- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] mm/sharepool: Fix a double free problem caused by init_local_group
by Yongqiang Liu 08 Dec '22

08 Dec '22

From: Chen Jun <chenjun102(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I64Y5Y CVE: NA ------------------------------- If local_group_add_task fails in init_local_group. ida free the same id twice. init_local_group local_group_add_task // failed goto free_spg free_spg: free_sp_group_locked free_sp_group_id // free spg->id free_spg_id: free_new_spg_id // double free spg->id To fix it, return before calling free_new_spg_id. Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> Reviewed-by: chenweilong <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- mm/share_pool.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/mm/share_pool.c b/mm/share_pool.c index 41ed3a3b8682..d2591c73a503 100644 --- a/mm/share_pool.c +++ b/mm/share_pool.c @@ -301,8 +301,8 @@ static int init_local_group(struct mm_struct *mm) spg = create_spg(spg_id, 0); if (IS_ERR(spg)) { - ret = PTR_ERR(spg); - goto free_spg_id; + free_new_spg_id(true, spg_id); + return PTR_ERR(spg); } master->local = spg; @@ -322,11 +322,9 @@ static int init_local_group(struct mm_struct *mm) return 0; free_spg: + /* spg_id is freed in free_sp_group_locked */ free_sp_group_locked(spg); master->local = NULL; -free_spg_id: - free_new_spg_id(true, spg_id); - return ret; } -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 00/25] linux-4.19.y inclusion
by Yongqiang Liu 08 Dec '22

08 Dec '22

Alexander Potapenko (2): mm: fs: initialize fsdata passed to write_begin/write_end interface ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network Arnd Bergmann (1): security: commoncap: fix -Wstringop-overread warning Baisong Zhong (1): bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() Chen Zhongjin (1): net, neigh: Fix null-ptr-deref in neigh_table_clear() Christian A. Ehrhardt (1): kernfs: fix use-after-free in __kernfs_remove Chuang Wang (1): net: macvlan: fix memory leaks of macvlan_common_newlink Daniil Tatianin (1): ring_buffer: Do not deactivate non-existant pages Eric Dumazet (1): macvlan: enforce a consistent minimal mtu Gaosheng Cui (1): capabilities: fix potential memleak on error path from vfs_getxattr_alloc() Ilpo Järvinen (2): serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs serial: 8250: Flush DMA Rx on RLSI Jiri Benc (1): net: gso: fix panic on frag_list with mixed head alloc types Kuniyuki Iwashima (1): tcp/udp: Make early_demux back namespacified. Li Qiang (1): kprobe: reverse kp->flags when arm_kprobe failed Neal Cardwell (1): tcp: fix indefinite deferral of RTO with SACK reneging Rik van Riel (1): mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages Seth Jenkins (1): mm: /proc/pid/smaps_rollup: fix no vma's null-deref Wang Wensheng (1): ftrace: Optimize the allocation for mcount entries Xia Fukun (2): ida: don't use BUG_ON() for debugging signal handling: don't use BUG_ON() for debugging Xiu Jianfeng (1): ftrace: Fix null pointer dereference in ftrace_add_mod() Zhang Xiaoxu (1): nfs4: Fix kmemleak when allocate slot failed Zhengchao Shao (2): net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed ipv6: fix WARNING in ip6_route_net_exit_late() drivers/net/macvlan.c | 6 ++- drivers/tty/serial/8250/8250_port.c | 7 +++- fs/buffer.c | 4 +- fs/kernfs/dir.c | 5 ++- fs/namei.c | 2 +- fs/nfs/nfs4client.c | 1 + fs/proc/task_mmu.c | 2 +- include/net/protocol.h | 4 -- include/net/tcp.h | 2 + include/net/udp.h | 1 + kernel/kprobes.c | 5 ++- kernel/signal.c | 8 ++-- kernel/trace/ftrace.c | 3 +- kernel/trace/ring_buffer.c | 4 +- lib/idr.c | 4 +- mm/filemap.c | 2 +- mm/hugetlb.c | 2 +- net/bpf/test_run.c | 1 + net/core/neighbour.c | 2 +- net/core/net_namespace.c | 7 ++++ net/core/skbuff.c | 36 +++++++++--------- net/ipv4/af_inet.c | 14 +------ net/ipv4/ip_input.c | 32 ++++++++++------ net/ipv4/sysctl_net_ipv4.c | 59 +---------------------------- net/ipv4/tcp_input.c | 3 +- net/ipv6/addrlabel.c | 1 + net/ipv6/ip6_input.c | 23 +++++++---- net/ipv6/route.c | 14 +++++-- net/ipv6/tcp_ipv6.c | 9 +---- net/ipv6/udp.c | 9 +---- security/commoncap.c | 6 ++- 31 files changed, 127 insertions(+), 151 deletions(-) -- 2.25.1

1 25

[PATCH openEuler-1.0-LTS] Bluetooth: L2CAP: Fix u8 overflow
by Yongqiang Liu 05 Dec '22

05 Dec '22

From: Sungwoo Kim <iam(a)sung-woo.kim> maillist inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I63D3E CVE: CVE-2022-45934 -------------------------------- By keep sending L2CAP_CONF_REQ packets, chan->num_conf_rsp increases multiple times and eventually it will wrap around the maximum number (i.e., 255). This patch prevents this by adding a boundary check with L2CAP_MAX_CONF_RSP Btmon log: Bluetooth monitor ver 5.64 = Note: Linux version 6.1.0-rc2 (x86_64) 0.264594 = Note: Bluetooth subsystem version 2.22 0.264636 @ MGMT Open: btmon (privileged) version 1.22 {0x0001} 0.272191 = New Index: 00:00:00:00:00:00 (Primary,Virtual,hci0) [hci0] 13.877604 @ RAW Open: 9496 (privileged) version 2.22 {0x0002} 13.890741 = Open Index: 00:00:00:00:00:00 [hci0] 13.900426 (...) > ACL Data RX: Handle 200 flags 0x00 dlen 1033 #32 [hci0] 14.273106 invalid packet size (12 != 1033) 08 00 01 00 02 01 04 00 01 10 ff ff ............ > ACL Data RX: Handle 200 flags 0x00 dlen 1547 #33 [hci0] 14.273561 invalid packet size (14 != 1547) 0a 00 01 00 04 01 06 00 40 00 00 00 00 00 ........@..... > ACL Data RX: Handle 200 flags 0x00 dlen 2061 #34 [hci0] 14.274390 invalid packet size (16 != 2061) 0c 00 01 00 04 01 08 00 40 00 00 00 00 00 00 04 ........@....... > ACL Data RX: Handle 200 flags 0x00 dlen 2061 #35 [hci0] 14.274932 invalid packet size (16 != 2061) 0c 00 01 00 04 01 08 00 40 00 00 00 07 00 03 00 ........@....... = bluetoothd: Bluetooth daemon 5.43 14.401828 > ACL Data RX: Handle 200 flags 0x00 dlen 1033 #36 [hci0] 14.275753 invalid packet size (12 != 1033) 08 00 01 00 04 01 04 00 40 00 00 00 ........@... Signed-off-by: Sungwoo Kim <iam(a)sung-woo.kim> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Baisong Zhong <zhongbaisong(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/bluetooth/l2cap_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 863ce43fa175..3b02e881cec1 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -4151,7 +4151,8 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, chan->ident = cmd->ident; l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp); - chan->num_conf_rsp++; + if (chan->num_conf_rsp < L2CAP_CONF_MAX_CONF_RSP) + chan->num_conf_rsp++; /* Reset config buffer. */ chan->conf_len = 0; -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/2] l2tp: Serialize access to sk_user_data with sk_callback_lock
by Yongqiang Liu 05 Dec '22

05 Dec '22

From: Jakub Sitnicki <jakub(a)cloudflare.com> mainline inclusion from mainline-v6.1-rc6 commit b68777d54fac21fc833ec26ea1a2a84f975ab035 category: bugfix bugzilla: 188056, https://gitee.com/src-openeuler/kernel/issues/I62RNU CVE: CVE-2022-4129 -------------------------------- sk->sk_user_data has multiple users, which are not compatible with each other. Writers must synchronize by grabbing the sk->sk_callback_lock. l2tp currently fails to grab the lock when modifying the underlying tunnel socket fields. Fix it by adding appropriate locking. We err on the side of safety and grab the sk_callback_lock also inside the sk_destruct callback overridden by l2tp, even though there should be no refs allowing access to the sock at the time when sk_destruct gets called. v4: - serialize write to sk_user_data in l2tp sk_destruct v3: - switch from sock lock to sk_callback_lock - document write-protection for sk_user_data v2: - update Fixes to point to origin of the bug - use real names in Reported/Tested-by tags Cc: Tom Parkin <tparkin(a)katalix.com> Fixes: 3557baabf280 ("[L2TP]: PPP over L2TP driver core") Reported-by: Haowei Yan <g1042620637(a)gmail.com> Signed-off-by: Jakub Sitnicki <jakub(a)cloudflare.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> conflict: net/l2tp/l2tp_core.c Signed-off-by: Lu Wei <luwei32(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- include/net/sock.h | 2 +- net/l2tp/l2tp_core.c | 19 +++++++++++++------ 2 files changed, 14 insertions(+), 7 deletions(-) diff --git a/include/net/sock.h b/include/net/sock.h index 273f8226dbff..adfb0219fc29 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -304,7 +304,7 @@ struct sock_common { * @sk_tskey: counter to disambiguate concurrent tstamp requests * @sk_zckey: counter to order MSG_ZEROCOPY notifications * @sk_socket: Identd and reporting IO signals - * @sk_user_data: RPC layer private data + * @sk_user_data: RPC layer private data. Write-protected by @sk_callback_lock. * @sk_frag: cached page frag * @sk_peek_off: current peek_offset value * @sk_send_head: front of stuff to transmit diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c index 9abdc0a04d99..a88e1fd1cfea 100644 --- a/net/l2tp/l2tp_core.c +++ b/net/l2tp/l2tp_core.c @@ -1172,8 +1172,10 @@ static void l2tp_tunnel_destruct(struct sock *sk) } /* Remove hooks into tunnel socket */ + write_lock_bh(&sk->sk_callback_lock); sk->sk_destruct = tunnel->old_sk_destruct; sk->sk_user_data = NULL; + write_unlock_bh(&sk->sk_callback_lock); /* Call the original destructor */ if (sk->sk_destruct) @@ -1492,12 +1494,15 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, sock = sockfd_lookup(tunnel->fd, &ret); if (!sock) goto err; - - ret = l2tp_validate_socket(sock->sk, net, tunnel->encap); - if (ret < 0) - goto err_sock; } + sk = sock->sk; + write_lock(&sk->sk_callback_lock); + + ret = l2tp_validate_socket(sk, net, tunnel->encap); + if (ret < 0) + goto err_sock; + tunnel->l2tp_net = net; pn = l2tp_pernet(net); @@ -1513,7 +1518,6 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list); spin_unlock_bh(&pn->l2tp_tunnel_list_lock); - sk = sock->sk; sock_hold(sk); tunnel->sock = sk; @@ -1527,7 +1531,7 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, setup_udp_tunnel_sock(net, sock, &udp_cfg); } else { - sk->sk_user_data = tunnel; + rcu_assign_sk_user_data(sk, tunnel); } tunnel->old_sk_destruct = sk->sk_destruct; @@ -1539,6 +1543,7 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, if (tunnel->fd >= 0) sockfd_put(sock); + write_unlock(&sk->sk_callback_lock); return 0; err_sock: @@ -1546,6 +1551,8 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, sock_release(sock); else sockfd_put(sock); + + write_unlock(&sk->sk_callback_lock); err: return ret; } -- 2.25.1

1 1

[PATCH openEuler-5.10 0/1] Backport 5.10.139 LTS
by Zheng Zengkai 02 Dec '22

02 Dec '22

Backport 5.10.139 LTS patches from upstream. git cherry-pick v5.10.138..v5.10.139~1 -s Total patches: 1 Ondrej Mosnacek (1): kbuild: dummy-tools: avoid tmpdir leak in dummy gcc scripts/dummy-tools/dummy-plugin-dir/include/plugin-version.h | 0 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 scripts/dummy-tools/dummy-plugin-dir/include/plugin-version.h -- 2.20.1

1 1

[PATCH] iommu: bugfix for missing symbols when build arm_smmu_v3.ko
by Zhang Jian 02 Dec '22

02 Dec '22

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I63SDZ CVE: NA ------------------------------- In Ascend featue, when we make CONFIG_ARM_AMMU_V3 be M, and when we build arm-smmu-v3.ko, it will miss symbols for acpi_dev_prop_read_single. So use acpi_dev_get_property to replace the old interface Signed-off-by: Zhang Jian <zhangjian210(a)huawei.com> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index 9ac1601c82ea..05be3a76e10f 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -3061,6 +3061,7 @@ static struct iommu_device *arm_smmu_probe_device(struct device *dev) struct iommu_fwspec *fwspec = dev_iommu_fwspec_get(dev); #ifdef CONFIG_ASCEND_FEATURES u32 sid; + const union acpi_object *obj = NULL; #endif if (!fwspec || fwspec->ops != &arm_smmu_ops) @@ -3109,8 +3110,9 @@ static struct iommu_device *arm_smmu_probe_device(struct device *dev) master->stall_enabled = true; #ifdef CONFIG_ASCEND_FEATURES - if (!acpi_dev_prop_read_single(ACPI_COMPANION(dev), - "streamid", DEV_PROP_U32, &sid)) { + if (!acpi_dev_get_property(ACPI_COMPANION(dev), + "streamid", ACPI_TYPE_INTEGER, &obj) && obj) { + sid = obj->integer.value; if (iommu_fwspec_add_ids(dev, &sid, 1)) dev_info(dev, "failed to add ids\n"); master->stall_enabled = true; -- 2.17.1

1 0

[PATCH openEuler-5.10 00/76] Backport 5.10.140 LTS
by Zheng Zengkai 02 Dec '22

02 Dec '22

Backport 5.10.140 LTS patches from upstream. git cherry-pick v5.10.139..v5.10.140~1 -s Already merged(-9): 6a564bad3a64 xfs: prevent a WARN_ONCE() in xfs_ioc_attr_list() 1b9b4139d794 xfs: reject crazy array sizes being fed to XFS_IOC_GETBMAP* 37837bc3ef31 xfs: return errors in xfs_fs_sync_fs 70d560e2fb5e xfs: only bother with sync_filesystem during readonly remount c5c4d4c9806d af_key: Do not call xfrm_probe_algs in parallel c08a104a8bce netfilter: nf_tables: disallow binding to already bound chain e3e0d117294d x86/unwind/orc: Unwind ftrace trampolines with correct ORC entry 3ddbd0907f6d blk-mq: fix io hung due to missing commit_rqs e89798071784 bpf: Don't use tnum_range on array range checking for poke descriptors Context conflict: 4379a10c1db7 xfrm: clone missing x->lastused in xfrm_do_migrate 6301a73bd83d netfilter: nf_tables: disallow jump to implicit chain from set element Skipped(-1): 2761612bcde9 xfrm: policy: fix metadata dst->dev xmit null pointer dereference due to 5b7f84b1f9f4 ("xfrm: Add possibility to set the default to block if we have no policy") skipped Total patches: 86 - 9 - 1 = 76 Alex Elder (1): net: ipa: don't assume SMEM is page-aligned Anand Jain (2): btrfs: replace: drop assert for suspended replace btrfs: add info when mount fails due to stale replace target Antony Antony (1): xfrm: clone missing x->lastused in xfrm_do_migrate Basavaraj Natikar (1): pinctrl: amd: Don't save/restore interrupt status and wake status bits Bernard Pidoux (1): rose: check NULL rose_loopback_neigh->loopback Brian Foster (1): s390: fix double free of GS and RI CBs on fork() failure Christoph Hellwig (1): fs: remove __sync_filesystem Colin Ian King (1): netfilter: nftables: remove redundant assignment of variable err Darrick J. Wong (1): vfs: make sync_filesystem return errors from ->sync_fs David Hildenbrand (1): mm/hugetlb: fix hugetlb not supporting softdirty tracking David Howells (1): rxrpc: Fix locking in rxrpc's sendmsg Duoming Zhou (1): nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout Eric Dumazet (1): tcp: tweak len/truesize ratio for coalesce candidates Filipe Manana (1): btrfs: fix silent failure when deleting root reference Florian Westphal (1): netfilter: ebtables: reject blobs that don't provide all entry points Gaosheng Cui (1): audit: fix potential double free on error path from fsnotify_add_inode_mark Goldwyn Rodrigues (1): btrfs: check if root is readonly while setting security xattr Guoqing Jiang (2): Revert "md-raid: destroy the bitmap after destroying the thread" md: call __md_stop_writes in md_stop Helge Deller (1): parisc: Fix exception handler for fldw and fstw instructions Hui Su (1): kernel/sched: Remove dl_boosted flag comment Jacob Keller (1): ixgbe: stop resetting SYSTIME in ixgbe_ptp_start_cyclecounter James Clark (1): perf python: Fix build when PYTHON_CONFIG is user supplied Jeremy Sowden (1): netfilter: bitwise: improve error goto labels Jonathan Toppins (1): bonding: 802.3ad: fix no transmission of LACPDUs Juergen Gross (1): xen/privcmd: fix error exit of privcmd_ioctl_dm_op() Kan Liang (1): perf/x86/lbr: Enable the branch type for the Arch LBR by default Kiwoong Kim (1): scsi: ufs: core: Enable link lost interrupt Kuniyuki Iwashima (15): net: Fix data-races around sysctl_[rw]mem(_offset)?. net: Fix data-races around sysctl_[rw]mem_(max|default). net: Fix data-races around weight_p and dev_weight_[rt]x_bias. net: Fix data-races around netdev_max_backlog. net: Fix data-races around netdev_tstamp_prequeue. ratelimit: Fix data-races in ___ratelimit(). net: Fix data-races around sysctl_optmem_max. net: Fix a data-race around sysctl_tstamp_allow_data. net: Fix a data-race around sysctl_net_busy_poll. net: Fix a data-race around sysctl_net_busy_read. net: Fix a data-race around netdev_budget. net: Fix a data-race around netdev_budget_usecs. net: Fix data-races around sysctl_fb_tunnels_only_for_init_net. net: Fix data-races around sysctl_devconf_inherit_init_net. net: Fix a data-race around sysctl_somaxconn. Maciej Fijalkowski (2): ice: xsk: Force rings to be sized to power of 2 ice: xsk: prohibit usage of non-balanced queue id Maciej Żenczykowski (1): net: ipvtap - add __init/__exit annotations to module init/exit funcs Martin KaFai Lau (1): bpf: Folding omem_charge() into sk_storage_charge() Miaohe Lin (1): mm/huge_memory.c: use helper function migration_entry_to_page() Olga Kornievskaia (1): NFSv4.2 fix problems with __nfs42_ssc_open Pablo Neira Ayuso (9): netfilter: nft_payload: report ERANGE for too long offset and length netfilter: nft_payload: do not truncate csum_offset and csum_type netfilter: nf_tables: do not leave chain stats enabled on error netfilter: nft_osf: restrict osf to ipv4, ipv6 and inet families netfilter: nft_tunnel: restrict it to netdev family netfilter: nf_tables: consolidate rule verdict trace call netfilter: nft_cmp: optimize comparison for 16-bytes netfilter: nf_tables: upfront validation of data via nft_data_init() netfilter: nf_tables: disallow jump to implicit chain from set element Pawan Gupta (1): x86/bugs: Add "unknown" reporting for MMIO Stale Data Peter Xu (1): mm/smaps: don't access young/dirty bit if pte unpresent Quanyang Wang (1): asm-generic: sections: refactor memory_intersects Randy Dunlap (1): kernel/sys_ni: add compat entry for fadvise64_64 Riwen Lu (1): ACPI: processor: Remove freq Qos request for all CPUs Salvatore Bonaccorso (1): Documentation/ABI: Mention retbleed vulnerability info file for sysfs Saurabh Sengar (1): scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq Sergei Antonov (1): net: moxa: get rid of asymmetry in DMA mapping/unmapping Shannon Nelson (1): ionic: fix up issues with handling EAGAIN on FW cmds Siddh Raman Pant (1): loop: Check for overflow while configuring loop Stephane Eranian (1): perf/x86/intel/uncore: Fix broken read_counter() for SNB IMC PMU Trond Myklebust (2): NFS: Don't allocate nfs_fattr on the stack in __nfs42_ssc_open() SUNRPC: RPC level errors should set task->tk_rpc_status Vikas Gupta (1): bnxt_en: fix NQ resource accounting during vf creation on 57500 chips Vlad Buslov (1): net/mlx5e: Properly disable vlan strip on non-UL reps Xin Xiong (1): xfrm: fix refcount leak in __xfrm_policy_check() Zenghui Yu (1): arm64: Fix match_list for erratum 1286807 on Arm Cortex-A76 .../ABI/testing/sysfs-devices-system-cpu | 1 + .../hw-vuln/processor_mmio_stale_data.rst | 14 ++ Documentation/admin-guide/sysctl/net.rst | 2 +- arch/arm64/kernel/cpu_errata.c | 2 + arch/parisc/kernel/unaligned.c | 2 +- arch/s390/kernel/process.c | 22 ++- arch/x86/events/intel/lbr.c | 8 + arch/x86/events/intel/uncore_snb.c | 18 ++- arch/x86/include/asm/cpufeatures.h | 5 +- arch/x86/kernel/cpu/bugs.c | 14 +- arch/x86/kernel/cpu/common.c | 42 ++++-- drivers/acpi/processor_thermal.c | 2 +- drivers/block/loop.c | 5 + drivers/md/md.c | 3 +- drivers/net/bonding/bond_3ad.c | 38 ++--- .../net/ethernet/broadcom/bnxt/bnxt_sriov.c | 2 +- drivers/net/ethernet/intel/ice/ice_xsk.c | 14 ++ drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c | 59 ++++++-- .../net/ethernet/mellanox/mlx5/core/en_rep.c | 2 + drivers/net/ethernet/moxa/moxart_ether.c | 11 +- .../net/ethernet/pensando/ionic/ionic_main.c | 4 +- drivers/net/ipa/ipa_mem.c | 2 +- drivers/net/ipvlan/ipvtap.c | 4 +- drivers/nfc/pn533/uart.c | 1 + drivers/pinctrl/pinctrl-amd.c | 11 +- drivers/scsi/storvsc_drv.c | 2 +- drivers/scsi/ufs/ufshci.h | 6 +- drivers/xen/privcmd.c | 21 +-- fs/btrfs/dev-replace.c | 5 +- fs/btrfs/root-tree.c | 5 +- fs/btrfs/xattr.c | 3 + fs/nfs/nfs4file.c | 16 +- fs/proc/task_mmu.c | 7 +- fs/sync.c | 48 +++--- include/asm-generic/sections.h | 7 +- include/linux/netdevice.h | 20 ++- include/linux/netfilter_bridge/ebtables.h | 4 - include/linux/sched.h | 4 - include/net/busy_poll.h | 2 +- include/net/netfilter/nf_tables.h | 9 +- include/net/netfilter/nf_tables_core.h | 9 ++ include/net/sock.h | 8 +- kernel/audit_fsnotify.c | 1 + kernel/sys_ni.c | 1 + lib/ratelimit.c | 12 +- mm/huge_memory.c | 4 +- mm/mmap.c | 8 +- net/bridge/netfilter/ebtable_broute.c | 8 - net/bridge/netfilter/ebtable_filter.c | 8 - net/bridge/netfilter/ebtable_nat.c | 8 - net/bridge/netfilter/ebtables.c | 8 +- net/core/bpf_sk_storage.c | 24 ++- net/core/dev.c | 18 +-- net/core/filter.c | 13 +- net/core/gro_cells.c | 2 +- net/core/skbuff.c | 2 +- net/core/sock.c | 18 ++- net/core/sysctl_net_core.c | 15 +- net/decnet/af_decnet.c | 4 +- net/ipv4/devinet.c | 16 +- net/ipv4/ip_output.c | 2 +- net/ipv4/ip_sockglue.c | 6 +- net/ipv4/tcp.c | 6 +- net/ipv4/tcp_input.c | 51 +++++-- net/ipv4/tcp_output.c | 4 +- net/ipv6/addrconf.c | 5 +- net/ipv6/ipv6_sockglue.c | 4 +- net/mptcp/protocol.c | 6 +- net/netfilter/ipvs/ip_vs_sync.c | 4 +- net/netfilter/nf_tables_api.c | 88 ++++++----- net/netfilter/nf_tables_core.c | 55 ++++++- net/netfilter/nft_bitwise.c | 67 +++++---- net/netfilter/nft_cmp.c | 142 +++++++++++++++--- net/netfilter/nft_immediate.c | 22 ++- net/netfilter/nft_osf.c | 18 ++- net/netfilter/nft_payload.c | 29 +++- net/netfilter/nft_range.c | 27 ++-- net/netfilter/nft_tunnel.c | 1 + net/rose/rose_loopback.c | 3 +- net/rxrpc/call_object.c | 4 +- net/rxrpc/sendmsg.c | 92 +++++++----- net/sched/sch_generic.c | 2 +- net/socket.c | 2 +- net/sunrpc/clnt.c | 2 +- net/tipc/socket.c | 2 +- net/xfrm/espintcp.c | 2 +- net/xfrm/xfrm_input.c | 2 +- net/xfrm/xfrm_policy.c | 1 + net/xfrm/xfrm_state.c | 1 + tools/perf/Makefile.config | 2 +- 90 files changed, 834 insertions(+), 452 deletions(-) -- 2.20.1

1 76

[PATCH OLK-5.10] acpi: EXPORT symbol acpi_dev_prop_read_single
by Zhang Jian 01 Dec '22

01 Dec '22

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I63SDZ CVE: NA ------------------------------- Bugfix for when we make CONFIG_ARM_AMMU_V3 be M, and when we build arm-smmu-v3.ko, it will miss symbols for acpi_dev_prop_read_single. Signed-off-by: Zhang Jian <zhangjian210(a)huawei.com> --- drivers/acpi/property.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c index 80e92c298055..34c8f649dabf 100644 --- a/drivers/acpi/property.c +++ b/drivers/acpi/property.c @@ -860,6 +860,7 @@ int acpi_dev_prop_read_single(struct acpi_device *adev, const char *propname, return ret; return 0; } +EXPORT_SYMBOL_GPL(acpi_dev_prop_read_single); static int acpi_copy_property_array_u8(const union acpi_object *items, u8 *val, size_t nval) -- 2.17.1

1 0

[PATCH] memblock,arm64: expand the static memblock memory table
by Zhang Jian 01 Dec '22

01 Dec '22

From: Zhou Guanghui <zhouguanghui1(a)huawei.com> In a system(Huawei Ascend ARM64 SoC) using HBM, a multi-bit ECC error occurs, and the BIOS will mark the corresponding area (for example, 2 MB) as unusable. When the system restarts next time, these areas are not reported or reported as EFI_UNUSABLE_MEMORY. Both cases lead to an increase in the number of memblocks, whereas EFI_UNUSABLE_MEMORY leads to a larger number of memblocks. For example, if the EFI_UNUSABLE_MEMORY type is reported: ... memory[0x92] [0x0000200834a00000-0x0000200835bfffff], 0x0000000001200000 bytes on node 7 flags: 0x0 memory[0x93] [0x0000200835c00000-0x0000200835dfffff], 0x0000000000200000 bytes on node 7 flags: 0x4 memory[0x94] [0x0000200835e00000-0x00002008367fffff], 0x0000000000a00000 bytes on node 7 flags: 0x0 memory[0x95] [0x0000200836800000-0x00002008369fffff], 0x0000000000200000 bytes on node 7 flags: 0x4 memory[0x96] [0x0000200836a00000-0x0000200837bfffff], 0x0000000001200000 bytes on node 7 flags: 0x0 memory[0x97] [0x0000200837c00000-0x0000200837dfffff], 0x0000000000200000 bytes on node 7 flags: 0x4 memory[0x98] [0x0000200837e00000-0x000020087fffffff], 0x0000000048200000 bytes on node 7 flags: 0x0 memory[0x99] [0x0000200880000000-0x0000200bcfffffff], 0x0000000350000000 bytes on node 6 flags: 0x0 memory[0x9a] [0x0000200bd0000000-0x0000200bd01fffff], 0x0000000000200000 bytes on node 6 flags: 0x4 memory[0x9b] [0x0000200bd0200000-0x0000200bd07fffff], 0x0000000000600000 bytes on node 6 flags: 0x0 memory[0x9c] [0x0000200bd0800000-0x0000200bd09fffff], 0x0000000000200000 bytes on node 6 flags: 0x4 memory[0x9d] [0x0000200bd0a00000-0x0000200fcfffffff], 0x00000003ff600000 bytes on node 6 flags: 0x0 memory[0x9e] [0x0000200fd0000000-0x0000200fd01fffff], 0x0000000000200000 bytes on node 6 flags: 0x4 memory[0x9f] [0x0000200fd0200000-0x0000200fffffffff], 0x000000002fe00000 bytes on node 6 flags: 0x0 ... The EFI memory map is parsed to construct the memblock arrays before the memblock arrays can be resized. As the result, memory regions beyond INIT_MEMBLOCK_REGIONS are lost. Add a new macro INIT_MEMBLOCK_MEMORY_REGIONS to replace INIT_MEMBLOCK_REGTIONS to define the size of the static memblock.memory array. Allow overriding memblock.memory array size with architecture defined INIT_MEMBLOCK_MEMORY_REGIONS and make arm64 to set INIT_MEMBLOCK_MEMORY_REGIONS to 1024 when CONFIG_EFI is enabled. Link: https://lkml.kernel.org/r/20220615102742.96450-1-zhouguanghui1@huawei.com Signed-off-by: Zhou Guanghui <zhouguanghui1(a)huawei.com> Acked-by: Mike Rapoport <rppt(a)linux.ibm.com> Tested-by: Darren Hart <darren(a)os.amperecomputing.com> Acked-by: Will Deacon <will(a)kernel.org> [arm64] Reviewed-by: Anshuman Khandual <anshuman.khandual(a)arm.com> Cc: Xu Qiang <xuqiang36(a)huawei.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- arch/arm64/include/asm/memory.h | 9 +++++++++ mm/memblock.c | 14 +++++++++----- 2 files changed, 18 insertions(+), 5 deletions(-) diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h index 0af70d9abede..ce8614fa376a 100644 --- a/arch/arm64/include/asm/memory.h +++ b/arch/arm64/include/asm/memory.h @@ -364,6 +364,15 @@ void dump_mem_limit(void); # define INIT_MEMBLOCK_RESERVED_REGIONS (INIT_MEMBLOCK_REGIONS + NR_CPUS + 1) #endif +/* + * memory regions which marked with flag MEMBLOCK_NOMAP(for example, the memory + * of the EFI_UNUSABLE_MEMORY type) may divide a continuous memory block into + * multiple parts. As a result, the number of memory regions is large. + */ +#ifdef CONFIG_EFI +#define INIT_MEMBLOCK_MEMORY_REGIONS (INIT_MEMBLOCK_REGIONS * 8) +#endif + #include <asm-generic/memory_model.h> #endif /* __ASM_MEMORY_H */ diff --git a/mm/memblock.c b/mm/memblock.c index 749abd2685c4..b7ebf4b7e9d9 100644 --- a/mm/memblock.c +++ b/mm/memblock.c @@ -29,6 +29,10 @@ # define INIT_MEMBLOCK_RESERVED_REGIONS INIT_MEMBLOCK_REGIONS #endif +#ifndef INIT_MEMBLOCK_MEMORY_REGIONS +#define INIT_MEMBLOCK_MEMORY_REGIONS INIT_MEMBLOCK_REGIONS +#endif + /** * DOC: memblock overview * @@ -55,9 +59,9 @@ * the allocator metadata. The "memory" and "reserved" types are nicely * wrapped with struct memblock. This structure is statically * initialized at build time. The region arrays are initially sized to - * %INIT_MEMBLOCK_REGIONS for "memory" and %INIT_MEMBLOCK_RESERVED_REGIONS - * for "reserved". The region array for "physmem" is initially sized to - * %INIT_PHYSMEM_REGIONS. + * %INIT_MEMBLOCK_MEMORY_REGIONS for "memory" and + * %INIT_MEMBLOCK_RESERVED_REGIONS for "reserved". The region array + * for "physmem" is initially sized to %INIT_PHYSMEM_REGIONS. * The memblock_allow_resize() enables automatic resizing of the region * arrays during addition of new regions. This feature should be used * with care so that memory allocated for the region array will not @@ -102,7 +106,7 @@ unsigned long min_low_pfn; unsigned long max_pfn; unsigned long long max_possible_pfn; -static struct memblock_region memblock_memory_init_regions[INIT_MEMBLOCK_REGIONS] __initdata_memblock; +static struct memblock_region memblock_memory_init_regions[INIT_MEMBLOCK_MEMORY_REGIONS] __initdata_memblock; static struct memblock_region memblock_reserved_init_regions[INIT_MEMBLOCK_RESERVED_REGIONS] __initdata_memblock; #ifdef CONFIG_HAVE_MEMBLOCK_PHYS_MAP static struct memblock_region memblock_physmem_init_regions[INIT_PHYSMEM_REGIONS]; @@ -111,7 +115,7 @@ static struct memblock_region memblock_physmem_init_regions[INIT_PHYSMEM_REGIONS struct memblock memblock __initdata_memblock = { .memory.regions = memblock_memory_init_regions, .memory.cnt = 1, /* empty dummy entry */ - .memory.max = INIT_MEMBLOCK_REGIONS, + .memory.max = INIT_MEMBLOCK_MEMORY_REGIONS, .memory.name = "memory", .reserved.regions = memblock_reserved_init_regions, -- 2.17.1

1 0

[OLK-5.10 v2 00/36] Perf tool add Hip09 json support
by Junhao He 30 Nov '22

30 Nov '22

Perf tool add Hip09 json support. Change log: Fix the Refs tag. Jin Yao (2): perf tools: Fix pattern matching for same substring in different PMU type perf pmu: Save pmu name John Garry (27): perf jevents: Add support for an extra directory level perf jevents: Add support for system events tables perf pmu: Add pmu_id() perf pmu: Add pmu_add_sys_aliases() perf evlist: Change evlist__splice_list_tail() ordering perf metricgroup: Fix metrics using aliases covering multiple PMUs perf metricgroup: Split up metricgroup__print() perf metricgroup: Support printing metric groups for system PMUs perf metricgroup: Support adding metrics for system PMUs perf pmu: Fix alias matching perf jevents: Add test for arch std events perf jevents: Make build dependency on test JSONs perf test: Factor out pmu-events event comparison perf jevents: Relocate test events to cpu folder perf test: Declare pmu-events test events separately perf test: Factor out pmu-events alias comparison perf test: Test pmu-events core aliases separately perf pmu: Check .is_uncore field in pmu_add_cpu_aliases_map() perf test: Re-add pmu-event uncore PMU alias test perf test: Add more pmu-events uncore aliases perf pmu: Make pmu_add_sys_aliases() public perf jevents: Print SoC name per system event table perf test: Add pmu-events sys event support perf parse-events: Set numeric term config perf jevents: Support ConfigCode perf test: Verify more event members in pmu-events test perf vendor events arm64: Revise hip08 uncore events Junhao He (1): perf test: Add pmu-events test for aliases of hip09 ddrc pmu Qi Liu (6): perf pmu: Add alias match method to fit pmu_name of HiSilicon DDRC perf jevents: Add support for HiSilicon L3C PMU aliasing perf jevents: Add support for HiSilicon DDRC PMU aliasing perf jevents: Add support for HiSilicon HHA PMU aliasing perf jevents: Add support for HiSilicon SLLC PMU aliasing perf jevents: Add support for HiSilicon PA PMU aliasing tools/perf/pmu-events/Build | 5 +- .../arm64/hisilicon/hip08/uncore-ddrc.json | 32 +- .../arm64/hisilicon/hip08/uncore-hha.json | 120 ++- .../arm64/hisilicon/hip08/uncore-l3c.json | 52 +- .../hisilicon/hip09/sys/uncore-ddrc.json | 117 +++ .../arm64/hisilicon/hip09/sys/uncore-hha.json | 102 +++ .../arm64/hisilicon/hip09/sys/uncore-l3c.json | 125 +++ .../arm64/hisilicon/hip09/sys/uncore-pa.json | 86 ++ .../hisilicon/hip09/sys/uncore-sllc.json | 134 ++++ .../pmu-events/arch/test/arch-std-events.json | 8 + .../{test_cpu => test_soc/cpu}/branch.json | 0 .../arch/test/test_soc/cpu/cache.json | 5 + .../{test_cpu => test_soc/cpu}/other.json | 0 .../{test_cpu => test_soc/cpu}/uncore.json | 21 + .../arch/test/test_soc/sys/uncore.json | 17 + tools/perf/pmu-events/jevents.c | 118 ++- tools/perf/pmu-events/pmu-events.h | 7 + tools/perf/tests/parse-events.c | 8 +- tools/perf/tests/pmu-events.c | 747 +++++++++++++----- tools/perf/util/evlist.c | 19 +- tools/perf/util/metricgroup.c | 255 ++++-- tools/perf/util/parse-events.c | 2 +- tools/perf/util/parse-events.y | 2 +- tools/perf/util/pmu.c | 158 +++- tools/perf/util/pmu.h | 7 + 25 files changed, 1806 insertions(+), 341 deletions(-) create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hip09/sys/uncore-ddrc.json create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hip09/sys/uncore-hha.json create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hip09/sys/uncore-l3c.json create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hip09/sys/uncore-pa.json create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hip09/sys/uncore-sllc.json create mode 100644 tools/perf/pmu-events/arch/test/arch-std-events.json rename tools/perf/pmu-events/arch/test/{test_cpu => test_soc/cpu}/branch.json (100%) create mode 100644 tools/perf/pmu-events/arch/test/test_soc/cpu/cache.json rename tools/perf/pmu-events/arch/test/{test_cpu => test_soc/cpu}/other.json (100%) rename tools/perf/pmu-events/arch/test/{test_cpu => test_soc/cpu}/uncore.json (52%) create mode 100644 tools/perf/pmu-events/arch/test/test_soc/sys/uncore.json -- 2.33.0

1 36