- Kernel - mailweb.openeuler.org

[PATCH] openEuler: add openEuler/MAINTAINERS for Maintainers & Committers
by Xie XiuQi 29 Nov '22

29 Nov '22

openEuler inclusion category: doc bugzilla: https://gitee.com/openeuler/kernel/issues/I63OX8 Add the Maintainer & Committers list for the openEuler/kernel repository by referring to the MAINTAINERS file of the upstream community. It is convenient to obtain the list of Maintainers & Committers of the openEuler/kernel based on the submitted PR or patches. Only the of the scheduling subsystem is added to openEuler/MAINTAINERS. This is used as a reference for other modules and subsystems. Example: $./scripts/get_maintainer.pl -no-l --no-rolestats --maintainer-path=openEuler/MAINTAINERS --no-tree --no-fixes --no-git-blame-signatures --no-git-fallback 0001-sched-fair-Fix-fault-in-reweight_entity.patch Signed-off-by: Xie XiuQi <xiexiuqi(a)huawei.com> --- openEuler/MAINTAINERS | 85 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 85 insertions(+) create mode 100644 openEuler/MAINTAINERS diff --git a/openEuler/MAINTAINERS b/openEuler/MAINTAINERS new file mode 100644 index 000000000000..151c64ec85bd --- /dev/null +++ b/openEuler/MAINTAINERS @@ -0,0 +1,85 @@ +List of maintainers/committers +==================================================== + +Descriptions of section entries and preferred order +--------------------------------------------------- + + M: *Mail* patches to: FullName <address@domain> + R: Designated *Reviewer*: FullName <address@domain> + These reviewers should be CCed on patches. + L: *Mailing list* that is relevant to this area + S: *Status*, one of the following: + Supported: Someone is actually paid to look after this. + Maintained: Someone actually looks after it. + Odd Fixes: It has a maintainer but they don't have time to do + much other than throw the odd patch in. See below.. + Orphan: No current maintainer [but maybe you could take the + role as you write your new code]. + Obsolete: Old code. Something tagged obsolete generally means + it has been replaced by a better system and you + should be using that. + W: *Web-page* with status/info + Q: *Patchwork* web based patch tracking system site + B: URI for where to file *bugs*. A web-page with detailed bug + filing info, a direct bug tracker link, or a mailto: URI. + C: URI for *chat* protocol, server and channel where developers + usually hang out, for example irc://server/channel. + P: Subsystem Profile document for more details submitting + patches to the given subsystem. This is either an in-tree file, + or a URI. See Documentation/maintainer/maintainer-entry-profile.rst + for details. + T: *SCM* tree type and location. + Type is one of: git, hg, quilt, stgit, topgit + F: *Files* and directories wildcard patterns. + A trailing slash includes all files and subdirectory files. + F: drivers/net/ all files in and below drivers/net + F: drivers/net/* all files in drivers/net, but not below + F: */net/* all files in "any top level directory"/net + One pattern per line. Multiple F: lines acceptable. + X: *Excluded* files and directories that are NOT maintained, same + rules as F:. Files exclusions are tested before file matches. + Can be useful for excluding a specific subdirectory, for instance: + F: net/ + X: net/ipv6/ + matches all files in and below net excluding net/ipv6/ + N: Files and directories *Regex* patterns. + N: [^a-z]tegra all files whose path contains tegra + (not including files like integrator) + One pattern per line. Multiple N: lines acceptable. + scripts/get_maintainer.pl has different behavior for files that + match F: pattern and matches of N: patterns. By default, + get_maintainer will not look at git log history when an F: pattern + match occurs. When an N: match occurs, git log history is used + to also notify the people that have git commit signatures. + K: *Content regex* (perl extended) pattern match in a patch or file. + For instance: + K: of_get_profile + matches patches or files that contain "of_get_profile" + K: \b(printk|pr_(info|err))\b + matches patches or files that contain one or more of the words + printk, pr_info or pr_err + One regex pattern per line. Multiple K: lines acceptable. + +Maintainers List +---------------- + +.. note:: When reading this list, please look for the most precise areas + first. When adding to this list, please keep the entries in + alphabetical order. + +SCHEDULER +M: zhengzucheng(a)huawei.com +S: Maintained +F: include/linux/preempt.h +F: include/linux/sched.h +F: include/linux/wait.h +F: include/uapi/linux/sched.h +F: kernel/sched/ + +THE REST +M: xiexiuqi(a)huawei.com +M: zhengzengkai(a)huawei.com +L: kernel(a)openeuler.org +S: Buried alive in reporters +F: * +F: */ -- 2.20.1

1 0

[PATCH openEuler-1.0-LTS] staging: rtl8712: fix use after free bugs
by Yongqiang Liu 29 Nov '22

29 Nov '22

From: Dan Carpenter <dan.carpenter(a)oracle.com> stable inclusion from stable-v5.10.142 commit 19e3f69d19801940abc2ac37c169882769ed9770 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I62AX2 CVE: CVE-2022-4095 -------------------------------- _Read/Write_MACREG callbacks are NULL so the read/write_macreg_hdl() functions don't do anything except free the "pcmd" pointer. It results in a use after free. Delete them. Fixes: 2865d42c78a9 ("staging: r8712u: Add the new driver to the mainline kernel") Cc: stable <stable(a)kernel.org> Reported-by: Zheng Wang <hackerzheng666(a)gmail.com> Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Link: https://lore.kernel.org/r/Yw4ASqkYcUhUfoY2@kili Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Guan Jing <guanjing6(a)huawei.com> Reviewed-by: Zhang Qiao <zhangqiao22(a)huawei.com> Reviewed-by: Chen Hui <judy.chenhui(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/staging/rtl8712/rtl8712_cmd.c | 36 --------------------------- 1 file changed, 36 deletions(-) diff --git a/drivers/staging/rtl8712/rtl8712_cmd.c b/drivers/staging/rtl8712/rtl8712_cmd.c index 63bc811681d9..fb092d4ec521 100644 --- a/drivers/staging/rtl8712/rtl8712_cmd.c +++ b/drivers/staging/rtl8712/rtl8712_cmd.c @@ -129,34 +129,6 @@ static void r871x_internal_cmd_hdl(struct _adapter *padapter, u8 *pbuf) kfree(pdrvcmd->pbuf); } -static u8 read_macreg_hdl(struct _adapter *padapter, u8 *pbuf) -{ - void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd); - struct cmd_obj *pcmd = (struct cmd_obj *)pbuf; - - /* invoke cmd->callback function */ - pcmd_callback = cmd_callback[pcmd->cmdcode].callback; - if (!pcmd_callback) - r8712_free_cmd_obj(pcmd); - else - pcmd_callback(padapter, pcmd); - return H2C_SUCCESS; -} - -static u8 write_macreg_hdl(struct _adapter *padapter, u8 *pbuf) -{ - void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd); - struct cmd_obj *pcmd = (struct cmd_obj *)pbuf; - - /* invoke cmd->callback function */ - pcmd_callback = cmd_callback[pcmd->cmdcode].callback; - if (!pcmd_callback) - r8712_free_cmd_obj(pcmd); - else - pcmd_callback(padapter, pcmd); - return H2C_SUCCESS; -} - static u8 read_bbreg_hdl(struct _adapter *padapter, u8 *pbuf) { struct cmd_obj *pcmd = (struct cmd_obj *)pbuf; @@ -225,14 +197,6 @@ static struct cmd_obj *cmd_hdl_filter(struct _adapter *padapter, pcmd_r = NULL; switch (pcmd->cmdcode) { - case GEN_CMD_CODE(_Read_MACREG): - read_macreg_hdl(padapter, (u8 *)pcmd); - pcmd_r = pcmd; - break; - case GEN_CMD_CODE(_Write_MACREG): - write_macreg_hdl(padapter, (u8 *)pcmd); - pcmd_r = pcmd; - break; case GEN_CMD_CODE(_Read_BBREG): read_bbreg_hdl(padapter, (u8 *)pcmd); break; -- 2.25.1

1 0

openEuler Kernel SIG双周例会
by openEuler conference 28 Nov '22

28 Nov '22

您好！ Kernel SIG 邀请您参加 2022-12-02 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可以回复邮件反馈，或者录入会议看板）会议链接：https://us06web.zoom.us/j/88119872664?pwd=V1V3eFBJeVBPZ25RbExvWGthZXJWUT09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2022-12-02 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可以回复邮件反馈，或者录入会议看板） You can join the meeting at https://us06web.zoom.us/j/88119872664?pwd=V1V3eFBJeVBPZ25RbExvWGthZXJWUT09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

转发: cgroupv1使能cgroup writeback.pptx
by Zhengzengkai 28 Nov '22

28 Nov '22

发件人: Zhengzengkai 发送时间: 2022年11月28日 10:39 收件人: kernel <kernel(a)openeuler.org> 抄送: Xiexiuqi <xiexiuqi(a)huawei.com>; liwei (GF) <liwei391(a)huawei.com> 主题: cgroupv1使能cgroup writeback.pptx

1 0

cgroupv1使能cgroup writeback.pptx
by Zhengzengkai 28 Nov '22

28 Nov '22

1 0

[PATCH openEuler-1.0-LTS] x86/tsc: use topology_max_packages() in tsc watchdog check
by Yongqiang Liu 27 Nov '22

27 Nov '22

From: Feng Tang <feng.tang(a)intel.com> hulk inclusion category: bugfix bugzilla: 187942, https://gitee.com/openeuler/kernel/issues/I5U037 CVE: NA ------------------------------- Commit b50db7095fe0 ("x86/tsc: Disable clocksource watchdog for TSC on qualified platorms") was introduced to solve problem that sometimes TSC clocksource is wrongly judged as unstable by watchdog like 'jiffies', HPET, etc. In it, the hardware socket number is a key factor for judging whether to disable the watchdog for TSC, and 'nr_online_nodes' was chosen as an estimation due to it is needed in early boot phase before registering 'tsc-early' clocksource, where all none-boot CPUs are not brought up yet. In recent patch review, Dave Hansen pointed out there are many cases that 'nr_online_nodes' could have issue, like: * numa emulation (numa=fake=4 etc.) * numa=off * platforms with CPU+DRAM nodes, CPU-less HBM nodes, CPU-less persistent memory nodes. Peter Zijlstra suggested to use logical package ids, but it is only usable after smp_init() and all CPUs are initialized. One solution is to skip the watchdog for 'tsc-early' clocksource, and move the check after smp_init(), while before 'tsc' clocksoure is registered, where topology_max_packages() could be used as a much more accurate socket number. Signed-off-by: Feng Tang <feng.tang(a)intel.com> Conflict: arch/x86/kernel/tsc.c Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> Reviewed-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- arch/x86/kernel/tsc.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c index b1ae78bdba50..a7f447c30089 100644 --- a/arch/x86/kernel/tsc.c +++ b/arch/x86/kernel/tsc.c @@ -1095,8 +1095,7 @@ static struct clocksource clocksource_tsc_early = { .rating = 299, .read = read_tsc, .mask = CLOCKSOURCE_MASK(64), - .flags = CLOCK_SOURCE_IS_CONTINUOUS | - CLOCK_SOURCE_MUST_VERIFY, + .flags = CLOCK_SOURCE_IS_CONTINUOUS, .archdata = { .vclock_mode = VCLOCK_TSC }, .resume = tsc_resume, .mark_unstable = tsc_cs_mark_unstable, @@ -1353,6 +1352,20 @@ static int __init init_tsc_clocksource(void) if (boot_cpu_has(X86_FEATURE_NONSTOP_TSC_S3)) clocksource_tsc.flags |= CLOCK_SOURCE_SUSPEND_NONSTOP; + /* + * Disable the clocksource watchdog when the system has: + * - TSC running at constant frequency + * - TSC which does not stop in C-States + * - the TSC_ADJUST register which allows to detect even minimal + * modifications + * - not more than four sockets. + */ + if (boot_cpu_has(X86_FEATURE_CONSTANT_TSC) && + boot_cpu_has(X86_FEATURE_NONSTOP_TSC) && + boot_cpu_has(X86_FEATURE_TSC_ADJUST) && + topology_max_packages() <= 4) + clocksource_tsc.flags &= ~CLOCK_SOURCE_MUST_VERIFY; + /* * When TSC frequency is known (retrieved via MSR or CPUID), we skip * the refined calibration and directly register it as a clocksource. @@ -1483,9 +1496,6 @@ void __init tsc_init(void) return; } - if (tsc_clocksource_reliable) - clocksource_tsc_early.flags &= ~CLOCK_SOURCE_MUST_VERIFY; - clocksource_register_khz(&clocksource_tsc_early, tsc_khz); detect_art(); } -- 2.25.1

1 0

[PATCH openEuler-5.10-LTS 000/151] Backport 5.10.138 LTS patches
by Zheng Zengkai 26 Nov '22

26 Nov '22

Backport 5.10.138 LTS patches from upstream. git cherry-pick v5.10.137..v5.10.138~1 -s Already merged(-5): 0e28678a770d devlink: Fix use-after-free after a failed reload 38ddccbda5e8 vsock: Fix memory leak in vsock_connect() a0ae122e9aec atm: idt77252: fix use-after-free bugs caused by tst_timer a220ff343396 can: j1939: j1939_session_destroy(): fix memory leak of skbs 3527e3cbb84d bpf: Fix KASAN use-after-free Read in compute_effective_progs Context conflict： 63671b2bdf5f watchdog: export lockup_detector_reconfigure Defered for performance degradation(-1): 823280a8fba3 locking/atomic: Make test_and_*_bit() ordered on failure Total patches: 157 - 5 - 1 = 151 Aaron Lu (1): x86/mm: Use proper mask when setting PUD mapping Al Viro (6): nios2: page fault et.al. are *not* restartable syscalls... nios2: don't leave NULLs in sys_call_table[] nios2: traced syscall does need to check the syscall number nios2: fix syscall restart checks nios2: restarts apply only to the first sigframe we build... nios2: add force_successful_syscall_return() Alan Brady (1): i40e: Fix to stop tx_timeout recovery if GLOBR fails Amadeusz Sławiński (1): ALSA: info: Fix llseek return value when using callback Amelie Delaunay (1): usb: dwc2: gadget: remove D+ pull-up while no vbus with usb-role-switch Andrew Donnellan (1): gcc-plugins: Undefine LATENT_ENTROPY_PLUGIN when plugin disabled for a file Andy Shevchenko (1): pinctrl: intel: Check against matching data instead of ACPI companion Arun Ramadoss (1): net: dsa: microchip: ksz9477: fix fdb_dump last invalid entry Bard Liao (1): ASoC: SOF: intel: move sof_intel_dsp_desc() forward Bob Pearson (1): RDMA/rxe: Limit the number of calls to each tasklet Celeste Liu (1): riscv: mmap with PROT_WRITE but no PROT_READ is invalid Chao Yu (2): f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page() f2fs: fix to do sanity check on segment type in build_sit_entries() Chen Lin (1): dpaa2-eth: trace the allocated address instead of page struct Chia-Lin Kao (AceLan) (1): net: atlantic: fix aq_vec index out of range error Christoffer Sandberg (1): ALSA: hda/realtek: Add quirk for Clevo NS50PU, NS70PU Christophe JAILLET (6): mmc: pxamci: Fix another error handling path in pxamci_probe() mmc: pxamci: Fix an error handling path in pxamci_probe() mmc: meson-gx: Fix an error handling path in meson_mmc_probe() perf probe: Fix an error handling path in 'parse_perf_probe_command()' stmmac: intel: Add a missing clk_disable_unprepare() call in intel_eth_pci_remove() cxl: Fix a memory leak in an error handling path Christophe Leroy (1): powerpc/32: Don't always pass -mcpu=powerpc to the compiler Csókás Bence (1): fec: Fix timer capture timing in `fec_ptp_enable_pps()` Damien Le Moal (1): ata: libata-eh: Add missing command name Dan Aloni (1): sunrpc: fix expiry of auth creds Dan Carpenter (3): NTB: ntb_tool: uninitialized heap data in tool_fn_write() xen/xenbus: fix return type in xenbus_file_read() netfilter: nftables: fix a warning message in nf_tables_commit_audit_collect() Dmitry Baryshkov (1): dt-bindings: clock: qcom,gcc-msm8996: add more GCC clock sources Dongliang Mu (1): netfilter: nf_tables: fix audit memory leak in nf_tables_commit Fedor Pchelkin (1): can: j1939: j1939_sk_queue_activate_next_locked(): replace WARN_ON_ONCE with netdev_warn_once() Filipe Manana (1): btrfs: fix lost error handling when looking up extended ref on log replay Florian Westphal (1): plip: avoid rcu debug splat Frank Li (1): usb: cdns3 fix use-after-free at workaround 2 Frieder Schrempf (1): regulator: pca9450: Remove restrictions for regulator-name Grzegorz Siwik (1): ice: Ignore EEXIST when setting promisc mode Guenter Roeck (1): lib/list_debug.c: Detect uninitialized lists Helge Deller (1): modules: Ensure natural alignment for .altinstructions and __bug_table sections Hou Tao (5): bpf: Acquire map uref in .init_seq_private for array map iterator bpf: Acquire map uref in .init_seq_private for hash map iterator bpf: Acquire map uref in .init_seq_private for sock local storage map iterator bpf: Acquire map uref in .init_seq_private for sock{map,hash} iterator bpf: Check the validity of max_rdwr_access for sock local storage map iterator Huacai Chen (1): PCI/ACPI: Guard ARM64-specific mcfg_quirks Jakub Kicinski (1): net: genl: fix error path memory leak in policy dumping James Smart (1): scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input Jason A. Donenfeld (1): um: add "noreboot" command line option for PANIC_TIMEOUT=-1 setups Jean-Philippe Brucker (1): uacce: Handle parent device removal or parent driver module rmmod Jeff Layton (1): ceph: don't leak snap_rwsem in handle_cap_grant Jens Wiklander (1): tee: fix memory leak in tee_shm_register() Jianhua Lu (1): pinctrl: qcom: sm8250: Fix PDC map John Johansen (5): apparmor: fix quiet_denied for file rules apparmor: fix absroot causing audited secids to begin with = apparmor: Fix failed mount permission check error message apparmor: fix setting unconfined mode on a loaded profile apparmor: fix overlapping attachment computation Jozef Martiniak (1): gadgetfs: ep_io - wait until IRQ finishes Keith Busch (1): PCI/ERR: Retain status from error notification Kiselev, Oleg (1): ext4: avoid resizing to a partial cluster size Krzysztof Kozlowski (1): dt-bindings: arm: qcom: fix MSM8916 MTP compatibles Laurent Dufour (1): watchdog: export lockup_detector_reconfigure Liang He (5): drm/meson: Fix refcount bugs in meson_vpu_has_available_connectors() usb: host: ohci-ppc-of: Fix refcount leak bug usb: renesas: Fix refcount leak bug tty: serial: Fix refcount leak bug in ucc_uart.c mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start Liao Chang (1): csky/kprobe: reclaim insn_slot on kprobe unregistration Lin Ma (1): igb: Add lock to avoid data race Logan Gunthorpe (1): md: Notify sysfs sync_completed in md_reap_sync_thread() Luís Henriques (1): ceph: use correct index when encoding client supported features Marc Kleine-Budde (1): can: ems_usb: fix clang's -Wunaligned-access warning Martin Povišer (4): ASoC: tas2770: Set correct FSYNC polarity ASoC: tas2770: Allow mono streams ASoC: tas2770: Drop conflicting set_bias_level power setting ASoC: tas2770: Fix handling of mute/unmute Masahiro Yamada (1): kbuild: fix the modules order between drivers and libs Matthew Wilcox (Oracle) (1): qrtr: Convert qrtr_ports from IDR to XArray Matthias May (3): geneve: do not use RT_TOS for IPv6 flowlabel ipv6: do not use RT_TOS for IPv6 flowlabel geneve: fix TOS inheriting for ipv4 Miaoqian Lin (1): pinctrl: nomadik: Fix refcount leak in nmk_pinctrl_dt_subnode_to_map Michael Ellerman (1): powerpc/pci: Fix get_phb_number() locking Michael Grzeschik (1): usb: gadget: uvc: call uvc uvcg_warn on completed status instead of uvcg_info Mikulas Patocka (1): rds: add missing barrier to release_refill Nathan Chancellor (1): MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0 Neil Armstrong (1): spi: meson-spicc: add local pow2 clock ops to preserve rate between messages Nikita Travkin (1): pinctrl: qcom: msm8916: Allow CAMSS GP clocks to be muxed Ondrej Mosnacek (1): kbuild: dummy-tools: avoid tmpdir leak in dummy gcc Pablo Neira Ayuso (5): netfilter: nf_tables: really skip inactive sets when allocating name netfilter: nf_tables: validate NFTA_SET_ELEM_OBJREF based on NFT_SET_OBJECT flag netfilter: nf_tables: check NFT_SET_CONCAT flag if field_count is specified netfilter: nftables: add helper function to set the base sequence number netfilter: add helper function to set up the nfnetlink header and use it Pascal Terjan (1): vboxguest: Do not use devm for irq Pavan Chebbi (1): PCI: Add ACS quirk for Broadcom BCM5750x NICs Peilin Ye (1): vsock: Set socket state back to SS_UNCONNECTED in vsock_connect_timeout() Przemyslaw Patynowski (1): iavf: Fix adminq error handling Qifu Zhang (1): Documentation: ACPI: EINJ: Fix obsolete example Richard Guy Briggs (1): audit: log nftables configuration change events once per table Robert Marko (1): clk: qcom: ipq8074: dont disable gcc_sleep_clk_src Roberto Sassu (1): tools build: Switch to new openssl API for test-libcrypto Rustam Subkhankulov (1): net: dsa: sja1105: fix buffer overflow in sja1105_setup_devlink_regions() Sagi Grimberg (1): nvmet-tcp: fix lockdep complaint on nvmet_tcp_wq flush during queue teardown Sai Prakash Ranjan (2): irqchip/tegra: Fix overflow implicit truncation warnings drm/meson: Fix overflow implicit truncation warnings Sakari Ailus (1): ACPI: property: Return type of acpi_add_nondev_subnodes() should be bool Samuel Holland (2): pinctrl: sunxi: Add I/O bias setting for H6 R-PIO drm/sun4i: dsi: Prevent underflow when computing packet sizes Sandor Bodo-Merle (1): net: bgmac: Fix a BUG triggered by wrong bytes_compl Schspa Shi (1): vfio: Clear the caps->buf to NULL after free Sebastian Würl (1): can: mcp251x: Fix race condition on receive interrupt Sergei Antonov (2): net: dsa: mv88e6060: prevent crash on an unused port net: moxa: pass pdev instead of ndev to DMA functions Sergey Senozhatsky (1): zram: do not lookup algorithm in backends table Steve French (1): smb3: check xattr value length earlier Steven Rostedt (Google) (3): tracing: Have filter accept "common_cpu" to be consistent selftests/kprobe: Do not test for GRP/ without event failures tracing/probes: Have kprobes and uprobes use $COMM too Takashi Iwai (4): ALSA: usb-audio: More comprehensive mixer map for ASUS ROG Zenith II ALSA: core: Add async signal helpers ALSA: timer: Use deferred fasync helper ALSA: control: Use deferred fasync helper Tom Rix (1): apparmor: fix aa_label_asxprint return check Tony Lindgren (1): clk: ti: Stop using legacy clkctrl names for omap4 and 5 Trond Myklebust (5): NFSv4.1: Don't decrease the value of seq_nr_highest_sent NFSv4.1: Handle NFS4ERR_DELAY replies to OP_SEQUENCE correctly NFSv4: Fix races in the legacy idmapper upcall NFSv4/pnfs: Fix a use-after-free bug in open SUNRPC: Reinitialise the backchannel request buffers before reuse Tzung-Bi Shih (1): platform/chrome: cros_ec_proto: don't show MKBP version if unsupported Uwe Kleine-König (2): i2c: imx: Make sure to unregister adapter on remove() dmaengine: sprd: Cleanup in .remove() after pm_runtime_get_sync() failed Vladimir Oltean (1): net: dsa: felix: fix ethtool 256-511 and 512-1023 TX packet counters Vladimir Zapolskiy (1): clk: qcom: clk-alpha-pll: fix clk_trion_pll_configure description Wentao_Liang (1): drivers:md:fix a potential use-after-free bug Xianting Tian (1): RISC-V: Add fast call path of crash_kexec() Xin Xiong (1): apparmor: fix reference count leak in aa_pivotroot() Xiu Jianfeng (1): apparmor: Fix memleak in aa_simple_write_to_buffer() Xuan Zhuo (1): virtio_net: fix memory leak inside XPD_TX with mergeable Ye Bin (1): ext4: avoid remove directory when directory is corrupted Yu Xiao (1): nfp: ethtool: fix the display error of `ethtool -m DEVNAME` Yuanzheng Song (1): tools/vm/slabinfo: use alphabetic order when two values are equal Zhang Xianwei (1): NFSv4.1: RECLAIM_COMPLETE must handle EACCES Zheyu Ma (1): video: fbdev: i740fb: Check the argument of i740_calc_vclk() Zhouyi Zhou (1): powerpc/64: Init jump labels before parse_early_param() .../devicetree/bindings/arm/qcom.yaml | 2 +- .../bindings/clock/qcom,gcc-msm8996.yaml | 16 + .../regulator/nxp,pca9450-regulator.yaml | 11 - .../firmware-guide/acpi/apei/einj.rst | 2 +- Makefile | 6 +- arch/csky/kernel/probes/kprobes.c | 4 + arch/mips/cavium-octeon/octeon-platform.c | 3 +- arch/mips/mm/tlbex.c | 4 +- arch/nios2/include/asm/entry.h | 3 +- arch/nios2/include/asm/ptrace.h | 2 + arch/nios2/kernel/entry.S | 22 +- arch/nios2/kernel/signal.c | 3 +- arch/nios2/kernel/syscall_table.c | 1 + arch/powerpc/Makefile | 26 +- arch/powerpc/kernel/pci-common.c | 16 +- arch/powerpc/kernel/prom.c | 7 + arch/powerpc/platforms/Kconfig.cputype | 21 +- arch/riscv/kernel/sys_riscv.c | 5 +- arch/riscv/kernel/traps.c | 4 + arch/um/os-Linux/skas/process.c | 17 +- arch/x86/mm/init_64.c | 2 +- drivers/acpi/pci_mcfg.c | 3 + drivers/acpi/property.c | 8 +- drivers/ata/libata-eh.c | 1 + drivers/block/zram/zcomp.c | 11 +- drivers/clk/qcom/clk-alpha-pll.c | 2 +- drivers/clk/qcom/gcc-ipq8074.c | 1 + drivers/clk/ti/clk-44xx.c | 210 +++++------ drivers/clk/ti/clk-54xx.c | 160 ++++----- drivers/clk/ti/clkctrl.c | 4 - drivers/dma/sprd-dma.c | 5 +- drivers/gpu/drm/meson/meson_drv.c | 5 +- drivers/gpu/drm/meson/meson_viu.c | 22 +- drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c | 10 +- drivers/i2c/busses/i2c-imx.c | 20 +- drivers/infiniband/sw/rxe/rxe_param.h | 6 + drivers/infiniband/sw/rxe/rxe_task.c | 16 +- drivers/irqchip/irq-tegra.c | 10 +- drivers/md/md.c | 1 + drivers/md/raid5.c | 2 +- drivers/misc/cxl/irq.c | 1 + drivers/misc/uacce/uacce.c | 133 ++++--- drivers/mmc/host/meson-gx-mmc.c | 6 +- drivers/mmc/host/pxamci.c | 4 +- drivers/net/can/spi/mcp251x.c | 18 +- drivers/net/can/usb/ems_usb.c | 2 +- drivers/net/dsa/microchip/ksz9477.c | 3 + drivers/net/dsa/mv88e6060.c | 3 + drivers/net/dsa/ocelot/felix_vsc9959.c | 3 +- drivers/net/dsa/sja1105/sja1105_devlink.c | 2 +- .../net/ethernet/aquantia/atlantic/aq_nic.c | 21 +- drivers/net/ethernet/broadcom/bgmac.c | 2 +- .../net/ethernet/freescale/dpaa2/dpaa2-eth.c | 4 +- drivers/net/ethernet/freescale/fec_ptp.c | 6 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 4 +- drivers/net/ethernet/intel/iavf/iavf_adminq.c | 15 +- drivers/net/ethernet/intel/ice/ice_switch.c | 2 +- drivers/net/ethernet/intel/igb/igb.h | 2 + drivers/net/ethernet/intel/igb/igb_main.c | 12 +- drivers/net/ethernet/moxa/moxart_ether.c | 20 +- .../ethernet/netronome/nfp/nfp_net_ethtool.c | 2 + .../net/ethernet/stmicro/stmmac/dwmac-intel.c | 1 + drivers/net/geneve.c | 15 +- drivers/net/plip/plip.c | 2 +- drivers/net/virtio_net.c | 5 +- drivers/ntb/test/ntb_tool.c | 8 +- drivers/nvme/target/tcp.c | 3 +- drivers/pci/pcie/err.c | 3 +- drivers/pci/quirks.c | 3 + drivers/pinctrl/intel/pinctrl-intel.c | 14 +- drivers/pinctrl/nomadik/pinctrl-nomadik.c | 4 +- drivers/pinctrl/qcom/pinctrl-msm8916.c | 4 +- drivers/pinctrl/qcom/pinctrl-sm8250.c | 2 +- drivers/pinctrl/sunxi/pinctrl-sun50i-h6-r.c | 1 + drivers/pinctrl/sunxi/pinctrl-sunxi.c | 7 +- drivers/platform/chrome/cros_ec_proto.c | 8 +- drivers/scsi/lpfc/lpfc_debugfs.c | 20 +- drivers/spi/spi-meson-spicc.c | 129 +++++-- drivers/tee/tee_core.c | 3 + drivers/tee/tee_shm.c | 3 - drivers/tty/serial/ucc_uart.c | 2 + drivers/usb/cdns3/gadget.c | 2 +- drivers/usb/dwc2/gadget.c | 3 +- drivers/usb/gadget/function/uvc_video.c | 2 +- drivers/usb/gadget/legacy/inode.c | 1 + drivers/usb/host/ohci-ppc-of.c | 1 + drivers/usb/renesas_usbhs/rza.c | 4 + drivers/vfio/vfio.c | 1 + drivers/video/fbdev/i740fb.c | 9 +- drivers/virt/vboxguest/vboxguest_linux.c | 9 +- drivers/xen/xenbus/xenbus_dev_frontend.c | 4 +- fs/btrfs/tree-log.c | 4 +- fs/ceph/caps.c | 27 +- fs/ceph/mds_client.c | 7 +- fs/ceph/mds_client.h | 6 - fs/cifs/smb2ops.c | 5 +- fs/ext4/namei.c | 7 +- fs/ext4/resize.c | 10 + fs/f2fs/node.c | 6 +- fs/f2fs/segment.c | 13 + fs/nfs/nfs4idmap.c | 46 +-- fs/nfs/nfs4proc.c | 20 +- include/linux/netfilter/nfnetlink.h | 27 ++ include/linux/nmi.h | 2 + include/linux/uacce.h | 6 +- include/sound/control.h | 2 +- include/sound/core.h | 8 + kernel/bpf/arraymap.c | 6 + kernel/bpf/hashtab.c | 2 + kernel/trace/trace_events.c | 1 + kernel/trace/trace_probe.c | 5 +- kernel/watchdog.c | 21 +- lib/list_debug.c | 12 +- net/can/j1939/socket.c | 5 +- net/core/bpf_sk_storage.c | 12 +- net/core/sock_map.c | 20 +- net/ipv6/ip6_output.c | 3 +- net/netfilter/ipset/ip_set_core.c | 17 +- net/netfilter/nf_conntrack_netlink.c | 77 ++--- net/netfilter/nf_tables_api.c | 325 +++++++++--------- net/netfilter/nf_tables_trace.c | 9 +- net/netfilter/nfnetlink_acct.c | 11 +- net/netfilter/nfnetlink_cthelper.c | 11 +- net/netfilter/nfnetlink_cttimeout.c | 22 +- net/netfilter/nfnetlink_log.c | 11 +- net/netfilter/nfnetlink_queue.c | 12 +- net/netfilter/nft_compat.c | 11 +- net/netlink/genetlink.c | 6 +- net/netlink/policy.c | 14 +- net/qrtr/qrtr.c | 42 +-- net/rds/ib_recv.c | 1 + net/sunrpc/auth.c | 2 +- net/sunrpc/backchannel_rqst.c | 14 + net/vmw_vsock/af_vsock.c | 1 + scripts/Makefile.gcc-plugins | 2 +- scripts/dummy-tools/gcc | 8 +- scripts/module.lds.S | 2 + security/apparmor/apparmorfs.c | 2 +- security/apparmor/audit.c | 2 +- security/apparmor/domain.c | 2 +- security/apparmor/include/lib.h | 5 + security/apparmor/include/policy.h | 2 +- security/apparmor/label.c | 13 +- security/apparmor/mount.c | 8 +- security/apparmor/policy_unpack.c | 12 +- sound/core/control.c | 7 +- sound/core/info.c | 6 +- sound/core/misc.c | 94 +++++ sound/core/timer.c | 11 +- sound/pci/hda/patch_realtek.c | 1 + sound/soc/codecs/tas2770.c | 98 +++--- sound/soc/codecs/tas2770.h | 5 + sound/soc/sof/intel/hda.c | 22 +- sound/usb/card.c | 8 + sound/usb/mixer_maps.c | 34 +- tools/build/feature/test-libcrypto.c | 15 +- tools/perf/util/probe-event.c | 6 +- .../test.d/kprobe/kprobe_syntax_errors.tc | 1 - tools/vm/slabinfo.c | 32 +- 159 files changed, 1459 insertions(+), 1020 deletions(-) -- 2.20.1

1 151

[PATCH openEuler-1.0-LTS 1/2] ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0
by Yongqiang Liu 26 Nov '22

26 Nov '22

From: Luís Henriques <lhenriques(a)suse.de> mainline inclusion from mainline-v6.0-rc7 commit 29a5b8a137ac8eb410cc823653a29ac0e7b7e1b0 category: bugfix bugzilla: 187444, https://gitee.com/openeuler/kernel/issues/I6261Z CVE: NA -------------------------------- When walking through an inode extents, the ext4_ext_binsearch_idx() function assumes that the extent header has been previously validated. However, there are no checks that verify that the number of entries (eh->eh_entries) is non-zero when depth is > 0. And this will lead to problems because the EXT_FIRST_INDEX() and EXT_LAST_INDEX() will return garbage and result in this: [ 135.245946] ------------[ cut here ]------------ [ 135.247579] kernel BUG at fs/ext4/extents.c:2258! [ 135.249045] invalid opcode: 0000 [#1] PREEMPT SMP [ 135.250320] CPU: 2 PID: 238 Comm: tmp118 Not tainted 5.19.0-rc8+ #4 [ 135.252067] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b-rebuilt.opensuse.org 04/01/2014 [ 135.255065] RIP: 0010:ext4_ext_map_blocks+0xc20/0xcb0 [ 135.256475] Code: [ 135.261433] RSP: 0018:ffffc900005939f8 EFLAGS: 00010246 [ 135.262847] RAX: 0000000000000024 RBX: ffffc90000593b70 RCX: 0000000000000023 [ 135.264765] RDX: ffff8880038e5f10 RSI: 0000000000000003 RDI: ffff8880046e922c [ 135.266670] RBP: ffff8880046e9348 R08: 0000000000000001 R09: ffff888002ca580c [ 135.268576] R10: 0000000000002602 R11: 0000000000000000 R12: 0000000000000024 [ 135.270477] R13: 0000000000000000 R14: 0000000000000024 R15: 0000000000000000 [ 135.272394] FS: 00007fdabdc56740(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000 [ 135.274510] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 135.276075] CR2: 00007ffc26bd4f00 CR3: 0000000006261004 CR4: 0000000000170ea0 [ 135.277952] Call Trace: [ 135.278635] <TASK> [ 135.279247] ? preempt_count_add+0x6d/0xa0 [ 135.280358] ? percpu_counter_add_batch+0x55/0xb0 [ 135.281612] ? _raw_read_unlock+0x18/0x30 [ 135.282704] ext4_map_blocks+0x294/0x5a0 [ 135.283745] ? xa_load+0x6f/0xa0 [ 135.284562] ext4_mpage_readpages+0x3d6/0x770 [ 135.285646] read_pages+0x67/0x1d0 [ 135.286492] ? folio_add_lru+0x51/0x80 [ 135.287441] page_cache_ra_unbounded+0x124/0x170 [ 135.288510] filemap_get_pages+0x23d/0x5a0 [ 135.289457] ? path_openat+0xa72/0xdd0 [ 135.290332] filemap_read+0xbf/0x300 [ 135.291158] ? _raw_spin_lock_irqsave+0x17/0x40 [ 135.292192] new_sync_read+0x103/0x170 [ 135.293014] vfs_read+0x15d/0x180 [ 135.293745] ksys_read+0xa1/0xe0 [ 135.294461] do_syscall_64+0x3c/0x80 [ 135.295284] entry_SYSCALL_64_after_hwframe+0x46/0xb0 This patch simply adds an extra check in __ext4_ext_check(), verifying that eh_entries is not 0 when eh_depth is > 0. Link: https://bugzilla.kernel.org/show_bug.cgi?id=215941 Link: https://bugzilla.kernel.org/show_bug.cgi?id=216283 Cc: Baokun Li <libaokun1(a)huawei.com> Cc: stable(a)kernel.org Signed-off-by: Luís Henriques <lhenriques(a)suse.de> Reviewed-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Baokun Li <libaokun1(a)huawei.com> Link: https://lore.kernel.org/r/20220822094235.2690-1-lhenriques@suse.de Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/ext4/extents.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index 578769f10906..6edab0ef28fd 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -508,6 +508,10 @@ static int __ext4_ext_check(const char *function, unsigned int line, error_msg = "invalid eh_entries"; goto corrupted; } + if (unlikely((eh->eh_entries == 0) && (depth > 0))) { + error_msg = "eh_entries is 0 but eh_depth is > 0"; + goto corrupted; + } if (!ext4_valid_extent_entries(inode, eh, lblk, &pblk, depth)) { error_msg = "invalid extent entries"; goto corrupted; -- 2.25.1

1 1

[PATCH openEuler-5.10-LTS 1/2] Bluetooth: L2CAP: Fix attempting to access uninitialized memory
by Zheng Zengkai 23 Nov '22

23 Nov '22

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v5.10.154 commit 26ca2ac091b49281d73df86111d16e5a76e43bd7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5ZNRS CVE: CVE-2022-42895 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b1a2cd50c0357f243b7435a732b4e62ba3157a2e upstream. On l2cap_parse_conf_req the variable efs is only initialized if remote_efs has been set. CVE: CVE-2022-42895 CC: stable(a)vger.kernel.org Reported-by: Tamás Koczka <poprdi(a)google.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Reviewed-by: Tedd Ho-Jeong An <tedd.an(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Baisong Zhong <zhongbaisong(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> --- net/bluetooth/l2cap_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 584a9deb8c80..d35b168e7793 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -3758,7 +3758,8 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), (unsigned long) &rfc, endptr - ptr); - if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) { + if (remote_efs && + test_bit(FLAG_EFS_ENABLE, &chan->flags)) { chan->remote_id = efs.id; chan->remote_stype = efs.stype; chan->remote_msdu = le16_to_cpu(efs.msdu); -- 2.20.1

1 1

[PATCH OLK-5.10 v4] mm: Fix kabi change caused by saved_auxv[] in mm_struct for x86_64
by Zheng Zengkai 23 Nov '22

23 Nov '22

openeuler inclusion category: bugfix bugzilla: https://gitee.com/openeuler/intel-kernel/issues/I5RQLJ CVE: NA Intel-SIG: mm: Fix kabi change caused by saved_auxv[] in mm_struct for x86_64. -------------------------------- Use the KABI_DEPRECATE and KABI_USE macro to fix kabi change caused by commit 1c33bb050750 ("x86/elf: Support a new ELF aux vector AT_MINSIGSTKSZ"). The extended saved_auxv[] causes the kabi breakage, move the saved_auxv[] to the end of struct mm_struct. To avoid introducing too many size increase of mm_struct, use a pointer to indirectly reference the relocated saved_auxv[], then adapt the code where mm->saved_auxv is used. Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Signed-off-by: Lin Wang <lin.x.wang(a)intel.com> Signed-off-by: Aichun Shi <aichun.shi(a)intel.com> --- arch/x86/include/uapi/asm/auxvec.h | 2 ++ fs/binfmt_elf.c | 12 ++++---- fs/binfmt_elf_fdpic.c | 2 +- fs/proc/base.c | 6 ++-- include/linux/mm_types.h | 30 ++++++++++++++++++++ kernel/fork.c | 44 ++++++++++++++++++++++++++---- kernel/sys.c | 10 +++---- 7 files changed, 86 insertions(+), 20 deletions(-) diff --git a/arch/x86/include/uapi/asm/auxvec.h b/arch/x86/include/uapi/asm/auxvec.h index 6beb55bbefa4..6be5f6584119 100644 --- a/arch/x86/include/uapi/asm/auxvec.h +++ b/arch/x86/include/uapi/asm/auxvec.h @@ -13,8 +13,10 @@ /* entries in ARCH_DLINFO: */ #if defined(CONFIG_IA32_EMULATION) || !defined(CONFIG_X86_64) # define AT_VECTOR_SIZE_ARCH 3 +# define ORIG_AT_VECTOR_SIZE_ARCH 2 #else /* else it's non-compat x86-64 */ # define AT_VECTOR_SIZE_ARCH 2 +# define ORIG_AT_VECTOR_SIZE_ARCH 1 #endif #endif /* _ASM_X86_AUXVEC_H */ diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c index ed507d27034b..8e56bb649f0e 100644 --- a/fs/binfmt_elf.c +++ b/fs/binfmt_elf.c @@ -236,7 +236,7 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec, return -EFAULT; /* Create the ELF interpreter info */ - elf_info = (elf_addr_t *)mm->saved_auxv; + elf_info = (elf_addr_t *)MM_SAVED_AUXV(mm); /* update AT_VECTOR_SIZE_BASE if the number of NEW_AUX_ENT() changes */ #define NEW_AUX_ENT(id, val) \ do { \ @@ -285,13 +285,13 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec, } #undef NEW_AUX_ENT /* AT_NULL is zero; clear the rest too */ - memset(elf_info, 0, (char *)mm->saved_auxv + - sizeof(mm->saved_auxv) - (char *)elf_info); + memset(elf_info, 0, (char *)MM_SAVED_AUXV(mm) + + sizeof(MM_SAVED_AUXV(mm)) - (char *)elf_info); /* And advance past the AT_NULL entry. */ elf_info += 2; - ei_index = elf_info - (elf_addr_t *)mm->saved_auxv; + ei_index = elf_info - (elf_addr_t *)MM_SAVED_AUXV(mm); sp = STACK_ADD(p, ei_index); items = (argc + 1) + (envc + 1) + 1; @@ -352,7 +352,7 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec, mm->env_end = p; /* Put the elf_info on the stack in the right place. */ - if (copy_to_user(sp, mm->saved_auxv, ei_index * sizeof(elf_addr_t))) + if (copy_to_user(sp, MM_SAVED_AUXV(mm), ei_index * sizeof(elf_addr_t))) return -EFAULT; return 0; } @@ -1586,7 +1586,7 @@ static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p, static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm) { - elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv; + elf_addr_t *auxv = (elf_addr_t *) MM_SAVED_AUXV(mm); int i = 0; do i += 2; diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c index be4062b8ba75..06d45339676f 100644 --- a/fs/binfmt_elf_fdpic.c +++ b/fs/binfmt_elf_fdpic.c @@ -1550,7 +1550,7 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm) fill_note(&psinfo_note, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo); thread_status_size += notesize(&psinfo_note); - auxv = (elf_addr_t *) current->mm->saved_auxv; + auxv = (elf_addr_t *) current->MM_SAVED_AUXV(mm); i = 0; do i += 2; diff --git a/fs/proc/base.c b/fs/proc/base.c index cc1fdff2e136..fe2633176ed5 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -1038,9 +1038,9 @@ static ssize_t auxv_read(struct file *file, char __user *buf, return 0; do { nwords += 2; - } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */ - return simple_read_from_buffer(buf, count, ppos, mm->saved_auxv, - nwords * sizeof(mm->saved_auxv[0])); + } while (MM_SAVED_AUXV(mm)[nwords - 2] != 0); /* AT_NULL */ + return simple_read_from_buffer(buf, count, ppos, MM_SAVED_AUXV(mm), + nwords * sizeof(MM_SAVED_AUXV(mm)[0])); } static const struct file_operations proc_auxv_operations = { diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h index 15ff1e20f5ca..ba69c5ecd4ce 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -24,6 +24,21 @@ #endif #define AT_VECTOR_SIZE (2*(AT_VECTOR_SIZE_ARCH + AT_VECTOR_SIZE_BASE + 1)) +#define _MM_STRUCT_SIZE (sizeof(struct mm_struct) + cpumask_size()) + +#if defined(CONFIG_X86_64) + #define ORIG_AT_VECTOR_SIZE (2*(ORIG_AT_VECTOR_SIZE_ARCH + AT_VECTOR_SIZE_BASE + 1)) + #define MM_SAVED_AUXV(mm) mm->mm_extend->saved_auxv + #define MM_STRUCT_SIZE (_MM_STRUCT_SIZE + sizeof(struct mm_struct_extend)) + #define OFFSET_OF_MM_SAVED_AUXV (_MM_STRUCT_SIZE + offsetof(struct mm_struct_extend, saved_auxv)) + #define SIZE_OF_MM_SAVED_AUXV sizeof_field(struct mm_struct_extend, saved_auxv) +#else + #define MM_SAVED_AUXV(mm) mm->saved_auxv + #define MM_STRUCT_SIZE _MM_STRUCT_SIZE + #define OFFSET_OF_MM_SAVED_AUXV offsetof(struct mm_struct, saved_auxv) + #define SIZE_OF_MM_SAVED_AUXV sizeof_field(struct mm_struct, saved_auxv) +#endif + #define INIT_PASID 0 struct address_space; @@ -394,6 +409,13 @@ struct core_state { }; struct kioctx_table; + +#if defined(CONFIG_X86_64) +struct mm_struct_extend { + unsigned long saved_auxv[AT_VECTOR_SIZE]; /* for /proc/PID/auxv */ +}; +#endif + struct mm_struct { struct { struct vm_area_struct *mmap; /* list of VMAs */ @@ -508,7 +530,11 @@ struct mm_struct { unsigned long start_brk, brk, start_stack; unsigned long arg_start, arg_end, env_start, env_end; +#if defined(CONFIG_X86_64) + KABI_DEPRECATE(unsigned long, saved_auxv[ORIG_AT_VECTOR_SIZE]) +#else unsigned long saved_auxv[AT_VECTOR_SIZE]; /* for /proc/PID/auxv */ +#endif /* * Special counters, in some configurations protected by the @@ -592,7 +618,11 @@ struct mm_struct { #endif } __randomize_layout; +#if defined(CONFIG_X86_64) + KABI_USE(1, struct mm_struct_extend *mm_extend) +#else KABI_RESERVE(1) +#endif KABI_RESERVE(2) KABI_RESERVE(3) KABI_RESERVE(4) diff --git a/kernel/fork.c b/kernel/fork.c index 8a40bfda35e1..c2f13f635135 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1088,6 +1088,21 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p, return NULL; } +static inline void mm_struct_clear(struct mm_struct *mm) +{ + memset(mm, 0, sizeof(*mm)); + +#if (defined(CONFIG_X86_64)) + /* + * init the mm_struct_extend extra area at the bottom of + * the allocated mm struct and reset mm->mm_extend accordingly. + */ + memset((void *)((unsigned long) mm + _MM_STRUCT_SIZE), + 0, sizeof(struct mm_struct_extend)); + mm->mm_extend = (struct mm_struct_extend *)((unsigned long) mm + _MM_STRUCT_SIZE); +#endif +} + /* * Allocate and initialize an mm_struct. */ @@ -1099,7 +1114,8 @@ struct mm_struct *mm_alloc(void) if (!mm) return NULL; - memset(mm, 0, sizeof(*mm)); + mm_struct_clear(mm); + return mm_init(mm, current, current_user_ns()); } @@ -1382,6 +1398,24 @@ void exec_mm_release(struct task_struct *tsk, struct mm_struct *mm) mm_release(tsk, mm); } +static inline void mm_struct_copy(struct mm_struct *mm, struct mm_struct *oldmm) +{ + memcpy(mm, oldmm, sizeof(*mm)); + +#if defined(CONFIG_X86_64) + /* + * copy the mm_struct_extend extra area at the bottom of + * the oldmm slab object over to the newly allocated mm struct, + * and reset mm->mm_extend accordingly. + */ + memcpy((void *)((unsigned long) mm + _MM_STRUCT_SIZE), + (void *)((unsigned long) oldmm + _MM_STRUCT_SIZE), + sizeof(struct mm_struct_extend)); + + mm->mm_extend = (struct mm_struct_extend *)((unsigned long) mm + _MM_STRUCT_SIZE); +#endif +} + /** * dup_mm() - duplicates an existing mm structure * @tsk: the task_struct with which the new mm will be associated. @@ -1402,7 +1436,7 @@ static struct mm_struct *dup_mm(struct task_struct *tsk, if (!mm) goto fail_nomem; - memcpy(mm, oldmm, sizeof(*mm)); + mm_struct_copy(mm, oldmm); if (!mm_init(mm, tsk, mm->user_ns)) goto fail_nomem; @@ -2872,13 +2906,13 @@ void __init proc_caches_init(void) * dynamically sized based on the maximum CPU number this system * can have, taking hotplug into account (nr_cpu_ids). */ - mm_size = sizeof(struct mm_struct) + cpumask_size(); + mm_size = MM_STRUCT_SIZE; mm_cachep = kmem_cache_create_usercopy("mm_struct", mm_size, ARCH_MIN_MMSTRUCT_ALIGN, SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT, - offsetof(struct mm_struct, saved_auxv), - sizeof_field(struct mm_struct, saved_auxv), + OFFSET_OF_MM_SAVED_AUXV, + SIZE_OF_MM_SAVED_AUXV, NULL); vm_area_cachep = KMEM_CACHE(vm_area_struct, SLAB_PANIC|SLAB_ACCOUNT); mmap_init(); diff --git a/kernel/sys.c b/kernel/sys.c index c8a31e1037be..10c5a6d2acdc 100644 --- a/kernel/sys.c +++ b/kernel/sys.c @@ -1962,7 +1962,7 @@ static int prctl_set_mm_map(int opt, const void __user *addr, unsigned long data struct mm_struct *mm = current->mm; int error; - BUILD_BUG_ON(sizeof(user_auxv) != sizeof(mm->saved_auxv)); + BUILD_BUG_ON(sizeof(user_auxv) != sizeof(MM_SAVED_AUXV(mm))); BUILD_BUG_ON(sizeof(struct prctl_mm_map) > 256); if (opt == PR_SET_MM_MAP_SIZE) @@ -1984,7 +1984,7 @@ static int prctl_set_mm_map(int opt, const void __user *addr, unsigned long data * Someone is trying to cheat the auxv vector. */ if (!prctl_map.auxv || - prctl_map.auxv_size > sizeof(mm->saved_auxv)) + prctl_map.auxv_size > sizeof(MM_SAVED_AUXV(mm))) return -EINVAL; memset(user_auxv, 0, sizeof(user_auxv)); @@ -2056,7 +2056,7 @@ static int prctl_set_mm_map(int opt, const void __user *addr, unsigned long data * more complex. */ if (prctl_map.auxv_size) - memcpy(mm->saved_auxv, user_auxv, sizeof(user_auxv)); + memcpy(MM_SAVED_AUXV(mm), user_auxv, sizeof(user_auxv)); mmap_read_unlock(mm); return 0; @@ -2084,10 +2084,10 @@ static int prctl_set_auxv(struct mm_struct *mm, unsigned long addr, user_auxv[AT_VECTOR_SIZE - 2] = 0; user_auxv[AT_VECTOR_SIZE - 1] = 0; - BUILD_BUG_ON(sizeof(user_auxv) != sizeof(mm->saved_auxv)); + BUILD_BUG_ON(sizeof(user_auxv) != sizeof(MM_SAVED_AUXV(mm))); task_lock(current); - memcpy(mm->saved_auxv, user_auxv, len); + memcpy(MM_SAVED_AUXV(mm), user_auxv, len); task_unlock(current); return 0; -- 2.20.1

1 0