- Kernel - mailweb.openeuler.org

[PATCH openEuler-5.10-LTS 001/141] Revert "block/wbt: fix negative inflight counter when remove scsi device"
by Zheng Zengkai 13 Dec '22

13 Dec '22

From: Li Nan <linan122(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187584, https://gitee.com/openeuler/kernel/issues/I5QW2R CVE: NA -------------------------------- This reverts commit 36f5d7662495aa5ad4ec197443e69e01384eda3c. There are two wbt_enable_default() in bfq_exit_queue(). Although it will not lead to no fault, revert one. Signed-off-by: Li Nan <linan122(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- block/bfq-iosched.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c index 4bfea5e5354e..1aec01c0a707 100644 --- a/block/bfq-iosched.c +++ b/block/bfq-iosched.c @@ -6418,8 +6418,6 @@ static void bfq_exit_queue(struct elevator_queue *e) spin_unlock_irq(&bfqd->lock); #endif - wbt_enable_default(bfqd->queue); - kfree(bfqd); /* Re-enable throttling in case elevator disabled it */ -- 2.20.1

3 142

[PATCH openEuler-1.0-LTS 1/3] USB: add usb_control_msg_send() and usb_control_msg_recv()
by Yongqiang Liu 13 Dec '22

13 Dec '22

From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> mainline inclusion from mainline-v5.10-rc1 commit 719b8f2850d3d9b863cc5e4f08e9ef0206e45b26 category: bugfix bugzilla: 188090, https://gitee.com/src-openeuler/kernel/issues/I6068W CVE: CVE-2022-3903 -------------------------------- New core functions to make sending/receiving USB control messages easier and saner. In discussions, it turns out that the large majority of users of usb_control_msg() do so in potentially incorrect ways. The most common issue is where a "short" message is received, yet never detected properly due to "incorrect" error handling. Handle all of this in the USB core with two new functions to try to make working with USB control messages simpler. No more need for dynamic data, messages can be on the stack, and only "complete" send/receive will work without causing an error. Link: https://lore.kernel.org/r/20200914153756.3412156-3-gregkh@linuxfoundation.o… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> The parts related to usb_control_msg_send() and usb_control_msg_recv() in commit USB: correct API of usb_control_msg_send/recv are added to solve CVE. Commit USB: core: drop pipe-type check from new control-message helpers is also added. Signed-off-by: Zhang Peng <zhangpeng362(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/usb/core/message.c | 134 +++++++++++++++++++++++++++++++++++++ include/linux/usb.h | 8 +++ 2 files changed, 142 insertions(+) diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c index fcf84bfc08e3..0be20b17e754 100644 --- a/drivers/usb/core/message.c +++ b/drivers/usb/core/message.c @@ -161,6 +161,140 @@ int usb_control_msg(struct usb_device *dev, unsigned int pipe, __u8 request, } EXPORT_SYMBOL_GPL(usb_control_msg); +/** + * usb_control_msg_send - Builds a control "send" message, sends it off and waits for completion + * @dev: pointer to the usb device to send the message to + * @endpoint: endpoint to send the message to + * @request: USB message request value + * @requesttype: USB message request type value + * @value: USB message value + * @index: USB message index value + * @driver_data: pointer to the data to send + * @size: length in bytes of the data to send + * @timeout: time in msecs to wait for the message to complete before timing + * out (if 0 the wait is forever) + * @memflags: the flags for memory allocation for buffers + * + * Context: !in_interrupt () + * + * This function sends a control message to a specified endpoint that is not + * expected to fill in a response (i.e. a "send message") and waits for the + * message to complete, or timeout. + * + * Do not use this function from within an interrupt context. If you need + * an asynchronous message, or need to send a message from within interrupt + * context, use usb_submit_urb(). If a thread in your driver uses this call, + * make sure your disconnect() method can wait for it to complete. Since you + * don't have a handle on the URB used, you can't cancel the request. + * + * The data pointer can be made to a reference on the stack, or anywhere else, + * as it will not be modified at all. This does not have the restriction that + * usb_control_msg() has where the data pointer must be to dynamically allocated + * memory (i.e. memory that can be successfully DMAed to a device). + * + * Return: If successful, 0 is returned, Otherwise, a negative error number. + */ +int usb_control_msg_send(struct usb_device *dev, __u8 endpoint, __u8 request, + __u8 requesttype, __u16 value, __u16 index, + const void *driver_data, __u16 size, int timeout, + gfp_t memflags) +{ + unsigned int pipe = usb_sndctrlpipe(dev, endpoint); + int ret; + u8 *data = NULL; + + if (size) { + data = kmemdup(driver_data, size, memflags); + if (!data) + return -ENOMEM; + } + + ret = usb_control_msg(dev, pipe, request, requesttype, value, index, + data, size, timeout); + kfree(data); + + if (ret < 0) + return ret; + if (ret == size) + return 0; + return -EINVAL; +} +EXPORT_SYMBOL_GPL(usb_control_msg_send); + +/** + * usb_control_msg_recv - Builds a control "receive" message, sends it off and waits for completion + * @dev: pointer to the usb device to send the message to + * @endpoint: endpoint to send the message to + * @request: USB message request value + * @requesttype: USB message request type value + * @value: USB message value + * @index: USB message index value + * @driver_data: pointer to the data to be filled in by the message + * @size: length in bytes of the data to be received + * @timeout: time in msecs to wait for the message to complete before timing + * out (if 0 the wait is forever) + * @memflags: the flags for memory allocation for buffers + * + * Context: !in_interrupt () + * + * This function sends a control message to a specified endpoint that is + * expected to fill in a response (i.e. a "receive message") and waits for the + * message to complete, or timeout. + * + * Do not use this function from within an interrupt context. If you need + * an asynchronous message, or need to send a message from within interrupt + * context, use usb_submit_urb(). If a thread in your driver uses this call, + * make sure your disconnect() method can wait for it to complete. Since you + * don't have a handle on the URB used, you can't cancel the request. + * + * The data pointer can be made to a reference on the stack, or anywhere else + * that can be successfully written to. This function does not have the + * restriction that usb_control_msg() has where the data pointer must be to + * dynamically allocated memory (i.e. memory that can be successfully DMAed to a + * device). + * + * The "whole" message must be properly received from the device in order for + * this function to be successful. If a device returns less than the expected + * amount of data, then the function will fail. Do not use this for messages + * where a variable amount of data might be returned. + * + * Return: If successful, 0 is returned, Otherwise, a negative error number. + */ +int usb_control_msg_recv(struct usb_device *dev, __u8 endpoint, __u8 request, + __u8 requesttype, __u16 value, __u16 index, + void *driver_data, __u16 size, int timeout, + gfp_t memflags) +{ + unsigned int pipe = usb_rcvctrlpipe(dev, endpoint); + int ret; + u8 *data; + + if (!size || !driver_data) + return -EINVAL; + + data = kmalloc(size, memflags); + if (!data) + return -ENOMEM; + + ret = usb_control_msg(dev, pipe, request, requesttype, value, index, + data, size, timeout); + + if (ret < 0) + goto exit; + + if (ret == size) { + memcpy(driver_data, data, size); + ret = 0; + } else { + ret = -EINVAL; + } + +exit: + kfree(data); + return ret; +} +EXPORT_SYMBOL_GPL(usb_control_msg_recv); + /** * usb_interrupt_msg - Builds an interrupt urb, sends it off and waits for completion * @usb_dev: pointer to the usb device to send the message to diff --git a/include/linux/usb.h b/include/linux/usb.h index ff010d1fd1c7..3e1e31f73d0e 100644 --- a/include/linux/usb.h +++ b/include/linux/usb.h @@ -1783,6 +1783,14 @@ extern int usb_bulk_msg(struct usb_device *usb_dev, unsigned int pipe, int timeout); /* wrappers around usb_control_msg() for the most common standard requests */ +int usb_control_msg_send(struct usb_device *dev, __u8 endpoint, __u8 request, + __u8 requesttype, __u16 value, __u16 index, + const void *data, __u16 size, int timeout, + gfp_t memflags); +int usb_control_msg_recv(struct usb_device *dev, __u8 endpoint, __u8 request, + __u8 requesttype, __u16 value, __u16 index, + void *data, __u16 size, int timeout, + gfp_t memflags); extern int usb_get_descriptor(struct usb_device *dev, unsigned char desctype, unsigned char descindex, void *buf, int size); extern int usb_get_status(struct usb_device *dev, -- 2.25.1

1 2

22.03LTS加入补丁的原则
by Guoqing Jiang 12 Dec '22

12 Dec '22

Hi All, 最近我发现openEuler-22.03-LTS分支加入了大量新特性的补丁, 比如ksmbd, coresight和LoongArch. 这是否意味着除了fix相关的补丁,openEuler LTS版本是可以加入新特性补丁? Thanks, Guoqing

3 4

[PATCH openEuler-5.10 1/7] ide-cd: don't clear rq_flags after blk_get_request
by Zheng Zengkai 12 Dec '22

12 Dec '22

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I65K8D CVE: NA -------------------------------- Prepare to add a flag while initializing request, there are no functional changes. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/ide/ide-cd_ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/ide/ide-cd_ioctl.c b/drivers/ide/ide-cd_ioctl.c index 46f2df288c6a..932c4be4c88c 100644 --- a/drivers/ide/ide-cd_ioctl.c +++ b/drivers/ide/ide-cd_ioctl.c @@ -298,7 +298,7 @@ int ide_cdrom_reset(struct cdrom_device_info *cdi) rq = blk_get_request(drive->queue, REQ_OP_DRV_IN, 0); ide_req(rq)->type = ATA_PRIV_MISC; - rq->rq_flags = RQF_QUIET; + rq->rq_flags |= RQF_QUIET; blk_execute_rq(drive->queue, cd->disk, rq, 0); ret = scsi_req(rq)->result ? -EIO : 0; blk_put_request(rq); -- 2.20.1

1 6

[PATCH openEuler-5.10] iommu: Fix error handling in probe_acpi_namespace_devices()
by Zheng Zengkai 12 Dec '22

12 Dec '22

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I65QZY -------------------------------- Fix smatch error in probe_acpi_namespace_devices(). In probe_acpi_namespace_devices(), if device_to_iommu() returns NULL, unlock operation is needed before return. Fixes: d660222861c4 ("iommu/vt-d:Add support for detecting ACPI device, in RMRR") Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Reviewed-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> --- drivers/iommu/intel/iommu.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c index 9e14cf9d875f..a1e56413600a 100644 --- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -4995,8 +4995,10 @@ static int __init probe_acpi_namespace_devices(void) } iommu = device_to_iommu(dev, &bus, &devfn); - if (!iommu) - return -ENODEV; + if (!iommu) { + ret = -ENODEV; + goto unlock; + } info = dmar_search_domain_by_dev_info(iommu->segment, bus, devfn); if (!info) { pn->dev->bus->iommu_ops = &intel_iommu_ops; @@ -5011,8 +5013,10 @@ static int __init probe_acpi_namespace_devices(void) } if (!pn_dev) { iommu = device_to_iommu(dev, &bus, &devfn); - if (!iommu) - return -ENODEV; + if (!iommu) { + ret = -ENODEV; + goto unlock; + } info = dmar_search_domain_by_dev_info(iommu->segment, bus, devfn); if (!info) { dev->bus->iommu_ops = &intel_iommu_ops; -- 2.20.1

1 0

[PATCH openEuler-22.03-LTS] List: add info for debugging list
by Wang ShaoBo 10 Dec '22

10 Dec '22

Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> --- include/linux/list.h | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/include/linux/list.h b/include/linux/list.h index a18c87b63376..b858dc1ce663 100644 --- a/include/linux/list.h +++ b/include/linux/list.h @@ -7,6 +7,7 @@ #include <linux/poison.h> #include <linux/const.h> #include <linux/kernel.h> +#include <asm/bug.h> /* * Simple doubly linked list implementation. @@ -71,6 +72,17 @@ static inline void __list_add(struct list_head *new, new->next = next; new->prev = prev; WRITE_ONCE(prev->next, new); + + WARN_ON(next->prev != new); + WARN_ON(new->next != next); + WARN_ON(new->prev != prev); + WARN_ON(prev->next != new); + wmb(); + mb(); + WARN_ON(next->prev != new); + WARN_ON(new->next != next); + WARN_ON(new->prev != prev); + WARN_ON(prev->next != new); } /** @@ -111,6 +123,13 @@ static inline void __list_del(struct list_head * prev, struct list_head * next) { next->prev = prev; WRITE_ONCE(prev->next, next); + + WARN_ON(next->prev != prev); + WARN_ON(prev->next != next); + wmb(); + mb(); + WARN_ON(next->prev != prev); + WARN_ON(prev->next != next); } /* -- 2.25.1

1 0

[PATCH openEuler-22.03-LTS 0/2] add debug info
by Wang ShaoBo 09 Dec '22

09 Dec '22

add debug info Wang ShaoBo (1): waitqueue: add info for debugging Yu Liao (1): timer: add info for debugging include/linux/dwait.h | 6 +++++ kernel/sched/wait.c | 39 +++++++++++++++++++++++++++++ kernel/time/timer.c | 8 ++++++ lib/list_debug.c | 57 +++++++++++++++++++++++++++++++++++++++---- 4 files changed, 105 insertions(+), 5 deletions(-) create mode 100644 include/linux/dwait.h -- 2.25.1

1 2

【知会】https://gitee.com/openeuler/kernel 仓 openEuler-22.03-LTS-SP1分支已从主干OLK-5.10分支拉取
by Zhengzengkai 08 Dec '22

08 Dec '22

Hi All, https://gitee.com/openeuler/kernel 仓 openEuler-22.03-LTS-SP1分支已从主干OLK-5.10分支拉取，后续合入openEuler-22.03-LTS-SP1分支的补丁，目标分支请提到openEuler-22.03-LTS-SP1分支，如需同步主干，请在PR中评论/sync OLK-5.10 或另提到OLK-5.10分支。谢谢！

1 0

[PATCH openEuler-5.10 01/37] sched: Fix null-ptr-deref in free_fair_sched_group
by Zheng Zengkai 08 Dec '22

08 Dec '22

From: Hui Tang <tanghui20(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187419, https://gitee.com/openeuler/kernel/issues/I612FD ------------------------------- do_el0_svc+0x50/0x11c arch/arm64/kernel/syscall.c:217 el0_svc+0x20/0x30 arch/arm64/kernel/entry-common.c:353 el0_sync_handler+0xe4/0x1e0 arch/arm64/kernel/entry-common.c:369 el0_sync+0x148/0x180 arch/arm64/kernel/entry.S:683 ================================================================== BUG: KASAN: null-ptr-deref in rq_of kernel/sched/sched.h:1118 [inline] BUG: KASAN: null-ptr-deref in unthrottle_qos_sched_group kernel/sched/fair.c:7619 [inline] BUG: KASAN: null-ptr-deref in free_fair_sched_group+0x124/0x320 kernel/sched/fair.c:12131 Read of size 8 at addr 0000000000000130 by task syz-executor100/223 CPU: 3 PID: 223 Comm: syz-executor100 Not tainted 5.10.0 #6 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x0/0x40c arch/arm64/kernel/stacktrace.c:132 show_stack+0x30/0x40 arch/arm64/kernel/stacktrace.c:196 __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1b4/0x248 lib/dump_stack.c:118 __kasan_report mm/kasan/report.c:551 [inline] kasan_report+0x18c/0x210 mm/kasan/report.c:564 check_memory_region_inline mm/kasan/generic.c:187 [inline] __asan_load8+0x98/0xc0 mm/kasan/generic.c:253 rq_of kernel/sched/sched.h:1118 [inline] unthrottle_qos_sched_group kernel/sched/fair.c:7619 [inline] free_fair_sched_group+0x124/0x320 kernel/sched/fair.c:12131 sched_free_group kernel/sched/core.c:7767 [inline] sched_create_group+0x48/0xc0 kernel/sched/core.c:7798 cpu_cgroup_css_alloc+0x18/0x40 kernel/sched/core.c:7930 css_create+0x7c/0x4a0 kernel/cgroup/cgroup.c:5328 cgroup_apply_control_enable+0x288/0x340 kernel/cgroup/cgroup.c:3135 cgroup_apply_control kernel/cgroup/cgroup.c:3217 [inline] cgroup_subtree_control_write+0x668/0x8b0 kernel/cgroup/cgroup.c:3375 cgroup_file_write+0x1a8/0x37c kernel/cgroup/cgroup.c:3909 kernfs_fop_write_iter+0x220/0x2f4 fs/kernfs/file.c:296 call_write_iter include/linux/fs.h:1960 [inline] new_sync_write+0x260/0x370 fs/read_write.c:515 vfs_write+0x3dc/0x4ac fs/read_write.c:602 ksys_write+0xfc/0x200 fs/read_write.c:655 __do_sys_write fs/read_write.c:667 [inline] __se_sys_write fs/read_write.c:664 [inline] __arm64_sys_write+0x50/0x60 fs/read_write.c:664 __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline] invoke_syscall arch/arm64/kernel/syscall.c:48 [inline] el0_svc_common.constprop.0+0xf4/0x414 arch/arm64/kernel/syscall.c:155 do_el0_svc+0x50/0x11c arch/arm64/kernel/syscall.c:217 el0_svc+0x20/0x30 arch/arm64/kernel/entry-common.c:353 el0_sync_handler+0xe4/0x1e0 arch/arm64/kernel/entry-common.c:369 el0_sync+0x148/0x180 arch/arm64/kernel/entry.S:683 So add check for tg->cfs_rq[i] before unthrottle_qos_sched_group() called. Signed-off-by: Hui Tang <tanghui20(a)huawei.com> Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> Reviewed-by: Zhang Qiao <zhangqiao22(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- kernel/sched/fair.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 7fa2eecac1f4..654e964b5c31 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -12157,7 +12157,7 @@ void free_fair_sched_group(struct task_group *tg) for_each_possible_cpu(i) { #ifdef CONFIG_QOS_SCHED - if (tg->cfs_rq) + if (tg->cfs_rq && tg->cfs_rq[i]) unthrottle_qos_sched_group(tg->cfs_rq[i]); #endif if (tg->cfs_rq) -- 2.20.1

1 36

[PATCH openEuler-1.0-LTS] mm/sharepool: Fix a double free problem caused by init_local_group
by Yongqiang Liu 08 Dec '22

08 Dec '22

From: Chen Jun <chenjun102(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I64Y5Y CVE: NA ------------------------------- If local_group_add_task fails in init_local_group. ida free the same id twice. init_local_group local_group_add_task // failed goto free_spg free_spg: free_sp_group_locked free_sp_group_id // free spg->id free_spg_id: free_new_spg_id // double free spg->id To fix it, return before calling free_new_spg_id. Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> Reviewed-by: chenweilong <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- mm/share_pool.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/mm/share_pool.c b/mm/share_pool.c index 41ed3a3b8682..d2591c73a503 100644 --- a/mm/share_pool.c +++ b/mm/share_pool.c @@ -301,8 +301,8 @@ static int init_local_group(struct mm_struct *mm) spg = create_spg(spg_id, 0); if (IS_ERR(spg)) { - ret = PTR_ERR(spg); - goto free_spg_id; + free_new_spg_id(true, spg_id); + return PTR_ERR(spg); } master->local = spg; @@ -322,11 +322,9 @@ static int init_local_group(struct mm_struct *mm) return 0; free_spg: + /* spg_id is freed in free_sp_group_locked */ free_sp_group_locked(spg); master->local = NULL; -free_spg_id: - free_new_spg_id(true, spg_id); - return ret; } -- 2.25.1

1 0