- Kernel - mailweb.openeuler.org

[PATCH v4 OLK-5.10 0/9] Add support for hbm memory device and
by Zhang Zekun 02 Mar '23

02 Mar '23

v4: - prettify the code v3: - prettify the code - add a hisi_internal.h to hold common code v2: - remove the !adev judge in patch 9, as it will always be true. patch 1-3: Add support for iterate through the child devices in the acpi device. patch 4-9: Add support for hbm memory device and hbm cache support Rafael J. Wysocki (3): ACPI: bus: Introduce acpi_dev_for_each_child() ACPI: bus: Avoid non-ACPI device objects in walks over children ACPI: bus: Export acpi_dev_for_each_child() to modules Zhang Zekun (6): ACPI: container: export the container list in the system ACPI: OSL: Export the symbol of acpi_hotplug_schedule soc: hisilicon: hisi_hbmdev: Add power domain control methods ACPI: memhotplug: export the state of each hotplug device soc: hisilicon: hisi_hbmdev: Provide extra memory topology information ACPI: hbmcache: Add support for online and offline the hbm cache drivers/acpi/acpi_memhotplug.c | 6 + drivers/acpi/bus.c | 27 ++++ drivers/acpi/container.c | 51 ++++++ drivers/acpi/internal.h | 1 - drivers/acpi/osl.c | 1 + drivers/soc/Kconfig | 1 + drivers/soc/Makefile | 1 + drivers/soc/hisilicon/Kconfig | 33 ++++ drivers/soc/hisilicon/Makefile | 4 + drivers/soc/hisilicon/hisi_hbmcache.c | 147 +++++++++++++++++ drivers/soc/hisilicon/hisi_hbmdev.c | 218 ++++++++++++++++++++++++++ drivers/soc/hisilicon/hisi_internal.h | 31 ++++ include/acpi/acpi_bus.h | 2 + include/linux/acpi.h | 1 + include/linux/container.h | 8 + include/linux/memory_hotplug.h | 2 + 16 files changed, 533 insertions(+), 1 deletion(-) create mode 100644 drivers/soc/hisilicon/Kconfig create mode 100644 drivers/soc/hisilicon/Makefile create mode 100644 drivers/soc/hisilicon/hisi_hbmcache.c create mode 100644 drivers/soc/hisilicon/hisi_hbmdev.c create mode 100644 drivers/soc/hisilicon/hisi_internal.h -- 2.17.1

1 9

Re: [PATCH v3 OLK-5.10 6/9] soc: hisilicon: hisi_hbmdev: Add power domain control methods
by zhangzekun (A) 02 Mar '23

02 Mar '23

在 2023/3/2 15:12, Kefeng Wang 写道: > > > On 2023/3/2 14:51, Zhang Zekun wrote: >> Offering: HULK >> hulk inclusion >> category: feature >> bugzilla: https://gitee.com/openeuler/kernel/issues/I67QNJ >> CVE: NA >> >> ------------------------------------------------------------------ >> >> Platform devices which supports power control are often required to be >> power off/on together with the devices in the same power domain. >> However, >> there isn't a generic driver that support the power control logic of >> these devices. >> >> ACPI container seems to be a good place to hold these control logic. Add >> platform devices in the same power domain in a ACPI container, we can >> easily get the locality information about these devices and can moniter >> the power of these devices in the same power domain together. >> >> This patch provide three userspace control interface to control the >> power >> of devices together in the container: >> - state: Echo online to state to power up the devices in the >> container and >> then online these devices which will be triggered by BIOS. Echo >> offline >> to the state to offline and eject the child devices in the container >> which are ejectable. >> - pxms: show the pxms of devices which are present in the container. >> >> In our scenario, we need to control the power of HBM memory devices >> which >> can be power consuming and will only be used in some specialized >> scenarios, >> such as HPC. HBM memory devices in a socket are in the same power >> domain, >> and should be power off/on together. We have come up with an idea >> that put >> these power control logic in a specialized driver, but ACPI container >> seems >> to be a more generic place to hold these control logic. >> >> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> >> --- >> v3: >> - move the common code to hisi_internal.h >> >> drivers/soc/Kconfig | 1 + >> drivers/soc/Makefile | 1 + >> drivers/soc/hisilicon/Kconfig | 19 +++ >> drivers/soc/hisilicon/Makefile | 3 + >> drivers/soc/hisilicon/hisi_hbmdev.c | 166 ++++++++++++++++++++++++++ >> drivers/soc/hisilicon/hisi_internal.h | 31 +++++ >> 6 files changed, 221 insertions(+) >> create mode 100644 drivers/soc/hisilicon/Kconfig >> create mode 100644 drivers/soc/hisilicon/Makefile >> create mode 100644 drivers/soc/hisilicon/hisi_hbmdev.c >> create mode 100644 drivers/soc/hisilicon/hisi_internal.h >> >> diff --git a/drivers/soc/Kconfig b/drivers/soc/Kconfig >> index 425ab6f7e375..f7c59b063321 100644 >> --- a/drivers/soc/Kconfig >> +++ b/drivers/soc/Kconfig >> @@ -23,5 +23,6 @@ source "drivers/soc/versatile/Kconfig" >> source "drivers/soc/xilinx/Kconfig" >> source "drivers/soc/zte/Kconfig" >> source "drivers/soc/kendryte/Kconfig" >> +source "drivers/soc/hisilicon/Kconfig" >> endmenu >> diff --git a/drivers/soc/Makefile b/drivers/soc/Makefile >> index 36452bed86ef..68f186e00e44 100644 >> --- a/drivers/soc/Makefile >> +++ b/drivers/soc/Makefile >> @@ -29,3 +29,4 @@ obj-$(CONFIG_PLAT_VERSATILE) += versatile/ >> obj-y += xilinx/ >> obj-$(CONFIG_ARCH_ZX) += zte/ >> obj-$(CONFIG_SOC_KENDRYTE) += kendryte/ >> +obj-y += hisilicon/ >> diff --git a/drivers/soc/hisilicon/Kconfig >> b/drivers/soc/hisilicon/Kconfig >> new file mode 100644 >> index 000000000000..497787af004e >> --- /dev/null >> +++ b/drivers/soc/hisilicon/Kconfig >> @@ -0,0 +1,19 @@ >> +# SPDX-License-Identifier: GPL-2.0 >> +# >> +# Hisilicon SoC drivers >> +# >> +menu "Hisilicon SoC driver support" >> + >> +config HISI_HBMDEV >> + tristate "add extra support for hbm memory device" >> + depends on ACPI_HOTPLUG_MEMORY >> + select ACPI_CONTAINER >> + help >> + This driver add extra supports for memory devices. The driver >> + provides methods for userpace to control the power of memory >> + devices in a container. >> + >> + To compile this driver as a module, choose M here: >> + the module will be called hisi_hbmdev. >> + >> +endmenu >> diff --git a/drivers/soc/hisilicon/Makefile >> b/drivers/soc/hisilicon/Makefile >> new file mode 100644 >> index 000000000000..22e87acb1ab3 >> --- /dev/null >> +++ b/drivers/soc/hisilicon/Makefile >> @@ -0,0 +1,3 @@ >> +# SPDX-License-Identifier: GPL-2.0 >> + >> +obj-$(CONFIG_HISI_HBMDEV) += hisi_hbmdev.o >> diff --git a/drivers/soc/hisilicon/hisi_hbmdev.c >> b/drivers/soc/hisilicon/hisi_hbmdev.c >> new file mode 100644 >> index 000000000000..82943cd35fa2 >> --- /dev/null >> +++ b/drivers/soc/hisilicon/hisi_hbmdev.c >> @@ -0,0 +1,166 @@ >> +// SPDX-License-Identifier: GPL-2.0 >> +/* >> + * Copyright (C) Huawei Technologies Co., Ltd. 2023. All rights >> reserved. >> + */ >> + >> +#include <linux/kobject.h> >> +#include <linux/module.h> >> +#include <linux/nodemask.h> >> +#include <linux/acpi.h> >> +#include <linux/container.h> >> + >> +#include "hisi_internal.h" >> + >> +struct memory_dev { >> + struct kobject *memdev_kobj; >> +}; >> + >> +static struct memory_dev *mdev; >> + >> +static int get_pxm(struct acpi_device *acpi_device, void *arg) >> +{ >> + int nid; >> + unsigned long long sta; >> + acpi_handle handle; >> + nodemask_t *mask; >> + acpi_status status; >> + >> + mask = arg; >> + handle = acpi_device->handle; > > 按照倒金字塔， > acpi_handle handle = acpi_device->handle; > nodemask_t *mask = arg; > unsigned long long sta; > acpi_status status; > int nid; >> + >> + status = acpi_evaluate_integer(handle, "_STA", NULL, &sta); >> + if (ACPI_SUCCESS(status) && (sta & ACPI_STA_DEVICE_ENABLED)) { >> + nid = acpi_get_node(handle); >> + if (nid >= 0) >> + node_set(nid, *mask); >> + } >> + >> + return 0; >> +} >> + >> +static ssize_t pxms_show(struct device *dev, >> + struct device_attribute *attr, >> + char *buf) >> +{ >> + nodemask_t mask; >> + struct acpi_device *adev; >> + >> + adev = to_acpi_device(dev); > 同上 > >> + nodes_clear(mask); >> + acpi_dev_for_each_child(adev, get_pxm, &mask); >> + >> + return sysfs_emit(buf, "%*pbl\n", >> + nodemask_pr_args(&mask)); >> +} >> +static DEVICE_ATTR_RO(pxms); >> + >> +static int memdev_power_on(struct acpi_device *adev) >> +{ >> + acpi_status status; >> + acpi_handle handle; >> + >> + handle = adev->handle; > ... >> + status = acpi_evaluate_object(handle, "_ON", NULL, NULL); >> + if (ACPI_FAILURE(status)) { >> + acpi_handle_warn(handle, "Power on failed (0x%x)\n", status); >> + return -ENODEV; >> + } >> + >> + return 0; >> +} >> + >> +static int eject_device(struct acpi_device *acpi_device, void >> *not_used) >> +{ >> + acpi_object_type unused; >> + acpi_status status; >> + >> + status = acpi_get_type(acpi_device->handle, &unused); >> + if (ACPI_FAILURE(status) || !acpi_device->flags.ejectable) >> + return -ENODEV; >> + >> + get_device(&acpi_device->dev); >> + status = acpi_hotplug_schedule(acpi_device, >> ACPI_OST_EC_OSPM_EJECT); >> + if (ACPI_SUCCESS(status)) >> + return 0; >> + >> + put_device(&acpi_device->dev); >> + acpi_evaluate_ost(acpi_device->handle, ACPI_OST_EC_OSPM_EJECT, >> + ACPI_OST_SC_NON_SPECIFIC_FAILURE, NULL); >> + >> + return status == AE_NO_MEMORY ? -ENOMEM : -EAGAIN; >> +} >> + >> +static int memdev_power_off(struct acpi_device *adev) >> +{ >> + return acpi_dev_for_each_child(adev, eject_device, NULL); >> +} >> + >> +static ssize_t state_store(struct device *d, struct device_attribute >> *attr, >> + const char *buf, size_t count) >> +{ >> + int ret; >> + struct acpi_device *adev; >> + const int online_type = online_type_from_str(buf); >> + >> + if (online_type < 0) >> + return -EINVAL; >> + >> + adev = to_acpi_device(d); > > > const int online_type = online_type_from_str(buf); > struct acpi_device *adev = to_acpi_device(d); > int ret; > ... > > >> + switch (online_type) { >> + case STATE_ONLINE: >> + ret = memdev_power_on(adev); >> + if (!ret) >> + return count; >> + break; >> + case STATE_OFFLINE: >> + ret = memdev_power_off(adev); >> + if (!ret) >> + return count; >> + break; >> + default: >> + return -EINVAL; >> + } > 这个有点奇怪，hbm cache和mem的热插拔的函数不能搞成类似的逻辑吗这里改成这样吧 { struct acpi_device *adev = to_acpi_device(d); const int type = online_type_from_str(buf); int ret = -EINVAL; switch (type) { case STATE_ONLINE: ret = memdev_power_on(adev); break; case STATE_OFFLINE: ret = memdev_power_off(adev); break; default: break; } if (ret) return ret; return count; } >> + >> + return ret; >> +} >> +static DEVICE_ATTR_WO(state); >> + >> +static int __init mdev_init(void) >> +{ >> + struct cdev_node *cnode; >> + >> + mdev = kzalloc(sizeof(struct memory_dev), GFP_KERNEL); >> + if (!mdev) >> + return -ENOMEM; >> + >> + mdev->memdev_kobj = kobject_create_and_add("hbm_memory", >> kernel_kobj); >> + if (!mdev->memdev_kobj) { >> + kfree(mdev); >> + return -ENOMEM; >> + } >> + >> + list_for_each_entry(cnode, &cdev_list->clist, clist) { >> + device_create_file(cnode->dev, &dev_attr_state); >> + device_create_file(cnode->dev, &dev_attr_pxms); >> + } >> + >> + return 0; >> +} >> +module_init(mdev_init); >> + >> +static void __exit mdev_exit(void) >> +{ >> + struct cdev_node *cnode; >> + >> + list_for_each_entry(cnode, &cdev_list->clist, clist) { >> + device_remove_file(cnode->dev, &dev_attr_state); >> + device_remove_file(cnode->dev, &dev_attr_pxms); >> + } >> + >> + kobject_put(mdev->memdev_kobj); >> + kfree(mdev); >> +} >> +module_exit(mdev_exit); >> + >> +MODULE_LICENSE("GPL v2"); >> +MODULE_AUTHOR("Zhang Zekun <zhangzekun11(a)huawei.com>"); >> diff --git a/drivers/soc/hisilicon/hisi_internal.h >> b/drivers/soc/hisilicon/hisi_internal.h >> new file mode 100644 >> index 000000000000..f14596f58a05 >> --- /dev/null >> +++ b/drivers/soc/hisilicon/hisi_internal.h >> @@ -0,0 +1,31 @@ >> +/* SPDX-License-Identifier: GPL-2.0 */ >> +/* >> + * Copyright (C) Huawei Technologies Co., Ltd. 2023. All rights >> reserved. >> + */ >> + >> +#ifndef _HISI_INTERNAL_H >> +#define _HISI_INTERNAL_H >> + >> +enum { >> + STATE_ONLINE, >> + STATE_OFFLINE, >> +}; >> + >> +static const char *const online_type_to_str[] = { >> + [STATE_ONLINE] = "online", >> + [STATE_OFFLINE] = "offline", >> +}; >> + >> +static int online_type_from_str(const char *str) > 不需要inline吗 >> +{ >> + int i; >> + >> + for (i = 0; i < ARRAY_SIZE(online_type_to_str); i++) { >> + if (sysfs_streq(str, online_type_to_str[i])) >> + return i; >> + } >> + >> + return -EINVAL; >> +} >> + >> +#endif

1 0

[PATCH v3 OLK-5.10 0/9] Add support for hbm memory device and
by Zhang Zekun 02 Mar '23

02 Mar '23

v3: - prettify the code - add a hisi_internal.h to hold common code v2: - remove the !adev judge in patch 9, as it will always be true. patch 1-3: Add support for iterate through the child devices in the acpi device. patch 4-9: Add support for hbm memory device and hbm cache support Rafael J. Wysocki (3): ACPI: bus: Introduce acpi_dev_for_each_child() ACPI: bus: Avoid non-ACPI device objects in walks over children ACPI: bus: Export acpi_dev_for_each_child() to modules Zhang Zekun (6): ACPI: container: export the container list in the system ACPI: OSL: Export the symbol of acpi_hotplug_schedule soc: hisilicon: hisi_hbmdev: Add power domain control methods ACPI: memhotplug: export the state of each hotplug device soc: hisilicon: hisi_hbmdev: Provide extra memory topology information ACPI: hbmcache: Add support for online and offline the hbm cache drivers/acpi/acpi_memhotplug.c | 6 + drivers/acpi/bus.c | 27 +++ drivers/acpi/container.c | 51 ++++++ drivers/acpi/internal.h | 1 - drivers/acpi/osl.c | 1 + drivers/soc/Kconfig | 1 + drivers/soc/Makefile | 1 + drivers/soc/hisilicon/Kconfig | 33 ++++ drivers/soc/hisilicon/Makefile | 4 + drivers/soc/hisilicon/hisi_hbmcache.c | 147 +++++++++++++++++ drivers/soc/hisilicon/hisi_hbmdev.c | 229 ++++++++++++++++++++++++++ drivers/soc/hisilicon/hisi_internal.h | 31 ++++ include/acpi/acpi_bus.h | 2 + include/linux/acpi.h | 1 + include/linux/container.h | 8 + include/linux/memory_hotplug.h | 2 + 16 files changed, 544 insertions(+), 1 deletion(-) create mode 100644 drivers/soc/hisilicon/Kconfig create mode 100644 drivers/soc/hisilicon/Makefile create mode 100644 drivers/soc/hisilicon/hisi_hbmcache.c create mode 100644 drivers/soc/hisilicon/hisi_hbmdev.c create mode 100644 drivers/soc/hisilicon/hisi_internal.h -- 2.17.1

1 9

[PATCH] Revert "scsi: fix iscsi rescan fails to create block"
by Zhong Jinghua 02 Mar '23

02 Mar '23

hulk inclusion category: bugfix bugzilla: 188150, https://gitee.com/openeuler/kernel/issues/I643OL ---------------------------------------- This reverts commit 7f10ea522db56188ae46c5bbee7052a2b2797515. This commit has a soft lock problem: watchdog: BUG: soft lockup - CPU#22 stuck for 67s! [iscsid:16369] Call Trace: scsi_remove_target+0x548/0x7b0 ? sdev_store_delete+0x90/0x90 ? __mutex_lock_slowpath+0x10/0x10 ? device_remove_class_symlinks+0x1b0/0x1b0 __iscsi_unbind_session+0x16b/0x250 [scsi_transport_iscsi] iscsi_remove_session+0x1d3/0x2f0 [scsi_transport_iscsi] iscsi_session_remove+0x5c/0x80 [libiscsi] iscsi_sw_tcp_session_destroy+0xd3/0x160 [iscsi_tcp] iscsi_if_rx+0x2369/0x5060 [scsi_transport_iscsi] The reason is that if other threads hold the reference count of the kobject while waiting for the device to be released, it will keep waiting in a loop. Fixes: 7f10ea522db5 ("scsi: fix iscsi rescan fails to create block") Signed-off-by: Zhong Jinghua <zhongjinghua(a)huawei.com> --- drivers/scsi/scsi_sysfs.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c index 4468b92bf83b..6433476d3e67 100644 --- a/drivers/scsi/scsi_sysfs.c +++ b/drivers/scsi/scsi_sysfs.c @@ -1507,13 +1507,6 @@ void scsi_remove_device(struct scsi_device *sdev) } EXPORT_SYMBOL(scsi_remove_device); -static int scsi_device_try_get(struct scsi_device *sdev) -{ - if (!kobject_get_unless_zero(&sdev->sdev_gendev.kobj)) - return -ENXIO; - return 0; -} - static void __scsi_remove_target(struct scsi_target *starget) { struct Scsi_Host *shost = dev_to_shost(starget->dev.parent); @@ -1532,7 +1525,9 @@ static void __scsi_remove_target(struct scsi_target *starget) if (sdev->channel != starget->channel || sdev->id != starget->id) continue; - if (scsi_device_try_get(sdev)) + if (sdev->sdev_state == SDEV_DEL || + sdev->sdev_state == SDEV_CANCEL || + !get_device(&sdev->sdev_gendev)) continue; spin_unlock_irqrestore(shost->host_lock, flags); scsi_remove_device(sdev); -- 2.31.1

1 0

[OLK-5.10 0/2] Supports the feature of querying stats
by Chengchang Tang 01 Mar '23

01 Mar '23

From: Juan Zhou <zhoujuan51(a)h-partners.com> 1.Support hns HW stats 2.Add dfx cnt stats Chengchang Tang (2): RDMA/hns: Support hns HW stats RDMA/hns: Add dfx cnt stats drivers/infiniband/hw/hns/hns_roce_ah.c | 8 +- drivers/infiniband/hw/hns/hns_roce_cmd.c | 17 ++- drivers/infiniband/hw/hns/hns_roce_cq.c | 17 ++- drivers/infiniband/hw/hns/hns_roce_device.h | 50 +++++++ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 59 ++++++++ drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 1 + drivers/infiniband/hw/hns/hns_roce_main.c | 146 +++++++++++++++++++- drivers/infiniband/hw/hns/hns_roce_mr.c | 22 ++- drivers/infiniband/hw/hns/hns_roce_pd.c | 10 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 16 ++- drivers/infiniband/hw/hns/hns_roce_srq.c | 7 +- 11 files changed, 320 insertions(+), 33 deletions(-) -- 2.30.0

1 2

[PATCH openEuler-1.0-LTS 1/2] scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress
by Yongqiang Liu 28 Feb '23

28 Feb '23

From: Mike Christie <michael.christie(a)oracle.com> mainline inclusion from mainline-v6.2-rc6~31 commit 6f1d64b13097e85abda0f91b5638000afc5f9a06 category: bugfix bugzilla: 188443, https://gitee.com/openeuler/kernel/issues/I6I8YD CVE: NA ---------------------------------------- Bug report and analysis from Ding Hui. During iSCSI session logout, if another task accesses the shost ipaddress attr, we can get a KASAN UAF report like this: [ 276.942144] BUG: KASAN: use-after-free in _raw_spin_lock_bh+0x78/0xe0 [ 276.942535] Write of size 4 at addr ffff8881053b45b8 by task cat/4088 [ 276.943511] CPU: 2 PID: 4088 Comm: cat Tainted: G E 6.1.0-rc8+ #3 [ 276.943997] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 [ 276.944470] Call Trace: [ 276.944943] <TASK> [ 276.945397] dump_stack_lvl+0x34/0x48 [ 276.945887] print_address_description.constprop.0+0x86/0x1e7 [ 276.946421] print_report+0x36/0x4f [ 276.947358] kasan_report+0xad/0x130 [ 276.948234] kasan_check_range+0x35/0x1c0 [ 276.948674] _raw_spin_lock_bh+0x78/0xe0 [ 276.949989] iscsi_sw_tcp_host_get_param+0xad/0x2e0 [iscsi_tcp] [ 276.951765] show_host_param_ISCSI_HOST_PARAM_IPADDRESS+0xe9/0x130 [scsi_transport_iscsi] [ 276.952185] dev_attr_show+0x3f/0x80 [ 276.953005] sysfs_kf_seq_show+0x1fb/0x3e0 [ 276.953401] seq_read_iter+0x402/0x1020 [ 276.954260] vfs_read+0x532/0x7b0 [ 276.955113] ksys_read+0xed/0x1c0 [ 276.955952] do_syscall_64+0x38/0x90 [ 276.956347] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 276.956769] RIP: 0033:0x7f5d3a679222 [ 276.957161] Code: c0 e9 b2 fe ff ff 50 48 8d 3d 32 c0 0b 00 e8 a5 fe 01 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24 [ 276.958009] RSP: 002b:00007ffc864d16a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 276.958431] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f5d3a679222 [ 276.958857] RDX: 0000000000020000 RSI: 00007f5d3a4fe000 RDI: 0000000000000003 [ 276.959281] RBP: 00007f5d3a4fe000 R08: 00000000ffffffff R09: 0000000000000000 [ 276.959682] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000020000 [ 276.960126] R13: 0000000000000003 R14: 0000000000000000 R15: 0000557a26dada58 [ 276.960536] </TASK> [ 276.961357] Allocated by task 2209: [ 276.961756] kasan_save_stack+0x1e/0x40 [ 276.962170] kasan_set_track+0x21/0x30 [ 276.962557] __kasan_kmalloc+0x7e/0x90 [ 276.962923] __kmalloc+0x5b/0x140 [ 276.963308] iscsi_alloc_session+0x28/0x840 [scsi_transport_iscsi] [ 276.963712] iscsi_session_setup+0xda/0xba0 [libiscsi] [ 276.964078] iscsi_sw_tcp_session_create+0x1fd/0x330 [iscsi_tcp] [ 276.964431] iscsi_if_create_session.isra.0+0x50/0x260 [scsi_transport_iscsi] [ 276.964793] iscsi_if_recv_msg+0xc5a/0x2660 [scsi_transport_iscsi] [ 276.965153] iscsi_if_rx+0x198/0x4b0 [scsi_transport_iscsi] [ 276.965546] netlink_unicast+0x4d5/0x7b0 [ 276.965905] netlink_sendmsg+0x78d/0xc30 [ 276.966236] sock_sendmsg+0xe5/0x120 [ 276.966576] ____sys_sendmsg+0x5fe/0x860 [ 276.966923] ___sys_sendmsg+0xe0/0x170 [ 276.967300] __sys_sendmsg+0xc8/0x170 [ 276.967666] do_syscall_64+0x38/0x90 [ 276.968028] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 276.968773] Freed by task 2209: [ 276.969111] kasan_save_stack+0x1e/0x40 [ 276.969449] kasan_set_track+0x21/0x30 [ 276.969789] kasan_save_free_info+0x2a/0x50 [ 276.970146] __kasan_slab_free+0x106/0x190 [ 276.970470] __kmem_cache_free+0x133/0x270 [ 276.970816] device_release+0x98/0x210 [ 276.971145] kobject_cleanup+0x101/0x360 [ 276.971462] iscsi_session_teardown+0x3fb/0x530 [libiscsi] [ 276.971775] iscsi_sw_tcp_session_destroy+0xd8/0x130 [iscsi_tcp] [ 276.972143] iscsi_if_recv_msg+0x1bf1/0x2660 [scsi_transport_iscsi] [ 276.972485] iscsi_if_rx+0x198/0x4b0 [scsi_transport_iscsi] [ 276.972808] netlink_unicast+0x4d5/0x7b0 [ 276.973201] netlink_sendmsg+0x78d/0xc30 [ 276.973544] sock_sendmsg+0xe5/0x120 [ 276.973864] ____sys_sendmsg+0x5fe/0x860 [ 276.974248] ___sys_sendmsg+0xe0/0x170 [ 276.974583] __sys_sendmsg+0xc8/0x170 [ 276.974891] do_syscall_64+0x38/0x90 [ 276.975216] entry_SYSCALL_64_after_hwframe+0x63/0xcd We can easily reproduce by two tasks: 1. while :; do iscsiadm -m node --login; iscsiadm -m node --logout; done 2. while :; do cat \ /sys/devices/platform/host*/iscsi_host/host*/ipaddress; done iscsid | cat --------------------------------+--------------------------------------- |- iscsi_sw_tcp_session_destroy | |- iscsi_session_teardown | |- device_release | |- iscsi_session_release ||- dev_attr_show |- kfree | |- show_host_param_ | ISCSI_HOST_PARAM_IPADDRESS | |- iscsi_sw_tcp_host_get_param | |- r/w tcp_sw_host->session (UAF) |- iscsi_host_remove | |- iscsi_host_free | Fix the above bug by splitting the session removal into 2 parts: 1. removal from iSCSI class which includes sysfs and removal from host tracking. 2. freeing of session. During iscsi_tcp host and session removal we can remove the session from sysfs then remove the host from sysfs. At this point we know userspace is not accessing the kernel via sysfs so we can free the session and host. Link: https://lore.kernel.org/r/20230117193937.21244-2-michael.christie@oracle.com Signed-off-by: Mike Christie <michael.christie(a)oracle.com> Reviewed-by: Lee Duncan <lduncan(a)suse.com> Acked-by: Ding Hui <dinghui(a)sangfor.com.cn> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Wenchao Hao <haowenchao2(a)huawei.com> Signed-off-by: Zhong Jinghua <zhongjinghua(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/scsi/iscsi_tcp.c | 11 +++++++++-- drivers/scsi/libiscsi.c | 39 +++++++++++++++++++++++++++++++-------- include/scsi/libiscsi.h | 2 ++ 3 files changed, 42 insertions(+), 10 deletions(-) diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c index 241b1a310519..a5259fd39d6d 100644 --- a/drivers/scsi/iscsi_tcp.c +++ b/drivers/scsi/iscsi_tcp.c @@ -910,10 +910,17 @@ static void iscsi_sw_tcp_session_destroy(struct iscsi_cls_session *cls_session) if (WARN_ON_ONCE(session->leadconn)) return; + iscsi_session_remove(cls_session); + /* + * Our get_host_param needs to access the session, so remove the + * host from sysfs before freeing the session to make sure userspace + * is no longer accessing the callout. + */ + iscsi_host_remove(shost); + iscsi_tcp_r2tpool_free(cls_session->dd_data); - iscsi_session_teardown(cls_session); - iscsi_host_remove(shost); + iscsi_session_free(cls_session); iscsi_host_free(shost); } diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c index 9f625a4d53c0..72463874d7b4 100644 --- a/drivers/scsi/libiscsi.c +++ b/drivers/scsi/libiscsi.c @@ -3018,20 +3018,34 @@ iscsi_session_setup(struct iscsi_transport *iscsit, struct Scsi_Host *shost, } EXPORT_SYMBOL_GPL(iscsi_session_setup); +/* + * issi_session_remove - Remove session from iSCSI class. + */ +void iscsi_session_remove(struct iscsi_cls_session *cls_session) +{ + struct iscsi_session *session = cls_session->dd_data; + struct Scsi_Host *shost = session->host; + + iscsi_remove_session(cls_session); + /* + * host removal only has to wait for its children to be removed from + * sysfs, and iscsi_tcp needs to do iscsi_host_remove before freeing + * the session, so drop the session count here. + */ + iscsi_host_dec_session_cnt(shost); +} +EXPORT_SYMBOL_GPL(iscsi_session_remove); + /** - * iscsi_session_teardown - destroy session, host, and cls_session + * iscsi_session_free - Free iscsi session and it's resources * @cls_session: iscsi session */ -void iscsi_session_teardown(struct iscsi_cls_session *cls_session) +void iscsi_session_free(struct iscsi_cls_session *cls_session) { struct iscsi_session *session = cls_session->dd_data; struct module *owner = cls_session->transport->owner; - struct Scsi_Host *shost = session->host; iscsi_pool_free(&session->cmdpool); - - iscsi_remove_session(cls_session); - kfree(session->password); kfree(session->password_in); kfree(session->username); @@ -3047,10 +3061,19 @@ void iscsi_session_teardown(struct iscsi_cls_session *cls_session) kfree(session->discovery_parent_type); iscsi_free_session(cls_session); - - iscsi_host_dec_session_cnt(shost); module_put(owner); } +EXPORT_SYMBOL_GPL(iscsi_session_free); + +/** + * iscsi_session_teardown - destroy session and cls_session + * @cls_session: iscsi session + */ +void iscsi_session_teardown(struct iscsi_cls_session *cls_session) +{ + iscsi_session_remove(cls_session); + iscsi_session_free(cls_session); +} EXPORT_SYMBOL_GPL(iscsi_session_teardown); /** diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h index 254e72b46d10..2a8d1de70290 100644 --- a/include/scsi/libiscsi.h +++ b/include/scsi/libiscsi.h @@ -425,6 +425,8 @@ extern int iscsi_host_get_max_scsi_cmds(struct Scsi_Host *shost, extern struct iscsi_cls_session * iscsi_session_setup(struct iscsi_transport *, struct Scsi_Host *shost, uint16_t, int, int, uint32_t, unsigned int); +void iscsi_session_remove(struct iscsi_cls_session *cls_session); +void iscsi_session_free(struct iscsi_cls_session *cls_session); extern void iscsi_session_teardown(struct iscsi_cls_session *); extern void iscsi_session_recovery_timedout(struct iscsi_cls_session *); extern int iscsi_set_param(struct iscsi_cls_conn *cls_conn, -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS] pciehp: fix the problem that the slot is powered on again after being powered off
by jiazhenyuan＠uniontech.com 28 Feb '23

28 Feb '23

From: jiazhenyuan <jiazhenyuan(a)uniontech.com> mainline inclusion from mainline-4.19-lts commit 32a8cef274feacd00b748a4f13b84d60aa6d82ff category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6ICDL CVE: NA ---------------------------------------- The DISABLE_SLOT event is lost when the slot is powered off. Signed-off-by: jiazhenyuan <jiazhenyuan(a)uniontech.com> --- drivers/pci/hotplug/pciehp_ctrl.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c index 2d549c97ac42..dd67dc540279 100644 --- a/drivers/pci/hotplug/pciehp_ctrl.c +++ b/drivers/pci/hotplug/pciehp_ctrl.c @@ -463,6 +463,7 @@ int pciehp_sysfs_disable_slot(struct slot *p_slot) mutex_unlock(&p_slot->lock); pci_config_pm_runtime_get(pdev); down_read(&ctrl->reset_lock); + atomic_or(DISABLE_SLOT, &ctrl->pending_events); pciehp_handle_disable_request(p_slot); up_read(&ctrl->reset_lock); pci_config_pm_runtime_put(pdev); -- 2.27.0

1 0

[PATCH openEuler-1.0-LTS] net: mpls: fix stale pointer if allocation fails during device rename
by Yongqiang Liu 28 Feb '23

28 Feb '23

From: Jakub Kicinski <kuba(a)kernel.org> stable inclusion from stable-v4.19.273 commit aa07c86e43ed8780d610ecfb2ce13da326729201 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6HZHU CVE: CVE-2023-26545 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fda6c89fe3d9aca073495a664e1d5aea28cd4377 upstream. lianhui reports that when MPLS fails to register the sysctl table under new location (during device rename) the old pointers won't get overwritten and may be freed again (double free). Handle this gracefully. The best option would be unregistering the MPLS from the device completely on failure, but unfortunately mpls_ifdown() can fail. So failing fully is also unreliable. Another option is to register the new table first then only remove old one if the new one succeeds. That requires more code, changes order of notifications and two tables may be visible at the same time. sysctl point is not used in the rest of the code - set to NULL on failures and skip unregister if already NULL. Reported-by: lianhui tang <bluetlh(a)gmail.com> Fixes: 0fae3bf018d9 ("mpls: handle device renames for per-device sysctls") Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/mpls/af_mpls.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c index 7623d9aec636..c7fd387baa61 100644 --- a/net/mpls/af_mpls.c +++ b/net/mpls/af_mpls.c @@ -1375,6 +1375,7 @@ static int mpls_dev_sysctl_register(struct net_device *dev, free: kfree(table); out: + mdev->sysctl = NULL; return -ENOBUFS; } @@ -1384,6 +1385,9 @@ static void mpls_dev_sysctl_unregister(struct net_device *dev, struct net *net = dev_net(dev); struct ctl_table *table; + if (!mdev->sysctl) + return; + table = mdev->sysctl->ctl_table_arg; unregister_net_sysctl_table(mdev->sysctl); kfree(table); -- 2.25.1

1 0

[PATCH openEuler-5.10-LTS-SP1] net: mpls: fix stale pointer if allocation fails during device rename
by Jialin Zhang 28 Feb '23

28 Feb '23

From: Jakub Kicinski <kuba(a)kernel.org> stable inclusion from stable-v5.10.169 commit 7ff0fdba82298d1f456c685e24930da89703c0fb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6HZHU CVE: CVE-2023-26545 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fda6c89fe3d9aca073495a664e1d5aea28cd4377 upstream. lianhui reports that when MPLS fails to register the sysctl table under new location (during device rename) the old pointers won't get overwritten and may be freed again (double free). Handle this gracefully. The best option would be unregistering the MPLS from the device completely on failure, but unfortunately mpls_ifdown() can fail. So failing fully is also unreliable. Another option is to register the new table first then only remove old one if the new one succeeds. That requires more code, changes order of notifications and two tables may be visible at the same time. sysctl point is not used in the rest of the code - set to NULL on failures and skip unregister if already NULL. Reported-by: lianhui tang <bluetlh(a)gmail.com> Fixes: 0fae3bf018d9 ("mpls: handle device renames for per-device sysctls") Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- net/mpls/af_mpls.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c index 72398149e4d4..1dcbdab9319b 100644 --- a/net/mpls/af_mpls.c +++ b/net/mpls/af_mpls.c @@ -1427,6 +1427,7 @@ static int mpls_dev_sysctl_register(struct net_device *dev, free: kfree(table); out: + mdev->sysctl = NULL; return -ENOBUFS; } @@ -1436,6 +1437,9 @@ static void mpls_dev_sysctl_unregister(struct net_device *dev, struct net *net = dev_net(dev); struct ctl_table *table; + if (!mdev->sysctl) + return; + table = mdev->sysctl->ctl_table_arg; unregister_net_sysctl_table(mdev->sysctl); kfree(table); -- 2.25.1

1 0

[PATCH openEuler-5.10-LTS 01/50] Revert "[Huawei] io_uring:drop identity before creating a private one"
by Jialin Zhang 28 Feb '23

28 Feb '23

From: Li Lingfeng <lilingfeng3(a)huawei.com> Offering: HULK hulk inclusion category: feature bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6BTWC ------------------------------- This reverts commit ab45921343c63dc9d461740e23003098697e0333. We need to apply patch 788d0824269bef (io_uring: import 5.15-stable io_uring) to move io_uring to separate directory and solve the problem of CVE-2023-0240. This patch fix a uaf problem of io_identity, and it can be reverted since io_identity is removed in patch 788d0824269bef. Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- fs/io_uring.c | 42 ------------------------------------------ 1 file changed, 42 deletions(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index 4ace89ae4832..2397c2a1d919 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -1364,47 +1364,6 @@ static bool io_identity_cow(struct io_kiocb *req) return true; } -static void io_drop_identity(struct io_kiocb *req) -{ - struct io_identity *id = req->work.identity; - - if (req->work.flags & IO_WQ_WORK_MM) { - mmdrop(id->mm); - req->work.flags &= ~IO_WQ_WORK_MM; - } -#ifdef CONFIG_BLK_CGROUP - if (req->work.flags & IO_WQ_WORK_BLKCG) { - css_put(id->blkcg_css); - req->work.flags &= ~IO_WQ_WORK_BLKCG; - } -#endif - if (req->work.flags & IO_WQ_WORK_CREDS) { - put_cred(id->creds); - req->work.flags &= ~IO_WQ_WORK_CREDS; - } - if (req->work.flags & IO_WQ_WORK_FILES) { - put_files_struct(req->work.identity->files); - put_nsproxy(req->work.identity->nsproxy); - req->work.flags &= ~IO_WQ_WORK_FILES; - } - if (req->work.flags & IO_WQ_WORK_CANCEL) - req->work.flags &= ~IO_WQ_WORK_CANCEL; - if (req->work.flags & IO_WQ_WORK_FS) { - struct fs_struct *fs = id->fs; - - spin_lock(&id->fs->lock); - if (--fs->users) - fs = NULL; - spin_unlock(&id->fs->lock); - - if (fs) - free_fs_struct(fs); - req->work.flags &= ~IO_WQ_WORK_FS; - } - if (req->work.flags & IO_WQ_WORK_FSIZE) - req->work.flags &= ~IO_WQ_WORK_FSIZE; -} - static bool io_grab_identity(struct io_kiocb *req) { const struct io_op_def *def = &io_op_defs[req->opcode]; @@ -1510,7 +1469,6 @@ static void io_prep_async_work(struct io_kiocb *req) if (io_grab_identity(req)) return; - io_drop_identity(req); if (!io_identity_cow(req)) return; -- 2.25.1

1 49