernel SIG 双周例会, Summary: 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可直接回复邮件，或直接录入会议看板） You can join the meeting at https://us06web.zoom.us/j/85789825222?pwd=bVcrNXVhVW9ObzVQWjVKdTlBNm14Zz09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

2 1

[PATCH -next] of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name()
by Ruan Jinjie 26 Jul '23

26 Jul '23

when kmalloc() fail to allocate memory in kasprintf(), name or full_name will be NULL, strcmp() will cause null pointer dereference. Signed-off-by: Ruan Jinjie <ruanjinjie(a)huawei.com> --- drivers/of/unittest.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c index a406a12eb208..e5b0eea8011c 100644 --- a/drivers/of/unittest.c +++ b/drivers/of/unittest.c @@ -77,7 +77,7 @@ static void __init of_unittest_find_node_by_name(void) np = of_find_node_by_path("/testcase-data"); name = kasprintf(GFP_KERNEL, "%pOF", np); - unittest(np && !strcmp("/testcase-data", name), + unittest(np && name && !strcmp("/testcase-data", name), "find /testcase-data failed\n"); of_node_put(np); kfree(name); @@ -88,14 +88,14 @@ static void __init of_unittest_find_node_by_name(void) np = of_find_node_by_path("/testcase-data/phandle-tests/consumer-a"); name = kasprintf(GFP_KERNEL, "%pOF", np); - unittest(np && !strcmp("/testcase-data/phandle-tests/consumer-a", name), + unittest(np && name && !strcmp("/testcase-data/phandle-tests/consumer-a", name), "find /testcase-data/phandle-tests/consumer-a failed\n"); of_node_put(np); kfree(name); np = of_find_node_by_path("testcase-alias"); name = kasprintf(GFP_KERNEL, "%pOF", np); - unittest(np && !strcmp("/testcase-data", name), + unittest(np && name && !strcmp("/testcase-data", name), "find testcase-alias failed\n"); of_node_put(np); kfree(name); @@ -106,7 +106,7 @@ static void __init of_unittest_find_node_by_name(void) np = of_find_node_by_path("testcase-alias/phandle-tests/consumer-a"); name = kasprintf(GFP_KERNEL, "%pOF", np); - unittest(np && !strcmp("/testcase-data/phandle-tests/consumer-a", name), + unittest(np && name && !strcmp("/testcase-data/phandle-tests/consumer-a", name), "find testcase-alias/phandle-tests/consumer-a failed\n"); of_node_put(np); kfree(name); @@ -1533,6 +1533,8 @@ static void attach_node_and_children(struct device_node *np) const char *full_name; full_name = kasprintf(GFP_KERNEL, "%pOF", np); + if (!full_name) + return; if (!strcmp(full_name, "/__local_fixups__") || !strcmp(full_name, "/__fixups__")) { -- 2.34.1

1 0

[PATCH OLK-5.10] mm: memcontrol: fix cannot alloc the maximum memcg ID
by Lu Jialin 25 Jul '23

25 Jul '23

From: Muchun Song <songmuchun(a)bytedance.com> mainline inclusion from mainline-v5.18-rc1 commit be740503ed03ea04ca362330baf082e6a38fe462 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7NXZ6?from=project-issue Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The idr_alloc() does not include @max ID. So in the current implementation, the maximum memcg ID is 65534 instead of 65535. It seems a bug. So fix this. Link: https://lkml.kernel.org/r/20220228122126.37293-15-songmuchun@bytedance.com Signed-off-by: Muchun Song <songmuchun(a)bytedance.com> Cc: Alex Shi <alexs(a)kernel.org> Cc: Anna Schumaker <Anna.Schumaker(a)Netapp.com> Cc: Chao Yu <chao(a)kernel.org> Cc: Dave Chinner <david(a)fromorbit.com> Cc: Fam Zheng <fam.zheng(a)bytedance.com> Cc: Jaegeuk Kim <jaegeuk(a)kernel.org> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Kari Argillander <kari.argillander(a)gmail.com> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: Michal Hocko <mhocko(a)kernel.org> Cc: Qi Zheng <zhengqi.arch(a)bytedance.com> Cc: Roman Gushchin <roman.gushchin(a)linux.dev> Cc: Shakeel Butt <shakeelb(a)google.com> Cc: Theodore Ts'o <tytso(a)mit.edu> Cc: Trond Myklebust <trond.myklebust(a)hammerspace.com> Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Wei Yang <richard.weiyang(a)gmail.com> Cc: Xiongchun Duan <duanxiongchun(a)bytedance.com> Cc: Yang Shi <shy828301(a)gmail.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- mm/memcontrol.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 635cb8b65b86..65accea3a799 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -5763,8 +5763,7 @@ static struct mem_cgroup *mem_cgroup_alloc(void) return ERR_PTR(error); memcg->id.id = idr_alloc(&mem_cgroup_idr, NULL, - 1, MEM_CGROUP_ID_MAX, - GFP_KERNEL); + 1, MEM_CGROUP_ID_MAX + 1, GFP_KERNEL); if (memcg->id.id < 0) { error = memcg->id.id; goto fail; -- 2.17.1

2 1

[PATCH openEuler-22.09 0/8] enable bonding XDP
by Zhengchao Shao 25 Jul '23

25 Jul '23

Currently, the 10G 82599 network adapter is used for the test on the Intel(R) Xeon(R) Gold 6138 CPU @ 2.00 GHz platform. The peer end uses the pktgen of the dpdk to send 64 bytes packets. The test performance is as follows: -----------------------| CPU |--| rxpck/s |--| txpck/s |---- without patch (1 dev): XDP_DROP: 1.00% 14.69Mpps XDP_TX: 2.20% 10.70Mpps 10.70Mpps XDP_DROP (RSS): 1.90% 10.13Mpps XDP_TX (RSS): 6.20% 10.09Mpps 10.09Mpps ----------------------- with patch, bond (1 dev): XDP_DROP: 1.00% 14.69Mpps XDP_TX: 2.10% 6.84Mpps 6.84Mpps XDP_DROP (RSS): 2.60% 12.57pps XDP_TX (RSS): 11.50% 12.49Mpps 12.49Mpps ----------------------- with patch, bond (2 devs): XDP_DROP: 1.90% 29.36Mpps XDP_TX: 3.90% 11.83Mpps 11.83Mpps XDP_DROP (RSS): 5.40% 25.00Mpps XDP_TX (RSS): 20.30% 19.10Mpps 19.10Mpps -------------------------------------------------------------- Jonathan Toppins (1): bonding: fix NULL deref in bond_rr_gen_slave_id Jussi Maki (5): net, bonding: Refactor bond_xmit_hash for use with xdp_buff net, core: Add support for XDP redirection to slave device net, bonding: Add XDP support to the bonding driver bonding: Fix negative jump label count on nested bonding net: bonding: Use per-cpu rr_tx_counter Moshe Tal (1): bonding: Fix extraction of ports from the packet headers Zhengchao Shao (1): net: fix kabi change in struct net_device_ops drivers/net/bonding/bond_main.c | 457 ++++++++++++++++++++++++++++---- include/linux/filter.h | 13 +- include/linux/netdevice.h | 7 +- include/net/bonding.h | 3 +- net/core/dev.c | 13 +- net/core/filter.c | 25 ++ 6 files changed, 456 insertions(+), 62 deletions(-) -- 2.34.1

2 9

[PATCH OLK-5.10] net/sched: sch_qfq: account for stab overhead in qfq_enqueue
by Zhengchao Shao 25 Jul '23

25 Jul '23

From: Pedro Tammela <pctammela(a)mojatatu.com> mainline inclusion from mainline-v6.5-rc2 commit 3e337087c3b5805fe0b8a46ba622a962880b5d64 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7N3MX CVE: CVE-2023-3611 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- Lion says: ------- In the QFQ scheduler a similar issue to CVE-2023-31436 persists. Consider the following code in net/sched/sch_qfq.c: static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct sk_buff **to_free) { unsigned int len = qdisc_pkt_len(skb), gso_segs; // ... if (unlikely(cl->agg->lmax < len)) { pr_debug("qfq: increasing maxpkt from %u to %u for class %u", cl->agg->lmax, len, cl->common.classid); err = qfq_change_agg(sch, cl, cl->agg->class_weight, len); if (err) { cl->qstats.drops++; return qdisc_drop(skb, sch, to_free); } // ... } Similarly to CVE-2023-31436, "lmax" is increased without any bounds checks according to the packet length "len". Usually this would not impose a problem because packet sizes are naturally limited. This is however not the actual packet length, rather the "qdisc_pkt_len(skb)" which might apply size transformations according to "struct qdisc_size_table" as created by "qdisc_get_stab()" in net/sched/sch_api.c if the TCA_STAB option was set when modifying the qdisc. A user may choose virtually any size using such a table. As a result the same issue as in CVE-2023-31436 can occur, allowing heap out-of-bounds read / writes in the kmalloc-8192 cache. ------- We can create the issue with the following commands: tc qdisc add dev $DEV root handle 1: stab mtu 2048 tsize 512 mpu 0 \ overhead 999999999 linklayer ethernet qfq tc class add dev $DEV parent 1: classid 1:1 htb rate 6mbit burst 15k tc filter add dev $DEV parent 1: matchall classid 1:1 ping -I $DEV 1.1.1.2 This is caused by incorrectly assuming that qdisc_pkt_len() returns a length within the QFQ_MIN_LMAX < len < QFQ_MAX_LMAX. Fixes: 462dbc9101ac ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost") Reported-by: Lion <nnamrec(a)gmail.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Signed-off-by: Pedro Tammela <pctammela(a)mojatatu.com> Reviewed-by: Simon Horman <simon.horman(a)corigine.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: net/sched/sch_qfq.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/sched/sch_qfq.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c index cad7deacf60a..1aa9e71a1d76 100644 --- a/net/sched/sch_qfq.c +++ b/net/sched/sch_qfq.c @@ -113,6 +113,7 @@ #define QFQ_MTU_SHIFT 16 /* to support TSO/GSO */ #define QFQ_MIN_LMAX 512 /* see qfq_slot_insert */ +#define QFQ_MAX_LMAX (1UL << QFQ_MTU_SHIFT) #define QFQ_MAX_AGG_CLASSES 8 /* max num classes per aggregate allowed */ @@ -375,8 +376,13 @@ static int qfq_change_agg(struct Qdisc *sch, struct qfq_class *cl, u32 weight, u32 lmax) { struct qfq_sched *q = qdisc_priv(sch); - struct qfq_aggregate *new_agg = qfq_find_agg(q, lmax, weight); + struct qfq_aggregate *new_agg; + /* 'lmax' can range from [QFQ_MIN_LMAX, pktlen + stab overhead] */ + if (lmax > QFQ_MAX_LMAX) + return -EINVAL; + + new_agg = qfq_find_agg(q, lmax, weight); if (new_agg == NULL) { /* create new aggregate */ new_agg = kzalloc(sizeof(*new_agg), GFP_ATOMIC); if (new_agg == NULL) -- 2.34.1

2 1

[PATCH] arm64/mpam: fix missing kfree domain's ctrl_val arrray
by Jialin Zhang 25 Jul '23

25 Jul '23

From: Wang ShaoBo <bobo.shaobowang(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187154, https://gitee.com/openeuler/kernel/issues/I7M52S CVE: NA -------------------------------- Fix mpam memleak issue found by kmemleak: unreferenced object 0xffff204000d1d000 (size 128): comm "cpuhp/24", pid 132, jiffies 4294896121 (age 146328.256s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000dd76fed3>] __kmalloc+0x478/0x664 [<00000000e2fa4b32>] mpam_resctrl_setup_domain+0x290/0x5d0 [<0000000088adc589>] mpam_resctrl_cpu_online+0x14c/0x1d0 [<00000000b223bfaa>] mpam_cpu_online+0x1c8/0x2e4 [<000000004438534a>] cpuhp_invoke_callback+0x1f4/0x11b0 [<0000000049ede841>] cpuhp_thread_fun+0x2b8/0x510 [<000000000d731c73>] smpboot_thread_fn+0x260/0x5a0 [<0000000093c61bad>] kthread+0x27c/0x350 [<00000000379f0572>] ret_from_fork+0x10/0x18 There are two cases causing memleak: 1. When offline all cpus of a domain in mpam_resctrl_cpu_offline(), we only free domain's space but not the space of ctrl_val array. 2. When allocating ctrl_val array failed in mpam_resctrl_setup_domain(), the space of ctrl_val array may not be freed. Fixes: 88371f8b4c90 ("arm64/mpam: resctrl: Handle cpuhp and resctrl_dom allocation") Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> Reviewed-by: liaoyu <liaoyu15(a)huawei.com> Reviewed-by: Wei Li <liwei391(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_setup.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kernel/mpam/mpam_setup.c b/arch/arm64/kernel/mpam/mpam_setup.c index f32ece505c78..a174ba62ba4e 100644 --- a/arch/arm64/kernel/mpam/mpam_setup.c +++ b/arch/arm64/kernel/mpam/mpam_setup.c @@ -65,7 +65,7 @@ static int mpam_resctrl_setup_domain(unsigned int cpu, struct mpam_component *comp_iter, *comp; u32 num_partid; u32 **ctrlval_ptr; - enum resctrl_ctrl_type type; + enum resctrl_ctrl_type type, type_free; struct list_head *tmp; num_partid = mpam_sysprops_num_partid(); @@ -96,6 +96,12 @@ static int mpam_resctrl_setup_domain(unsigned int cpu, *ctrlval_ptr = kmalloc_array(num_partid, sizeof(**ctrlval_ptr), GFP_KERNEL); if (!*ctrlval_ptr) { + for_each_ctrl_type(type_free) { + if (type_free == type) + break; + ctrlval_ptr = &dom->resctrl_dom.ctrl_val[type_free]; + kfree(*ctrlval_ptr); + } kfree(dom); return -ENOMEM; } @@ -156,6 +162,8 @@ int mpam_resctrl_cpu_offline(unsigned int cpu) struct rdt_domain *d; struct mpam_resctrl_res *res; struct mpam_resctrl_dom *dom; + u32 **ctrlval_ptr; + enum resctrl_ctrl_type type; for_each_supported_resctrl_exports(res) { d = resctrl_get_domain_from_cpu(cpu, &res->resctrl_res); @@ -171,6 +179,11 @@ int mpam_resctrl_cpu_offline(unsigned int cpu) list_del(&d->list); dom = container_of(d, struct mpam_resctrl_dom, resctrl_dom); + for_each_ctrl_type(type) { + ctrlval_ptr = &dom->resctrl_dom.ctrl_val[type]; + kfree(*ctrlval_ptr); + } + kfree(dom); } -- 2.25.1

1 0

[PATCH openEuler-23.09 0/7] sched: Support dynamic affinity in scheduler
by Hui Tang 25 Jul '23

25 Jul '23

This pathchset support dynamic affinity feature. Dynamic affinity set preferred cpus for task. When the utilization of taskgroup's preferred cpu is low, task only run in cpus preferred to enhance cpu resource locality and reduce interference between task cgroups, otherwise task can burst preferred cpus to use external cpu within cpus allowed. Hui Tang (1): sched: Add cmdline for dynamic affinity tanghui (6): sched: Introduce dynamic affinity for cfs scheduler cpuset: Introduce new interface for scheduler dynamic affinity sched: Adjust wakeup cpu range according CPU util dynamicly sched: Adjust cpu allowed in load balance dynamicly sched: Add statistics for scheduler dynamic affinity config: enable CONFIG_QOS_SCHED_DYNAMIC_AFFINITY by default arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/proc/base.c | 73 +++++++++++ include/linux/sched.h | 22 ++++ include/linux/sched/sysctl.h | 3 + init/Kconfig | 10 ++ init/init_task.c | 3 + kernel/cgroup/cpuset.c | 153 ++++++++++++++++++++++- kernel/fork.c | 16 +++ kernel/sched/core.c | 98 +++++++++++++++ kernel/sched/debug.c | 6 + kernel/sched/fair.c | 162 +++++++++++++++++++++++++ kernel/sysctl.c | 11 ++ 13 files changed, 558 insertions(+), 1 deletion(-) -- 2.17.1

2 8

2024

2023

2022

2021

2020

2019

Kernel July 2023