- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 01/40] fuse: fix page stealing
by Yang Yingliang 27 Jan '22

27 Jan '22

From: Miklos Szeredi <mszeredi(a)redhat.com> stable inclusion from linux-4.19.219 commit 65f1f3eb09a3907c5f5edaff6c473b99e49e6020 -------------------------------- commit 712a951025c0667ff00b25afc360f74e639dfabe upstream. It is possible to trigger a crash by splicing anon pipe bufs to the fuse device. The reason for this is that anon_pipe_buf_release() will reuse buf->page if the refcount is 1, but that page might have already been stolen and its flags modified (e.g. PG_lru added). This happens in the unlikely case of fuse_dev_splice_write() getting around to calling pipe_buf_release() after a page has been stolen, added to the page cache and removed from the page cache. Fix by calling pipe_buf_release() right after the page was inserted into the page cache. In this case the page has an elevated refcount so any release function will know that the page isn't reusable. Reported-by: Frank Dinoff <fdinoff(a)google.com> Link: https://lore.kernel.org/r/CAAmZXrsGg2xsP1CK+cbuEMumtrqdvD-NKnWzhNcvn71RV3c1… Fixes: dd3bb14f44a6 ("fuse: support splice() writing to fuse device") Cc: <stable(a)vger.kernel.org> # v2.6.35 Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/fuse/dev.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c index 498a4fab40801..3fee28ee63745 100644 --- a/fs/fuse/dev.c +++ b/fs/fuse/dev.c @@ -905,6 +905,12 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep) goto out_put_old; } + /* + * Release while we have extra ref on stolen page. Otherwise + * anon_pipe_buf_release() might think the page can be reused. + */ + pipe_buf_release(cs->pipe, buf); + get_page(newpage); if (!(buf->flags & PIPE_BUF_FLAG_LRU)) @@ -2054,8 +2060,12 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe, pipe_lock(pipe); out_free: - for (idx = 0; idx < nbuf; idx++) - pipe_buf_release(pipe, &bufs[idx]); + for (idx = 0; idx < nbuf; idx++) { + struct pipe_buffer *buf = &bufs[idx]; + + if (buf->ops) + pipe_buf_release(pipe, buf); + } pipe_unlock(pipe); kvfree(bufs); -- 2.25.1

1 39

[PATCH openEuler-5.10 01/47] net: add and use skb_unclone_keeptruesize() helper
by Zheng Zengkai 27 Jan '22

27 Jan '22

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v5.16-rc1 commit c4777efa751d293e369aec464ce6875e957be255 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4RYXI CVE: NA -------------------------------- While commit 097b9146c0e2 ("net: fix up truesize of cloned skb in skb_prepare_for_shift()") fixed immediate issues found when KFENCE was enabled/tested, there are still similar issues, when tcp_trim_head() hits KFENCE while the master skb is cloned. This happens under heavy networking TX workloads, when the TX completion might be delayed after incoming ACK. This patch fixes the WARNING in sk_stream_kill_queues when sk->sk_mem_queued/sk->sk_forward_alloc are not zero. Fixes: d3fb45f370d9 ("mm, kfence: insert KFENCE hooks for SLAB") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Acked-by: Marco Elver <elver(a)google.com> Link: https://lore.kernel.org/r/20211102004555.1359210-1-eric.dumazet@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: YueHaibing <yuehaibing(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- include/linux/skbuff.h | 16 ++++++++++++++++ net/core/skbuff.c | 14 +------------- net/ipv4/tcp_output.c | 6 +++--- 3 files changed, 20 insertions(+), 16 deletions(-) diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index d485f17ff33a..e5f61bdd42a8 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -1652,6 +1652,22 @@ static inline int skb_unclone(struct sk_buff *skb, gfp_t pri) return 0; } +/* This variant of skb_unclone() makes sure skb->truesize is not changed */ +static inline int skb_unclone_keeptruesize(struct sk_buff *skb, gfp_t pri) +{ + might_sleep_if(gfpflags_allow_blocking(pri)); + + if (skb_cloned(skb)) { + unsigned int save = skb->truesize; + int res; + + res = pskb_expand_head(skb, 0, 0, pri); + skb->truesize = save; + return res; + } + return 0; +} + /** * skb_header_cloned - is the header a clone * @skb: buffer to check diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 8d73503c8b32..16c74a81b7bf 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -3311,19 +3311,7 @@ EXPORT_SYMBOL(skb_split); */ static int skb_prepare_for_shift(struct sk_buff *skb) { - int ret = 0; - - if (skb_cloned(skb)) { - /* Save and restore truesize: pskb_expand_head() may reallocate - * memory where ksize(kmalloc(S)) != ksize(kmalloc(S)), but we - * cannot change truesize at this point. - */ - unsigned int save_truesize = skb->truesize; - - ret = pskb_expand_head(skb, 0, 0, GFP_ATOMIC); - skb->truesize = save_truesize; - } - return ret; + return skb_unclone_keeptruesize(skb, GFP_ATOMIC); } /** diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index c8420b48de36..da8bcdd90715 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -1613,7 +1613,7 @@ int tcp_fragment(struct sock *sk, enum tcp_queue tcp_queue, return -ENOMEM; } - if (skb_unclone(skb, gfp)) + if (skb_unclone_keeptruesize(skb, gfp)) return -ENOMEM; /* Get a new skb... force flag on. */ @@ -1722,7 +1722,7 @@ int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len) { u32 delta_truesize; - if (skb_unclone(skb, GFP_ATOMIC)) + if (skb_unclone_keeptruesize(skb, GFP_ATOMIC)) return -ENOMEM; delta_truesize = __pskb_trim_head(skb, len); @@ -3236,7 +3236,7 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs) cur_mss, GFP_ATOMIC)) return -ENOMEM; /* We'll try again later. */ } else { - if (skb_unclone(skb, GFP_ATOMIC)) + if (skb_unclone_keeptruesize(skb, GFP_ATOMIC)) return -ENOMEM; diff = tcp_skb_pcount(skb); -- 2.20.1

1 43

[PATCH openEuler-5.10 1/9] crypto: Add PMULL judgment during initialization to prevent oops
by Zheng Zengkai 26 Jan '22

26 Jan '22

From: wangshouping <wangshouping(a)huawei.com> openEuler inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4OKIE?from=project-issue CVE: NA ---------------------------------------- For servers that do not support PMULL on the cpu, execute "modprobe crct10dif-ce", and accur oops. Signed-off-by: wangshouping <wangshouping(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- arch/arm64/crypto/crct10dif-neon_glue.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/arm64/crypto/crct10dif-neon_glue.c b/arch/arm64/crypto/crct10dif-neon_glue.c index e0c4a9acee27..af731b3ec30e 100644 --- a/arch/arm64/crypto/crct10dif-neon_glue.c +++ b/arch/arm64/crypto/crct10dif-neon_glue.c @@ -97,7 +97,11 @@ static struct shash_alg alg = { static int __init crct10dif_arm64_mod_init(void) { - return crypto_register_shash(&alg); + if (cpu_have_named_feature(PMULL)) { + return crypto_register_shash(&alg); + } else { + return -ENODEV; + } } static void __exit crct10dif_arm64_mod_fini(void) -- 2.20.1

1 8

Re: [PATCH openEuler-1.0-LTS V3 34/92] KVM: mmu: Fix SPTE encoding of MMIO generation upper half
by Zenghui Yu 26 Jan '22

26 Jan '22

Reviewed-by: Zenghui Yu <yuzenghui(a)huawei.com>

1 0

Re: [PATCH openEuler-1.0-LTS V3 32/92] KVM: x86: fix overlap between SPTE_MMIO_MASK and generation
by Zenghui Yu 26 Jan '22

26 Jan '22

Reviewed-by: Zenghui Yu <yuzenghui(a)huawei.com>

1 0

[PATCH openEuler-1.0-LTS] ipmi_si: Phytium S2500 workaround for MMIO-based IPMI
by Yang Yingliang 26 Jan '22

26 Jan '22

From: Laibin Qiu <qiulaibin(a)huawei.com> phytium inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4RK58 CVE: NA -------------------------------- The system would hang up when the Phytium S2500 communicates with some BMCs after several rounds of transactions, unless we reset the controller timeout counter manually by calling firmware through SMC. Signed-off-by: Wang Yinfeng <wangyinfeng(a)phytium.com.cn> Signed-off-by: Chen Baozi <chenbaozi(a)phytium.com.cn> #openEuler_contributor Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/char/ipmi/ipmi_si_mem_io.c | 72 ++++++++++++++++++++++++++++++ 1 file changed, 72 insertions(+) diff --git a/drivers/char/ipmi/ipmi_si_mem_io.c b/drivers/char/ipmi/ipmi_si_mem_io.c index 75583612ab105..9403e35a19934 100644 --- a/drivers/char/ipmi/ipmi_si_mem_io.c +++ b/drivers/char/ipmi/ipmi_si_mem_io.c @@ -3,9 +3,75 @@ #include <linux/io.h> #include "ipmi_si.h" +#ifdef CONFIG_ARM_GIC_PHYTIUM_2500 +#include <linux/arm-smccc.h> + +#define CTL_RST_FUNC_ID 0xC2000011 + +static bool apply_phytium2500_workaround; + +struct ipmi_workaround_oem_info { + char oem_id[ACPI_OEM_ID_SIZE + 1]; +}; + +static struct ipmi_workaround_oem_info wa_info[] = { + { + .oem_id = "KPSVVJ", + } +}; + +static void ipmi_check_phytium_workaround(void) +{ +#ifdef CONFIG_ACPI + struct acpi_table_header tbl; + int i; + + if (ACPI_FAILURE(acpi_get_table_header(ACPI_SIG_DSDT, 0, &tbl))) + return; + + for (i = 0; i < ARRAY_SIZE(wa_info); i++) { + if (strncmp(wa_info[i].oem_id, tbl.oem_id, ACPI_OEM_ID_SIZE)) + continue; + + apply_phytium2500_workaround = true; + break; + } +#endif +} + +static void ctl_smc(unsigned long arg0, unsigned long arg1, + unsigned long arg2, unsigned long arg3) +{ + struct arm_smccc_res res; + + arm_smccc_smc(arg0, arg1, arg2, arg3, 0, 0, 0, 0, &res); + if (res.a0 != 0) + pr_err("Error: Firmware call SMC reset Failed: %d, addr: 0x%lx\n", + (int)res.a0, arg2); +} + +static void ctl_timeout_reset(void) +{ + ctl_smc(CTL_RST_FUNC_ID, 0x1, 0x28100208, 0x1); + ctl_smc(CTL_RST_FUNC_ID, 0x1, 0x2810020C, 0x1); +} + +static inline void ipmi_phytium_workaround(void) +{ + if (apply_phytium2500_workaround) + ctl_timeout_reset(); +} + +#else +static inline void ipmi_check_phytium_workaround(void) {} +static inline void ipmi_phytium_workaround(void) {} +#endif + static unsigned char intf_mem_inb(const struct si_sm_io *io, unsigned int offset) { + ipmi_phytium_workaround(); + return readb((io->addr)+(offset * io->regspacing)); } @@ -31,6 +97,8 @@ static void intf_mem_outw(const struct si_sm_io *io, unsigned int offset, static unsigned char intf_mem_inl(const struct si_sm_io *io, unsigned int offset) { + ipmi_phytium_workaround(); + return (readl((io->addr)+(offset * io->regspacing)) >> io->regshift) & 0xff; } @@ -44,6 +112,8 @@ static void intf_mem_outl(const struct si_sm_io *io, unsigned int offset, #ifdef readq static unsigned char mem_inq(const struct si_sm_io *io, unsigned int offset) { + ipmi_phytium_workaround(); + return (readq((io->addr)+(offset * io->regspacing)) >> io->regshift) & 0xff; } @@ -81,6 +151,8 @@ int ipmi_si_mem_setup(struct si_sm_io *io) if (!addr) return -ENODEV; + ipmi_check_phytium_workaround(); + /* * Figure out the actual readb/readw/readl/etc routine to use based * upon the register size. -- 2.25.1

1 0

Re: [PATCH openEuler-1.0-LTS V3 31/92] KVM: x86: assign two bits to track SPTE kinds
by Zenghui Yu 26 Jan '22

26 Jan '22

Reviewed-by: Zenghui Yu <yuzenghui(a)huawei.com>

1 0

Re: [PATCH openEuler-1.0-LTS V3 30/92] KVM: Move the memslot update in-progress flag to bit 63
by Zenghui Yu 26 Jan '22

26 Jan '22

Reviewed-by: Zenghui Yu <yuzenghui(a)huawei.com>

1 0

Re: [PATCH openEuler-1.0-LTS V3 29/92] KVM: Remove the hack to trigger memslot generation wraparound
by Zenghui Yu 26 Jan '22

26 Jan '22

Reviewed-by: Zenghui Yu <yuzenghui(a)huawei.com>

1 0

Re: [PATCH openEuler-1.0-LTS V3 13/92] KVM: x86: Refactor the MMIO SPTE generation handling
by Zenghui Yu 26 Jan '22

26 Jan '22

Reviewed-by: Zenghui Yu <yuzenghui(a)huawei.com>

1 0