- Kernel - mailweb.openeuler.org

openEuler Kernel SIG双周例会
by openEuler conference 10 Feb '23

10 Feb '23

您好！ Kernel SIG 邀请您参加 2023-02-10 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容：欢迎您参加年后第一次Kernel SIG 双周例会： 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板）会议链接：https://us06web.zoom.us/j/89146789515?pwd=NVN5RmdCSFh2Y1g4SXUwK2NCRnFEZz09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2023-02-10 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 欢迎您参加年后第一次Kernel SIG 双周例会： 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板） You can join the meeting at https://us06web.zoom.us/j/89146789515?pwd=NVN5RmdCSFh2Y1g4SXUwK2NCRnFEZz09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

4 3

[PATCH openEuler-5.10-LTS 1/5] crypto: hisilicon/qm - add functions for releasing resources
by Zheng Zengkai 09 Feb '23

09 Feb '23

From: Weili Qian <qianweili(a)huawei.com> mainline inclusion from mainline-v6.0-rc1 commit bf081d6fa8e9 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I6DRLU CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- The resources allocated by hisi_qm_memory_init() are released by hisi_qm_uninit(). Add hisi_qm_memory_uninit() to release resources, no functional change. conficts: drivers/crypto/hisilicon/qm.c Signed-off-by: Weili Qian <qianweili(a)huawei.com> Signed-off-by: JiangShui Yang <yangjiangshui(a)h-partners.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> --- drivers/crypto/hisilicon/qm.c | 30 +++++++++++++++++------------- 1 file changed, 17 insertions(+), 13 deletions(-) diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c index 57de083e8967..ef09e45bdc3e 100644 --- a/drivers/crypto/hisilicon/qm.c +++ b/drivers/crypto/hisilicon/qm.c @@ -3480,6 +3480,21 @@ static void hisi_qm_pci_uninit(struct hisi_qm *qm) pci_disable_device(pdev); } +static void hisi_qm_memory_uninit(struct hisi_qm *qm) +{ + struct device *dev = &qm->pdev->dev; + + hisi_qp_memory_uninit(qm, qm->qp_num); + if (qm->qdma.va) { + hisi_qm_cache_wb(qm); + dma_free_coherent(dev, qm->qdma.size, + qm->qdma.va, qm->qdma.dma); + } + + idr_destroy(&qm->qp_idr); + kfree(qm->factor); +} + /** * hisi_qm_uninit() - Uninitialize qm. * @qm: The qm needed uninit. @@ -3488,26 +3503,15 @@ static void hisi_qm_pci_uninit(struct hisi_qm *qm) */ void hisi_qm_uninit(struct hisi_qm *qm) { - struct pci_dev *pdev = qm->pdev; - struct device *dev = &pdev->dev; - qm_cmd_uninit(qm); - kfree(qm->factor); - down_write(&qm->qps_lock); + down_write(&qm->qps_lock); if (!qm_avail_state(qm, QM_CLOSE)) { up_write(&qm->qps_lock); return; } - hisi_qp_memory_uninit(qm, qm->qp_num); - idr_destroy(&qm->qp_idr); - - if (qm->qdma.va) { - hisi_qm_cache_wb(qm); - dma_free_coherent(dev, qm->qdma.size, - qm->qdma.va, qm->qdma.dma); - } + hisi_qm_memory_uninit(qm); up_write(&qm->qps_lock); hisi_qm_set_state(qm, VF_NOT_READY); -- 2.20.1

1 4

[PATCH openEuler-1.0-LTS 00/49] linux-4.19.y inclusion
by Yongqiang Liu 09 Feb '23

09 Feb '23

Chen Zhongjin (1): perf: Fix possible memleak in pmu_dev_alloc() Christian Brauner (1): pnode: terminate at peers of source Chuck Lever (1): SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails Dan Carpenter (2): bonding: uninitialized variable in bond_miimon_inspect() ipmi: fix use after free in _ipmi_destroy_user() Enzo Matsumiya (1): cifs: do not include page data when checking signature Eric Dumazet (1): net: stream: purge sk_error_queue in sk_stream_kill_queues() Greg Kroah-Hartman (1): prlimit: do_prlimit needs to have a speculation check Huaxin Lu (1): ima: Fix a potential NULL pointer access in ima_restore_measurement_list Isaac J. Manjarres (1): driver core: Fix bus_type.match() error handling in __driver_attach() Jakub Kicinski (2): bpf: pull before calling skb_postpull_rcsum() net: stream: don't purge sk_error_queue in sk_stream_kill_queues() Jan Kara (2): mbcache: automatically delete entries from cache on freeing ext4: fix deadlock due to mbcache entry corruption Jann Horn (2): mm/khugepaged: fix GUP-fast interaction by sending IPI mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths Jiamei Xie (1): serial: amba-pl011: avoid SBSA UART accessing DMACR register Jiang Li (1): md/raid1: stop mdx_raid1 thread when raid1 array run failed Li Zetao (1): ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() Mark Rutland (1): arm64: cmpxchg_double*: hazard against entire exchange variable Michael S. Tsirkin (1): PCI: Fix pci_device_is_present() for VFs by checking PF Mikulas Patocka (1): md: fix a crash in mempool_free Paolo Abeni (1): net/ulp: prevent ULP without clone op from entering the LISTEN status Rafael J. Wysocki (1): ACPICA: Fix error code path in acpi_ds_call_control_method() Sascha Hauer (1): PCI/sysfs: Fix double free in error path Schspa Shi (1): mrp: introduce active flags to prevent UAF when applicant uninit Stanislav Fomichev (1): bpf: make sure skb->len != 0 when redirecting to a tunneling device Stephen Boyd (1): pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP Subash Abhinov Kasiviswanathan (1): skbuff: Account for tail adjustment during pull operations Ulf Hansson (1): cpuidle: dt: Return the correct numbers of parsed idle states Volker Lendecke (1): cifs: Fix uninitialized memory read for smb311 posix symlink create Wang ShaoBo (1): SUNRPC: Fix missing release socket in rpc_sockname() Wang Weiyang (1): device_cgroup: Roll back to original exceptions after copy failure Wang Yufen (2): pstore/ram: Fix error return code in ramoops_probe() binfmt: Fix error return code in load_elf_fdpic_binary() Xiu Jianfeng (1): ima: Fix misuse of dereference of pointer in template_desc_init_fields() Yang Jihong (1): blktrace: Fix output non-blktrace event when blk_classic option enabled Yang Shi (1): mm: gup: fix the fast GUP race against THP collapse Yang Yingliang (2): class: fix possible memory leak in __class_register() chardev: fix error handling in cdev_device_add() Ye Bin (1): blk-mq: fix possible memleak when register 'hctx' failed Yuan Can (1): perf: arm_dsu: Fix hotplug callback leak in dsu_pmu_init() Zhang Tianci (1): ovl: Use ovl mounter's fsuid and fsgid in ovl_link() Zhang Yiqun (1): crypto: tcrypt - Fix multibuffer skcipher speed test mem leak Zhang Yuchen (2): ipmi: fix memleak when unload ipmi driver ipmi: fix long wait in unload when IPMI disconnect ZhangPeng (1): pinctrl: pinconf-generic: add missing of_node_put() delisun (1): serial: pl011: Do not clear RX FIFO & RX interrupt in unthrottle. minoura makoto (1): SUNRPC: ensure the matching upcall is in-flight upon downcall arch/arm64/include/asm/atomic_ll_sc.h | 2 +- arch/arm64/include/asm/atomic_lse.h | 2 +- block/blk-mq-sysfs.c | 11 ++- crypto/tcrypt.c | 9 -- drivers/acpi/acpica/dsmethod.c | 10 ++- drivers/acpi/acpica/utcopy.c | 7 -- drivers/base/class.c | 5 ++ drivers/base/dd.c | 8 +- drivers/char/ipmi/ipmi_msghandler.c | 12 ++- drivers/char/ipmi/ipmi_si_intf.c | 27 ++++-- drivers/cpuidle/dt_idle_states.c | 2 +- drivers/md/md.c | 9 +- drivers/md/raid1.c | 1 + drivers/net/bonding/bond_main.c | 2 +- drivers/pci/pci-sysfs.c | 13 ++- drivers/pci/pci.c | 2 + drivers/perf/arm_dsu_pmu.c | 6 +- drivers/pinctrl/pinconf-generic.c | 4 +- drivers/tty/serial/amba-pl011.c | 14 ++- fs/binfmt_elf_fdpic.c | 5 +- fs/char_dev.c | 2 +- fs/cifs/link.c | 1 + fs/cifs/smb2pdu.c | 15 ++-- fs/ext4/xattr.c | 4 +- fs/mbcache.c | 118 ++++++++++---------------- fs/overlayfs/dir.c | 46 ++++++---- fs/pnode.c | 2 +- fs/pstore/ram.c | 2 + fs/pstore/ram_core.c | 6 +- include/asm-generic/tlb.h | 6 ++ include/linux/mbcache.h | 33 ++++--- include/linux/sunrpc/rpc_pipe_fs.h | 5 ++ include/net/mrp.h | 1 + kernel/events/core.c | 8 +- kernel/sys.c | 2 + kernel/trace/blktrace.c | 3 +- mm/gup.c | 34 ++++++-- mm/khugepaged.c | 34 ++++++-- mm/memory.c | 1 + mm/mmu_gather.c | 5 ++ net/802/mrp.c | 18 ++-- net/core/filter.c | 11 ++- net/core/skbuff.c | 3 + net/core/stream.c | 7 +- net/ipv4/inet_connection_sock.c | 16 +++- net/sunrpc/auth_gss/auth_gss.c | 19 ++++- net/sunrpc/auth_gss/svcauth_gss.c | 4 +- net/sunrpc/clnt.c | 2 +- security/device_cgroup.c | 33 ++++++- security/integrity/ima/ima_template.c | 9 +- 50 files changed, 406 insertions(+), 195 deletions(-) -- 2.25.1

1 49

[PATCH openEuler-1.0-LTS 0/5] mainline backport
by Yongqiang Liu 09 Feb '23

09 Feb '23

Ard Biesheuvel (1): crypto: tcrypt - avoid signed overflow in byte count Guenter Roeck (1): lib/list_debug.c: Detect uninitialized lists Guoqing Jiang (1): md: protect md_unregister_thread from reentrancy Konstantin Khlebnikov (1): sched/rt: Optimize checking group RT scheduler constraints Sean Christopherson (1): hugetlbfs: fix off-by-one error in hugetlb_vmdelete_list() crypto/tcrypt.c | 20 ++++++++++---------- drivers/md/md.c | 15 ++++++++++----- fs/hugetlbfs/inode.c | 7 ++++--- kernel/sched/rt.c | 24 +++++++++++------------- lib/list_debug.c | 12 ++++++++++-- 5 files changed, 45 insertions(+), 33 deletions(-) -- 2.25.1

1 5

[PATCH openEuler-1.0-LTS] mm: sharepool: fix hugepage_rsvd count increase error
by Yongqiang Liu 09 Feb '23

09 Feb '23

From: Guo Mengqi <guomengqi3(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5RO2H CVE: NA -------------------------------- When nr_hugepages is configured, sharepool allocates hugepages first from hugetlb pool, then from buddy system if the pool had been used up. Current page release function treat the buddy system hugepages as hugetlb pages, which caused HugePages_Rsvd to increase improperly. Add a check in page release function: if the page is temporary, do not call hugetlb_unreserve_pages. Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/hugetlbfs/inode.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c index f29d6d2fb052..d70c8aaf5acc 100644 --- a/fs/hugetlbfs/inode.c +++ b/fs/hugetlbfs/inode.c @@ -448,6 +448,14 @@ hugetlb_vmdelete_list(struct rb_root_cached *root, pgoff_t start, pgoff_t end) } } +static inline bool PageHugeTemporary(struct page *page) +{ + if (!PageHuge(page)) + return false; + + return (unsigned long)page[2].mapping == -1U; +} + /* * remove_inode_hugepages handles two distinct cases: truncation and hole * punch. There are subtle differences in operation for each case. @@ -532,11 +540,17 @@ static void remove_inode_hugepages(struct inode *inode, loff_t lstart, */ VM_BUG_ON(PagePrivate(page)); remove_huge_page(page); - freed++; - if (!truncate_op) { - if (unlikely(hugetlb_unreserve_pages(inode, + /* + * if the page is from buddy system, do not add to freed. + * because freed is used for hugetlbfs reservation accounting. + */ + if (!PageHugeTemporary(page)) { + freed++; + if (!truncate_op) { + if (unlikely(hugetlb_unreserve_pages(inode, index, index + 1, 1))) hugetlb_fix_reserve_counts(inode); + } } unlock_page(page); -- 2.25.1

1 0

[PATCH openEuler-5.10-LTS 1/5] crypto: hisilicon/qm - add functions for releasing resources
by Zheng Zengkai 09 Feb '23

09 Feb '23

From: Weili Qian <qianweili(a)huawei.com> mainline inclusion from mainline-v6.0-rc1 commit bf081d6fa8e9 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I6DRLU CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- The resources allocated by hisi_qm_memory_init() are released by hisi_qm_uninit(). Add hisi_qm_memory_uninit() to release resources, no functional change. conficts: drivers/crypto/hisilicon/qm.c Signed-off-by: Weili Qian <qianweili(a)huawei.com> Signed-off-by: JiangShui Yang <yangjiangshui(a)h-partners.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> --- drivers/crypto/hisilicon/qm.c | 30 +++++++++++++++++------------- 1 file changed, 17 insertions(+), 13 deletions(-) diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c index 57de083e8967..ef09e45bdc3e 100644 --- a/drivers/crypto/hisilicon/qm.c +++ b/drivers/crypto/hisilicon/qm.c @@ -3480,6 +3480,21 @@ static void hisi_qm_pci_uninit(struct hisi_qm *qm) pci_disable_device(pdev); } +static void hisi_qm_memory_uninit(struct hisi_qm *qm) +{ + struct device *dev = &qm->pdev->dev; + + hisi_qp_memory_uninit(qm, qm->qp_num); + if (qm->qdma.va) { + hisi_qm_cache_wb(qm); + dma_free_coherent(dev, qm->qdma.size, + qm->qdma.va, qm->qdma.dma); + } + + idr_destroy(&qm->qp_idr); + kfree(qm->factor); +} + /** * hisi_qm_uninit() - Uninitialize qm. * @qm: The qm needed uninit. @@ -3488,26 +3503,15 @@ static void hisi_qm_pci_uninit(struct hisi_qm *qm) */ void hisi_qm_uninit(struct hisi_qm *qm) { - struct pci_dev *pdev = qm->pdev; - struct device *dev = &pdev->dev; - qm_cmd_uninit(qm); - kfree(qm->factor); - down_write(&qm->qps_lock); + down_write(&qm->qps_lock); if (!qm_avail_state(qm, QM_CLOSE)) { up_write(&qm->qps_lock); return; } - hisi_qp_memory_uninit(qm, qm->qp_num); - idr_destroy(&qm->qp_idr); - - if (qm->qdma.va) { - hisi_qm_cache_wb(qm); - dma_free_coherent(dev, qm->qdma.size, - qm->qdma.va, qm->qdma.dma); - } + hisi_qm_memory_uninit(qm); up_write(&qm->qps_lock); hisi_qm_set_state(qm, VF_NOT_READY); -- 2.20.1

1 4

[PATCH openEuler-1.0-LTS 1/3] irqchip/gic-v3-its: introduce CONFIG_GENERIC_PENDING_IRQ
by Yongqiang Liu 09 Feb '23

09 Feb '23

From: Yipeng Zou <zouyipeng(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I6BO2R CVE: NA -------------------------------- Now, There is some issues about LPI migration on ARM SMP platform. For example, NIC device generates MSI and sends LPI to CPU0 via ITS, meanwhile irqbalance running on CPU1 set irq affinty of NIC to CPU1, the next interrupt will be sent to CPU2, due to the state of irq is still in progress, kernel does not end up performing irq handler on CPU2, which results in some userland service timeouts, the sequence of events is shown as follows: NIC CPU0 CPU1 Generate IRQ#1 READ_IAR Lock irq_desc Set IRQD_IN_PROGRESS Unlock irq_desc Lock irq_desc Change LPI Affinity Unlock irq_desc Call irq_handler Generate IRQ#2 READ_IAR Lock irq_desc Check IRQD_IN_PROGRESS Unlock irq_desc Return from interrupt#2 Lock irq_desc Clear IRQD_IN_PROGRESS Unlock irq_desc return from interrupt#1 For this scenario, We can enable CONFIG_GENERIC_PENDING_IRQ to avoid this. The CONFIG_GENERIC_PENDING_IRQ will delay all action that modify LPI affinity until the next interrupt eoi handler. Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> Reviewed-by: Liao Chang <liaochang1(a)huawei.com> Reviewed-by: Zhang Jianhua <chris.zjh(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/irqchip/irq-gic-v3-its.c | 8 +++++++- kernel/irq/Kconfig | 4 +++- kernel/irq/migration.c | 2 ++ 3 files changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index 15a0292e8e61..7a0adf67761e 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -1162,6 +1162,12 @@ static void its_unmask_irq(struct irq_data *d) lpi_update_config(d, 0, LPI_PROP_ENABLED); } +static void its_irq_chip_eoi(struct irq_data *d) +{ + irq_move_irq(d); + irq_chip_eoi_parent(d); +} + static int its_set_affinity(struct irq_data *d, const struct cpumask *mask_val, bool force) { @@ -1485,7 +1491,7 @@ static struct irq_chip its_irq_chip = { .name = "ITS", .irq_mask = its_mask_irq, .irq_unmask = its_unmask_irq, - .irq_eoi = irq_chip_eoi_parent, + .irq_eoi = its_irq_chip_eoi, .irq_set_affinity = its_set_affinity, .irq_compose_msi_msg = its_irq_compose_msi_msg, .irq_set_irqchip_state = its_irq_set_irqchip_state, diff --git a/kernel/irq/Kconfig b/kernel/irq/Kconfig index 14a85d0161ea..eebbced84e44 100644 --- a/kernel/irq/Kconfig +++ b/kernel/irq/Kconfig @@ -32,7 +32,9 @@ config GENERIC_IRQ_LEGACY_ALLOC_HWIRQ # Support for delayed migration from interrupt context config GENERIC_PENDING_IRQ - bool + bool "Support for delayed migration from interrupt context" + depends on SMP + default n # Support for generic irq migrating off cpu before the cpu is offline. config GENERIC_IRQ_MIGRATION diff --git a/kernel/irq/migration.c b/kernel/irq/migration.c index def48589ea48..bcb61ee69c20 100644 --- a/kernel/irq/migration.c +++ b/kernel/irq/migration.c @@ -117,3 +117,5 @@ void __irq_move_irq(struct irq_data *idata) if (!masked) idata->chip->irq_unmask(idata); } + +void __weak irq_force_complete_move(struct irq_desc *desc) { } -- 2.25.1

1 2

[PATCH openEuler-1.0-LTS 1/3] jbd2: Fix data missing when reusing bh which is ready to be checkpointed
by Yongqiang Liu 09 Feb '23

09 Feb '23

From: Zhihao Cheng <chengzhihao1(a)huawei.com> maillist inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6C5HV CVE: NA Reference: https://lore.kernel.org/lkml/20230110015327.1181863-1-chengzhihao1@huawei.c… -------------------------------- Following process will make data lost and could lead to a filesystem corrupted problem: 1. jh(bh) is inserted into T1->t_checkpoint_list, bh is dirty, and jh->b_transaction = NULL 2. T1 is added into journal->j_checkpoint_transactions. 3. Get bh prepare to write while doing checkpoing: PA PB do_get_write_access jbd2_log_do_checkpoint spin_lock(&jh->b_state_lock) if (buffer_dirty(bh)) clear_buffer_dirty(bh) // clear buffer dirty set_buffer_jbddirty(bh) transaction = journal->j_checkpoint_transactions jh = transaction->t_checkpoint_list if (!buffer_dirty(bh)) __jbd2_journal_remove_checkpoint(jh) // bh won't be flushed jbd2_cleanup_journal_tail __jbd2_journal_file_buffer(jh, transaction, BJ_Reserved) 4. Aborting journal/Power-cut before writing latest bh on journal area. In this way we get a corrupted filesystem with bh's data lost. Fix it by moving the clearing of buffer_dirty bit just before the call to __jbd2_journal_file_buffer(), both bit clearing and jh->b_transaction assignment are under journal->j_list_lock locked, so that jbd2_log_do_checkpoint() will wait until jh's new transaction fininshed even bh is currently not dirty. And journal_shrink_one_cp_list() won't remove jh from checkpoint list if the buffer head is reused in do_get_write_access(). Fetch a reproducer in [Link]. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216898 Cc: <stable(a)kernel.org> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Signed-off-by: zhanchengbin <zhanchengbin1(a)huawei.com> Suggested-by: Jan Kara <jack(a)suse.cz> Conflicts: fs/jbd2/transaction.c [ 464170647b5648bb8("jbd2: Make state lock a spinlock") is not applied. ] Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/jbd2/transaction.c | 50 +++++++++++++++++++++++++------------------ 1 file changed, 29 insertions(+), 21 deletions(-) diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c index 3b31bd1f7b77..149190c2ac89 100644 --- a/fs/jbd2/transaction.c +++ b/fs/jbd2/transaction.c @@ -935,36 +935,28 @@ do_get_write_access(handle_t *handle, struct journal_head *jh, * ie. locked but not dirty) or tune2fs (which may actually have * the buffer dirtied, ugh.) */ - if (buffer_dirty(bh)) { + if (buffer_dirty(bh) && jh->b_transaction) { + warn_dirty_buffer(bh); /* - * First question: is this buffer already part of the current - * transaction or the existing committing transaction? - */ - if (jh->b_transaction) { - J_ASSERT_JH(jh, - jh->b_transaction == transaction || - jh->b_transaction == - journal->j_committing_transaction); - if (jh->b_next_transaction) - J_ASSERT_JH(jh, jh->b_next_transaction == - transaction); - warn_dirty_buffer(bh); - } - /* - * In any case we need to clean the dirty flag and we must - * do it under the buffer lock to be sure we don't race - * with running write-out. + * We need to clean the dirty flag and we must do it under the + * buffer lock to be sure we don't race with running write-out. */ JBUFFER_TRACE(jh, "Journalling dirty buffer"); clear_buffer_dirty(bh); + /* + * The buffer is going to be added to BJ_Reserved list now and + * nothing guarantees jbd2_journal_dirty_metadata() will be + * ever called for it. So we need to set jbddirty bit here to + * make sure the buffer is dirtied and written out when the + * journaling machinery is done with it. + */ set_buffer_jbddirty(bh); } - unlock_buffer(bh); - error = -EROFS; if (is_handle_aborted(handle)) { jbd_unlock_bh_state(bh); + unlock_buffer(bh); goto out; } error = 0; @@ -974,8 +966,10 @@ do_get_write_access(handle_t *handle, struct journal_head *jh, * b_next_transaction points to it */ if (jh->b_transaction == transaction || - jh->b_next_transaction == transaction) + jh->b_next_transaction == transaction) { + unlock_buffer(bh); goto done; + } /* * this is the first time this transaction is touching this buffer, @@ -999,10 +993,24 @@ do_get_write_access(handle_t *handle, struct journal_head *jh, */ smp_wmb(); spin_lock(&journal->j_list_lock); + if (test_clear_buffer_dirty(bh)) { + /* + * Execute buffer dirty clearing and jh->b_transaction + * assignment under journal->j_list_lock locked to + * prevent bh being removed from checkpoint list if + * the buffer is in an intermediate state (not dirty + * and jh->b_transaction is NULL). + */ + JBUFFER_TRACE(jh, "Journalling dirty buffer"); + set_buffer_jbddirty(bh); + } __jbd2_journal_file_buffer(jh, transaction, BJ_Reserved); spin_unlock(&journal->j_list_lock); + unlock_buffer(bh); goto done; } + unlock_buffer(bh); + /* * If there is already a copy-out version of this buffer, then we don't * need to make another one -- 2.25.1

1 2

[PATCH openEuler-1.0-LTS] x86/unwind: Fix orc entry for paravirt {save,restore}_fl
by Yongqiang Liu 08 Feb '23

08 Feb '23

From: Chen Zhongjin <chenzhongjin(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187818, https://gitee.com/openeuler/kernel/issues/I6DK3O CVE: NA -------------------------------- When CONFIG_PARAVIRT is enabled, the code of {save,restore}_fl is defined as: ff 14 25 00 00 00 00 callq *0x0 which will be patched to call the xen paravirt function, or native implementation, in 'paravirt_patch_64.c': pushfq; popq %rax // for native_save_fl pushq %rdi; popfq // for native_restore_fl The orc metadata is generated with insn 'callq', so it can become inconsistent with the real insn 'push;pop'. This makes stacktrace on the 'pop' insn fail and incorrect stacktrace result can be returned. To prevent reliable stacktrace broken, check the insns when unwind pt_regs stack frame: When there are 'push;pop' combination and both insns don't change orc entry, it means the stack state is inconsistent with orc on pop. Add one slot to sp_offset for on original orc entry to get the correct orc entry. Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> Reviewed-by: Xu Kuohai <xukuohai(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- arch/x86/kernel/unwind_orc.c | 43 ++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c index 0402bc0b5851..ec4a14e4f639 100644 --- a/arch/x86/kernel/unwind_orc.c +++ b/arch/x86/kernel/unwind_orc.c @@ -138,6 +138,34 @@ static struct orc_entry null_orc_entry = { .type = ORC_TYPE_CALL }; +#ifdef CONFIG_PARAVIRT +static bool check_paravirt(struct unwind_state *state, struct orc_entry *orc) +{ + u8 *ip = (u8 *)state->ip; + + /* + * In paravirt_patch_64.c, patched paravirt opcode should be: + * pushfq; popq %rax // 0x9c 0x58 + * pushq %rdi; popfq // 0x57 0x9d + * + * Error unwinding only happens when: + * 1. In irq or preempt context. + * 2. Current insn is popq, and it doesn't change orc. + * 3. Last insn doesn't change orc, checking it first to + * promise ip - 1 is valid. + * 4. Last byte fits pushf. + */ + if (state->regs && orc->type == ORC_TYPE_CALL && + (ip[0] == 0x58 || ip[0] == 0x9d) && + orc == orc_find((unsigned long)(ip + 1)) && + orc == orc_find((unsigned long)(ip - 1)) && + (ip[-1] == 0x9c || ip[-1] == 0x57)) + return true; + + return false; +} +#endif + static struct orc_entry *orc_find(unsigned long ip) { static struct orc_entry *orc; @@ -415,6 +443,9 @@ bool unwind_next_frame(struct unwind_state *state) enum stack_type prev_type = state->stack_info.type; struct orc_entry *orc; bool indirect = false; +#ifdef CONFIG_PARAVIRT + struct orc_entry para_orc; +#endif if (unwind_done(state)) return false; @@ -436,6 +467,18 @@ bool unwind_next_frame(struct unwind_state *state) if (!orc) goto err; +#ifdef CONFIG_PARAVIRT + /* + * When hitting paravirt POP insn, the orc entry should add + * one slot for PUSH insn. + */ + if (!state->error && check_paravirt(state, orc)) { + para_orc = *orc; + para_orc.sp_offset += sizeof(long); + orc = &para_orc; + } +#endif + /* End-of-stack check for kernel threads: */ if (orc->sp_reg == ORC_REG_UNDEFINED) { if (!orc->end) -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/2] drm/i915/gvt: fix double free bug in split_2MB_gtt_entry
by Yongqiang Liu 07 Feb '23

07 Feb '23

From: Zheng Wang <zyytlz.wz(a)163.com> mainline inclusion from mainline-v6.2-rc3 commit 4a61648af68f5ba4884f0e3b494ee1cabc4b6620 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5XXFF CVE: CVE-2022-3707 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If intel_gvt_dma_map_guest_page failed, it will call ppgtt_invalidate_spt, which will finally free the spt. But the caller function ppgtt_populate_spt_by_guest_entry does not notice that, it will free spt again in its error path. Fix this by canceling the mapping of DMA address and freeing sub_spt. Besides, leave the handle of spt destroy to caller function instead of callee function when error occurs. Fixes: b901b252b6cf ("drm/i915/gvt: Add 2M huge gtt support") Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Reviewed-by: Zhenyu Wang <zhenyuw(a)linux.intel.com> Signed-off-by: Zhenyu Wang <zhenyuw(a)linux.intel.com> Link: http://patchwork.freedesktop.org/patch/msgid/20221229165641.1192455-1-zyytl… conflicts: drivers/gpu/drm/i915/gvt/gtt.c Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Wei Li <liwei391(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/gpu/drm/i915/gvt/gtt.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c index 40b32b4d1d98..afbc648befec 100644 --- a/drivers/gpu/drm/i915/gvt/gtt.c +++ b/drivers/gpu/drm/i915/gvt/gtt.c @@ -1155,10 +1155,8 @@ static int split_2MB_gtt_entry(struct intel_vgpu *vgpu, for_each_shadow_entry(sub_spt, &sub_se, sub_index) { ret = intel_gvt_hypervisor_dma_map_guest_page(vgpu, start_gfn + sub_index, PAGE_SIZE, &dma_addr); - if (ret) { - ppgtt_invalidate_spt(spt); - return ret; - } + if (ret) + goto err; sub_se.val64 = se->val64; /* Copy the PAT field from PDE. */ @@ -1177,6 +1175,17 @@ static int split_2MB_gtt_entry(struct intel_vgpu *vgpu, ops->set_pfn(se, sub_spt->shadow_page.mfn); ppgtt_set_shadow_entry(spt, se, index); return 0; +err: + /* Cancel the existing addess mappings of DMA addr. */ + for_each_present_shadow_entry(sub_spt, &sub_se, sub_index) { + gvt_vdbg_mm("invalidate 4K entry\n"); + ppgtt_invalidate_pte(sub_spt, &sub_se); + } + /* Release the new allocated spt. */ + trace_spt_change(sub_spt->vgpu->id, "release", sub_spt, + sub_spt->guest_page.gfn, sub_spt->shadow_page.type); + ppgtt_free_spt(sub_spt); + return ret; } static int split_64KB_gtt_entry(struct intel_vgpu *vgpu, -- 2.25.1

1 1