- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/2] fix memleak with efi_fake_mem
by Wupeng Ma 21 Jun '23

21 Jun '23

From: Ma Wupeng <mawupeng1(a)huawei.com> 1. fix memleak with efi_fake_mem 2. disable efi_fake_mem support by default for arm64 Ma Wupeng (2): efi: Fix UAF for arm64 when enable efi_fake_mem config: Disable EFI_FAKE_MEMMAP support for arm64 by default arch/arm64/configs/openeuler_defconfig | 3 +-- drivers/firmware/efi/fake_mem.c | 13 +++++++++++++ 2 files changed, 14 insertions(+), 2 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 0/3] fix memory reliable related issues
by Wupeng Ma 21 Jun '23

21 Jun '23

From: Ma Wupeng <mawupeng1(a)huawei.com> Fix memory reliable related issues. Ma Wupeng (3): mm: mem_reliable: Fix reliable page counter mismatch problem mm: mem_reliable: Update reliable page counter to zero if underflows efi: Disable mirror feature during crashkernel drivers/firmware/efi/efi.c | 6 ++++++ include/linux/mem_reliable.h | 15 +++++++++++++-- mm/memory.c | 1 + 3 files changed, 20 insertions(+), 2 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10] memcg: fix implicit declaration of memcg_print_bad_task()
by Liu Shixin 21 Jun '23

21 Jun '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6NYW4 CVE: NA -------------------------------- Fix implicit declaration of function 'memcg_print_bad_task'. Fixes: 9cd6f55e9c33 ("mm: oom: move memcg_print_bad_task() out of mem_cgroup_scan_tasks()") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- include/linux/memcontrol.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h index 5b8982e95876..e1c24b0056d0 100644 --- a/include/linux/memcontrol.h +++ b/include/linux/memcontrol.h @@ -420,6 +420,8 @@ bool memcg_low_priority_scan_tasks(int (*)(struct task_struct *, void *), void memcg_print_bad_task(struct oom_control *oc); extern int sysctl_memcg_qos_handler(struct ctl_table *table, int write, void __user *buffer, size_t *length, loff_t *ppos); +#else +void memcg_print_bad_task(struct oom_control *oc); #endif /* @@ -1695,6 +1697,10 @@ unsigned long mem_cgroup_soft_limit_reclaim(pg_data_t *pgdat, int order, { return 0; } + +static inline void memcg_print_bad_task(struct oom_control *oc) +{ +} #endif /* CONFIG_MEMCG */ /* idx can be of type enum memcg_stat_item or node_stat_item */ -- 2.25.1

2 1

[PATCH opwnEuler-22.03-LTS-SP2 0/1] uacce: remove uacce device refcnt
by Wenkai Lin 21 Jun '23

21 Jun '23

From: JiangShui Yang <yangjiangshui(a)h-partners.com> Delete the reference counting so that the isolation policy can be dynamically configured. Wenkai Lin (1): uacce: remove uacce device refcnt drivers/misc/uacce/uacce.c | 5 ----- include/linux/uacce.h | 2 -- 2 files changed, 7 deletions(-) -- 2.30.0

1 1

[PATCH openEuler-22.03-LTS-SP2 0/2] Fix NULL pointer and Keep PERF_PMU_CAP_EXCLUSIVE
by Junhao He 20 Jun '23

20 Jun '23

1) Fix NULL pointer for hisi_ptt 2) Keep to advertise PERF_PMU_CAP_EXCLUSIVE. Such ptt pmus can only have one event scheduled at a time. Junhao He (2): hwtracing: hisi_ptt: Add dummy callback pmu::read() hwtracing: hisi_ptt: Keep to advertise PERF_PMU_CAP_EXCLUSIVE drivers/hwtracing/ptt/hisi_ptt.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) -- 2.33.0

2 3

[PATCH OLK-5.10 0/2] nbd: validate the block size in nbd_set_size
by Zhong Jinghua 20 Jun '23

20 Jun '23

nbd: validate the block size in nbd_set_size Christoph Hellwig (1): nbd: validate the block size in nbd_set_size Zhong Jinghua (1): nbd: fix incomplete validation of ioctl arg drivers/block/nbd.c | 51 ++++++++++++++++++--------------------------- 1 file changed, 20 insertions(+), 31 deletions(-) -- 2.31.1

2 3

[PATCH openEuler-22.03-LTS-SP2 v2 0/2] Fix some warning messages in netacc
by Liu Jian 20 Jun '23

20 Jun '23

v1->v2: add bugzilla tag. Fix below warning messages: libbpf: Error in bpf_create_map_xattr(redissock_map):ERROR: strerror_r(-524)=22(-524). Retrying without BTF. rmmod: ERROR: Module localip is not currently loaded Hengqi Chen (1): libbpf: Support uniform BTF-defined key/value specification across all BPF maps Liu Jian (1): tools: ignore one warning message tools/lib/bpf/libbpf.c | 24 ++++++++++++++++++++++++ tools/netacc/net-acc | 2 +- 2 files changed, 25 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/5] sched: Some fixes for smart grid
by Zhang Changzhong 20 Jun '23

20 Jun '23

Some fixes for smart gird, as follows: Hui Tang (5): sched: Fix timer storm for smart grid sched: fix dereference NULL pointers sched: Fix memory leak on error branch sched: clear credit count in error branch sched: Adjust few parameters range for smart grid kernel/fork.c | 2 +- kernel/sched/core.c | 32 ++++++++++++++++++++++++++++---- kernel/sched/fair.c | 40 ++++++++++++++++++++-------------------- kernel/sysctl.c | 6 ++++-- 4 files changed, 53 insertions(+), 27 deletions(-) -- 2.9.5

1 5

[OLK-5.10 v2] RDMA/hns: Fix CQ and QP cache affinity
by Chengchang Tang 20 Jun '23

20 Jun '23

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7DCX0 --------------------------------------------------------------------------- Currently, the affinity between QP cache and CQ cache is not considered when assigning QPN, it will affect the message rate of HW. Allocate QPN from QP cache with better CQ affinity to get better performance. Fixes: c746005b2800 ("RDMA/hns: Create QP with selected QPN for bank load balance") Signed-off-by: Chengchang Tang <tangchengchang(a)huawei.com> --- drivers/infiniband/hw/hns/hns_roce_device.h | 1 + drivers/infiniband/hw/hns/hns_roce_qp.c | 29 ++++++++++++++++----- 2 files changed, 24 insertions(+), 6 deletions(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h index 01c16a4d97c5..9694cef03adb 100644 --- a/drivers/infiniband/hw/hns/hns_roce_device.h +++ b/drivers/infiniband/hw/hns/hns_roce_device.h @@ -101,6 +101,7 @@ #define HNS_ROCE_CQ_BANK_NUM 4 #define CQ_BANKID_SHIFT 2 +#define CQ_BANKID_MASK GENMASK(1, 0) enum { SERV_TYPE_RC, diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c index f64464fbad41..2c11b1a0b0c7 100644 --- a/drivers/infiniband/hw/hns/hns_roce_qp.c +++ b/drivers/infiniband/hw/hns/hns_roce_qp.c @@ -171,14 +171,29 @@ static void hns_roce_ib_qp_event(struct hns_roce_qp *hr_qp, } } -static u8 get_least_load_bankid_for_qp(struct hns_roce_bank *bank) +static u8 get_affinity_cq_bank(u8 qp_bank) { - u32 least_load = bank[0].inuse; + return (qp_bank >> 1) & CQ_BANKID_MASK; +} + +static u8 get_least_load_bankid_for_qp(struct ib_qp_init_attr *init_attr, + struct hns_roce_bank *bank) +{ +#define INVALID_LOAD_QPNUM 0xFFFFFFFF + struct ib_cq *scq = init_attr->send_cq; + u32 least_load = INVALID_LOAD_QPNUM; + unsigned long cqn = 0; u8 bankid = 0; u32 bankcnt; u8 i; - for (i = 1; i < HNS_ROCE_QP_BANK_NUM; i++) { + if (scq) + cqn = to_hr_cq(scq)->cqn; + + for (i = 0; i < HNS_ROCE_QP_BANK_NUM; i++) { + if (scq && (get_affinity_cq_bank(i) != (cqn & CQ_BANKID_MASK))) + continue; + bankcnt = bank[i].inuse; if (bankcnt < least_load) { least_load = bankcnt; @@ -210,7 +225,9 @@ static int alloc_qpn_with_bankid(struct hns_roce_bank *bank, u8 bankid, return 0; } -static int alloc_qpn(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp) + +static int alloc_qpn(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp, + struct ib_qp_init_attr *init_attr) { struct hns_roce_qp_table *qp_table = &hr_dev->qp_table; unsigned long num = 0; @@ -222,7 +239,7 @@ static int alloc_qpn(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp) hr_qp->doorbell_qpn = 1; } else { mutex_lock(&qp_table->bank_mutex); - bankid = get_least_load_bankid_for_qp(qp_table->bank); + bankid = get_least_load_bankid_for_qp(init_attr, qp_table->bank); ret = alloc_qpn_with_bankid(&qp_table->bank[bankid], bankid, &num); @@ -1218,7 +1235,7 @@ static int hns_roce_create_qp_common(struct hns_roce_dev *hr_dev, } } - ret = alloc_qpn(hr_dev, hr_qp); + ret = alloc_qpn(hr_dev, hr_qp, init_attr); if (ret) { ibdev_err(ibdev, "failed to alloc QPN, ret = %d.\n", ret); goto err_qpn; -- 2.30.0

1 0

[PATCH OLK-5.10] relayfs: fix out-of-bounds access in relay_file_read
by GONG, Ruiqi 20 Jun '23

20 Jun '23

From: Zhang Zhengming <zhang.zhengming(a)h3c.com> stable inclusion from stable-v5.10.180 commit 1b0df44753bf9e45eaf5cee34f87597193f862e8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7E5C1 CVE: CVE-2023-3268 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------- commit 43ec16f1450f4936025a9bdf1a273affdb9732c1 upstream. There is a crash in relay_file_read, as the var from point to the end of last subbuf. The oops looks something like: pc : __arch_copy_to_user+0x180/0x310 lr : relay_file_read+0x20c/0x2c8 Call trace: __arch_copy_to_user+0x180/0x310 full_proxy_read+0x68/0x98 vfs_read+0xb0/0x1d0 ksys_read+0x6c/0xf0 __arm64_sys_read+0x20/0x28 el0_svc_common.constprop.3+0x84/0x108 do_el0_svc+0x74/0x90 el0_svc+0x1c/0x28 el0_sync_handler+0x88/0xb0 el0_sync+0x148/0x180 We get the condition by analyzing the vmcore: 1). The last produced byte and last consumed byte both at the end of the last subbuf 2). A softirq calls function(e.g __blk_add_trace) to write relay buffer occurs when an program is calling relay_file_read_avail(). relay_file_read relay_file_read_avail relay_file_read_consume(buf, 0, 0); //interrupted by softirq who will write subbuf .... return 1; //read_start point to the end of the last subbuf read_start = relay_file_read_start_pos //avail is equal to subsize avail = relay_file_read_subbuf_avail //from points to an invalid memory address from = buf->start + read_start //system is crashed copy_to_user(buffer, from, avail) Link: https://lkml.kernel.org/r/20230419040203.37676-1-zhang.zhengming@h3c.com Fixes: 8d62fdebdaf9 ("relay file read: start-pos fix") Signed-off-by: Zhang Zhengming <zhang.zhengming(a)h3c.com> Reviewed-by: Zhao Lei <zhao_lei1(a)hoperun.com> Reviewed-by: Zhou Kete <zhou.kete(a)h3c.com> Reviewed-by: Pengcheng Yang <yangpc(a)wangsu.com> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: GONG, Ruiqi <gongruiqi1(a)huawei.com> --- kernel/relay.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/relay.c b/kernel/relay.c index b08d936d5fa7..9cae6bf2e66a 100644 --- a/kernel/relay.c +++ b/kernel/relay.c @@ -1077,7 +1077,8 @@ static size_t relay_file_read_start_pos(struct rchan_buf *buf) size_t subbuf_size = buf->chan->subbuf_size; size_t n_subbufs = buf->chan->n_subbufs; size_t consumed = buf->subbufs_consumed % n_subbufs; - size_t read_pos = consumed * subbuf_size + buf->bytes_consumed; + size_t read_pos = (consumed * subbuf_size + buf->bytes_consumed) + % (n_subbufs * subbuf_size); read_subbuf = read_pos / subbuf_size; padding = buf->padding[read_subbuf]; -- 2.25.1

2 1