- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] fs/dcache.c: avoid panic while lockref of dentry overflow
by Zizhi Wo 25 Nov '23

25 Nov '23

From: yangerkun <yangerkun(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8JDP6?from=project-issue --------------------------- We use lockref for dentry reference without notice that so many negative dentry under one dir can lead to overflow of lockref. This can lead to system crash if we do this under root dir. Since there is not a perfect solution, we just limit max number of dentry count up to INT_MAX / 2. Also, it will cost a lot of time from INT_MAX / 2 to INT_MAX, so we no need to do this under protection of dentry lock. Also, we limit the FILES_MAX to INT_MAX / 2, since a lot open for same file can lead to overflow too. Changelog: v1->v2: add a function to do check / add a Macro to mean INT_MAX / 2 Signed-off-by: yangerkun <yangerkun(a)huawei.com> Reviewed-by: Miao Xie <miaoxie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Conflicts: fs/dcache.c Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/dcache.c | 32 ++++++++++++++++++++++++++++---- include/linux/fs.h | 3 +++ 2 files changed, 31 insertions(+), 4 deletions(-) diff --git a/fs/dcache.c b/fs/dcache.c index 25ac74d30bff..7cdd8bbedd1c 100644 --- a/fs/dcache.c +++ b/fs/dcache.c @@ -1834,6 +1834,18 @@ static struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name) return dentry; } +static inline bool d_forbid_overflow(struct dentry *dentry) +{ + if (unlikely(d_count(dentry) >= D_COUNT_MAX)) { + shrink_dcache_parent(dentry); + + if (d_count(dentry) >= D_COUNT_MAX) + return false; + } + + return true; +} + /** * d_alloc - allocate a dcache entry * @parent: parent of entry to allocate @@ -1845,9 +1857,15 @@ static struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name) */ struct dentry *d_alloc(struct dentry * parent, const struct qstr *name) { - struct dentry *dentry = __d_alloc(parent->d_sb, name); + struct dentry *dentry = NULL; + + if (unlikely(!d_forbid_overflow(parent))) + goto out; + + dentry = __d_alloc(parent->d_sb, name); if (!dentry) - return NULL; + goto out; + spin_lock(&parent->d_lock); /* * don't need child lock because it is not subject @@ -1857,7 +1875,7 @@ struct dentry *d_alloc(struct dentry * parent, const struct qstr *name) dentry->d_parent = parent; list_add(&dentry->d_child, &parent->d_subdirs); spin_unlock(&parent->d_lock); - +out: return dentry; } EXPORT_SYMBOL(d_alloc); @@ -1870,11 +1888,17 @@ EXPORT_SYMBOL(d_alloc_anon); struct dentry *d_alloc_cursor(struct dentry * parent) { - struct dentry *dentry = d_alloc_anon(parent->d_sb); + struct dentry *dentry = NULL; + + if (unlikely(!d_forbid_overflow(parent))) + goto out; + + dentry = d_alloc_anon(parent->d_sb); if (dentry) { dentry->d_flags |= DCACHE_DENTRY_CURSOR; dentry->d_parent = dget(parent); } +out: return dentry; } diff --git a/include/linux/fs.h b/include/linux/fs.h index 4a40823c3c67..4f6b15e960ec 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -47,6 +47,9 @@ #include <asm/byteorder.h> #include <uapi/linux/fs.h> +#define D_COUNT_MAX (INT_MAX / 2) + + struct backing_dev_info; struct bdi_writeback; struct bio; -- 2.39.2

2 1

[PATCH OLK-6.6] hugetlbfs: avoid overflow in hugetlbfs_fallocate
by Zizhi Wo 25 Nov '23

25 Nov '23

From: yangerkun <yangerkun(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8JDQ7?from=project-issue --------------------------- luojiajun report a problem[1] two years ago which seems still exists in mainline. vfs_fallocate can avoid 'offset + len' trigger overflow, but 'offset + len + hpage_size - 1' may overflow too and will lead to a wrong 'end'. luojiajun give a solution which can fix the wrong 'end' but leave the overflow still happened. Fix it with DIV_ROUND_UP_ULL. [1] https://patchwork.kernel.org/project/linux-mm/patch/1554775226-67213-1-git-… Signed-off-by: yangerkun <yangerkun(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/hugetlbfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c index 316c4cebd3f3..cb6a5ea74cda 100644 --- a/fs/hugetlbfs/inode.c +++ b/fs/hugetlbfs/inode.c @@ -836,7 +836,7 @@ static long hugetlbfs_fallocate(struct file *file, int mode, loff_t offset, * as well as being converted to page offsets. */ start = offset >> hpage_shift; - end = (offset + len + hpage_size - 1) >> hpage_shift; + end = DIV_ROUND_UP_ULL(offset + len, hpage_size); inode_lock(inode); -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS 0/4] Add script to check & update openeuler_defconfig
by Jialin Zhang 25 Nov '23

25 Nov '23

Jialin Zhang (3): Revert "kconfig: Add script to update openeuler_defconfig" config: update openeuler_defconfig for x86 config: update openeuler_defconfig for arm64 Xie XiuQi (1): kconfig: Add script to check & update openeuler_defconfig arch/arm64/configs/openeuler_defconfig | 32 ++++++++++++++++++-------- arch/x86/configs/openeuler_defconfig | 12 ++++++---- scripts/kconfig/Makefile | 14 +++++++++++ scripts/kconfig/makeconfig.sh | 5 ++++ 4 files changed, 49 insertions(+), 14 deletions(-) -- 2.25.1

2 5

[PATCH openEuler-22.03-LTS-SP1 0/4] Add script to check & update openeuler_defconfig
by Jialin Zhang 25 Nov '23

25 Nov '23

Jialin Zhang (3): Revert "kconfig: Add script to update openeuler_defconfig" config: update openeuler_defconfig for x86 config: update openeuler_defconfig for arm64 Xie XiuQi (1): kconfig: Add script to check & update openeuler_defconfig arch/arm64/configs/openeuler_defconfig | 26 ++++++++++++++++++-------- arch/x86/configs/openeuler_defconfig | 8 +++----- scripts/kconfig/Makefile | 14 ++++++++++++++ scripts/kconfig/makeconfig.sh | 5 +++++ 4 files changed, 40 insertions(+), 13 deletions(-) -- 2.25.1

2 5

[PATCH openEuler-22.03-LTS-SP2 0/4] Add script to check & update openeuler_defconfig
by Jialin Zhang 25 Nov '23

25 Nov '23

Jialin Zhang (3): Revert "kconfig: Add script to update openeuler_defconfig" config: update openeuler_defconfig for x86 config: update openeuler_defconfig for arm64 Xie XiuQi (1): kconfig: Add script to check & update openeuler_defconfig arch/arm64/configs/openeuler_defconfig | 51 +++++++++++++++++--------- arch/x86/configs/openeuler_defconfig | 32 ++++++++++------ scripts/kconfig/Makefile | 14 +++++++ scripts/kconfig/makeconfig.sh | 5 +++ 4 files changed, 74 insertions(+), 28 deletions(-) -- 2.25.1

2 5

[PATCH openEuler-1.0-LTS] x86/mce/inject: Fix a wrong assignment of i_mce.status
by liwei 25 Nov '23

25 Nov '23

From: Zhenzhong Duan <zhenzhong.duan(a)gmail.com> mainline inclusion from mainline-v5.9-rc1 commit 5d7f7d1d5e01c22894dee7c9c9266500478dca99 category: bugfix bugzilla: 189383 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- The original code is a nop as i_mce.status is or'ed with part of itself, fix it. Fixes: a1300e505297 ("x86/ras/mce_amd_inj: Trigger deferred and thresholding errors interrupts") Signed-off-by: Zhenzhong Duan <zhenzhong.duan(a)gmail.com> Signed-off-by: Borislav Petkov <bp(a)suse.de> Acked-by: Yazen Ghannam <yazen.ghannam(a)amd.com> Link: https://lkml.kernel.org/r/20200611023238.3830-1-zhenzhong.duan@gmail.com Signed-off-by: liwei <liwei728(a)huawei.com> --- arch/x86/kernel/cpu/mce/inject.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kernel/cpu/mce/inject.c b/arch/x86/kernel/cpu/mce/inject.c index 3f82afd0f46f..f21f3f26c555 100644 --- a/arch/x86/kernel/cpu/mce/inject.c +++ b/arch/x86/kernel/cpu/mce/inject.c @@ -518,7 +518,7 @@ static void do_inject(void) */ if (inj_type == DFR_INT_INJ) { i_mce.status |= MCI_STATUS_DEFERRED; - i_mce.status |= (i_mce.status & ~MCI_STATUS_UC); + i_mce.status &= ~MCI_STATUS_UC; } /* -- 2.25.1

2 1

[PATCH OLK-6.6] io_uring: fix soft lockup in io_submit_sqes()
by Zizhi Wo 25 Nov '23

25 Nov '23

From: Guo Xuenan <guoxuenan(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5930C ------------------- when set up sq ring size with IORING_MAX_ENTRIES, io_submit_sqes may looping ~32768 times which may trigger soft lockups. add cond_resched condition to avoid this bad situation. set sq ring size 32768 to perform stress test as follows: watchdog: BUG: soft lockup - CPU#3 stuck for 26s! [poc:691] Modules linked in: CPU: 3 PID: 691 Comm: poc Not tainted 5.18.0+ #9 Hardware name: linux,dummy-virt (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : arch_local_irq_enable+0xc/0x28 lr : io_issue_sqe+0x870/0x28e8 sp : ffff80000e0f7800 x29: ffff80000e0f7800 x28: ffff0000cf850dd0 x27: ffff0000cf2c2000 x26: ffff8000096f4b20 x25: ffff0000cd769c00 x24: ffff0000c12b6650 x23: ffff800009dad958 x22: 00000006fc23ac00 x21: ffff0000cd769c08 x20: 1ffff00001c1ef1a x19: ffff0000cd767e00 x18: 0000000000000000 x17: ffff800008032b74 x16: ffff800008636448 x15: 0000fffff7166568 x14: ffff80000861edf0 x13: ffff600019e58449 x12: 1fffe00019e58448 x11: 1fffe00019e58448 x10: ffff600019e58448 x9 : dfff800000000000 x8 : ffff0000cf2c2244 x7 : 0000000000000001 x6 : ffff600019e58449 x5 : ffff600019e58449 x4 : ffff600019e58449 x3 : ffff8000086306c0 x2 : 0000000000000001 x1 : ffff0000cf2c2244 x0 : 00000000000000e0 Call trace: arch_local_irq_enable+0xc/0x28 io_submit_sqes+0x530/0x29d8 __arm64_sys_io_uring_enter+0x380/0xd18 invoke_syscall+0x64/0x180 el0_svc_common.constprop.2+0x178/0x208 do_el0_svc+0x84/0xa0 el0_svc+0x48/0x1a0 el0t_64_sync_handler+0x90/0xb8 el0t_64_sync+0x180/0x184 Kernel panic - not syncing: softlockup: hung tasks CPU: 3 PID: 691 Comm: poc Tainted: G L 5.18.0+ #9 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x218/0x228 show_stack+0x20/0x68 dump_stack_lvl+0x68/0x84 dump_stack+0x1c/0x38 panic+0x1ec/0x3ec watchdog_timer_fn+0x28c/0x300 __hrtimer_run_queues+0x1d8/0x498 hrtimer_interrupt+0x238/0x558 arch_timer_handler_virt+0x48/0x60 handle_percpu_devid_irq+0xdc/0x270 generic_handle_domain_irq+0x50/0x70 gic_handle_irq+0x8c/0x4bc call_on_irq_stack+0x2c/0x38 do_interrupt_handler+0xc4/0xc8 el1_interrupt+0x48/0xb0 el1h_64_irq_handler+0x18/0x28 el1h_64_irq+0x74/0x78 arch_local_irq_enable+0xc/0x28 io_submit_sqes+0x530/0x29d8 __arm64_sys_io_uring_enter+0x380/0xd18 invoke_syscall+0x64/0x180 el0_svc_common.constprop.2+0x178/0x208 do_el0_svc+0x84/0xa0 el0_svc+0x48/0x1a0 el0t_64_sync_handler+0x90/0xb8 el0t_64_sync+0x180/0x184 SMP: stopping secondary CPUs Kernel Offset: disabled CPU features: 0x110,00008f09,00001006 Memory Limit: none ---[ end Kernel panic - not syncing: softlockup: hung tasks ]--- Link: https://lore.kernel.org/all/d4bc3afb-02d5-1793-cffa-e15b2bdb0028@huawei.com/ Signed-off-by: Guo Xuenan <guoxuenan(a)huawei.com> Conflict: io_uring/io_uring.c Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- io_uring/io_uring.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 8d1bc6cdfe71..d79e78971ec5 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -2440,6 +2440,9 @@ int io_submit_sqes(struct io_ring_ctx *ctx, unsigned int nr) left--; break; } + /* to avoid doing too much in one submit round */ + if (left > IORING_MAX_ENTRIES / 2) + cond_resched(); } while (--left); if (unlikely(left)) { -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS] x86/mce/amd: Publish the bank pointer only after setup has succeeded
by liwei 25 Nov '23

25 Nov '23

From: Borislav Petkov <bp(a)suse.de> mainline inclusion from mainline-v5.6-rc3 commit 6e5cf31fbe651bed7ba1df768f2e123531132417 category: bugfix bugzilla: 189381 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- threshold_create_bank() creates a bank descriptor per MCA error thresholding counter which can be controlled over sysfs. It publishes the pointer to that bank in a per-CPU variable and then goes on to create additional thresholding blocks if the bank has such. However, that creation of additional blocks in allocate_threshold_blocks() can fail, leading to a use-after-free through the per-CPU pointer. Therefore, publish that pointer only after all blocks have been setup successfully. Fixes: 019f34fccfd5 ("x86, MCE, AMD: Move shared bank to node descriptor") Reported-by: Saar Amar <Saar.Amar(a)microsoft.com> Reported-by: Dan Carpenter <dan.carpenter(a)oracle.com> Signed-off-by: Borislav Petkov <bp(a)suse.de> Cc: <stable(a)vger.kernel.org> Link: http://lkml.kernel.org/r/20200128140846.phctkvx5btiexvbx@kili.mountain Signed-off-by: liwei <liwei728(a)huawei.com> --- arch/x86/kernel/cpu/mce/amd.c | 33 ++++++++++++++++----------------- 1 file changed, 16 insertions(+), 17 deletions(-) diff --git a/arch/x86/kernel/cpu/mce/amd.c b/arch/x86/kernel/cpu/mce/amd.c index 38b18fa055ef..af4a83695970 100644 --- a/arch/x86/kernel/cpu/mce/amd.c +++ b/arch/x86/kernel/cpu/mce/amd.c @@ -1200,8 +1200,9 @@ static const char *get_name(unsigned int bank, struct threshold_block *b) return buf_mcatype; } -static int allocate_threshold_blocks(unsigned int cpu, unsigned int bank, - unsigned int block, u32 address) +static int allocate_threshold_blocks(unsigned int cpu, struct threshold_bank *tb, + unsigned int bank, unsigned int block, + u32 address) { struct threshold_block *b = NULL; u32 low, high; @@ -1245,16 +1246,12 @@ static int allocate_threshold_blocks(unsigned int cpu, unsigned int bank, INIT_LIST_HEAD(&b->miscj); - if (per_cpu(threshold_banks, cpu)[bank]->blocks) { - list_add(&b->miscj, - &per_cpu(threshold_banks, cpu)[bank]->blocks->miscj); - } else { - per_cpu(threshold_banks, cpu)[bank]->blocks = b; - } + if (tb->blocks) + list_add(&b->miscj, &tb->blocks->miscj); + else + tb->blocks = b; - err = kobject_init_and_add(&b->kobj, &threshold_ktype, - per_cpu(threshold_banks, cpu)[bank]->kobj, - get_name(bank, b)); + err = kobject_init_and_add(&b->kobj, &threshold_ktype, tb->kobj, get_name(bank, b)); if (err) goto out_free; recurse: @@ -1262,7 +1259,7 @@ static int allocate_threshold_blocks(unsigned int cpu, unsigned int bank, if (!address) return 0; - err = allocate_threshold_blocks(cpu, bank, block, address); + err = allocate_threshold_blocks(cpu, tb, bank, block, address); if (err) goto out_free; @@ -1347,8 +1344,6 @@ static int threshold_create_bank(unsigned int cpu, unsigned int bank) goto out_free; } - per_cpu(threshold_banks, cpu)[bank] = b; - if (is_shared_bank(bank)) { refcount_set(&b->cpus, 1); @@ -1359,9 +1354,13 @@ static int threshold_create_bank(unsigned int cpu, unsigned int bank) } } - err = allocate_threshold_blocks(cpu, bank, 0, msr_ops.misc(bank)); - if (!err) - goto out; + err = allocate_threshold_blocks(cpu, b, bank, 0, msr_ops.misc(bank)); + if (err) + goto out_free; + + per_cpu(threshold_banks, cpu)[bank] = b; + + return 0; out_free: kfree(b); -- 2.25.1

2 1

[PATCH OLK-5.10 0/4] Add script to check & update openeuler_defconfig
by Jialin Zhang 25 Nov '23

25 Nov '23

Jialin Zhang (3): Revert "kconfig: Add script to update openeuler_defconfig" config: update openeuler_defconfig for x86 config: update openeuler_defconfig for arm64 Xie XiuQi (1): kconfig: Add script to check & update openeuler_defconfig arch/arm64/configs/openeuler_defconfig | 60 +++++++++++++++++--------- arch/x86/configs/openeuler_defconfig | 39 +++++++++++------ scripts/kconfig/Makefile | 14 ++++++ scripts/kconfig/makeconfig.sh | 5 +++ 4 files changed, 86 insertions(+), 32 deletions(-) -- 2.25.1

2 5

[PATCH openEuler-1.0-LTS 0/2] Backport crypto bugfix
by Yi Yang 25 Nov '23

25 Nov '23

crypto bugfix and fix kabi broken. Herbert Xu (1): crypto: api - Use work queue in crypto_destroy_instance Yi Yang (1): crypto: fix kabi broken in struct crypto_instance crypto/algapi.c | 29 +++++++++++++++++++++++++++-- include/crypto/algapi.h | 6 ++++++ 2 files changed, 33 insertions(+), 2 deletions(-) -- 2.25.1

2 3