- Kernel - mailweb.openeuler.org

[PATCH openEuler-5.10 00/13] bugfix for arch/fs/kernel modules
by Zheng Zengkai 15 Oct '21

15 Oct '21

bugfix for arch/fs/kernel modules Arnd Bergmann (2): asm-generic: fix ffs -Wshadow warning seqlock: avoid -Wshadow warnings Chen Jiahao (1): arm64: seccomp: fix the incorrect name of syscall __NR_compat_exit in secure computing mode Liang Wang (1): lib: use PFN_PHYS() in devmem_is_allowed() Lin Ruizhe (1): amba-pl011: Fix no irq issue due to no IRQ domain found Mark Rutland (1): arm64: fix compat syscall return truncation Peter Zijlstra (1): kthread: Fix PF_KTHREAD vs to_kthread() race Yu Kuai (4): block: ensure the memory order between bi_private and bi_status Revert "[Huawei] block: avoid creating invalid symlink file for patitions" Revert "[Backport] block: take bd_mutex around delete_partitions in del_gendisk" blk: reuse lookup_sem to serialize partition operations Zhihao Cheng (2): mtd: mtdconcat: Judge callback existence based on the master mtd: mtdconcat: Check _read,_write callbacks existence before assignment arch/arm/mm/mmap.c | 2 +- arch/arm64/include/asm/ptrace.h | 12 +++++++- arch/arm64/include/asm/seccomp.h | 2 +- arch/arm64/include/asm/syscall.h | 19 +++++++------ arch/arm64/kernel/ptrace.c | 2 +- arch/arm64/kernel/signal.c | 3 +- arch/arm64/kernel/syscall.c | 9 ++---- block/genhd.c | 14 +-------- block/partitions/core.c | 4 +++ drivers/mtd/mtdconcat.c | 33 +++++++++++++++------- drivers/tty/serial/amba-pl011.c | 12 +++++++- fs/block_dev.c | 36 ++++++++++++++++++++---- include/asm-generic/bitops/builtin-ffs.h | 5 +--- include/linux/seqlock.h | 14 ++++----- kernel/kthread.c | 33 ++++++++++++++++++---- kernel/sched/fair.c | 2 +- 16 files changed, 134 insertions(+), 68 deletions(-) -- 2.20.1

1 13

[PATCH openEuler-5.10 00/30] Backport LTS 5.10.57
by Zheng Zengkai 15 Oct '21

15 Oct '21

Backport LTS 5.10.57 patches from upstream. Alain Volmat (1): spi: stm32h7: fix full duplex irq handler handling Andrei Matei (2): selftest/bpf: Adjust expected verifier errors selftest/bpf: Verifier tests for var-off access Axel Lin (1): regulator: rt5033: Fix n_voltages settings for BUCK and LDO Borislav Petkov (1): efi/mokvar: Reserve the table only if it is in boot services data ChiYuan Huang (1): regulator: rtmv20: Fix wrong mask for strobe-polarity-high Cristian Marussi (1): firmware: arm_scmi: Add delayed response status check Daniel Borkmann (3): bpf, selftests: Adjust few selftest result_unpriv outcomes bpf: Update selftests to reflect new error states bpf, selftests: Adjust few selftest outcomes wrt unreachable code Filipe Manana (2): btrfs: fix race causing unnecessary inode logging during link and rename btrfs: fix lost inode on log replay after mix of fsync, rename and inode eviction Greg Kroah-Hartman (2): Revert "Bluetooth: Shutdown controller after workqueues are flushed or cancelled" Revert "watchdog: iTCO_wdt: Account for rebooting on second timeout" Guenter Roeck (1): spi: mediatek: Fix fifo transfer Jason Ekstrand (2): drm/i915: Revert "drm/i915/gem: Asynchronous cmdparser" Revert "drm/i915: Propagate errors on awaiting already signaled fences" Jia He (1): qed: fix possible unpaired spin_{un}lock_bh in _qed_mcp_cmd_and_union() Keith Busch (1): nvme: fix nvme_setup_command metadata trace event Kyle Russell (1): ASoC: tlv320aic31xx: fix reversed bclk/wclk master bits Linus Torvalds (1): ACPI: fix NULL pointer dereference Nicholas Kazlauskas (1): drm/amd/display: Fix max vstartup calculation for modes with borders Oder Chiou (1): ASoC: rt5682: Fix the issue of garbled recording after powerd_dbus_suspend Peter Ujfalusi (2): ASoC: ti: j721e-evm: Fix unbalanced domain activity tracking during startup ASoC: ti: j721e-evm: Check for not initialized parent_clk_id Pravin B Shelar (1): net: Fix zero-copy head len calculation. Sudeep Holla (1): firmware: arm_scmi: Ensure drivers provide a probe function Takashi Iwai (1): r8152: Fix potential PM refcount imbalance Victor Lu (1): drm/amd/display: Fix comparison error in dcn21 DML Yonghong Song (1): selftests/bpf: Add a test for ptr_to_map_value on stack for helper access drivers/firmware/arm_scmi/bus.c | 3 + drivers/firmware/arm_scmi/driver.c | 8 +- drivers/firmware/efi/mokvar-table.c | 5 +- .../drm/amd/display/dc/dcn20/dcn20_resource.c | 6 +- .../dc/dml/dcn21/display_mode_vba_21.c | 2 +- .../gpu/drm/i915/gem/i915_gem_execbuffer.c | 164 +----------------- drivers/gpu/drm/i915/i915_cmd_parser.c | 28 +-- drivers/gpu/drm/i915/i915_request.c | 8 +- drivers/net/ethernet/qlogic/qed/qed_mcp.c | 23 ++- drivers/net/usb/r8152.c | 3 +- drivers/nvme/host/trace.h | 6 +- drivers/regulator/rtmv20-regulator.c | 2 +- drivers/spi/spi-mt65xx.c | 19 +- drivers/spi/spi-stm32.c | 15 +- drivers/watchdog/iTCO_wdt.c | 12 +- fs/btrfs/tree-log.c | 5 +- include/acpi/acpi_bus.h | 3 +- include/linux/mfd/rt5033-private.h | 4 +- net/bluetooth/hci_core.c | 16 +- net/core/skbuff.c | 5 +- sound/soc/codecs/rt5682.c | 8 +- sound/soc/codecs/tlv320aic31xx.h | 4 +- sound/soc/ti/j721e-evm.c | 18 +- .../selftests/bpf/progs/bpf_iter_task.c | 3 +- tools/testing/selftests/bpf/test_verifier.c | 2 +- tools/testing/selftests/bpf/verifier/and.c | 2 + .../selftests/bpf/verifier/basic_stack.c | 2 +- tools/testing/selftests/bpf/verifier/bounds.c | 19 +- .../selftests/bpf/verifier/bounds_deduction.c | 21 +-- .../bpf/verifier/bounds_mix_sign_unsign.c | 13 -- tools/testing/selftests/bpf/verifier/calls.c | 4 +- .../testing/selftests/bpf/verifier/const_or.c | 4 +- .../selftests/bpf/verifier/dead_code.c | 2 + .../bpf/verifier/helper_access_var_len.c | 12 +- .../testing/selftests/bpf/verifier/int_ptr.c | 6 +- tools/testing/selftests/bpf/verifier/jmp32.c | 22 +++ tools/testing/selftests/bpf/verifier/jset.c | 10 +- .../testing/selftests/bpf/verifier/map_ptr.c | 4 +- .../selftests/bpf/verifier/raw_stack.c | 10 +- .../selftests/bpf/verifier/stack_ptr.c | 22 +-- tools/testing/selftests/bpf/verifier/unpriv.c | 9 +- .../selftests/bpf/verifier/value_ptr_arith.c | 17 +- .../testing/selftests/bpf/verifier/var_off.c | 115 ++++++++++-- 43 files changed, 331 insertions(+), 335 deletions(-) -- 2.20.1

1 30

[PATCH openEuler-5.10 00/30] Backport LTS 5.10.57
by Zheng Zengkai 15 Oct '21

15 Oct '21

Backport LTS 5.10.57 patches from upstream. Alain Volmat (1): spi: stm32h7: fix full duplex irq handler handling Andrei Matei (2): selftest/bpf: Adjust expected verifier errors selftest/bpf: Verifier tests for var-off access Axel Lin (1): regulator: rt5033: Fix n_voltages settings for BUCK and LDO Borislav Petkov (1): efi/mokvar: Reserve the table only if it is in boot services data ChiYuan Huang (1): regulator: rtmv20: Fix wrong mask for strobe-polarity-high Cristian Marussi (1): firmware: arm_scmi: Add delayed response status check Daniel Borkmann (3): bpf, selftests: Adjust few selftest result_unpriv outcomes bpf: Update selftests to reflect new error states bpf, selftests: Adjust few selftest outcomes wrt unreachable code Filipe Manana (2): btrfs: fix race causing unnecessary inode logging during link and rename btrfs: fix lost inode on log replay after mix of fsync, rename and inode eviction Greg Kroah-Hartman (2): Revert "Bluetooth: Shutdown controller after workqueues are flushed or cancelled" Revert "watchdog: iTCO_wdt: Account for rebooting on second timeout" Guenter Roeck (1): spi: mediatek: Fix fifo transfer Jason Ekstrand (2): drm/i915: Revert "drm/i915/gem: Asynchronous cmdparser" Revert "drm/i915: Propagate errors on awaiting already signaled fences" Jia He (1): qed: fix possible unpaired spin_{un}lock_bh in _qed_mcp_cmd_and_union() Keith Busch (1): nvme: fix nvme_setup_command metadata trace event Kyle Russell (1): ASoC: tlv320aic31xx: fix reversed bclk/wclk master bits Linus Torvalds (1): ACPI: fix NULL pointer dereference Nicholas Kazlauskas (1): drm/amd/display: Fix max vstartup calculation for modes with borders Oder Chiou (1): ASoC: rt5682: Fix the issue of garbled recording after powerd_dbus_suspend Peter Ujfalusi (2): ASoC: ti: j721e-evm: Fix unbalanced domain activity tracking during startup ASoC: ti: j721e-evm: Check for not initialized parent_clk_id Pravin B Shelar (1): net: Fix zero-copy head len calculation. Sudeep Holla (1): firmware: arm_scmi: Ensure drivers provide a probe function Takashi Iwai (1): r8152: Fix potential PM refcount imbalance Victor Lu (1): drm/amd/display: Fix comparison error in dcn21 DML Yonghong Song (1): selftests/bpf: Add a test for ptr_to_map_value on stack for helper access drivers/firmware/arm_scmi/bus.c | 3 + drivers/firmware/arm_scmi/driver.c | 8 +- drivers/firmware/efi/mokvar-table.c | 5 +- .../drm/amd/display/dc/dcn20/dcn20_resource.c | 6 +- .../dc/dml/dcn21/display_mode_vba_21.c | 2 +- .../gpu/drm/i915/gem/i915_gem_execbuffer.c | 164 +----------------- drivers/gpu/drm/i915/i915_cmd_parser.c | 28 +-- drivers/gpu/drm/i915/i915_request.c | 8 +- drivers/net/ethernet/qlogic/qed/qed_mcp.c | 23 ++- drivers/net/usb/r8152.c | 3 +- drivers/nvme/host/trace.h | 6 +- drivers/regulator/rtmv20-regulator.c | 2 +- drivers/spi/spi-mt65xx.c | 19 +- drivers/spi/spi-stm32.c | 15 +- drivers/watchdog/iTCO_wdt.c | 12 +- fs/btrfs/tree-log.c | 5 +- include/acpi/acpi_bus.h | 3 +- include/linux/mfd/rt5033-private.h | 4 +- net/bluetooth/hci_core.c | 16 +- net/core/skbuff.c | 5 +- sound/soc/codecs/rt5682.c | 8 +- sound/soc/codecs/tlv320aic31xx.h | 4 +- sound/soc/ti/j721e-evm.c | 18 +- .../selftests/bpf/progs/bpf_iter_task.c | 3 +- tools/testing/selftests/bpf/test_verifier.c | 2 +- tools/testing/selftests/bpf/verifier/and.c | 2 + .../selftests/bpf/verifier/basic_stack.c | 2 +- tools/testing/selftests/bpf/verifier/bounds.c | 19 +- .../selftests/bpf/verifier/bounds_deduction.c | 21 +-- .../bpf/verifier/bounds_mix_sign_unsign.c | 13 -- tools/testing/selftests/bpf/verifier/calls.c | 4 +- .../testing/selftests/bpf/verifier/const_or.c | 4 +- .../selftests/bpf/verifier/dead_code.c | 2 + .../bpf/verifier/helper_access_var_len.c | 12 +- .../testing/selftests/bpf/verifier/int_ptr.c | 6 +- tools/testing/selftests/bpf/verifier/jmp32.c | 22 +++ tools/testing/selftests/bpf/verifier/jset.c | 10 +- .../testing/selftests/bpf/verifier/map_ptr.c | 4 +- .../selftests/bpf/verifier/raw_stack.c | 10 +- .../selftests/bpf/verifier/stack_ptr.c | 22 +-- tools/testing/selftests/bpf/verifier/unpriv.c | 9 +- .../selftests/bpf/verifier/value_ptr_arith.c | 17 +- .../testing/selftests/bpf/verifier/var_off.c | 115 ++++++++++-- 43 files changed, 331 insertions(+), 335 deletions(-) -- 2.20.1

1 26

[PATCH openEuler-5.10 0/5] bugfix for mm/sched/kprobes
by Zheng Zengkai 15 Oct '21

15 Oct '21

backport some bugfix patches for mm/sched/kprobes modules. Aili Yao (1): mm,hwpoison: return -EHWPOISON to denote that the page has already been poisoned Pu Lehui (1): powerpc/kprobes: Fix kprobe Oops happens in booke Tony Luck (1): mm/memory-failure: use a mutex to avoid memory_failure() races Yu Jiahua (2): sched: Access control for sysctl_update_load_latency sched: Fix branch prediction error in static_key arch/powerpc/kernel/kprobes.c | 3 ++- kernel/sched/fair.c | 5 ++++- mm/memory-failure.c | 40 ++++++++++++++++++++++------------- 3 files changed, 31 insertions(+), 17 deletions(-) -- 2.20.1

1 5

[PATCH openEuler-5.10 00/68] Backport LTS 5.10.56
by Zheng Zengkai 15 Oct '21

15 Oct '21

Backport LTS 5.10.56 from upstream. Arkadiusz Kubalewski (2): i40e: Fix logic of disabling queues i40e: Fix firmware LLDP agent related warning Arnaldo Carvalho de Melo (1): Revert "perf map: Fix dso->nsinfo refcounting" Bjorn Andersson (1): drm/msm/dp: Initialize the INTF_CONFIG register Cong Wang (1): skmsg: Make sk_psock_destroy() static Dale Zhao (1): drm/amd/display: ensure dentist display clock update finished in DCN20 Dan Carpenter (1): can: hi311x: fix a signedness bug in hi3110_cmd() Daniel Borkmann (4): bpf: Introduce BPF nospec instruction for mitigating Spectre v4 bpf: Fix leakage due to insufficient speculative store bypass mitigation bpf: Remove superfluous aux sanitation on subprog rejection bpf: Fix pointer arithmetic mask tightening under state pruning Desmond Cheong Zhi Xi (1): btrfs: fix rw device counting in __btrfs_free_extra_devids Dima Chumak (1): net/mlx5e: Fix nullptr in mlx5e_hairpin_get_mdev() Felix Fietkau (1): mac80211: fix enabling 4-address mode on a sta vif after assoc Florian Westphal (1): netfilter: conntrack: adjust stop timestamp to real expiry value Geetha sowjanya (1): octeontx2-pf: Fix interface down flag on error Gilad Naaman (1): net: Set true network header for ECN decapsulation Goldwyn Rodrigues (1): btrfs: mark compressed range uptodate only if all bio succeed Greg Kroah-Hartman (1): selftest: fix build error in tools/testing/selftests/vm/userfaultfd.c Hoang Le (1): tipc: fix sleeping in tipc accept routine Hui Wang (1): Revert "ACPI: resources: Add checks for ACPI IRQ override" Jan Kiszka (1): x86/asm: Ensure asm/proto.h can be included stand-alone Jason Gerecke (1): HID: wacom: Re-enable touch by default for Cintiq 24HDT / 27QHDT Jedrzej Jagielski (2): i40e: Fix queue-to-TC mapping on Tx i40e: Fix log TC creation failure when max num of queues is exceeded Jiapeng Chong (1): mlx4: Fix missing error code in mlx4_load_one() Jiri Kosina (2): drm/amdgpu: Avoid printing of stack contents on firmware load error drm/amdgpu: Fix resource leak on probe error path Juergen Gross (1): x86/kvm: fix vcpu-id indexed array sizes Junxiao Bi (2): ocfs2: fix zero out valid data ocfs2: issue zeroout to EOF blocks Krzysztof Kozlowski (1): nfc: nfcsim: fix use after free during module unload Linus Torvalds (1): pipe: make pipe writes always wake up readers Lorenz Bauer (2): bpf: Fix OOB read when printing XDP link fdinfo bpf: verifier: Allocate idmap scratch in verifier env Lukasz Cieplicki (1): i40e: Add additional info to PHY type error Maor Gottlieb (1): net/mlx5: Fix flow table chaining Marcelo Ricardo Leitner (1): sctp: fix return value check in __sctp_rcv_asconf_lookup Mike Rapoport (1): alpha: register early reserved memory in memblock Naresh Kumar PBS (1): RDMA/bnxt_re: Fix stats counters Nguyen Dinh Phi (1): cfg80211: Fix possible memory leak in function cfg80211_bss_update Oleksij Rempel (1): can: j1939: j1939_session_deactivate(): clarify lifetime of session object Pablo Neira Ayuso (1): netfilter: nft_nat: allow to specify layer 4 protocol NAT only Paolo Bonzini (1): KVM: add missing compat KVM_CLEAR_DIRTY_LOG Paul Jakma (1): NIU: fix incorrect error return, missed in previous revert Pavel Skripkin (6): can: mcba_usb_start(): add missing urb->transfer_dma initialization can: usb_8dev: fix memory leak can: ems_usb: fix memory leak can: esd_usb2: fix memory leak net: qrtr: fix memory leaks net: llc: fix skb_over_panic Robert Foss (1): drm/msm/dpu: Fix sm8250_mdp register length Shannon Nelson (3): ionic: remove intr coalesce update from napi ionic: fix up dim accounting for tx and rx ionic: count csum_none when offload enabled Srikar Dronamraju (1): powerpc/pseries: Fix regression while building external modules Srinivas Pandruvada (1): ACPI: DPTF: Fix reading of attributes Stephane Grosjean (1): can: peak_usb: pcan_usb_handle_bus_evt(): fix reading rxerr/txerr values Steve French (1): SMB3: fix readpage for large swap cache Tejun Heo (1): blk-iocost: fix operation ordering in iocg_wake_fn() Vitaly Kuznetsov (1): KVM: x86: Check the right feature bit for MSR_KVM_ASYNC_PF_ACK access Wang Hai (2): tulip: windbond-840: Fix missing pci_disable_device() in probe and remove sis900: Fix missing pci_disable_device() in probe and remove Xin Long (2): tipc: fix implicit-connect for SYN+ tipc: do not write skb_shinfo frags when doing decrytion Yang Yingliang (1): io_uring: fix null-ptr-deref in io_sq_offload_start() Zhang Changzhong (1): can: j1939: j1939_xtp_rx_dat_one(): fix rxtimer value between consecutive TP.DT to 750ms Ziyang Xuan (1): can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF arch/alpha/kernel/setup.c | 13 +- arch/arm/net/bpf_jit_32.c | 3 + arch/arm64/net/bpf_jit_comp.c | 13 ++ arch/mips/net/ebpf_jit.c | 3 + arch/powerpc/net/bpf_jit_comp64.c | 6 + arch/powerpc/platforms/pseries/setup.c | 2 +- arch/riscv/net/bpf_jit_comp32.c | 4 + arch/riscv/net/bpf_jit_comp64.c | 4 + arch/s390/net/bpf_jit_comp.c | 5 + arch/sparc/net/bpf_jit_comp_64.c | 3 + arch/x86/include/asm/proto.h | 2 + arch/x86/kvm/ioapic.c | 2 +- arch/x86/kvm/ioapic.h | 4 +- arch/x86/kvm/x86.c | 4 +- arch/x86/net/bpf_jit_comp.c | 7 + arch/x86/net/bpf_jit_comp32.c | 6 + block/blk-iocost.c | 11 +- drivers/acpi/dptf/dptf_pch_fivr.c | 51 ++++- drivers/acpi/resource.c | 9 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 +- drivers/gpu/drm/amd/amdgpu/psp_v12_0.c | 7 +- .../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c | 2 +- .../gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c | 2 +- drivers/gpu/drm/msm/dp/dp_catalog.c | 1 + drivers/hid/wacom_wac.c | 2 +- drivers/infiniband/hw/bnxt_re/main.c | 4 +- drivers/infiniband/hw/bnxt_re/qplib_res.c | 10 +- drivers/infiniband/hw/bnxt_re/qplib_res.h | 1 + drivers/net/can/spi/hi311x.c | 2 +- drivers/net/can/usb/ems_usb.c | 14 +- drivers/net/can/usb/esd_usb2.c | 16 +- drivers/net/can/usb/mcba_usb.c | 2 + drivers/net/can/usb/peak_usb/pcan_usb.c | 10 +- drivers/net/can/usb/usb_8dev.c | 15 +- drivers/net/ethernet/dec/tulip/winbond-840.c | 7 +- .../net/ethernet/intel/i40e/i40e_ethtool.c | 6 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 61 +++--- drivers/net/ethernet/intel/i40e/i40e_txrx.c | 50 +++++ drivers/net/ethernet/intel/i40e/i40e_txrx.h | 2 + .../marvell/octeontx2/nic/otx2_ethtool.c | 7 +- .../ethernet/marvell/octeontx2/nic/otx2_pf.c | 5 + drivers/net/ethernet/mellanox/mlx4/main.c | 1 + .../net/ethernet/mellanox/mlx5/core/en_tc.c | 33 +++- .../net/ethernet/mellanox/mlx5/core/fs_core.c | 10 +- .../net/ethernet/pensando/ionic/ionic_lif.c | 14 +- .../net/ethernet/pensando/ionic/ionic_txrx.c | 41 ++-- drivers/net/ethernet/sis/sis900.c | 7 +- drivers/net/ethernet/sun/niu.c | 3 +- drivers/nfc/nfcsim.c | 3 +- fs/btrfs/compression.c | 2 +- fs/btrfs/volumes.c | 1 + fs/cifs/file.c | 2 +- fs/io_uring.c | 2 +- fs/ocfs2/file.c | 103 ++++++---- fs/pipe.c | 10 +- include/linux/bpf_types.h | 1 + include/linux/bpf_verifier.h | 11 +- include/linux/filter.h | 15 ++ include/linux/skmsg.h | 1 - include/net/llc_pdu.h | 31 ++- kernel/bpf/core.c | 19 +- kernel/bpf/disasm.c | 16 +- kernel/bpf/verifier.c | 186 ++++++------------ net/can/j1939/transport.c | 11 +- net/can/raw.c | 20 +- net/core/skmsg.c | 3 +- net/ipv4/ip_tunnel.c | 2 +- net/llc/af_llc.c | 10 +- net/llc/llc_s_ac.c | 2 +- net/mac80211/cfg.c | 19 ++ net/mac80211/ieee80211_i.h | 2 + net/mac80211/mlme.c | 4 +- net/netfilter/nf_conntrack_core.c | 7 +- net/netfilter/nft_nat.c | 4 +- net/qrtr/qrtr.c | 6 +- net/sctp/input.c | 2 +- net/tipc/crypto.c | 14 +- net/tipc/socket.c | 30 +-- net/wireless/scan.c | 6 +- tools/perf/util/map.c | 2 - tools/testing/selftests/vm/userfaultfd.c | 2 +- virt/kvm/kvm_main.c | 28 +++ 82 files changed, 706 insertions(+), 366 deletions(-) -- 2.20.1

1 68

[PATCH openEuler-5.10 00/24] Backport LTS 5.10.55
by Zheng Zengkai 15 Oct '21

15 Oct '21

Backport LTS 5.10.55 from upstream. Christoph Hellwig (2): iomap: remove the length variable in iomap_seek_data iomap: remove the length variable in iomap_seek_hole Cristian Marussi (1): firmware: arm_scmi: Fix range check for the maximum number of pending messages Desmond Cheong Zhi Xi (3): hfs: add missing clean-up in hfs_fill_super hfs: fix high memory mapping in hfs_bnode_read hfs: add lock nesting notation to hfs_find_init Eric Dumazet (1): net: annotate data race around sk_ll_usec Hyunchul Lee (1): cifs: fix the out of range assignment to bit fields in parse_server_interfaces Maxim Levitsky (1): KVM: x86: determine if an exception has an error code only when injecting it. Miklos Szeredi (1): af_unix: fix garbage collect vs MSG_PEEK Paul E. McKenney (2): rcu-tasks: Don't delete holdouts within trc_inspect_reader() rcu-tasks: Don't delete holdouts within trc_wait_for_one_reader() Paul Gortmaker (1): cgroup1: fix leaked context root causing sporadic NULL deref in LTP Pavel Begunkov (1): io_uring: fix link timeout refs Sudeep Holla (2): firmware: arm_scmi: Fix possible scmi_linux_errmap buffer overflow ARM: dts: versatile: Fix up interrupt controller node names Vasily Averin (2): ipv6: allocate enough headroom in ip6_finish_output2() ipv6: ip6_finish_output2: set sk into newly allocated nskb Xin Long (1): sctp: move 198 addresses from unusable to private scope Yang Yingliang (3): workqueue: fix UAF in pwq_unbound_release_workfn() net/802/mrp: fix memleak in mrp_request_join() net/802/garp: fix memleak in garp_request_join() Yonghong Song (1): tools: Allow proper CC/CXX/... override with LLVM=1 in Makefile.include Zheyu Ma (1): drm/ttm: add a check against null pointer dereference arch/arm/boot/dts/versatile-ab.dts | 5 +-- arch/arm/boot/dts/versatile-pb.dts | 2 +- arch/x86/kvm/x86.c | 13 +++++-- drivers/firmware/arm_scmi/driver.c | 12 +++--- drivers/gpu/drm/ttm/ttm_range_manager.c | 3 ++ fs/cifs/smb2ops.c | 4 +- fs/hfs/bfind.c | 14 ++++++- fs/hfs/bnode.c | 25 +++++++++--- fs/hfs/btree.h | 7 ++++ fs/hfs/super.c | 10 ++--- fs/internal.h | 1 - fs/io_uring.c | 1 - fs/iomap/seek.c | 25 +++++------- include/linux/fs_context.h | 1 + include/net/busy_poll.h | 2 +- include/net/sctp/constants.h | 4 +- kernel/cgroup/cgroup-v1.c | 4 +- kernel/rcu/tasks.h | 6 +-- kernel/workqueue.c | 20 ++++++---- net/802/garp.c | 14 +++++++ net/802/mrp.c | 14 +++++++ net/core/sock.c | 2 +- net/ipv6/ip6_output.c | 28 ++++++++++++++ net/sctp/protocol.c | 3 +- net/unix/af_unix.c | 51 ++++++++++++++++++++++++- tools/scripts/Makefile.include | 12 +++++- 26 files changed, 215 insertions(+), 68 deletions(-) -- 2.20.1

1 24

[PATCH openEuler-1.0-LTS 1/2] io_uring: hold uring_lock while completing failed polled io in io_wq_submit_work()
by Yang Yingliang 15 Oct '21

15 Oct '21

From: Xiaoguang Wang <xiaoguang.wang(a)linux.alibaba.com> mainline inclusion from mainline-5.11-rc1 commit c07e6719511e77c4b289f62bfe96423eb6ea061d category: bugfix bugzilla: 182869 CVE: NA --------------------------- io_iopoll_complete() does not hold completion_lock to complete polled io, so in io_wq_submit_work(), we can not call io_req_complete() directly, to complete polled io, otherwise there maybe concurrent access to cqring, defer_list, etc, which is not safe. Commit dad1b1242fd5 ("io_uring: always let io_iopoll_complete() complete polled io") has fixed this issue, but Pavel reported that IOPOLL apart from rw can do buf reg/unreg requests( IORING_OP_PROVIDE_BUFFERS or IORING_OP_REMOVE_BUFFERS), so the fix is not good. Given that io_iopoll_complete() is always called under uring_lock, so here for polled io, we can also get uring_lock to fix this issue. Fixes: dad1b1242fd5 ("io_uring: always let io_iopoll_complete() complete polled io") Cc: <stable(a)vger.kernel.org> # 5.5+ Signed-off-by: Xiaoguang Wang <xiaoguang.wang(a)linux.alibaba.com> Reviewed-by: Pavel Begunkov <asml.silence(a)gmail.com> [axboe: don't deref 'req' after completing it'] Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/io_uring.c | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index c944a27178a48..b5fb86e2ed597 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -5782,19 +5782,28 @@ static struct io_wq_work *io_wq_submit_work(struct io_wq_work *work) } if (ret) { + struct io_ring_ctx *lock_ctx = NULL; + + if (req->ctx->flags & IORING_SETUP_IOPOLL) + lock_ctx = req->ctx; + /* - * io_iopoll_complete() does not hold completion_lock to complete - * polled io, so here for polled io, just mark it done and still let - * io_iopoll_complete() complete it. + * io_iopoll_complete() does not hold completion_lock to + * complete polled io, so here for polled io, we can not call + * io_req_complete() directly, otherwise there maybe concurrent + * access to cqring, defer_list, etc, which is not safe. Given + * that io_iopoll_complete() is always called under uring_lock, + * so here for polled io, we also get uring_lock to complete + * it. */ - if (req->ctx->flags & IORING_SETUP_IOPOLL) { - struct kiocb *kiocb = &req->rw.kiocb; + if (lock_ctx) + mutex_lock(&lock_ctx->uring_lock); - kiocb_done(kiocb, ret, NULL); - } else { - req_set_fail_links(req); - io_req_complete(req, ret); - } + req_set_fail_links(req); + io_req_complete(req, ret); + + if (lock_ctx) + mutex_unlock(&lock_ctx->uring_lock); } return io_steal_work(req); -- 2.25.1

1 1

[PATCH kernel-4.19] block: fix UAF from race of ioc_release_fn() and __ioc_clear_queue()
by Yang Yingliang 15 Oct '21

15 Oct '21

From: Laibin Qiu <qiulaibin(a)huawei.com> hulk inclusion category: bugfix bugzilla: 182666 CVE: NA -------------------------- KASAN reports a use-after-free report when doing block test: [293762.535116] ================================================================== [293762.535129] BUG: KASAN: use-after-free in queued_spin_lock_slowpath+0x78/0x4c8 [293762.535133] Write of size 2 at addr ffff8000d5f12bc8 by task sh/9148 [293762.535135] [293762.535145] CPU: 1 PID: 9148 Comm: sh Kdump: loaded Tainted: G W 4.19.90-vhulk2108.6.0.h824.kasan.eulerosv2r10.aarch64 #1 [293762.535148] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 [293762.535150] Call trace: [293762.535154] dump_backtrace+0x0/0x310 [293762.535158] show_stack+0x28/0x38 [293762.535165] dump_stack+0xec/0x15c [293762.535172] print_address_description+0x68/0x2d0 [293762.535177] kasan_report+0x130/0x2f0 [293762.535182] __asan_store2+0x80/0xa8 [293762.535189] queued_spin_lock_slowpath+0x78/0x4c8 [293762.535194] __ioc_clear_queue+0x158/0x160 [293762.535198] ioc_clear_queue+0x194/0x258 [293762.535202] elevator_switch_mq+0x64/0x170 [293762.535206] elevator_switch+0x140/0x270 [293762.535211] elv_iosched_store+0x1a4/0x2a0 [293762.535215] queue_attr_store+0x90/0xe0 [293762.535219] sysfs_kf_write+0xa8/0xe8 [293762.535222] kernfs_fop_write+0x1f8/0x378 [293762.535227] __vfs_write+0xe0/0x360 [293762.535233] vfs_write+0xf0/0x270 [293762.535237] ksys_write+0xdc/0x1b8 [293762.535241] __arm64_sys_write+0x50/0x60 [293762.535245] el0_svc_common+0xc8/0x320 [293762.535250] el0_svc_handler+0xf8/0x160 [293762.535253] el0_svc+0x10/0x218 [293762.535254] [293762.535258] Allocated by task 3466763: [293762.535264] kasan_kmalloc+0xe0/0x190 [293762.535269] kasan_slab_alloc+0x14/0x20 [293762.535276] kmem_cache_alloc_node+0x1b4/0x420 [293762.535280] create_task_io_context+0x40/0x210 [293762.535284] generic_make_request_checks+0xc78/0xe38 [293762.535288] generic_make_request+0xf8/0x640 [293762.535394] generic_file_direct_write+0x100/0x268 [293762.535401] __generic_file_write_iter+0x128/0x370 [293762.535467] vfs_iter_write+0x64/0x90 [293762.535489] ovl_write_iter+0x2f8/0x458 [overlay] [293762.535493] __vfs_write+0x264/0x360 [293762.535497] vfs_write+0xf0/0x270 [293762.535501] ksys_write+0xdc/0x1b8 [293762.535505] __arm64_sys_write+0x50/0x60 [293762.535509] el0_svc_common+0xc8/0x320 [293762.535387] ext4_direct_IO+0x3c8/0xe80 [ext4] [293762.535394] generic_file_direct_write+0x100/0x268 [293762.535401] __generic_file_write_iter+0x128/0x370 [293762.535452] ext4_file_write_iter+0x610/0xa80 [ext4] [293762.535457] do_iter_readv_writev+0x28c/0x390 [293762.535463] do_iter_write+0xfc/0x360 [293762.535467] vfs_iter_write+0x64/0x90 [293762.535489] ovl_write_iter+0x2f8/0x458 [overlay] [293762.535493] __vfs_write+0x264/0x360 [293762.535497] vfs_write+0xf0/0x270 [293762.535501] ksys_write+0xdc/0x1b8 [293762.535505] __arm64_sys_write+0x50/0x60 [293762.535509] el0_svc_common+0xc8/0x320 [293762.535513] el0_svc_handler+0xf8/0x160 [293762.535517] el0_svc+0x10/0x218 [293762.535521] [293762.535523] Freed by task 3466763: [293762.535528] __kasan_slab_free+0x120/0x228 [293762.535532] kasan_slab_free+0x10/0x18 [293762.535536] kmem_cache_free+0x68/0x248 [293762.535540] put_io_context+0x104/0x190 [293762.535545] put_io_context_active+0x204/0x2c8 [293762.535549] exit_io_context+0x74/0xa0 [293762.535553] do_exit+0x658/0xae0 [293762.535557] do_group_exit+0x74/0x1a8 [293762.535561] get_signal+0x21c/0xf38 [293762.535564] do_signal+0x10c/0x450 [293762.535568] do_notify_resume+0x224/0x4b0 [293762.535573] work_pending+0x8/0x10 [293762.535574] [293762.535578] The buggy address belongs to the object at ffff8000d5f12bb8 which belongs to the cache blkdev_ioc of size 136 [293762.535582] The buggy address is located 16 bytes inside of 136-byte region [ffff8000d5f12bb8, ffff8000d5f12c40) [293762.535583] The buggy address belongs to the page: [293762.535588] page:ffff7e000357c480 count:1 mapcount:0 mapping:ffff8000d8563c00 index:0x0 [293762.536201] flags: 0x7ffff0000000100(slab) [293762.536540] raw: 07ffff0000000100 ffff7e0003118588 ffff8000d8adb530 ffff8000d8563c00 [293762.536546] raw: 0000000000000000 0000000000140014 00000001ffffffff 0000000000000000 [293762.536551] page dumped because: kasan: bad access detected [293762.536552] [293762.536554] Memory state around the buggy address: [293762.536558] ffff8000d5f12a80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fb fb [293762.536562] ffff8000d5f12b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc [293762.536566] >ffff8000d5f12b80: fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb fb [293762.536568] ^ [293762.536572] ffff8000d5f12c00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [293762.536576] ffff8000d5f12c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [293762.536577] ================================================================== ioc_release_fn() will destroy icq from ioc->icq_list and __ioc_clear_queue() will destroy icq from request_queue->icq_list. However, the ioc_release_fn() will hold ioc_lock firstly, and free ioc finally. Then __ioc_clear_queue() will get ioc from icq and hold ioc_lock, but ioc has been released, which will result in a use-after-free. CPU0 CPU1 put_io_context elevator_switch_mq queue_work &ioc->release_work ioc_clear_queue ^^^ splice q->icq_list __ioc_clear_queue ^^^get icq from icq_list get ioc from icq->ioc ioc_release_fn spin_lock(ioc->lock) ioc_destroy_icq(icq) spin_unlock(ioc->lock) free(ioc) spin_lock(ioc->lock) <= UAF Fix by grabbing the request_queue->queue_lock in ioc_clear_queue() to avoid this race scene. Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> Link: https://lore.kernel.org/lkml/1c9ad9f2-c487-c793-1ffc-5c3ec0fcc0ae@kernel.dk/ Conflicts: block/blk-ioc.c Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/blk-ioc.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/block/blk-ioc.c b/block/blk-ioc.c index 4c810969c3e2f..281b7a93e340a 100644 --- a/block/blk-ioc.c +++ b/block/blk-ioc.c @@ -261,13 +261,8 @@ void ioc_clear_queue(struct request_queue *q) spin_lock_irq(q->queue_lock); list_splice_init(&q->icq_list, &icq_list); - if (q->mq_ops) { - spin_unlock_irq(q->queue_lock); - __ioc_clear_queue(&icq_list); - } else { - __ioc_clear_queue(&icq_list); - spin_unlock_irq(q->queue_lock); - } + __ioc_clear_queue(&icq_list); + spin_unlock_irq(q->queue_lock); } int create_task_io_context(struct task_struct *task, gfp_t gfp_flags, int node) -- 2.25.1

1 0

[PATCH kernel-4.19] Driver/SMMUV3: Bugfix for the softlockup when the driver processes events
by Yang Yingliang 15 Oct '21

15 Oct '21

From: Zhou Guanghui <zhouguanghui1(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4D63I CVE: NA ------------------------------------------------- If the SMMU frequently reports a large number of events, the events in the event queue cannot be processed in time. As a result, the while loop cannot exit. So add a cond_resched() to avoid softlockup. Signed-off-by: Zhou Guanghui <zhouguanghui1(a)huawei.com> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/iommu/arm-smmu-v3.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c index 292fd9a10c7ff..8b5083c3e0a16 100644 --- a/drivers/iommu/arm-smmu-v3.c +++ b/drivers/iommu/arm-smmu-v3.c @@ -1832,6 +1832,7 @@ static irqreturn_t arm_smmu_evtq_thread(int irq, void *dev) u8 id = FIELD_GET(EVTQ_0_ID, evt[0]); spin_unlock(&q->wq.lock); + cond_resched(); ret = arm_smmu_handle_evt(smmu, evt); spin_lock(&q->wq.lock); -- 2.25.1

1 0

[PATCH kernel-4.19] net_sched: remove need_resched() from qdisc_run()
by Yang Yingliang 15 Oct '21

15 Oct '21

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v5.5-rc1 commit b60fa1c5d01a10e358c509b904d4bead6114d593 category: bugfix bugzilla: 182865 CVE: NA ------------------------------------------------- The introduction of this schedule point was done in commit 2ba2506ca7ca ("[NET]: Add preemption point in qdisc_run") at a time the loop was not bounded. Then later in commit d5b8aa1d246f ("net_sched: fix dequeuer fairness") we added a limit on the number of packets. Now is the time to remove the schedule point, since the default limit of 64 packets matches the number of packets a typical NAPI poll can process in a row. This solves a latency problem for most TCP receivers under moderate load : 1) host receives a packet. NET_RX_SOFTIRQ is raised by NIC hard IRQ handler 2) __do_softirq() does its first loop, handling NET_RX_SOFTIRQ and calling the driver napi->loop() function 3) TCP stores the skb in socket receive queue: 4) TCP calls sk->sk_data_ready() and wakeups a user thread waiting for EPOLLIN (as a result, need_resched() might now be true) 5) TCP cooks an ACK and sends it. 6) qdisc_run() processes one packet from qdisc, and sees need_resched(), this raises NET_TX_SOFTIRQ (even if there are no more packets in the qdisc) Then we go back to the __do_softirq() in 2), and we see that new softirqs were raised. Since need_resched() is true, we end up waking ksoftirqd in this path : if (pending) { if (time_before(jiffies, end) && !need_resched() && --max_restart) goto restart; wakeup_softirqd(); } So we have many wakeups of ksoftirqd kernel threads, and more calls to qdisc_run() with associated lock overhead. Note that another way to solve the issue would be to change TCP to first send the ACK packet, then signal the EPOLLIN, but this changes P99 latencies, as sending the ACK packet can add a long delay. Signed-off-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Lu Wei <luwei32(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/sched/sch_generic.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c index 4e15913e7519e..c2276a3c9dd8d 100644 --- a/net/sched/sch_generic.c +++ b/net/sched/sch_generic.c @@ -401,13 +401,8 @@ void __qdisc_run(struct Qdisc *q) int packets; while (qdisc_restart(q, &packets)) { - /* - * Ordered by possible occurrence: Postpone processing if - * 1. we've exceeded packet quota - * 2. another process needs the CPU; - */ quota -= packets; - if (quota <= 0 || need_resched()) { + if (quota <= 0) { __netif_schedule(q); break; } -- 2.25.1

1 0

2025

2024

2023

2022

2021

2020

2019

Kernel