- Kernel - mailweb.openeuler.org

[PATCH] fs: eulerfs: fix wrong dereferencing in eufs_lookup
by Kang Chen 10 Apr '23

10 Apr '23

inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6TN56 -------------------------------- smatch report: fs/eulerfs/namei.c:118 eufs_lookup() error: 'inode' dereferencing possible ERR_PTR() Signed-off-by: Kang Chen <void0red(a)hust.edu.cn> --- I run smatch on the openEuler-2203-sp1 source and find some bugs. But I have on idea on the fields of the commit message template. Please let me know if there is anything that can be improved. fs/eulerfs/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/eulerfs/namei.c b/fs/eulerfs/namei.c index e4c6c36575f2..cfba6eefbcc8 100644 --- a/fs/eulerfs/namei.c +++ b/fs/eulerfs/namei.c @@ -116,7 +116,7 @@ static struct dentry *eufs_lookup(struct inode *dir, struct dentry *dentry, inode = eufs_iget(dir->i_sb, s2p(dir->i_sb, de->inode)); if (inode == ERR_PTR(-ESTALE)) { eufs_err(dir->i_sb, "deleted inode referenced: 0x%lx", - inode->i_ino); + le64_to_cpu(de->inode)); return ERR_PTR(-EIO); } not_found: -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] xirc2ps_cs: Fix use after free bug in xirc2ps_detach
by Yongqiang Liu 10 Apr '23

10 Apr '23

From: Zheng Wang <zyytlz.wz(a)163.com> stable inclusion from stable-v4.19.279 commit 526660c25d3b93b1232a525b75469048388f0928 category: bugfix bugzilla: 188641, https://gitee.com/src-openeuler/kernel/issues/I6R4MM CVE: CVE-2023-1670 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e8d20c3ded59a092532513c9bd030d1ea66f5f44 ] In xirc2ps_probe, the local->tx_timeout_task was bounded with xirc2ps_tx_timeout_task. When timeout occurs, it will call xirc_tx_timeout->schedule_work to start the work. When we call xirc2ps_detach to remove the driver, there may be a sequence as follows: Stop responding to timeout tasks and complete scheduled tasks before cleanup in xirc2ps_detach, which will fix the problem. CPU0 CPU1 |xirc2ps_tx_timeout_task xirc2ps_detach | free_netdev | kfree(dev); | | | do_reset | //use dev Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/net/ethernet/xircom/xirc2ps_cs.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/ethernet/xircom/xirc2ps_cs.c b/drivers/net/ethernet/xircom/xirc2ps_cs.c index fd5288ff53b5..e3438cef5f9c 100644 --- a/drivers/net/ethernet/xircom/xirc2ps_cs.c +++ b/drivers/net/ethernet/xircom/xirc2ps_cs.c @@ -503,6 +503,11 @@ static void xirc2ps_detach(struct pcmcia_device *link) { struct net_device *dev = link->priv; + struct local_info *local = netdev_priv(dev); + + netif_carrier_off(dev); + netif_tx_disable(dev); + cancel_work_sync(&local->tx_timeout_task); dev_dbg(&link->dev, "detach\n"); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition
by Yongqiang Liu 10 Apr '23

10 Apr '23

From: Zheng Wang <zyytlz.wz(a)163.com> maillist inclusion category: bugfix bugzilla: 188655, https://gitee.com/src-openeuler/kernel/issues/I6T36H CVE: CVE-2023-1859 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/… ---------------------------------------- In xen_9pfs_front_probe, it calls xen_9pfs_front_alloc_dataring to init priv->rings and bound &ring->work with p9_xen_response. When it calls xen_9pfs_front_event_handler to handle IRQ requests, it will finally call schedule_work to start the work. When we call xen_9pfs_front_remove to remove the driver, there may be a sequence as follows: Fix it by finishing the work before cleanup in xen_9pfs_front_free. Note that, this bug is found by static analysis, which might be false positive. CPU0 CPU1 |p9_xen_response xen_9pfs_front_remove| xen_9pfs_front_free| kfree(priv) | //free priv | |p9_tag_lookup |//use priv->client Fixes: 71ebd71921e4 ("xen/9pfs: connect to the backend") Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Reviewed-by: Michal Swiatkowski <michal.swiatkowski(a)linux.intel.com> Signed-off-by: Eric Van Hensbergen <ericvh(a)kernel.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/9p/trans_xen.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c index 81002cba88b3..8e158f09cba8 100644 --- a/net/9p/trans_xen.c +++ b/net/9p/trans_xen.c @@ -290,6 +290,10 @@ static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv) write_unlock(&xen_9pfs_lock); for (i = 0; i < priv->num_rings; i++) { + struct xen_9pfs_dataring *ring = &priv->rings[i]; + + cancel_work_sync(&ring->work); + if (!priv->rings[i].intf) break; if (priv->rings[i].irq > 0) -- 2.25.1

1 0

[PATCH OLK-5.10] KVM: nVMX: Set LDTR to its architecturally defined value on nested VM-Exit
by 任敏敏(联通集团联通数字科技有限公司本部) 10 Apr '23

10 Apr '23

From: Sean Christopherson <seanjc(a)google.com> stable inclusion from stable-v5.15 commit afc8de0118be84f4058b9977d481aeb3e0758dbb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6SN2F CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ commit afc8de0118be84f4058b9977d481aeb3e0758dbb upstream Set L1's LDTR on VM-Exit per the Intel SDM: The host-state area does not contain a selector field for LDTR. LDTR is established as follows on all VM exits: the selector is cleared to 0000H, the segment is marked unusable and is otherwise undefined (although the base address is always canonical). This is likely a benign bug since the LDTR is unusable, as it means the L1 VMM is conditioned to reload its LDTR in order to function properly on bare metal. Fixes: 4704d0befb07 ("KVM: nVMX: Exiting from L2 to L1") Reviewed-by: Reiji Watanabe <reijiw(a)google.com> Signed-off-by: Sean Christopherson <seanjc(a)google.com> Message-Id: <20210713163324.627647-3-seanjc(a)google.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: rminmin <renmm6(a)chinaunicom.cn> --- arch/x86/kvm/vmx/nested.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c index 9003b14d72ca..05284589c14d 100644 --- a/arch/x86/kvm/vmx/nested.c +++ b/arch/x86/kvm/vmx/nested.c @@ -4326,6 +4326,10 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu, }; vmx_set_segment(vcpu, &seg, VCPU_SREG_TR); + memset(&seg, 0, sizeof(seg)); + seg.unusable = 1; + vmx_set_segment(vcpu, &seg, VCPU_SREG_LDTR); + kvm_set_dr(vcpu, 7, 0x400); vmcs_write64(GUEST_IA32_DEBUGCTL, 0); -- 2.33.0 Èç¹ûÄúŽíÎóœÓÊÕÁËžÃÓÊŒþ£¬ÇëÍš¹ýµç×ÓÓÊŒþÁ¢ŒŽÍšÖªÎÒÃÇ¡£Çë»ØžŽÓÊŒþµœ hqs-spmc@chinaunicom.cn£¬ŒŽ¿ÉÒÔÍË¶©ŽËÓÊŒþ¡£ÎÒÃÇœ«Á¢ŒŽœ«ÄúµÄÐÅÏ¢ŽÓÎÒÃÇµÄ·¢ËÍÄ¿ÂŒÖÐÉŸ³ý¡£ If you have received this email in error please notify us immediately by e-mail. Please reply to hqs-spmc(a)chinaunicom.cn ,you can unsubscribe from this mail. We will immediately remove your information from send catalogue of our.

1 0

[PATCH 0/2] support dynamic affinity
by Hui Tang 08 Apr '23

08 Apr '23

test report: [root@localhost at]# bash -x dyn_affinity_interface.sh + ret=0 ++ cat /proc/sys/kernel/sched_util_low_pct + default_sched_util_low_pct=85 + read_default_val /proc/sys/kernel/sched_util_low_pct 85 + local interface=/proc/sys/kernel/sched_util_low_pct + local expect_val=85 + echo 'TINFO: test /proc/sys/kernel/sched_util_low_pct default value is 85' TINFO: test /proc/sys/kernel/sched_util_low_pct default value is 85 + '[' '!' -f /proc/sys/kernel/sched_util_low_pct ']' ++ cat /proc/sys/kernel/sched_util_low_pct + '[' 85 '!=' 85 ']' + '[' 0 -ne 0 ']' + echo 'TPASS: dyn_affinity_interface test success' TPASS: dyn_affinity_interface test success + write_some_val /proc/sys/kernel/sched_util_low_pct -1 1 + write_some_val /proc/sys/kernel/sched_util_low_pct 101 1 + write_some_val /proc/sys/kernel/sched_util_low_pct abc 1 + write_some_val /proc/sys/kernel/sched_util_low_pct 100 0 + local interface=/proc/sys/kernel/sched_util_low_pct + local write_val=100 + local expect_ret=0 + echo 'TINFO: write 100 to /proc/sys/kernel/sched_util_low_pct, expect ret: 0' TINFO: write 100 to /proc/sys/kernel/sched_util_low_pct, expect ret: 0 + echo 100 + '[' 0 -ne 0 ']' + echo 'TPASS: write 100 to /proc/sys/kernel/sched_util_low_pct success' TPASS: write 100 to /proc/sys/kernel/sched_util_low_pct success + write_some_val /proc/sys/kernel/sched_util_low_pct 0 0 + local interface=/proc/sys/kernel/sched_util_low_pct + local write_val=0 + local expect_ret=0 + echo 'TINFO: write 0 to /proc/sys/kernel/sched_util_low_pct, expect ret: 0' TINFO: write 0 to /proc/sys/kernel/sched_util_low_pct, expect ret: 0 + echo 0 + '[' 0 -ne 0 ']' + echo 'TPASS: write 0 to /proc/sys/kernel/sched_util_low_pct success' TPASS: write 0 to /proc/sys/kernel/sched_util_low_pct success + cleanup + echo 85 + exit 0 [root@localhost at]# [root@localhost at]# bash -x dyn_affinity_low_load.sh + TEST_CPUSET_PATH=/sys/fs/cgroup/cpuset/cloud + TEST_CPU_PATH=/sys/fs/cgroup/cpu/cloud + ret=0 ++ seq 1 1 + for i in $(seq 1 1) + setup + '[' -d /sys/fs/cgroup/cpuset/cloud ']' + mkdir -p /sys/fs/cgroup/cpuset/cloud /sys/fs/cgroup/cpu/cloud + echo 0 + echo 0-7 + echo 1 + do_test + echo 4166 + echo 4166 + local pid=0 ++ seq 1 3 + for i in $(seq 1 3) + pid=4170 + echo 4170 + echo 4170 + for i in $(seq 1 3) + pid=4171 + echo 4171 + echo 4171 + ./cpu_load_not_while + for i in $(seq 1 3) + pid=4172 + ./cpu_load_not_while + echo 4172 + ./cpu_load_not_while + echo 4172 + echo 4166 + echo 4166 + sleep 0.1 ++ seq 1 100 + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ egrep 1 -w ++ grep load ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ wc -l ++ egrep 1 -w + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ egrep 1 -w ++ wc -l ++ grep load + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=3 + '[' 3 -ne 3 ']' + '[' 0 -eq 0 ']' + ps -o psr,comm,pid + grep cpu_load 1 cpu_load_not_wh 4170 1 cpu_load_not_wh 4171 1 cpu_load_not_wh 4172 + echo 'TPASS: test success' TPASS: test success + cleanup + killall cpu_load_not_while + sleep 0.1 + rmdir /sys/fs/cgroup/cpuset/cloud /sys/fs/cgroup/cpu/cloud + exit 0 [root@localhost at]# bash -x dyn_affinity_high_load.sh + TEST_CPUSET_PATH=/sys/fs/cgroup/cpuset/cloud + TEST_CPU_PATH=/sys/fs/cgroup/cpu/cloud + ret=0 ++ seq 1 1 + for i in $(seq 1 1) + setup + '[' -d /sys/fs/cgroup/cpuset/cloud ']' + mkdir -p /sys/fs/cgroup/cpuset/cloud /sys/fs/cgroup/cpu/cloud + echo 0 + echo 0-7 + echo 1 + do_test + echo 4121 + echo 4121 + local pid=0 ++ seq 1 30 + for i in $(seq 1 30) + pid=4125 + echo 4125 + echo 4125 + for i in $(seq 1 30) + pid=4126 + echo 4126 + ./cpu_load_not_while + echo 4126 + for i in $(seq 1 30) + pid=4127 + echo 4127 + ./cpu_load_not_while + ./cpu_load_not_while + echo 4127 + for i in $(seq 1 30) + pid=4128 + ./cpu_load_not_while + echo 4128 + echo 4128 + for i in $(seq 1 30) + pid=4129 + echo 4129 + echo 4129 + for i in $(seq 1 30) + ./cpu_load_not_while + pid=4130 + echo 4130 + ./cpu_load_not_while + echo 4130 + for i in $(seq 1 30) + pid=4131 + ./cpu_load_not_while + echo 4131 + echo 4131 + for i in $(seq 1 30) + pid=4132 + echo 4132 + echo 4132 + ./cpu_load_not_while + for i in $(seq 1 30) + pid=4133 + ./cpu_load_not_while + echo 4133 + echo 4133 + for i in $(seq 1 30) + pid=4134 + ./cpu_load_not_while + echo 4134 + echo 4134 + for i in $(seq 1 30) + pid=4135 + ./cpu_load_not_while + echo 4135 + echo 4135 + for i in $(seq 1 30) + pid=4136 + ./cpu_load_not_while + echo 4136 + echo 4136 + for i in $(seq 1 30) + pid=4137 + ./cpu_load_not_while + echo 4137 + echo 4137 + for i in $(seq 1 30) + pid=4138 + echo 4138 + ./cpu_load_not_while + echo 4138 + for i in $(seq 1 30) + pid=4139 + ./cpu_load_not_while + echo 4139 + echo 4139 + for i in $(seq 1 30) + pid=4140 + ./cpu_load_not_while + echo 4140 + echo 4140 + for i in $(seq 1 30) + pid=4141 + echo 4141 + ./cpu_load_not_while + echo 4141 + for i in $(seq 1 30) + pid=4142 + echo 4142 + ./cpu_load_not_while + echo 4142 + for i in $(seq 1 30) + pid=4143 + echo 4143 + ./cpu_load_not_while + echo 4143 + for i in $(seq 1 30) + pid=4144 + ./cpu_load_not_while + echo 4144 + echo 4144 + for i in $(seq 1 30) + pid=4145 + ./cpu_load_not_while + echo 4145 + echo 4145 + for i in $(seq 1 30) + pid=4146 + echo 4146 + echo 4146 + ./cpu_load_not_while + for i in $(seq 1 30) + pid=4147 + echo 4147 + echo 4147 + ./cpu_load_not_while + for i in $(seq 1 30) + pid=4148 + echo 4148 + echo 4148 + ./cpu_load_not_while + for i in $(seq 1 30) + pid=4149 + echo 4149 + echo 4149 + ./cpu_load_not_while + for i in $(seq 1 30) + pid=4150 + echo 4150 + echo 4150 + ./cpu_load_not_while + for i in $(seq 1 30) + pid=4151 + echo 4151 + echo 4151 + ./cpu_load_not_while + for i in $(seq 1 30) + pid=4152 + echo 4152 + ./cpu_load_not_while + echo 4152 + for i in $(seq 1 30) + pid=4153 + ./cpu_load_not_while + echo 4153 + echo 4153 + for i in $(seq 1 30) + pid=4154 + ./cpu_load_not_while + echo 4154 + echo 4154 + echo 4121 + echo 4121 + sleep 0.1 ++ seq 1 100 + for i in $(seq 1 100) ++ ps -o psr,comm,pid ++ grep load ++ egrep 1 -w ++ wc -l + local count=19 + '[' 19 -ne 30 ']' + ps -o psr,comm,pid + grep cpu_load 1 cpu_load_not_wh 4125 6 cpu_load_not_wh 4126 1 cpu_load_not_wh 4127 1 cpu_load_not_wh 4128 1 cpu_load_not_wh 4129 1 cpu_load_not_wh 4130 1 cpu_load_not_wh 4131 1 cpu_load_not_wh 4132 1 cpu_load_not_wh 4133 1 cpu_load_not_wh 4134 7 cpu_load_not_wh 4135 1 cpu_load_not_wh 4136 1 cpu_load_not_wh 4137 4 cpu_load_not_wh 4138 1 cpu_load_not_wh 4139 1 cpu_load_not_wh 4140 1 cpu_load_not_wh 4141 5 cpu_load_not_wh 4142 1 cpu_load_not_wh 4143 1 cpu_load_not_wh 4144 1 cpu_load_not_wh 4145 1 cpu_load_not_wh 4146 1 cpu_load_not_wh 4147 3 cpu_load_not_wh 4148 5 cpu_load_not_wh 4149 1 cpu_load_not_wh 4150 1 cpu_load_not_wh 4151 1 cpu_load_not_wh 4152 5 cpu_load_not_wh 4153 6 cpu_load_not_wh 4154 + echo 'TPASS: test success' TPASS: test success + exit tanghui (2): sched: Add statistics for scheduler dynamic affinity config: enable CONFIG_QOS_SCHED_DYNAMIC_AFFINITY by default arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/linux/sched.h | 6 ++++++ kernel/sched/debug.c | 4 ++++ kernel/sched/fair.c | 11 +++++++++-- 5 files changed, 21 insertions(+), 2 deletions(-) -- 2.17.1

1 2

[PATCH openEuler-1.0-LTS] bpf: add missing header file include
by Yongqiang Liu 08 Apr '23

08 Apr '23

From: Linus Torvalds <torvalds(a)linux-foundation.org> stable inclusion from stable-v4.19.274 commit c7603df97635954165fb599e64e197efc353979b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6TIG1 CVE: NA -------------------------------- commit f3dd0c53370e70c0f9b7e931bbec12916f3bb8cc upstream. Commit 74e19ef0ff80 ("uaccess: Add speculation barrier to copy_from_user()") built fine on x86-64 and arm64, and that's the extent of my local build testing. It turns out those got the <linux/nospec.h> include incidentally through other header files (<linux/kvm_host.h> in particular), but that was not true of other architectures, resulting in build errors kernel/bpf/core.c: In function ‘___bpf_prog_run’: kernel/bpf/core.c:1913:3: error: implicit declaration of function ‘barrier_nospec’ so just make sure to explicitly include the proper <linux/nospec.h> header file to make everybody see it. Fixes: 74e19ef0ff80 ("uaccess: Add speculation barrier to copy_from_user()") Reported-by: kernel test robot <lkp(a)intel.com> Reported-by: Viresh Kumar <viresh.kumar(a)linaro.org> Reported-by: Huacai Chen <chenhuacai(a)loongson.cn> Tested-by: Geert Uytterhoeven <geert(a)linux-m68k.org> Tested-by: Dave Hansen <dave.hansen(a)linux.intel.com> Acked-by: Alexei Starovoitov <alexei.starovoitov(a)gmail.com> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- kernel/bpf/core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index abf30609e0d9..56a60d483c8d 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -32,6 +32,7 @@ #include <linux/kallsyms.h> #include <linux/rcupdate.h> #include <linux/perf_event.h> +#include <linux/nospec.h> #include <asm/barrier.h> #include <asm/unaligned.h> -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 00/19] linux-4.19.y inclusion
by Yongqiang Liu 07 Apr '23

07 Apr '23

*** BLURB HERE *** Armin Wolf (1): ACPI: battery: Fix missing NUL-termination with large strings Baokun Li (1): ext4: fail ext4_iget if special inode unallocated Breno Leitao (1): x86/bugs: Reset speculation control settings on init Daniil Tatianin (1): ACPICA: nsrepair: handle cases without a return value correctly Dave Hansen (1): uaccess: Add speculation barrier to copy_from_user() Herbert Xu (2): crypto: seqiv - Handle EBUSY correctly crypto: rsa-pkcs1pad - Use akcipher_request_complete Jann Horn (1): timers: Prevent union confusion from unexpected restart_syscall() Jason A. Donenfeld (1): random: always mix cycle counter in add_latent_entropy() Johan Hovold (3): irqdomain: Fix association race irqdomain: Fix disassociation race irqdomain: Drop bogus fwspec-mapping error handling Nikita Zhandarovich (1): x86/mm: Fix use of uninitialized buffer in sme_enable() Thomas Gleixner (1): alarmtimer: Prevent starvation by small intervals and SIG_IGN Vishal Verma (1): ACPI: NFIT: fix a potential deadlock during NFIT teardown Yang Jihong (2): x86/kprobes: Fix __recover_optprobed_insn check optimizing logic x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range Zhen Lei (1): genirq: Fix the return type of kstat_cpu_irqs_sum() Zhihao Cheng (1): ext4: zero i_disksize when initializing the bootloader inode arch/x86/include/asm/msr-index.h | 4 ++++ arch/x86/kernel/cpu/bugs.c | 10 ++++++++- arch/x86/kernel/kprobes/opt.c | 6 +++--- arch/x86/mm/mem_encrypt_identity.c | 3 ++- crypto/rsa-pkcs1pad.c | 34 +++++++++++++----------------- crypto/seqiv.c | 2 +- drivers/acpi/acpica/nsrepair.c | 12 ++++++----- drivers/acpi/battery.c | 2 +- drivers/acpi/nfit/core.c | 2 +- fs/ext4/inode.c | 18 +++++++--------- fs/ext4/ioctl.c | 1 + include/linux/kernel_stat.h | 2 +- include/linux/kprobes.h | 2 ++ include/linux/nospec.h | 4 ++++ include/linux/random.h | 6 +++--- kernel/bpf/core.c | 2 -- kernel/irq/irqdomain.c | 31 +++++++++++++++++---------- kernel/kprobes.c | 6 +++--- kernel/time/alarmtimer.c | 33 +++++++++++++++++++++++++---- kernel/time/hrtimer.c | 2 ++ kernel/time/posix-stubs.c | 2 ++ kernel/time/posix-timers.c | 2 ++ lib/usercopy.c | 7 ++++++ 23 files changed, 127 insertions(+), 66 deletions(-) -- 2.25.1

1 19

[PATCH openEuler-1.0-LTS 01/19] alarmtimer: Prevent starvation by small intervals and SIG_IGN
by Yongqiang Liu 07 Apr '23

07 Apr '23

From: Thomas Gleixner <tglx(a)linutronix.de> stable inclusion from stable-v4.19.274 commit d6a300076d11a6e27b4d4f7fd986ec66ee97a3e1 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6TIG1 CVE: NA -------------------------------- commit d125d1349abeb46945dc5e98f7824bf688266f13 upstream. syzbot reported a RCU stall which is caused by setting up an alarmtimer with a very small interval and ignoring the signal. The reproducer arms the alarm timer with a relative expiry of 8ns and an interval of 9ns. Not a problem per se, but that's an issue when the signal is ignored because then the timer is immediately rearmed because there is no way to delay that rearming to the signal delivery path. See posix_timer_fn() and commit 58229a189942 ("posix-timers: Prevent softirq starvation by small intervals and SIG_IGN") for details. The reproducer does not set SIG_IGN explicitely, but it sets up the timers signal with SIGCONT. That has the same effect as explicitely setting SIG_IGN for a signal as SIGCONT is ignored if there is no handler set and the task is not ptraced. The log clearly shows that: [pid 5102] --- SIGCONT {si_signo=SIGCONT, si_code=SI_TIMER, si_timerid=0, si_overrun=316014, si_int=0, si_ptr=NULL} --- It works because the tasks are traced and therefore the signal is queued so the tracer can see it, which delays the restart of the timer to the signal delivery path. But then the tracer is killed: [pid 5087] kill(-5102, SIGKILL <unfinished ...> ... ./strace-static-x86_64: Process 5107 detached and after it's gone the stall can be observed: syzkaller login: [ 79.439102][ C0] hrtimer: interrupt took 68471 ns [ 184.460538][ C1] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: ... [ 184.658237][ C1] rcu: Stack dump where RCU GP kthread last ran: [ 184.664574][ C1] Sending NMI from CPU 1 to CPUs 0: [ 184.669821][ C0] NMI backtrace for cpu 0 [ 184.669831][ C0] CPU: 0 PID: 5108 Comm: syz-executor192 Not tainted 6.2.0-rc6-next-20230203-syzkaller #0 ... [ 184.670036][ C0] Call Trace: [ 184.670041][ C0] <IRQ> [ 184.670045][ C0] alarmtimer_fired+0x327/0x670 posix_timer_fn() prevents that by checking whether the interval for timers which have the signal ignored is smaller than a jiffie and artifically delay it by shifting the next expiry out by a jiffie. That's accurate vs. the overrun accounting, but slightly inaccurate vs. timer_gettimer(2). The comment in that function says what needs to be done and there was a fix available for the regular userspace induced SIG_IGN mechanism, but that did not work due to the implicit ignore for SIGCONT and similar signals. This needs to be worked on, but for now the only available workaround is to do exactly what posix_timer_fn() does: Increase the interval of self-rearming timers, which have their signal ignored, to at least a jiffie. Interestingly this has been fixed before via commit ff86bf0c65f1 ("alarmtimer: Rate limit periodic intervals") already, but that fix got lost in a later rework. Reported-by: syzbot+b9564ba6e8e00694511b(a)syzkaller.appspotmail.com Fixes: f2c45807d399 ("alarmtimer: Switch over to generic set/get/rearm routine") Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Acked-by: John Stultz <jstultz(a)google.com> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/87k00q1no2.ffs@tglx Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- kernel/time/alarmtimer.c | 33 +++++++++++++++++++++++++++++---- 1 file changed, 29 insertions(+), 4 deletions(-) diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c index 6a2ba39889bd..56af8a97cf2d 100644 --- a/kernel/time/alarmtimer.c +++ b/kernel/time/alarmtimer.c @@ -476,11 +476,35 @@ u64 alarm_forward(struct alarm *alarm, ktime_t now, ktime_t interval) } EXPORT_SYMBOL_GPL(alarm_forward); -u64 alarm_forward_now(struct alarm *alarm, ktime_t interval) +static u64 __alarm_forward_now(struct alarm *alarm, ktime_t interval, bool throttle) { struct alarm_base *base = &alarm_bases[alarm->type]; + ktime_t now = base->gettime(); + + if (IS_ENABLED(CONFIG_HIGH_RES_TIMERS) && throttle) { + /* + * Same issue as with posix_timer_fn(). Timers which are + * periodic but the signal is ignored can starve the system + * with a very small interval. The real fix which was + * promised in the context of posix_timer_fn() never + * materialized, but someone should really work on it. + * + * To prevent DOS fake @now to be 1 jiffie out which keeps + * the overrun accounting correct but creates an + * inconsistency vs. timer_gettime(2). + */ + ktime_t kj = NSEC_PER_SEC / HZ; + + if (interval < kj) + now = ktime_add(now, kj); + } + + return alarm_forward(alarm, now, interval); +} - return alarm_forward(alarm, base->gettime(), interval); +u64 alarm_forward_now(struct alarm *alarm, ktime_t interval) +{ + return __alarm_forward_now(alarm, interval, false); } EXPORT_SYMBOL_GPL(alarm_forward_now); @@ -554,9 +578,10 @@ static enum alarmtimer_restart alarm_handle_timer(struct alarm *alarm, if (posix_timer_event(ptr, si_private) && ptr->it_interval) { /* * Handle ignored signals and rearm the timer. This will go - * away once we handle ignored signals proper. + * away once we handle ignored signals proper. Ensure that + * small intervals cannot starve the system. */ - ptr->it_overrun += alarm_forward_now(alarm, ptr->it_interval); + ptr->it_overrun += __alarm_forward_now(alarm, ptr->it_interval, true); ++ptr->it_requeue_pending; ptr->it_active = 1; result = ALARMTIMER_RESTART; -- 2.25.1

1 18

[PATCH openEuler-1.0-LTS 1/7] Revert "cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()"
by Yongqiang Liu 07 Apr '23

07 Apr '23

From: Cai Xinchen <caixinchen1(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6TI3Y CVE: NA -------------------------------- This reverts commit c2d8355618485dd9108ee9077799a227771af307. Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- kernel/cgroup/cgroup-internal.h | 2 -- kernel/cgroup/cgroup-v1.c | 4 ++-- kernel/cgroup/cgroup.c | 4 ++-- 3 files changed, 4 insertions(+), 6 deletions(-) diff --git a/kernel/cgroup/cgroup-internal.h b/kernel/cgroup/cgroup-internal.h index edb45e2f7f54..2e65e4c4d6e7 100644 --- a/kernel/cgroup/cgroup-internal.h +++ b/kernel/cgroup/cgroup-internal.h @@ -226,8 +226,6 @@ int cgroup_migrate(struct task_struct *leader, bool threadgroup, int cgroup_attach_task(struct cgroup *dst_cgrp, struct task_struct *leader, bool threadgroup); -void cgroup_attach_lock(void); -void cgroup_attach_unlock(void); struct task_struct *cgroup_procs_write_start(char *buf, bool threadgroup) __acquires(&cgroup_threadgroup_rwsem); void cgroup_procs_write_finish(struct task_struct *task) diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c index 8bd36f2143eb..c4cc6c1ddacd 100644 --- a/kernel/cgroup/cgroup-v1.c +++ b/kernel/cgroup/cgroup-v1.c @@ -55,7 +55,7 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk) int retval = 0; mutex_lock(&cgroup_mutex); - cgroup_attach_lock(); + percpu_down_write(&cgroup_threadgroup_rwsem); for_each_root(root) { struct cgroup *from_cgrp; @@ -70,7 +70,7 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk) if (retval) break; } - cgroup_attach_unlock(); + percpu_up_write(&cgroup_threadgroup_rwsem); mutex_unlock(&cgroup_mutex); return retval; diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index 4a4d8a3f06ab..6487df9a6be0 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -2236,7 +2236,7 @@ EXPORT_SYMBOL_GPL(task_cgroup_path); * write-locking cgroup_threadgroup_rwsem. This allows ->attach() to assume that * CPU hotplug is disabled on entry. */ -void cgroup_attach_lock(void) +static void cgroup_attach_lock(void) { cpus_read_lock(); percpu_down_write(&cgroup_threadgroup_rwsem); @@ -2246,7 +2246,7 @@ void cgroup_attach_lock(void) * cgroup_attach_unlock - Undo cgroup_attach_lock() * @lock_threadgroup: whether to up_write cgroup_threadgroup_rwsem */ -void cgroup_attach_unlock(void) +static void cgroup_attach_unlock(void) { percpu_up_write(&cgroup_threadgroup_rwsem); cpus_read_unlock(); -- 2.25.1

1 6

[PATCH openEuler-22.03-LTS] net/smc: align the connect behaviour with TCP
by Litao Jiao 07 Apr '23

07 Apr '23

mainline inclusion from mainline-v5.19.rc1 commit 3aba103006bcc4a7472b7c9506b3bc065ffb7992 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6TK1U CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Connect with O_NONBLOCK will not be completed immediately and returns -EINPROGRESS. It is possible to use selector/poll for completion by selecting the socket for writing. After select indicates writability, a second connect function call will return 0 to indicate connected successfully as TCP does, but smc returns -EISCONN. Use socket state for smc to indicate connect state, which can help smc aligning the connect behaviour with TCP. Signed-off-by: Guangguan Wang <guangguan.wang(a)linux.alibaba.com> Acked-by: Karsten Graul <kgraul(a)linux.ibm.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Litao Jiao <jiaolitao(a)sangfor.com.cn> --- net/smc/af_smc.c | 51 ++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 47 insertions(+), 4 deletions(-) diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c index 5d7710dd9514..8f73da1ee7b4 100644 --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -1097,9 +1097,29 @@ static int smc_connect(struct socket *sock, struct sockaddr *addr, goto out_err; lock_sock(sk); + switch (sock->state) { + default: + rc = -EINVAL; + goto out; + case SS_CONNECTED: + rc = sk->sk_state == SMC_ACTIVE ? -EISCONN : -EINVAL; + goto out; + case SS_CONNECTING: + if (sk->sk_state == SMC_ACTIVE) + goto connected; + break; + case SS_UNCONNECTED: + sock->state = SS_CONNECTING; + break; + } + switch (sk->sk_state) { default: goto out; + case SMC_CLOSED: + rc = sock_error(sk) ? : -ECONNABORTED; + sock->state = SS_UNCONNECTED; + goto out; case SMC_ACTIVE: rc = -EISCONN; goto out; @@ -1118,21 +1138,26 @@ static int smc_connect(struct socket *sock, struct sockaddr *addr, if (rc && rc != -EINPROGRESS) goto out; - if (smc->use_fallback) + if (smc->use_fallback) { + sock->state = rc ? SS_CONNECTING : SS_CONNECTED; goto out; + } sock_hold(&smc->sk); /* sock put in passive closing */ + if (flags & O_NONBLOCK) { if (queue_work(smc_hs_wq, &smc->connect_work)) smc->connect_nonblock = 1; rc = -EINPROGRESS; + goto out; } else { rc = __smc_connect(smc); if (rc < 0) goto out; - else - rc = 0; /* success cases including fallback */ } +connected: + rc = 0; + sock->state = SS_CONNECTED; out: release_sock(sk); out_err: @@ -1234,6 +1259,7 @@ struct sock *smc_accept_dequeue(struct sock *parent, } if (new_sock) { sock_graft(new_sk, new_sock); + new_sock->state = SS_CONNECTED; if (isk->use_fallback) { smc_sk(new_sk)->clcsock->file = new_sock->file; isk->clcsock->file->private_data = isk->clcsock; @@ -1865,7 +1891,7 @@ static int smc_listen(struct socket *sock, int backlog) rc = -EINVAL; if ((sk->sk_state != SMC_INIT && sk->sk_state != SMC_LISTEN) || - smc->connect_nonblock) + smc->connect_nonblock || sock->state != SS_UNCONNECTED) goto out; rc = 0; @@ -2135,6 +2161,17 @@ static int smc_shutdown(struct socket *sock, int how) lock_sock(sk); + if (sock->state == SS_CONNECTING) { + if (sk->sk_state == SMC_ACTIVE) + sock->state = SS_CONNECTED; + else if (sk->sk_state == SMC_PEERCLOSEWAIT1 || + sk->sk_state == SMC_PEERCLOSEWAIT2 || + sk->sk_state == SMC_APPCLOSEWAIT1 || + sk->sk_state == SMC_APPCLOSEWAIT2 || + sk->sk_state == SMC_APPFINCLOSEWAIT) + sock->state = SS_DISCONNECTING; + } + rc = -ENOTCONN; if ((sk->sk_state != SMC_ACTIVE) && (sk->sk_state != SMC_PEERCLOSEWAIT1) && @@ -2148,6 +2185,7 @@ static int smc_shutdown(struct socket *sock, int how) sk->sk_shutdown = smc->clcsock->sk->sk_shutdown; if (sk->sk_shutdown == SHUTDOWN_MASK) { sk->sk_state = SMC_CLOSED; + sk->sk_socket->state = SS_UNCONNECTED; sock_put(sk); } goto out; @@ -2173,6 +2211,10 @@ static int smc_shutdown(struct socket *sock, int how) /* map sock_shutdown_cmd constants to sk_shutdown value range */ sk->sk_shutdown |= how + 1; + if (sk->sk_state == SMC_CLOSED) + sock->state = SS_UNCONNECTED; + else + sock->state = SS_DISCONNECTING; out: release_sock(sk); return rc ? rc : rc1; @@ -2464,6 +2506,7 @@ static int smc_create(struct net *net, struct socket *sock, int protocol, rc = -ENOBUFS; sock->ops = &smc_sock_ops; + sock->state = SS_UNCONNECTED; sk = smc_sock_alloc(net, sock, protocol); if (!sk) goto out; -- 2.18.0.windows.1

1 0

2024

2023

2022

2021

2020

2019

Kernel