- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] configs: enable CONFIG_INTEL_IDXD
by fuyufan 24 Feb '22

24 Feb '22

euler inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4URME CVE: NA -------------------------------- Enable CONFIG_INTEL_IDXD in openeuler_defconfig for x86. Support Intel Data Accelerators on Xeon hardware. Signed-off-by: fuyufan <fuyufan(a)huawei.com> --- arch/x86/configs/openeuler_defconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 316c4122a859..350a02583978 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -6353,7 +6353,7 @@ CONFIG_DMA_VIRTUAL_CHANNELS=y CONFIG_DMA_ACPI=y # CONFIG_ALTERA_MSGDMA is not set CONFIG_INTEL_IDMA64=m -# CONFIG_INTEL_IDXD is not set +CONFIG_INTEL_IDXD=y CONFIG_INTEL_IOATDMA=m # CONFIG_PLX_DMA is not set # CONFIG_QCOM_HIDMA_MGMT is not set -- 2.27.0

1 0

[PATCH openEuler-1.0-LTS 1/2] udf: Fix NULL ptr deref when converting from inline format
by Yang Yingliang 24 Feb '22

24 Feb '22

From: Jan Kara <jack(a)suse.cz> mainline inclusion from mainline-v5.17-rc2 commit 7fc3b7c2981bbd1047916ade327beccb90994eee category: bugfix bugzilla: 186269 CVE: CVE-2022-0617 ----------------------------------------------- udf_expand_file_adinicb() calls directly ->writepage to write data expanded into a page. This however misses to setup inode for writeback properly and so we can crash on inode->i_wb dereference when submitting page for IO like: BUG: kernel NULL pointer dereference, address: 0000000000000158 #PF: supervisor read access in kernel mode ... <TASK> __folio_start_writeback+0x2ac/0x350 __block_write_full_page+0x37d/0x490 udf_expand_file_adinicb+0x255/0x400 [udf] udf_file_write_iter+0xbe/0x1b0 [udf] new_sync_write+0x125/0x1c0 vfs_write+0x28e/0x400 Fix the problem by marking the page dirty and going through the standard writeback path to write the page. Strictly speaking we would not even have to write the page but we want to catch e.g. ENOSPC errors early. Reported-by: butt3rflyh4ck <butterflyhuangxx(a)gmail.com> CC: stable(a)vger.kernel.org Fixes: 52ebea749aae ("writeback: make backing_dev_info host cgroup-specific bdi_writebacks") Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Zhang Wensheng <zhangwensheng5(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/udf/inode.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/fs/udf/inode.c b/fs/udf/inode.c index 4c46ebf0e773b..d1fab052ac759 100644 --- a/fs/udf/inode.c +++ b/fs/udf/inode.c @@ -248,10 +248,6 @@ int udf_expand_file_adinicb(struct inode *inode) char *kaddr; struct udf_inode_info *iinfo = UDF_I(inode); int err; - struct writeback_control udf_wbc = { - .sync_mode = WB_SYNC_NONE, - .nr_to_write = 1, - }; WARN_ON_ONCE(!inode_is_locked(inode)); if (!iinfo->i_lenAlloc) { @@ -295,8 +291,10 @@ int udf_expand_file_adinicb(struct inode *inode) iinfo->i_alloc_type = ICBTAG_FLAG_AD_LONG; /* from now on we have normal address_space methods */ inode->i_data.a_ops = &udf_aops; + set_page_dirty(page); + unlock_page(page); up_write(&iinfo->i_data_sem); - err = inode->i_data.a_ops->writepage(page, &udf_wbc); + err = filemap_fdatawrite(inode->i_mapping); if (err) { /* Restore everything back so that we don't lose data... */ lock_page(page); -- 2.25.1

1 1

[PATCH openEuler-5.10 01/18] efi: Make efi_print_memmap() public
by Zheng Zengkai 23 Feb '22

23 Feb '22

From: Ma Wupeng <mawupeng1(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4PM01 CVE: NA -------------------------------- Make efi_print_memmap() public in preparation for adding fake memory support for architecture with efi support, eg, arm64. Co-developed-by: Jing Xiangfeng <jingxiangfeng(a)huawei.com> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- arch/x86/include/asm/efi.h | 1 - arch/x86/platform/efi/efi.c | 16 ---------------- drivers/firmware/efi/memmap.c | 16 ++++++++++++++++ include/linux/efi.h | 1 + 4 files changed, 17 insertions(+), 17 deletions(-) diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h index bc9758ef292e..3be8754408d5 100644 --- a/arch/x86/include/asm/efi.h +++ b/arch/x86/include/asm/efi.h @@ -138,7 +138,6 @@ struct efi_scratch { extern struct efi_scratch efi_scratch; extern int __init efi_memblock_x86_reserve_range(void); -extern void __init efi_print_memmap(void); extern void __init efi_map_region(efi_memory_desc_t *md); extern void __init efi_map_region_fixed(efi_memory_desc_t *md); extern void efi_sync_low_kernel_mappings(void); diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c index 8a26e705cb06..ef6f4cbffe28 100644 --- a/arch/x86/platform/efi/efi.c +++ b/arch/x86/platform/efi/efi.c @@ -323,22 +323,6 @@ static void __init efi_clean_memmap(void) } } -void __init efi_print_memmap(void) -{ - efi_memory_desc_t *md; - int i = 0; - - for_each_efi_memory_desc(md) { - char buf[64]; - - pr_info("mem%02u: %s range=[0x%016llx-0x%016llx] (%lluMB)\n", - i++, efi_md_typeattr_format(buf, sizeof(buf), md), - md->phys_addr, - md->phys_addr + (md->num_pages << EFI_PAGE_SHIFT) - 1, - (md->num_pages >> (20 - EFI_PAGE_SHIFT))); - } -} - static int __init efi_systab_init(unsigned long phys) { int size = efi_enabled(EFI_64BIT) ? sizeof(efi_system_table_64_t) diff --git a/drivers/firmware/efi/memmap.c b/drivers/firmware/efi/memmap.c index 2ff1883dc788..0155bf066ba5 100644 --- a/drivers/firmware/efi/memmap.c +++ b/drivers/firmware/efi/memmap.c @@ -376,3 +376,19 @@ void __init efi_memmap_insert(struct efi_memory_map *old_memmap, void *buf, } } } + +void __init efi_print_memmap(void) +{ + efi_memory_desc_t *md; + int i = 0; + + for_each_efi_memory_desc(md) { + char buf[64]; + + pr_info("mem%02u: %s range=[0x%016llx-0x%016llx] (%lluMB)\n", + i++, efi_md_typeattr_format(buf, sizeof(buf), md), + md->phys_addr, + md->phys_addr + (md->num_pages << EFI_PAGE_SHIFT) - 1, + (md->num_pages >> (20 - EFI_PAGE_SHIFT))); + } +} diff --git a/include/linux/efi.h b/include/linux/efi.h index e17cd4c44f93..280f36cb7c14 100644 --- a/include/linux/efi.h +++ b/include/linux/efi.h @@ -643,6 +643,7 @@ extern int __init efi_memmap_split_count(efi_memory_desc_t *md, struct range *range); extern void __init efi_memmap_insert(struct efi_memory_map *old_memmap, void *buf, struct efi_mem_range *mem); +extern void __init efi_print_memmap(void); #ifdef CONFIG_EFI_ESRT extern void __init efi_esrt_init(void); -- 2.20.1

1 17

[PATCH openEuler-5.10 04/25] ahci: Fix some bugs like plugin support and sata link stability when user enable ahci RTD3
by Zheng Zengkai 23 Feb '22

23 Feb '22

From: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> zhaoxin inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I40QDN CVE: NA ---------------------------------------------------------------- The kernel driver now will disable interrupt when port is suspended, causing plugin not work. It is useful to make plugin work，when the plugin interrupt is enabled with power management status. Adding pm_request_resume() is to reume port for plugin or PME signal waking up controller which in D3. with the AHCI controller frequently enters into D3 and leaves from D3, the identify cmd may be timeout when controller resumes and establishes a connect with the device.it is effective to delay 10ms between controller resume and port resume，with link’s smooth transition. with non power management request and power management competing with each other in queue, it is often found that block IO hang 120s when system disk is suspending or resuming.it is now guaranteed that PM requests will enter the queue no matter other non-PM requests are waiting. Increase the pm_only counter before checking whether any non-PM blk_queue_enter() calls are in progress. Meanwhile, the new blk_pm_request_resume() call is necessary to occur during request assigned to a queue when device is suspended. Signed-off-by: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> Reviewed-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/ata/ahci.c | 13 +++++++++++++ drivers/ata/libahci.c | 15 +++++++++++++++ 2 files changed, 28 insertions(+) diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c index ff2add0101fe..8a7140ee88b5 100644 --- a/drivers/ata/ahci.c +++ b/drivers/ata/ahci.c @@ -869,6 +869,19 @@ static int ahci_pci_device_runtime_resume(struct device *dev) if (rc) return rc; ahci_pci_init_controller(host); + + /* Port resume for Zhaoxin platform */ + if (pdev->vendor == PCI_VENDOR_ID_ZHAOXIN) { + if (pdev->revision == 0x01) + ata_msleep(NULL, 10); + + for (rc = 0; rc < host->n_ports; rc++) { + struct ata_port *ap = host->ports[rc]; + + pm_request_resume(&ap->tdev); + } + } + return 0; } diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c index fec2e9754aed..4514f3f28b7c 100644 --- a/drivers/ata/libahci.c +++ b/drivers/ata/libahci.c @@ -823,9 +823,15 @@ static int ahci_set_lpm(struct ata_link *link, enum ata_lpm_policy policy, static void ahci_power_down(struct ata_port *ap) { struct ahci_host_priv *hpriv = ap->host->private_data; + struct pci_dev *pdev; void __iomem *port_mmio = ahci_port_base(ap); u32 cmd, scontrol; + /* port suspended enable Plugin intr for Zhaoxin platform */ + pdev = (ap->dev && dev_is_pci(ap->dev)) ? to_pci_dev(ap->dev) : NULL; + if ((pdev && pdev->vendor == PCI_VENDOR_ID_ZHAOXIN) && !ap->link.device->sdev) + writel(PORT_IRQ_CONNECT, port_mmio + PORT_IRQ_MASK); + if (!(hpriv->cap & HOST_CAP_SSS)) return; @@ -1701,6 +1707,7 @@ static void ahci_error_intr(struct ata_port *ap, u32 irq_stat) struct ata_link *link = NULL; struct ata_queued_cmd *active_qc; struct ata_eh_info *active_ehi; + struct pci_dev *pdev; bool fbs_need_dec = false; u32 serror; @@ -1791,6 +1798,14 @@ static void ahci_error_intr(struct ata_port *ap, u32 irq_stat) ata_ehi_push_desc(host_ehi, "%s", irq_stat & PORT_IRQ_CONNECT ? "connection status changed" : "PHY RDY changed"); + + /* When plugin intr happen, now resume suspended port for Zhaoxin platform */ + pdev = (ap->dev && dev_is_pci(ap->dev)) ? to_pci_dev(ap->dev) : NULL; + if ((pdev && pdev->vendor == PCI_VENDOR_ID_ZHAOXIN) && + (ap->pflags & ATA_PFLAG_SUSPENDED)) { + pm_request_resume(&ap->tdev); + return; + } } /* okay, let's hand over to EH */ -- 2.20.1

1 3

[PATCH openEuler-5.10 01/25] rtc: Fix set RTC time delay 500ms on some Zhaoxin SOCs
by Zheng Zengkai 23 Feb '22

23 Feb '22

From: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> zhaoxin inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I40QDN CVE: NA ---------------------------------------------------------------- When the RTC divider is changed from reset to an operating time base, the first update cycle should be 500ms later. But on some Zhaoxin SOCs, this first update cycle is one second later. So set RTC time on these Zhaoxin SOCs will causing 500ms delay. Skip setup RTC divider on these SOCs in mc146818_set_time to fix it. Signed-off-by: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Reviewed-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/rtc/rtc-mc146818-lib.c | 26 +++++++++++++++++++++++--- 1 file changed, 23 insertions(+), 3 deletions(-) diff --git a/drivers/rtc/rtc-mc146818-lib.c b/drivers/rtc/rtc-mc146818-lib.c index 2ecd8752b088..033dcc0645a5 100644 --- a/drivers/rtc/rtc-mc146818-lib.c +++ b/drivers/rtc/rtc-mc146818-lib.c @@ -8,6 +8,22 @@ #include <linux/acpi.h> #endif +#ifdef CONFIG_X86 +static inline bool follow_mc146818_divider_reset(void) +{ + if ((boot_cpu_data.x86_vendor == X86_VENDOR_CENTAUR || + boot_cpu_data.x86_vendor == X86_VENDOR_ZHAOXIN) && + (boot_cpu_data.x86 <= 7 && boot_cpu_data.x86_model <= 59)) + return false; + return true; +} +#else +static inline bool follow_mc146818_divider_reset(void) +{ + return true; +} +#endif + /* * Returns true if a clock update is in progress */ @@ -171,8 +187,11 @@ int mc146818_set_time(struct rtc_time *time) save_control = CMOS_READ(RTC_CONTROL); CMOS_WRITE((save_control|RTC_SET), RTC_CONTROL); - save_freq_select = CMOS_READ(RTC_FREQ_SELECT); - CMOS_WRITE((save_freq_select|RTC_DIV_RESET2), RTC_FREQ_SELECT); + if (follow_mc146818_divider_reset()) { + save_freq_select = CMOS_READ(RTC_FREQ_SELECT); + CMOS_WRITE((save_freq_select|RTC_DIV_RESET2), RTC_FREQ_SELECT); + } + #ifdef CONFIG_MACH_DECSTATION CMOS_WRITE(real_yrs, RTC_DEC_YEAR); @@ -190,7 +209,8 @@ int mc146818_set_time(struct rtc_time *time) #endif CMOS_WRITE(save_control, RTC_CONTROL); - CMOS_WRITE(save_freq_select, RTC_FREQ_SELECT); + if (follow_mc146818_divider_reset()) + CMOS_WRITE(save_freq_select, RTC_FREQ_SELECT); spin_unlock_irqrestore(&rtc_lock, flags); -- 2.20.1

1 24

[PATCH openEuler-1.0-LTS] ext4: fix underflow in ext4_max_bitmap_size()
by Yang Yingliang 23 Feb '22

23 Feb '22

From: Zhang Yi <yi.zhang(a)huawei.com> hulk inclusion category: bugfix bugzilla: 186216, https://gitee.com/openeuler/kernel/issues/I4PW7R CVE: NA -------------------------------- The same to commit 1c2d14212b15 ("ext2: Fix underflow in ext2_max_size()") in ext2 filesystem, ext4 driver has the same issue with 64K block size and ^huge_file, fix this issue the same as ext2. This patch also revert commit 75ca6ad408f4 ("ext4: fix loff_t overflow in ext4_max_bitmap_size()") because it's no longer needed. Signed-off-by: Zhang Yi <yi.zhang(a)huawei.com> Conflicts: fs/ext4/super.c Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/ext4/super.c | 46 +++++++++++++++++++++++++++++++--------------- 1 file changed, 31 insertions(+), 15 deletions(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 59637e70f9e32..8f9d60ec607ea 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -2958,9 +2958,10 @@ static loff_t ext4_max_size(int blkbits, int has_huge_files) */ static loff_t ext4_max_bitmap_size(int bits, int has_huge_files) { - loff_t res = EXT4_NDIR_BLOCKS; + loff_t upper_limit, res = EXT4_NDIR_BLOCKS; int meta_blocks; - loff_t upper_limit; + unsigned int ppb = 1 << (bits - 2); + /* This is calculated to be the largest file size for a dense, block * mapped file such that the file's total number of 512-byte sectors, * including data and all indirect blocks, does not exceed (2^48 - 1). @@ -2991,23 +2992,38 @@ static loff_t ext4_max_bitmap_size(int bits, int has_huge_files) } - /* indirect blocks */ - meta_blocks = 1; - /* double indirect blocks */ - meta_blocks += 1 + (1LL << (bits-2)); - /* tripple indirect blocks */ - meta_blocks += 1 + (1LL << (bits-2)) + (1LL << (2*(bits-2))); - - upper_limit -= meta_blocks; - upper_limit <<= bits; - + /* Compute how many blocks we can address by block tree */ res += 1LL << (bits-2); res += 1LL << (2*(bits-2)); res += 1LL << (3*(bits-2)); + /* Compute how many metadata blocks are needed */ + meta_blocks = 1; + meta_blocks += 1 + ppb; + meta_blocks += 1 + ppb + ppb * ppb; + /* Does block tree limit file size? */ + if (res + meta_blocks <= upper_limit) + goto check_lfs; + + res = upper_limit; + /* How many metadata blocks are needed for addressing upper_limit? */ + upper_limit -= EXT4_NDIR_BLOCKS; + /* indirect blocks */ + meta_blocks = 1; + upper_limit -= ppb; + /* double indirect blocks */ + if (upper_limit < ppb * ppb) { + meta_blocks += 1 + DIV_ROUND_UP(upper_limit, ppb); + res -= meta_blocks; + goto check_lfs; + } + meta_blocks += 1 + ppb; + upper_limit -= ppb * ppb; + /* tripple indirect blocks for the rest */ + meta_blocks += 1 + DIV_ROUND_UP(upper_limit, ppb) + + DIV_ROUND_UP(upper_limit, ppb*ppb); + res -= meta_blocks; +check_lfs: res <<= bits; - if (res > upper_limit) - res = upper_limit; - if (res > MAX_LFS_FILESIZE) res = MAX_LFS_FILESIZE; -- 2.25.1

1 0

[PATCH OLK-5.10 v4 0/7] Backport zhaoxin enhancement and bugfix
by Zheng Zengkai 23 Feb '22

23 Feb '22

v3->v4: Refector 0001 patch. v2->v3: Fix compile warning "ahci_error_intr ISO C90 forbids mixed declarations and code" Backport zhaoxin enhancement and bugfix patches. LeoLiu-oc (7): rtc: Fix set RTC time delay 500ms on some Zhaoxin SOCs XHCI:Fix some device identify fail when enable xHCI runtime suspend EHCI:Clear wakeup signal locked in S0 state when device plug in Fix some bugs like plugin support and sata link stability when user enable ahci RTD3 Add support for disabling PhyRdy Change Interrupt based on actual LPM capability Add support for PxSCT.LPM set based on actual LPM capability x86/tsc: Make cur->adjusted values in package#1 to be the same arch/x86/kernel/tsc_sync.c | 5 +++++ drivers/ata/ahci.c | 24 ++++++++++++++++++++++++ drivers/ata/libahci.c | 15 +++++++++++++++ drivers/ata/libata-eh.c | 7 +++++++ drivers/ata/libata-sata.c | 20 ++++++++++++++++++-- drivers/pci/pci-driver.c | 6 +++++- drivers/rtc/rtc-mc146818-lib.c | 28 +++++++++++++++++++++++++--- drivers/usb/host/ehci-hcd.c | 21 +++++++++++++++++++++ drivers/usb/host/ehci-pci.c | 4 ++++ drivers/usb/host/ehci.h | 1 + drivers/usb/host/xhci-pci.c | 2 ++ include/linux/libata.h | 4 ++++ 12 files changed, 131 insertions(+), 6 deletions(-) -- 2.20.1

2 9

[PATCH openEuler-5.10 01/90] ACPICA: Interpreter: fix memory leak by using existing buffer
by Zheng Zengkai 23 Feb '22

23 Feb '22

From: Erik Kaneda <erik.kaneda(a)intel.com> mainline inclusion from mainline-v5.11-rc1 commit 32cf1a12cad43358e47dac8014379c2f33dfbed4 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4T7OX CVE: NA -------------------------------- ACPICA commit 52d1da5dcbd79a722b70f02a1a83f04088f51ff6 There was a memory leak that ocurred when a _CID object is defined as a package containing string objects. When _CID is checked for any possible repairs, it calls a helper function to repair _HID (because _CID basically contains multiple _HID entries). The _HID repair function assumes that string objects are standalone objects that are not contained inside of any packages. The _HID repair function replaces the string object with a brand new object and attempts to delete the old object by decrementing the reference count of the old object. Strings inside of packages have a reference count of 2 so the _HID repair function leaves this object in a dangling state and causes a memory leak. Instead of allocating a brand new object and removing the old object, use the existing object when repairing the _HID object. Link: https://github.com/acpica/acpica/commit/52d1da5d Signed-off-by: Erik Kaneda <erik.kaneda(a)intel.com> Signed-off-by: Bob Moore <robert.moore(a)intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Conflicts: drivers/acpi/acpica/nsrepair2.c [wangxiongfeng: fix conflicts caused by context mismatch] Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/acpi/acpica/nsrepair2.c | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) diff --git a/drivers/acpi/acpica/nsrepair2.c b/drivers/acpi/acpica/nsrepair2.c index 125143c41bb8..fb4f8f6209bd 100644 --- a/drivers/acpi/acpica/nsrepair2.c +++ b/drivers/acpi/acpica/nsrepair2.c @@ -491,9 +491,8 @@ acpi_ns_repair_HID(struct acpi_evaluate_info *info, union acpi_operand_object **return_object_ptr) { union acpi_operand_object *return_object = *return_object_ptr; - union acpi_operand_object *new_string; - char *source; char *dest; + char *source; ACPI_FUNCTION_NAME(ns_repair_HID); @@ -514,13 +513,6 @@ acpi_ns_repair_HID(struct acpi_evaluate_info *info, return (AE_OK); } - /* It is simplest to always create a new string object */ - - new_string = acpi_ut_create_string_object(return_object->string.length); - if (!new_string) { - return (AE_NO_MEMORY); - } - /* * Remove a leading asterisk if present. For some unknown reason, there * are many machines in the field that contains IDs like this. @@ -530,7 +522,7 @@ acpi_ns_repair_HID(struct acpi_evaluate_info *info, source = return_object->string.pointer; if (*source == '*') { source++; - new_string->string.length--; + return_object->string.length--; ACPI_DEBUG_PRINT((ACPI_DB_REPAIR, "%s: Removed invalid leading asterisk\n", @@ -545,12 +537,11 @@ acpi_ns_repair_HID(struct acpi_evaluate_info *info, * "NNNN####" where N is an uppercase letter or decimal digit, and * # is a hex digit. */ - for (dest = new_string->string.pointer; *source; dest++, source++) { + for (dest = return_object->string.pointer; *source; dest++, source++) { *dest = (char)toupper((int)*source); } + return_object->string.pointer[return_object->string.length] = 0; - acpi_ut_remove_reference(return_object); - *return_object_ptr = new_string; return (AE_OK); } -- 2.20.1

2 91

Re: [PATCH OLK-5.10 v3 3/7] EHCI: Clear wakeup signal locked in S0 state when device plug in
by Zheng Zengkai 23 Feb '22

23 Feb '22

Loop Leo 在 2022/2/22 17:49, Jackie Liu 写道: > > > 在 2022/2/22 下午4:16, Zheng Zengkai 写道: >> From: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> >> >> zhaoxin inclusion >> category: feature >> bugzilla: https://gitee.com/openeuler/kernel/issues/I40QDN >> CVE: NA >> >> ---------------------------------------------------------------- >> >> If we plug in a LS/FS device on USB2 port of EHCI, it will latch a wakeup >> signal in EHCI internal. This is a bug of EHCI for Some project of >> ZhaoXin. If enable EHCI runtime suspend and no device attach. >> PM core will let EHCI go to D3 to save power. However, once EHCI go to D3, >> it will release wakeup signal that latched on device connect to port >> during S0. Which will generate a SCI interrupt and bring EHCI to D0. >> But without device connect, EHCI will go to D3 again. >> So, there is suspend-resume loop and generate SCI interrupt Continuously. >> >> In order to fix this issues, we need to clear the wakeup signal latched >> in EHCI when EHCI suspend function is called. >> >> Signed-off-by: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> >> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> >> --- >> drivers/pci/pci-driver.c | 6 +++++- >> drivers/usb/host/ehci-hcd.c | 21 +++++++++++++++++++++ >> drivers/usb/host/ehci-pci.c | 4 ++++ >> drivers/usb/host/ehci.h | 1 + >> 4 files changed, 31 insertions(+), 1 deletion(-) >> >> diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c >> index 8b587fc97f7b..c33d7e0a60b5 100644 >> --- a/drivers/pci/pci-driver.c >> +++ b/drivers/pci/pci-driver.c >> @@ -518,7 +518,11 @@ static int pci_restore_standard_config(struct pci_dev *pci_dev) >> } >> >> pci_restore_state(pci_dev); >> - pci_pme_restore(pci_dev); >> + if (!((pci_dev->vendor == PCI_VENDOR_ID_ZHAOXIN) && >> + (pci_dev->device == 0x3104) && >> + ((pci_dev->revision & 0xf0) == 0x90)) || > >> + !(pci_dev->class == PCI_CLASS_SERIAL_USB_EHCI)) > 上面这句话是不是改变了通用逻辑？增加了一个 pci_dev->class != > PCI_CLASS_SERIAL_USB_EHCI 才进行 restore？ > >> + pci_pme_restore(pci_dev); >> return 0; >> } >> >> diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c >> index 8aff19ff8e8f..586e2735d6e0 100644 >> --- a/drivers/usb/host/ehci-hcd.c >> +++ b/drivers/usb/host/ehci-hcd.c >> @@ -1142,6 +1142,27 @@ int ehci_suspend(struct usb_hcd *hcd, bool do_wakeup) >> return -EBUSY; >> } >> >> + /*clear wakeup signal locked in S0 state when device plug in*/ >> + if (ehci->zx_wakeup_clear == 1) { >> + u32 __iomem *reg = &ehci->regs->port_status[4]; >> + u32 t1 = ehci_readl(ehci, reg); >> + >> + t1 &= (u32)~0xf0000; >> + t1 |= PORT_TEST_FORCE; >> + ehci_writel(ehci, t1, reg); >> + t1 = ehci_readl(ehci, reg); >> + usleep_range(1000, 2000); >> + t1 &= (u32)~0xf0000; >> + ehci_writel(ehci, t1, reg); >> + usleep_range(1000, 2000); >> + t1 = ehci_readl(ehci, reg); >> + ehci_writel(ehci, t1 | PORT_CSC, reg); >> + udelay(500); >> + t1 = ehci_readl(ehci, &ehci->regs->status); >> + ehci_writel(ehci, t1 & STS_PCD, &ehci->regs->status); >> + ehci_readl(ehci, &ehci->regs->status); >> + } >> + >> return 0; >> } >> EXPORT_SYMBOL_GPL(ehci_suspend); >> diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c >> index e87cf3a00fa4..a5e27deda83a 100644 >> --- a/drivers/usb/host/ehci-pci.c >> +++ b/drivers/usb/host/ehci-pci.c >> @@ -222,6 +222,10 @@ static int ehci_pci_setup(struct usb_hcd *hcd) >> ehci->has_synopsys_hc_bug = 1; >> } >> break; >> + case PCI_VENDOR_ID_ZHAOXIN: >> + if (pdev->device == 0x3104 && (pdev->revision & 0xf0) == 0x90) >> + ehci->zx_wakeup_clear = 1; >> + break; >> } >> >> /* optional debug port, normally in the first BAR */ >> diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h >> index 59fd523c55f3..8da080a54668 100644 >> --- a/drivers/usb/host/ehci.h >> +++ b/drivers/usb/host/ehci.h >> @@ -219,6 +219,7 @@ struct ehci_hcd { /* one per controller */ >> unsigned need_oc_pp_cycle:1; /* MPC834X port power */ >> unsigned imx28_write_fix:1; /* For Freescale i.MX28 */ >> unsigned is_aspeed:1; >> + unsigned zx_wakeup_clear:1; >> >> /* required for usb32 quirk */ >> #define OHCI_CTRL_HCFS (3 << 6) >> >> >> Content-type: Text/plain >> >> No virus found >> Checked by Hillstone Network AntiVirus

2 1

Re: [PATCH OLK-5.10 v3 1/7] rtc: Fix set RTC time delay 500ms on some Zhaoxin SOCs
by Zheng Zengkai 23 Feb '22

23 Feb '22

Hi Jackie, Leo 在 2022/2/22 17:46, Jackie Liu 写道: > > > 在 2022/2/22 下午4:16, Zheng Zengkai 写道: >> From: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> >> >> zhaoxin inclusion >> category: bugfix >> bugzilla: https://gitee.com/openeuler/kernel/issues/I40QDN >> CVE: NA >> >> ---------------------------------------------------------------- >> >> When the RTC divider is changed from reset to an operating time base, >> the first update cycle should be 500ms later. But on some Zhaoxin SOCs, >> this first update cycle is one second later. >> So set RTC time on these Zhaoxin SOCs will causing 500ms delay. >> Skip setup RTC divider on these SOCs in mc146818_set_time to fix it. >> >> Signed-off-by: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> >> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> >> --- >> drivers/rtc/rtc-mc146818-lib.c | 16 ++++++++++++++++ >> 1 file changed, 16 insertions(+) >> >> diff --git a/drivers/rtc/rtc-mc146818-lib.c b/drivers/rtc/rtc-mc146818-lib.c >> index 2ecd8752b088..96d9d0219394 100644 >> --- a/drivers/rtc/rtc-mc146818-lib.c >> +++ b/drivers/rtc/rtc-mc146818-lib.c >> @@ -171,8 +171,17 @@ int mc146818_set_time(struct rtc_time *time) >> >> save_control = CMOS_READ(RTC_CONTROL); >> CMOS_WRITE((save_control|RTC_SET), RTC_CONTROL); >> +#ifdef CONFIG_X86 >> + if (!((boot_cpu_data.x86_vendor == X86_VENDOR_CENTAUR || >> + boot_cpu_data.x86_vendor == X86_VENDOR_ZHAOXIN) && >> + (boot_cpu_data.x86 <= 7 && boot_cpu_data.x86_model <= 59))) { >> + save_freq_select = CMOS_READ(RTC_FREQ_SELECT); >> + CMOS_WRITE((save_freq_select|RTC_DIV_RESET2), RTC_FREQ_SELECT); >> + } >> +#else >> save_freq_select = CMOS_READ(RTC_FREQ_SELECT); >> CMOS_WRITE((save_freq_select|RTC_DIV_RESET2), RTC_FREQ_SELECT); >> +#endif >> >> #ifdef CONFIG_MACH_DECSTATION >> CMOS_WRITE(real_yrs, RTC_DEC_YEAR); >> @@ -190,7 +199,14 @@ int mc146818_set_time(struct rtc_time *time) >> #endif >> >> CMOS_WRITE(save_control, RTC_CONTROL); >> +#ifdef CONFIG_X86 >> + if (!((boot_cpu_data.x86_vendor == X86_VENDOR_CENTAUR || >> + boot_cpu_data.x86_vendor == X86_VENDOR_ZHAOXIN) && >> + (boot_cpu_data.x86 <= 7 && boot_cpu_data.x86_model <= 59))) > 在这里直接写个 #endif 后面的 else 和 endif 就不需要了 > >> + CMOS_WRITE(save_freq_select, RTC_FREQ_SELECT); >> +#else >> CMOS_WRITE(save_freq_select, RTC_FREQ_SELECT); >> +#endif 这里依据上次兆芯同事解释的代码逻辑： X86架构情况下，兆芯的相应平台不执行CMOS_WRITE(save_freq_select, RTC_FREQ_SELECT), 即 commit message中Skip setup RTC divider on these SOCs in mc146818_set_time to fix it; 而其他架构(#else 分支)，仍然需要执行CMOS_WRITE(save_freq_select, RTC_FREQ_SELECT); @Jackie @ Leo，两位看下理解是否OK？ >> >> spin_unlock_irqrestore(&rtc_lock, flags); >> >> >> >> Content-type: Text/plain >> >> No virus found >> Checked by Hillstone Network AntiVirus

2 1

Re: [PATCH OLK-5.10 v3 3/7] EHCI: Clear wakeup signal locked in S0 state when device plug in
by Zheng Zengkai 23 Feb '22

23 Feb '22

Hi Jackie, 在 2022/2/22 17:49, Jackie Liu 写道: > > > 在 2022/2/22 下午4:16, Zheng Zengkai 写道: >> From: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> >> >> zhaoxin inclusion >> category: feature >> bugzilla: https://gitee.com/openeuler/kernel/issues/I40QDN >> CVE: NA >> >> ---------------------------------------------------------------- >> >> If we plug in a LS/FS device on USB2 port of EHCI, it will latch a wakeup >> signal in EHCI internal. This is a bug of EHCI for Some project of >> ZhaoXin. If enable EHCI runtime suspend and no device attach. >> PM core will let EHCI go to D3 to save power. However, once EHCI go to D3, >> it will release wakeup signal that latched on device connect to port >> during S0. Which will generate a SCI interrupt and bring EHCI to D0. >> But without device connect, EHCI will go to D3 again. >> So, there is suspend-resume loop and generate SCI interrupt Continuously. >> >> In order to fix this issues, we need to clear the wakeup signal latched >> in EHCI when EHCI suspend function is called. >> >> Signed-off-by: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> >> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> >> --- >> drivers/pci/pci-driver.c | 6 +++++- >> drivers/usb/host/ehci-hcd.c | 21 +++++++++++++++++++++ >> drivers/usb/host/ehci-pci.c | 4 ++++ >> drivers/usb/host/ehci.h | 1 + >> 4 files changed, 31 insertions(+), 1 deletion(-) >> >> diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c >> index 8b587fc97f7b..c33d7e0a60b5 100644 >> --- a/drivers/pci/pci-driver.c >> +++ b/drivers/pci/pci-driver.c >> @@ -518,7 +518,11 @@ static int pci_restore_standard_config(struct pci_dev *pci_dev) >> } >> >> pci_restore_state(pci_dev); >> - pci_pme_restore(pci_dev); >> + if (!((pci_dev->vendor == PCI_VENDOR_ID_ZHAOXIN) && >> + (pci_dev->device == 0x3104) && >> + ((pci_dev->revision & 0xf0) == 0x90)) || > >> + !(pci_dev->class == PCI_CLASS_SERIAL_USB_EHCI)) > 上面这句话是不是改变了通用逻辑？增加了一个 pci_dev->class != > PCI_CLASS_SERIAL_USB_EHCI 才进行 restore？ > >> + pci_pme_restore(pci_dev); 逻辑上应该是和！((pci_dev->vendor == PCI_VENDOR_ID_ZHAOXIN) && (pci_dev->device == 0x3104) && ((pci_dev->revision & 0xf0) == 0x90) && (pci_dev->class == PCI_CLASS_SERIAL_USB_EHCI)）等同的, 即只有zhaoxin的0x3104 devid的PCI_CLASS_SERIAL_USB_EHCI设备不做pci_pme_restore(pci_dev)操作 >> return 0; >> } >> >> diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c >> index 8aff19ff8e8f..586e2735d6e0 100644 >> --- a/drivers/usb/host/ehci-hcd.c >> +++ b/drivers/usb/host/ehci-hcd.c >> @@ -1142,6 +1142,27 @@ int ehci_suspend(struct usb_hcd *hcd, bool do_wakeup) >> return -EBUSY; >> } >> >> + /*clear wakeup signal locked in S0 state when device plug in*/ >> + if (ehci->zx_wakeup_clear == 1) { >> + u32 __iomem *reg = &ehci->regs->port_status[4]; >> + u32 t1 = ehci_readl(ehci, reg); >> + >> + t1 &= (u32)~0xf0000; >> + t1 |= PORT_TEST_FORCE; >> + ehci_writel(ehci, t1, reg); >> + t1 = ehci_readl(ehci, reg); >> + usleep_range(1000, 2000); >> + t1 &= (u32)~0xf0000; >> + ehci_writel(ehci, t1, reg); >> + usleep_range(1000, 2000); >> + t1 = ehci_readl(ehci, reg); >> + ehci_writel(ehci, t1 | PORT_CSC, reg); >> + udelay(500); >> + t1 = ehci_readl(ehci, &ehci->regs->status); >> + ehci_writel(ehci, t1 & STS_PCD, &ehci->regs->status); >> + ehci_readl(ehci, &ehci->regs->status); >> + } >> + >> return 0; >> } >> EXPORT_SYMBOL_GPL(ehci_suspend); >> diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c >> index e87cf3a00fa4..a5e27deda83a 100644 >> --- a/drivers/usb/host/ehci-pci.c >> +++ b/drivers/usb/host/ehci-pci.c >> @@ -222,6 +222,10 @@ static int ehci_pci_setup(struct usb_hcd *hcd) >> ehci->has_synopsys_hc_bug = 1; >> } >> break; >> + case PCI_VENDOR_ID_ZHAOXIN: >> + if (pdev->device == 0x3104 && (pdev->revision & 0xf0) == 0x90) >> + ehci->zx_wakeup_clear = 1; >> + break; >> } >> >> /* optional debug port, normally in the first BAR */ >> diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h >> index 59fd523c55f3..8da080a54668 100644 >> --- a/drivers/usb/host/ehci.h >> +++ b/drivers/usb/host/ehci.h >> @@ -219,6 +219,7 @@ struct ehci_hcd { /* one per controller */ >> unsigned need_oc_pp_cycle:1; /* MPC834X port power */ >> unsigned imx28_write_fix:1; /* For Freescale i.MX28 */ >> unsigned is_aspeed:1; >> + unsigned zx_wakeup_clear:1; >> >> /* required for usb32 quirk */ >> #define OHCI_CTRL_HCFS (3 << 6) >> >> >> Content-type: Text/plain >> >> No virus found >> Checked by Hillstone Network AntiVirus

1 0

[PATCH OLK-5.10,v4,0/3] Add support for kunpeng920 Ultrasoc System Memory Buffer driver
by Qi Liu 23 Feb '22

23 Feb '22

Add support for kunpeng920 Ultrasoc System Memory Buffer driver v3->4: Resend this patchset as openeuler maillist hasn't received patch[1/3] in v3 series. Qi Liu (3): coresight: etm4x: Modify core-commit to avoid HiSilicon ETM overflow drivers/coresight: Add Ultrasoc System Memory Buffer driver arm64: openeuler_defconfig: Enable config for ultrasoc driver arch/arm64/configs/openeuler_defconfig | 13 +- drivers/hwtracing/coresight/Kconfig | 20 + drivers/hwtracing/coresight/Makefile | 1 + .../coresight/coresight-etm4x-core.c | 98 +++ drivers/hwtracing/coresight/coresight-etm4x.h | 8 + drivers/hwtracing/coresight/ultrasoc-smb.c | 602 ++++++++++++++++++ drivers/hwtracing/coresight/ultrasoc-smb.h | 100 +++ 7 files changed, 841 insertions(+), 1 deletion(-) create mode 100644 drivers/hwtracing/coresight/ultrasoc-smb.c create mode 100644 drivers/hwtracing/coresight/ultrasoc-smb.h -- 2.33.0

1 3

[PATCH OLK-5.10 v2] uce: copy_from_user scenario support kernel recovery
by Tong Tiangen 22 Feb '22

22 Feb '22

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4PM10 CVE: NA -------------------------------- During kernel copy_from_user processing, the kernel triggers a RAS exception when reading pages. In this solution, we identify this scenario in the kernel do_sea processing process, send SIGBUS signals to the process that triggers copy_from_user and isolate memory pages, preventing kernel panic. At the same time, we use both cmdline(uce_kernel_recovery) and proc (/proc/sys/kernel/uce_kernel_recovery) to control this feature on/off. Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- v1->v2: 1. update commit msg. 2. change copy_from_user return value. 3. change copy_from_user proc control bit. arch/arm64/Kconfig | 9 ++ arch/arm64/include/asm/exception.h | 12 +++ arch/arm64/lib/copy_from_user.S | 5 + arch/arm64/mm/fault.c | 154 +++++++++++++++++++++++++++++ include/linux/kernel.h | 4 + kernel/sysctl.c | 11 +++ 6 files changed, 195 insertions(+) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index c0f6a275f798..5858cb9a3dac 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -2155,6 +2155,15 @@ config ARCH_HIBERNATION_HEADER config ARCH_SUSPEND_POSSIBLE def_bool y +config UCE_KERNEL_RECOVERY + bool "uce kernel recovery from special scenario" + def_bool n + help + With ARM v8.2 RAS Extension, SEA are usually triggered when memory errors + are consumed. In some cases, if the error address is in a user page there + is a chance to recover. Such as error occurs in COW and pagecache reading + scenario, we can isolate this page and killing process instead of die. + endmenu menu "CPU Power Management" diff --git a/arch/arm64/include/asm/exception.h b/arch/arm64/include/asm/exception.h index 0756191f44f6..bad92fe763fb 100644 --- a/arch/arm64/include/asm/exception.h +++ b/arch/arm64/include/asm/exception.h @@ -53,4 +53,16 @@ void do_cp15instr(unsigned int esr, struct pt_regs *regs); void do_el0_svc(struct pt_regs *regs); void do_el0_svc_compat(struct pt_regs *regs); void do_ptrauth_fault(struct pt_regs *regs, unsigned int esr); + +#ifdef CONFIG_UCE_KERNEL_RECOVERY +struct uce_kernel_recovery_info { + int (*fn)(void); + const char *name; + unsigned long addr; + unsigned long size; +}; + +extern int copy_from_user_sea_fallback(void); +#endif + #endif /* __ASM_EXCEPTION_H */ diff --git a/arch/arm64/lib/copy_from_user.S b/arch/arm64/lib/copy_from_user.S index 2cf999e41d30..b03ea0faa118 100644 --- a/arch/arm64/lib/copy_from_user.S +++ b/arch/arm64/lib/copy_from_user.S @@ -60,6 +60,11 @@ SYM_FUNC_START(__arch_copy_from_user) #include "copy_template.S" mov x0, #0 // Nothing to copy ret + + .global copy_from_user_sea_fallback +copy_from_user_sea_fallback: + sub x0, end, dst // bytes not copied + ret SYM_FUNC_END(__arch_copy_from_user) EXPORT_SYMBOL(__arch_copy_from_user) diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c index 3fc5aceb72eb..7f76e277daa3 100644 --- a/arch/arm64/mm/fault.c +++ b/arch/arm64/mm/fault.c @@ -634,6 +634,127 @@ static int do_bad(unsigned long addr, unsigned int esr, struct pt_regs *regs) return 1; /* "fault" */ } +#ifdef CONFIG_UCE_KERNEL_RECOVERY +int kernel_access_sea_recovery; + +#define UCE_KER_REC_NUM ARRAY_SIZE(reco_info) +static struct uce_kernel_recovery_info reco_info[] = { + {NULL, NULL, 0, 0}, + {NULL, NULL, 0, 0}, + {copy_from_user_sea_fallback, "__arch_copy_from_user", (unsigned long)__arch_copy_from_user, 0}, +}; + +static int __init kernel_access_sea_recovery_init(void) +{ + unsigned long addr, size, offset; + unsigned int i; + + for (i = 0; i < UCE_KER_REC_NUM; i++) { + addr = reco_info[i].addr; + if (!kallsyms_lookup_size_offset(addr, &size, &offset)) { + pr_info("UCE: symbol %s lookup addr fail.\n", + reco_info[i].name); + size = 0; + } + + reco_info[i].size = size; + } + + return 1; +} +fs_initcall(kernel_access_sea_recovery_init); + +static int __init enable_kernel_access_sea_recovery(char *str) +{ + int max = (1 << UCE_KER_REC_NUM) - 1; + int val; + + if (kstrtoint(str, 0, &val)) + return -EINVAL; + + if (val < 0 || val > max) { + pr_info("UCE: invalid uce_kernel_recovery value %d", val); + return -EINVAL; + } + + kernel_access_sea_recovery = val; + + return 1; +} +__setup("uce_kernel_recovery=", enable_kernel_access_sea_recovery); + +/* + * what is kernel recovery? + * If the process's private data is accessed in the kernel mode to trigger + * special sea fault, it can controlled by killing the process and isolating + * the failure pages instead of die. + */ +static int is_in_kernel_recovery(unsigned int esr, struct pt_regs *regs) +{ + /* + * target insn: ldp-pre, ldp-post, ldp-offset, + * ldr-64bit-pre/pose, ldr-32bit-pre/post, ldrb-pre/post, ldrh-pre/post + */ + u32 target_insn[] = {0xa8c, 0xa9c, 0xa94, 0xf84, 0x784, 0x384, 0xb84}; + void *pc = (void *)instruction_pointer(regs); + struct uce_kernel_recovery_info *info; + bool insn_match = false; + u32 insn; + int i; + + pr_emerg("UCE: %s-%d, kernel recovery: 0x%x, esr: 0x%08x -- %s, %pS\n", + current->comm, current->pid, kernel_access_sea_recovery, esr, + esr_get_class_string(esr), pc); + + if (aarch64_insn_read((void *)pc, &insn)) { + pr_emerg("UCE: insn read fail.\n"); + return -EFAULT; + } + + /* + * We process special ESR: + * EC : 0b100101 Data Abort taken without a change in Exception level. + * DFSC : 0b010000 Synchronous External abort, not on translation table + * walk or hardware update of translation table. + * eg: 0x96000610 + */ + if (ESR_ELx_EC(esr) != ESR_ELx_EC_DABT_CUR || + (esr & ESR_ELx_FSC) != ESR_ELx_FSC_EXTABT) { + pr_emerg("UCE: esr not match.\n"); + return -EINVAL; + } + + insn = (insn >> 20) & 0xffc; + for (i = 0; i < ARRAY_SIZE(target_insn); i++) { + if (insn == target_insn[i]) { + insn_match = true; + break; + } + } + + if (!insn_match) { + pr_emerg("UCE: insn 0x%x is not match.\n", insn); + return -EINVAL; + } + + for (i = 0; i < UCE_KER_REC_NUM; i++) { + if (!((kernel_access_sea_recovery >> i) & 0x1)) + continue; + + info = &reco_info[i]; + if (info->fn && regs->pc >= info->addr && + regs->pc < (info->addr + info->size)) { + pr_emerg("UCE: total match %s success.\n", info->name); + return i; + } + } + + pr_emerg("UCE: symbol is not match or switch if off, kernel recovery %d.\n", + kernel_access_sea_recovery); + return -EINVAL; +} +#endif + static int do_sea(unsigned long addr, unsigned int esr, struct pt_regs *regs) { const struct fault_info *inf; @@ -649,6 +770,39 @@ static int do_sea(unsigned long addr, unsigned int esr, struct pt_regs *regs) return 0; } +#ifdef CONFIG_UCE_KERNEL_RECOVERY + if (!user_mode(regs)) { + int idx; + + if (!current->mm || !kernel_access_sea_recovery) { + pr_emerg("UCE: kernel recovery %d, %s-%d is %s-thread.\n", + kernel_access_sea_recovery, + current->comm, current->pid, + (current->mm) ? "user" : "kernel"); + die("Uncorrected hardware memory error in kernel-access\n", + regs, esr); + } + + idx = is_in_kernel_recovery(esr, regs); + if (idx >= 0 && idx < UCE_KER_REC_NUM) { + current->thread.fault_address = 0; + current->thread.fault_code = esr; + regs->pc = (unsigned long)reco_info[idx].fn; + + if (esr & ESR_ELx_FnV) + siaddr = NULL; + else + siaddr = (void __user *)addr; + + arm64_force_sig_fault(inf->sig, inf->code, siaddr, + "Uncorrected hardware memory use with kernel recovery in kernel-access\n"); + } else { + die("Uncorrected hardware memory error (not match idx or sence switch is off) in kernel-access\n", + regs, esr); + } + } +#endif + if (esr & ESR_ELx_FnV) siaddr = NULL; else diff --git a/include/linux/kernel.h b/include/linux/kernel.h index 78a0907f0b04..b634fb1cce38 100644 --- a/include/linux/kernel.h +++ b/include/linux/kernel.h @@ -558,6 +558,10 @@ extern int sysctl_panic_on_stackoverflow; extern bool crash_kexec_post_notifiers; +#ifdef CONFIG_UCE_KERNEL_RECOVERY +extern int kernel_access_sea_recovery; +#endif + /* * panic_cpu is used for synchronizing panic() and crash_kexec() execution. It * holds a CPU number which is executing panic() currently. A value of diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 89ef0c1a1642..e38fff657683 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -2711,6 +2711,17 @@ static struct ctl_table kern_table[] = { .extra1 = &one_hundred, .extra2 = &one_thousand, }, +#endif +#if defined(CONFIG_UCE_KERNEL_RECOVERY) + { + .procname = "uce_kernel_recovery", + .data = &kernel_access_sea_recovery, + .maxlen = sizeof(kernel_access_sea_recovery), + .mode = 0644, + .proc_handler = proc_dointvec_minmax, + .extra1 = &four, + .extra2 = &four, + }, #endif { } }; -- 2.18.0.huawei.25

2 1

[PATCH openEuler-5.10 12/90] x86/cpu/intel: Add a nosgx kernel parameter
by Zheng Zengkai 22 Feb '22

22 Feb '22

From: Jarkko Sakkinen <jarkko(a)kernel.org> mainline inclusion from mainline-v5.11-rc1 commit 38853a303982e3be3eccb1a1132399a5c5e2d806 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4SIGI CVE: NA -------------------------------- Add a kernel parameter to disable SGX kernel support and document it. [ bp: Massage. ] Intel-SIG: commit 38853a303982 x86/cpu/intel: Add a nosgx kernel parameter Backport for SGX Foundations support Signed-off-by: Jarkko Sakkinen <jarkko(a)kernel.org> Signed-off-by: Borislav Petkov <bp(a)suse.de> Reviewed-by: Sean Christopherson <sean.j.christopherson(a)intel.com> Acked-by: Jethro Beekman <jethro(a)fortanix.com> Tested-by: Sean Christopherson <sean.j.christopherson(a)intel.com> Link: https://lkml.kernel.org/r/20201112220135.165028-9-jarkko@kernel.org Signed-off-by: Fan Du <fan.du(a)intel.com> #openEuler_contributor Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> Reviewed-by: Bamvor Zhang <bamvor.zhang(a)suse.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- Documentation/admin-guide/kernel-parameters.txt | 2 ++ arch/x86/kernel/cpu/feat_ctl.c | 9 +++++++++ 2 files changed, 11 insertions(+) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index b73108a82f18..a4e5614bee12 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -3498,6 +3498,8 @@ nosep [BUGS=X86-32] Disables x86 SYSENTER/SYSEXIT support. + nosgx [X86-64,SGX] Disables Intel SGX kernel support. + nosmp [SMP] Tells an SMP kernel to act as a UP kernel, and disable the IO APIC. legacy for "maxcpus=0". diff --git a/arch/x86/kernel/cpu/feat_ctl.c b/arch/x86/kernel/cpu/feat_ctl.c index d38e97325018..3b1b01f2b248 100644 --- a/arch/x86/kernel/cpu/feat_ctl.c +++ b/arch/x86/kernel/cpu/feat_ctl.c @@ -99,6 +99,15 @@ static void clear_sgx_caps(void) setup_clear_cpu_cap(X86_FEATURE_SGX_LC); } +static int __init nosgx(char *str) +{ + clear_sgx_caps(); + + return 0; +} + +early_param("nosgx", nosgx); + void init_ia32_feat_ctl(struct cpuinfo_x86 *c) { bool tboot = tboot_enabled(); -- 2.20.1

1 1

[PATCH OLK-5.10 v2 0/5] net/spnic: spnic bugfix series
by Yanling Song 22 Feb '22

22 Feb '22

Fix 5 bugs: 1. Fix array bounds error in ethtool get_link_ksettings 2. Fix ethtool loopback command failure 3. Fix xor checksum error when sending a non 4B-aligned message to firmware 4. Fix an error when netdev failed to link up 5. Reduce the timeout of the channel between driver and firmware Yanling Song (5): net/spnic: Fix array bounds error in ethtool get_link_ksettings net/spnic: Fix ethtool loopback command failure net/spnic: Fix xor checksum error when sending a non 4B-aligned message to firmware net/spnic: Fix an error when netdev failed to link up net/spnic: Reduce the timeout of the channel between driver and firmware .../net/ethernet/ramaxel/spnic/hw/sphw_cmdq.c | 2 +- .../net/ethernet/ramaxel/spnic/hw/sphw_mbox.c | 10 ++-- .../net/ethernet/ramaxel/spnic/hw/sphw_mgmt.c | 2 +- .../ramaxel/spnic/spnic_ethtool_stats.c | 4 +- .../ethernet/ramaxel/spnic/spnic_mag_cfg.c | 2 +- .../ethernet/ramaxel/spnic/spnic_nic_cfg_vf.c | 49 ++++++++++++------- 6 files changed, 41 insertions(+), 28 deletions(-) -- 2.32.0

2 6

[PATCH OLK-5.10,v3,0/3] Add support for kunpeng920 Ultrasoc System Memory Buffer driver
by Qi Liu 22 Feb '22

22 Feb '22

Add support for kunpeng920 Ultrasoc System Memory Buffer driver Qi Liu (3): coresight: etm4x: Modify core-commit to avoid HiSilicon ETM overflow drivers/coresight: Add Ultrasoc System Memory Buffer driver arm64: openeuler_defconfig: Enable config for ultrasoc driver arch/arm64/configs/openeuler_defconfig | 13 +- drivers/hwtracing/coresight/Kconfig | 20 + drivers/hwtracing/coresight/Makefile | 1 + .../coresight/coresight-etm4x-core.c | 98 +++ drivers/hwtracing/coresight/coresight-etm4x.h | 8 + drivers/hwtracing/coresight/ultrasoc-smb.c | 602 ++++++++++++++++++ drivers/hwtracing/coresight/ultrasoc-smb.h | 100 +++ 7 files changed, 841 insertions(+), 1 deletion(-) create mode 100644 drivers/hwtracing/coresight/ultrasoc-smb.c create mode 100644 drivers/hwtracing/coresight/ultrasoc-smb.h -- 2.33.0

3 5

Re: [PATCH OLK-5.10 v3 1/7] rtc: Fix set RTC time delay 500ms on some Zhaoxin SOCs
by Zheng Zengkai 22 Feb '22

22 Feb '22

loop Leo 在 2022/2/22 17:46, Jackie Liu 写道: > > > 在 2022/2/22 下午4:16, Zheng Zengkai 写道: >> From: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> >> >> zhaoxin inclusion >> category: bugfix >> bugzilla: https://gitee.com/openeuler/kernel/issues/I40QDN >> CVE: NA >> >> ---------------------------------------------------------------- >> >> When the RTC divider is changed from reset to an operating time base, >> the first update cycle should be 500ms later. But on some Zhaoxin SOCs, >> this first update cycle is one second later. >> So set RTC time on these Zhaoxin SOCs will causing 500ms delay. >> Skip setup RTC divider on these SOCs in mc146818_set_time to fix it. >> >> Signed-off-by: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> >> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> >> --- >> drivers/rtc/rtc-mc146818-lib.c | 16 ++++++++++++++++ >> 1 file changed, 16 insertions(+) >> >> diff --git a/drivers/rtc/rtc-mc146818-lib.c b/drivers/rtc/rtc-mc146818-lib.c >> index 2ecd8752b088..96d9d0219394 100644 >> --- a/drivers/rtc/rtc-mc146818-lib.c >> +++ b/drivers/rtc/rtc-mc146818-lib.c >> @@ -171,8 +171,17 @@ int mc146818_set_time(struct rtc_time *time) >> >> save_control = CMOS_READ(RTC_CONTROL); >> CMOS_WRITE((save_control|RTC_SET), RTC_CONTROL); >> +#ifdef CONFIG_X86 >> + if (!((boot_cpu_data.x86_vendor == X86_VENDOR_CENTAUR || >> + boot_cpu_data.x86_vendor == X86_VENDOR_ZHAOXIN) && >> + (boot_cpu_data.x86 <= 7 && boot_cpu_data.x86_model <= 59))) { >> + save_freq_select = CMOS_READ(RTC_FREQ_SELECT); >> + CMOS_WRITE((save_freq_select|RTC_DIV_RESET2), RTC_FREQ_SELECT); >> + } >> +#else >> save_freq_select = CMOS_READ(RTC_FREQ_SELECT); >> CMOS_WRITE((save_freq_select|RTC_DIV_RESET2), RTC_FREQ_SELECT); >> +#endif >> >> #ifdef CONFIG_MACH_DECSTATION >> CMOS_WRITE(real_yrs, RTC_DEC_YEAR); >> @@ -190,7 +199,14 @@ int mc146818_set_time(struct rtc_time *time) >> #endif >> >> CMOS_WRITE(save_control, RTC_CONTROL); >> +#ifdef CONFIG_X86 >> + if (!((boot_cpu_data.x86_vendor == X86_VENDOR_CENTAUR || >> + boot_cpu_data.x86_vendor == X86_VENDOR_ZHAOXIN) && >> + (boot_cpu_data.x86 <= 7 && boot_cpu_data.x86_model <= 59))) > 在这里直接写个 #endif 后面的 else 和 endif 就不需要了 > >> + CMOS_WRITE(save_freq_select, RTC_FREQ_SELECT); >> +#else >> CMOS_WRITE(save_freq_select, RTC_FREQ_SELECT); >> +#endif >> >> spin_unlock_irqrestore(&rtc_lock, flags); >> >> >> >> Content-type: Text/plain >> >> No virus found >> Checked by Hillstone Network AntiVirus

1 0

[PATCH OLK-5.10,v2,0/3] Add support for kunpeng920 Ultrasoc System Memory Buffer driver
by Qi Liu 22 Feb '22

22 Feb '22

Add support for kunpeng920 Ultrasoc System Memory Buffer driver Qi Liu (3): coresight: etm4x: Modify core-commit to avoid HiSilicon ETM overflow drivers/coresight: Add Ultrasoc System Memory Buffer driver arm64: openeuler_defconfig: Enable config for ultrasoc driver arch/arm64/configs/openeuler_defconfig | 7 +- drivers/hwtracing/coresight/Kconfig | 20 + drivers/hwtracing/coresight/Makefile | 1 + .../coresight/coresight-etm4x-core.c | 98 +++ drivers/hwtracing/coresight/coresight-etm4x.h | 8 + drivers/hwtracing/coresight/ultrasoc-smb.c | 602 ++++++++++++++++++ drivers/hwtracing/coresight/ultrasoc-smb.h | 100 +++ 7 files changed, 835 insertions(+), 1 deletion(-) create mode 100644 drivers/hwtracing/coresight/ultrasoc-smb.c create mode 100644 drivers/hwtracing/coresight/ultrasoc-smb.h -- 2.33.0

4 7

[PATCH OLK-5.10 V3 00/45] intel-icelake: 22.03 support SGX
by Laibin Qiu 22 Feb '22

22 Feb '22

V3: add missing config enable. bugzilla: https://gitee.com/openeuler/kernel/issues/I4SIGI Borislav Petkov (1): x86/sgx: Fix sgx_ioc_enclave_provision() kernel-doc Daniel Vetter (1): x86/sgx: Drop racy follow_pfn() check Dave Hansen (3): x86/sgx: Clarify 'laundry_list' locking selftests/sgx: Improve error detection and messages selftests/sgx: remove checks for file execute permissions Ira Weiny (1): x86/sgx: Remove unnecessary kmap() from sgx_ioc_enclave_init() Jarkko Sakkinen (25): x86/sgx: Add SGX architectural data structures x86/sgx: Add wrappers for ENCLS functions x86/cpu/intel: Add a nosgx kernel parameter x86/sgx: Add SGX page allocator functions x86/sgx: Add an SGX misc driver interface x86/sgx: Add SGX_IOC_ENCLAVE_CREATE x86/sgx: Add SGX_IOC_ENCLAVE_ADD_PAGES x86/sgx: Add SGX_IOC_ENCLAVE_INIT x86/sgx: Add SGX_IOC_ENCLAVE_PROVISION selftests/x86: Add a selftest for SGX x86/sgx: Add a page reclaimer x86/sgx: Add ptrace() support for the SGX driver Documentation/x86: Document SGX kernel architecture x86/sgx: Update MAINTAINERS x86/sgx: Return -ERESTARTSYS in sgx_ioc_enclave_add_pages() x86/sgx: Return -EINVAL on a zero length buffer in sgx_ioc_enclave_add_pages() x86/sgx: Maintain encl->refcount for each encl->mm_list entry x86/sgx: Replace section->init_laundry_list with sgx_dirty_page_list x86/sgx: Add a basic NUMA allocation scheme to sgx_alloc_epc_page() selftests/sgx: Use a statically generated 3072-bit RSA key selftests/sgx: Rename 'eenter' and 'sgx_call_vdso' selftests/sgx: Migrate to kselftest harness selftests/sgx: Dump enclave memory map selftests/sgx: Add EXPECT_EEXIT() macro selftests/sgx: Refine the test enclave to have storage Laibin Qiu (1): deconfig: intel ice-lake missing config enable Sami Tolvanen (1): x86/sgx: Fix the return type of sgx_init() Sean Christopherson (10): x86/cpufeatures: Add Intel SGX hardware bits x86/{cpufeatures,msr}: Add Intel SGX Launch Control hardware bits x86/sgx: Initialize metadata for Enclave Page Cache (EPC) sections x86/cpu/intel: Detect SGX support mm: Add 'mprotect' hook to struct vm_operations_struct x86/vdso: Add support for exception fixup in vDSO functions x86/fault: Add a helper function to sanitize error code x86/traps: Attempt to fixup exceptions in vDSO before signaling x86/vdso: Implement a vDSO for Intel SGX enclave call x86/sgx: Expose SGX architectural definitions to the kernel Tianjia Zhang (2): selftests/sgx: Use getauxval() to simplify test code selftests/sgx: Fix Q1 and Q2 calculation in sigstruct.c .../admin-guide/kernel-parameters.txt | 2 + .../userspace-api/ioctl/ioctl-number.rst | 1 + Documentation/x86/index.rst | 1 + Documentation/x86/sgx.rst | 211 +++++ MAINTAINERS | 14 + arch/x86/Kconfig | 18 + arch/x86/configs/openeuler_defconfig | 3 +- arch/x86/entry/vdso/Makefile | 8 +- arch/x86/entry/vdso/extable.c | 46 ++ arch/x86/entry/vdso/extable.h | 28 + arch/x86/entry/vdso/vdso-layout.lds.S | 9 +- arch/x86/entry/vdso/vdso.lds.S | 1 + arch/x86/entry/vdso/vdso2c.h | 50 +- arch/x86/entry/vdso/vsgx.S | 151 ++++ arch/x86/include/asm/cpufeatures.h | 2 + arch/x86/include/asm/disabled-features.h | 8 +- arch/x86/include/asm/enclu.h | 9 + arch/x86/include/asm/msr-index.h | 8 + arch/x86/include/asm/sgx.h | 348 ++++++++ arch/x86/include/asm/vdso.h | 5 + arch/x86/include/uapi/asm/sgx.h | 168 ++++ arch/x86/kernel/cpu/Makefile | 1 + arch/x86/kernel/cpu/feat_ctl.c | 38 +- arch/x86/kernel/cpu/sgx/Makefile | 5 + arch/x86/kernel/cpu/sgx/driver.c | 197 +++++ arch/x86/kernel/cpu/sgx/driver.h | 29 + arch/x86/kernel/cpu/sgx/encl.c | 737 +++++++++++++++++ arch/x86/kernel/cpu/sgx/encl.h | 119 +++ arch/x86/kernel/cpu/sgx/encls.h | 231 ++++++ arch/x86/kernel/cpu/sgx/ioctl.c | 718 ++++++++++++++++ arch/x86/kernel/cpu/sgx/main.c | 768 ++++++++++++++++++ arch/x86/kernel/cpu/sgx/sgx.h | 83 ++ arch/x86/kernel/traps.c | 10 + arch/x86/mm/fault.c | 33 +- include/linux/mm.h | 7 + mm/mprotect.c | 7 + tools/testing/selftests/Makefile | 1 + tools/testing/selftests/sgx/.gitignore | 2 + tools/testing/selftests/sgx/Makefile | 57 ++ tools/testing/selftests/sgx/call.S | 44 + tools/testing/selftests/sgx/defines.h | 31 + tools/testing/selftests/sgx/load.c | 305 +++++++ tools/testing/selftests/sgx/main.c | 293 +++++++ tools/testing/selftests/sgx/main.h | 41 + tools/testing/selftests/sgx/sign_key.S | 12 + tools/testing/selftests/sgx/sign_key.pem | 39 + tools/testing/selftests/sgx/sigstruct.c | 382 +++++++++ tools/testing/selftests/sgx/test_encl.c | 35 + tools/testing/selftests/sgx/test_encl.lds | 41 + .../selftests/sgx/test_encl_bootstrap.S | 89 ++ 50 files changed, 5426 insertions(+), 20 deletions(-) create mode 100644 Documentation/x86/sgx.rst create mode 100644 arch/x86/entry/vdso/extable.c create mode 100644 arch/x86/entry/vdso/extable.h create mode 100644 arch/x86/entry/vdso/vsgx.S create mode 100644 arch/x86/include/asm/enclu.h create mode 100644 arch/x86/include/asm/sgx.h create mode 100644 arch/x86/include/uapi/asm/sgx.h create mode 100644 arch/x86/kernel/cpu/sgx/Makefile create mode 100644 arch/x86/kernel/cpu/sgx/driver.c create mode 100644 arch/x86/kernel/cpu/sgx/driver.h create mode 100644 arch/x86/kernel/cpu/sgx/encl.c create mode 100644 arch/x86/kernel/cpu/sgx/encl.h create mode 100644 arch/x86/kernel/cpu/sgx/encls.h create mode 100644 arch/x86/kernel/cpu/sgx/ioctl.c create mode 100644 arch/x86/kernel/cpu/sgx/main.c create mode 100644 arch/x86/kernel/cpu/sgx/sgx.h create mode 100644 tools/testing/selftests/sgx/.gitignore create mode 100644 tools/testing/selftests/sgx/Makefile create mode 100644 tools/testing/selftests/sgx/call.S create mode 100644 tools/testing/selftests/sgx/defines.h create mode 100644 tools/testing/selftests/sgx/load.c create mode 100644 tools/testing/selftests/sgx/main.c create mode 100644 tools/testing/selftests/sgx/main.h create mode 100644 tools/testing/selftests/sgx/sign_key.S create mode 100644 tools/testing/selftests/sgx/sign_key.pem create mode 100644 tools/testing/selftests/sgx/sigstruct.c create mode 100644 tools/testing/selftests/sgx/test_encl.c create mode 100644 tools/testing/selftests/sgx/test_encl.lds create mode 100644 tools/testing/selftests/sgx/test_encl_bootstrap.S -- 2.22.0

4 74

Re: [PATCH OLK-5.10] configs: enable CONFIG_INTEL_IDXD
by Kai Liu 22 Feb '22

22 Feb '22

LGTM. Thanks. Reviewed-by: Kai Liu <kai.liu(a)suse.com> On 2022/02/22 Tue 09:09, fuyufan wrote: >euler inclusion >category: feature >bugzilla: https://gitee.com/openeuler/kernel/issues/I4URME >CVE: NA > >-------------------------------- > >Enable CONFIG_INTEL_IDXD in openeuler_defconfig for x86. >Support Intel Data Accelerators on Xeon hardware. > >Signed-off-by: fuyufan <fuyufan(a)huawei.com> >--- > arch/x86/configs/openeuler_defconfig | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig >index 316c4122a859..350a02583978 100644 >--- a/arch/x86/configs/openeuler_defconfig >+++ b/arch/x86/configs/openeuler_defconfig >@@ -6353,7 +6353,7 @@ CONFIG_DMA_VIRTUAL_CHANNELS=y > CONFIG_DMA_ACPI=y > # CONFIG_ALTERA_MSGDMA is not set > CONFIG_INTEL_IDMA64=m >-# CONFIG_INTEL_IDXD is not set >+CONFIG_INTEL_IDXD=m > CONFIG_INTEL_IOATDMA=m > # CONFIG_PLX_DMA is not set > # CONFIG_QCOM_HIDMA_MGMT is not set >-- >2.27.0 >

1 0

Re: [PATCH OLK-5.10] configs: enable CONFIG_INTEL_IDXD
by Kai Liu 22 Feb '22

22 Feb '22

On 2022/02/22 Tue 08:27, fuyufan wrote: >euler inclusion >category: feature >bugzilla: https://gitee.com/openeuler/kernel/issues/I4URME >CVE: NA > >-------------------------------- > >Enable CONFIG_INTEL_IDXD in openeuler_defconfig for x86. >Support Intel Data Accelerators on Xeon hardware. > >Signed-off-by: fuyufan <fuyufan(a)huawei.com> >--- > arch/x86/configs/openeuler_defconfig | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig >index 316c4122a859..350a02583978 100644 >--- a/arch/x86/configs/openeuler_defconfig >+++ b/arch/x86/configs/openeuler_defconfig >@@ -6353,7 +6353,7 @@ CONFIG_DMA_VIRTUAL_CHANNELS=y > CONFIG_DMA_ACPI=y > # CONFIG_ALTERA_MSGDMA is not set > CONFIG_INTEL_IDMA64=m >-# CONFIG_INTEL_IDXD is not set >+CONFIG_INTEL_IDXD=y 为什么不=m？类似情况已经有几次了，我觉得值得设置一个规范，支持编译为模块的除有特别原因支撑的，一律应设置为m。 Regards, Kai

1 0

[PATCH OLK-5.10 v2] scsi: spfc: Remove redundant mask and spinlock
by Yanling Song 22 Feb '22

22 Feb '22

Ramaxel inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4UA67 CVE: NA Changes from v1: Update description. Fix: 1.Remove UNF_ORIGIN_HOTTAG_MASK and UNF_HOTTAG_FLAG 2.Update some output string 3.Remove spinlock protect in free_parent_sq() because there is spinlock protect in caller function free_parent_queue_info() Signed-off-by: Yanling Song <songyl(a)ramaxel.com> Reviewed-by: Yun Xu <xuyun(a)ramaxel.com> --- drivers/scsi/spfc/common/unf_common.h | 2 -- drivers/scsi/spfc/common/unf_io.c | 3 +-- drivers/scsi/spfc/common/unf_io_abnormal.c | 2 +- drivers/scsi/spfc/common/unf_rport.c | 2 +- drivers/scsi/spfc/common/unf_service.c | 19 +++++-------------- drivers/scsi/spfc/hw/spfc_hba.c | 2 +- drivers/scsi/spfc/hw/spfc_io.c | 2 +- drivers/scsi/spfc/hw/spfc_queue.c | 5 ----- drivers/scsi/spfc/hw/spfc_service.c | 22 ++++++++++++---------- 9 files changed, 22 insertions(+), 37 deletions(-) diff --git a/drivers/scsi/spfc/common/unf_common.h b/drivers/scsi/spfc/common/unf_common.h index bf9d156e07ce..9613649308bf 100644 --- a/drivers/scsi/spfc/common/unf_common.h +++ b/drivers/scsi/spfc/common/unf_common.h @@ -12,8 +12,6 @@ #define SPFC_DRV_DESC "Ramaxel Memory Technology Fibre Channel Driver" #define UNF_MAX_SECTORS 0xffff -#define UNF_ORIGIN_HOTTAG_MASK 0x7fff -#define UNF_HOTTAG_FLAG (1 << 15) #define UNF_PKG_FREE_OXID 0x0 #define UNF_PKG_FREE_RXID 0x1 diff --git a/drivers/scsi/spfc/common/unf_io.c b/drivers/scsi/spfc/common/unf_io.c index b1255ecba88c..5de69f8ddc6d 100644 --- a/drivers/scsi/spfc/common/unf_io.c +++ b/drivers/scsi/spfc/common/unf_io.c @@ -890,8 +890,7 @@ static int unf_send_fcpcmnd(struct unf_lport *lport, struct unf_rport *rport, unf_xchg->private_data[PKG_PRIVATE_XCHG_ALLOC_TIME]; pkg.private_data[PKG_PRIVATE_XCHG_VP_INDEX] = unf_lport->vp_index; pkg.private_data[PKG_PRIVATE_XCHG_RPORT_INDEX] = unf_rport->rport_index; - pkg.private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = - unf_xchg->hotpooltag | UNF_HOTTAG_FLAG; + pkg.private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = unf_xchg->hotpooltag; unf_select_sq(unf_xchg, &pkg); pkg.fcp_cmnd = &unf_xchg->fcp_cmnd; diff --git a/drivers/scsi/spfc/common/unf_io_abnormal.c b/drivers/scsi/spfc/common/unf_io_abnormal.c index fece7aa5f441..4e268ac026ca 100644 --- a/drivers/scsi/spfc/common/unf_io_abnormal.c +++ b/drivers/scsi/spfc/common/unf_io_abnormal.c @@ -763,7 +763,7 @@ int unf_send_scsi_mgmt_cmnd(struct unf_xchg *xchg, struct unf_lport *lport, pkg.xchg_contex = unf_xchg; pkg.private_data[PKG_PRIVATE_XCHG_RPORT_INDEX] = rport->rport_index; pkg.fcp_cmnd = &unf_xchg->fcp_cmnd; - pkg.private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = unf_xchg->hotpooltag | UNF_HOTTAG_FLAG; + pkg.private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = unf_xchg->hotpooltag; pkg.frame_head.csctl_sid = lport->nport_id; pkg.frame_head.rctl_did = rport->nport_id; diff --git a/drivers/scsi/spfc/common/unf_rport.c b/drivers/scsi/spfc/common/unf_rport.c index aa4967fc0ab6..9b06df884524 100644 --- a/drivers/scsi/spfc/common/unf_rport.c +++ b/drivers/scsi/spfc/common/unf_rport.c @@ -352,7 +352,7 @@ struct unf_rport *unf_find_valid_rport(struct unf_lport *lport, u64 wwpn, u32 si spin_unlock_irqrestore(rport_state_lock, flags); FC_DRV_PRINT(UNF_LOG_LOGIN_ATT, UNF_INFO, - "[err]Port(0x%x) RPort(0x%p) find by WWPN(0x%llx) is invalid", + "[info]Port(0x%x) RPort(0x%p) find by WWPN(0x%llx) is invalid", lport->port_id, rport_by_wwpn, wwpn); rport_by_wwpn = NULL; diff --git a/drivers/scsi/spfc/common/unf_service.c b/drivers/scsi/spfc/common/unf_service.c index 8f72f6470647..9c86c99374c8 100644 --- a/drivers/scsi/spfc/common/unf_service.c +++ b/drivers/scsi/spfc/common/unf_service.c @@ -130,7 +130,7 @@ void unf_fill_package(struct unf_frame_pkg *pkg, struct unf_xchg *xchg, pkg->private_data[PKG_PRIVATE_RPORT_RX_SIZE] = rport->max_frame_size; } - pkg->private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = xchg->hotpooltag | UNF_HOTTAG_FLAG; + pkg->private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = xchg->hotpooltag; pkg->private_data[PKG_PRIVATE_XCHG_ALLOC_TIME] = xchg->private_data[PKG_PRIVATE_XCHG_ALLOC_TIME]; pkg->private_data[PKG_PRIVATE_LOWLEVEL_XCHG_ADD] = @@ -250,7 +250,7 @@ u32 unf_send_abts(struct unf_lport *lport, struct unf_xchg *xchg) pkg.unf_cmnd_pload_bl.buffer_ptr = (u8 *)xchg->fcp_sfs_union.sfs_entry.fc_sfs_entry_ptr; pkg.unf_cmnd_pload_bl.buf_dma_addr = xchg->fcp_sfs_union.sfs_entry.sfs_buff_phy_addr; - pkg.private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = xchg->hotpooltag | UNF_HOTTAG_FLAG; + pkg.private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = xchg->hotpooltag; UNF_SET_XCHG_ALLOC_TIME(&pkg, xchg); UNF_SET_ABORT_INFO_IOTYPE(&pkg, xchg); @@ -407,19 +407,10 @@ static u32 unf_els_cmnd_default_handler(struct unf_lport *lport, struct unf_xchg rjt_info.reason_code = UNF_LS_RJT_NOT_SUPPORTED; unf_rport = unf_get_rport_by_nport_id(lport, sid); - if (unf_rport) { - if (unf_rport->rport_index != - xchg->private_data[PKG_PRIVATE_XCHG_RPORT_INDEX]) { - FC_DRV_PRINT(UNF_LOG_LOGIN_ATT, UNF_WARN, - "[warn]Port(0x%x_0x%x) NPort handle(0x%x) from low level is not equal to RPort index(0x%x)", - lport->port_id, lport->nport_id, - xchg->private_data[PKG_PRIVATE_XCHG_RPORT_INDEX], - unf_rport->rport_index); - } + if (unf_rport) ret = unf_send_els_rjt_by_rport(lport, xchg, unf_rport, &rjt_info); - } else { + else ret = unf_send_els_rjt_by_did(lport, xchg, sid, &rjt_info); - } return ret; } @@ -1389,7 +1380,7 @@ static void unf_fill_free_xid_pkg(struct unf_xchg *xchg, struct unf_frame_pkg *p pkg->frame_head.csctl_sid = xchg->sid; pkg->frame_head.rctl_did = xchg->did; pkg->frame_head.oxid_rxid = (u32)(((u32)xchg->oxid << UNF_SHIFT_16) | xchg->rxid); - pkg->private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = xchg->hotpooltag | UNF_HOTTAG_FLAG; + pkg->private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = xchg->hotpooltag; UNF_SET_XCHG_ALLOC_TIME(pkg, xchg); if (xchg->xchg_type == UNF_XCHG_TYPE_SFS) { diff --git a/drivers/scsi/spfc/hw/spfc_hba.c b/drivers/scsi/spfc/hw/spfc_hba.c index e12299c9e2c9..b033dcb78bb3 100644 --- a/drivers/scsi/spfc/hw/spfc_hba.c +++ b/drivers/scsi/spfc/hw/spfc_hba.c @@ -56,7 +56,7 @@ static struct unf_cfg_item spfc_port_cfg_parm[] = { {"port_topology", 0, 0xf, 0x20}, {"port_alpa", 0, 0xdead, 0xffff}, /* alpa address of port */ /* queue depth of originator registered to SCSI midlayer */ - {"max_queue_depth", 0, 128, 128}, + {"max_queue_depth", 0, 512, 512}, {"sest_num", 0, 2048, 2048}, {"max_login", 0, 2048, 2048}, /* nodename from 32 bit to 64 bit */ diff --git a/drivers/scsi/spfc/hw/spfc_io.c b/drivers/scsi/spfc/hw/spfc_io.c index 2b1d1c607b13..7184eb6a10af 100644 --- a/drivers/scsi/spfc/hw/spfc_io.c +++ b/drivers/scsi/spfc/hw/spfc_io.c @@ -1138,7 +1138,7 @@ u32 spfc_scq_recv_iresp(struct spfc_hba_info *hba, union spfc_scqe *wqe) pkg.private_data[PKG_PRIVATE_XCHG_ALLOC_TIME] = iresp->magic_num; pkg.frame_head.oxid_rxid = (((iresp->wd0.ox_id) << UNF_SHIFT_16) | (iresp->wd0.rx_id)); - hot_tag = (u16)iresp->wd2.hotpooltag & UNF_ORIGIN_HOTTAG_MASK; + hot_tag = (u16)iresp->wd2.hotpooltag; /* 2. HotTag validity check */ if (likely(hot_tag >= hba->exi_base && (hot_tag < hba->exi_base + hba->exi_count))) { pkg.status = UNF_IO_SUCCESS; diff --git a/drivers/scsi/spfc/hw/spfc_queue.c b/drivers/scsi/spfc/hw/spfc_queue.c index abcf1ff3f49f..fa4295832da7 100644 --- a/drivers/scsi/spfc/hw/spfc_queue.c +++ b/drivers/scsi/spfc/hw/spfc_queue.c @@ -2138,11 +2138,9 @@ static void spfc_free_parent_sq(struct spfc_hba_info *hba, u32 uidelaycnt = 0; struct list_head *list = NULL; struct spfc_suspend_sqe_info *suspend_sqe = NULL; - ulong flag = 0; sq_info = &parq_info->parent_sq_info; - spin_lock_irqsave(&parq_info->parent_queue_state_lock, flag); while (!list_empty(&sq_info->suspend_sqe_list)) { list = UNF_OS_LIST_NEXT(&sq_info->suspend_sqe_list); list_del(list); @@ -2156,7 +2154,6 @@ static void spfc_free_parent_sq(struct spfc_hba_info *hba, kfree(suspend_sqe); } } - spin_unlock_irqrestore(&parq_info->parent_queue_state_lock, flag); /* Free data cos */ spfc_update_cos_rport_cnt(hba, parq_info->queue_data_cos); @@ -4475,9 +4472,7 @@ void spfc_free_parent_queue_info(void *handle, struct spfc_parent_queue_info *pa * with the sq in the queue of the parent */ - spin_unlock_irqrestore(prtq_state_lock, flag); spfc_free_parent_sq(hba, parent_queue_info); - spin_lock_irqsave(prtq_state_lock, flag); /* The initialization of all queue id is invalid */ parent_queue_info->parent_cmd_scq_info.cqm_queue_id = INVALID_VALUE32; diff --git a/drivers/scsi/spfc/hw/spfc_service.c b/drivers/scsi/spfc/hw/spfc_service.c index e99802df50a2..1da58e3f9fbe 100644 --- a/drivers/scsi/spfc/hw/spfc_service.c +++ b/drivers/scsi/spfc/hw/spfc_service.c @@ -742,7 +742,7 @@ u32 spfc_scq_recv_abts_rsp(struct spfc_hba_info *hba, union spfc_scqe *scqe) ox_id = (u32)(abts_rsp->wd0.ox_id); - hot_tag = abts_rsp->wd1.hotpooltag & UNF_ORIGIN_HOTTAG_MASK; + hot_tag = abts_rsp->wd1.hotpooltag; if (unlikely(hot_tag < (u32)hba->exi_base || hot_tag >= (u32)(hba->exi_base + hba->exi_count))) { FC_DRV_PRINT(UNF_LOG_LOGIN_ATT, UNF_ERR, @@ -1210,7 +1210,7 @@ u32 spfc_scq_recv_ls_gs_rsp(struct spfc_hba_info *hba, union spfc_scqe *scqe) spfc_swap_16_in_32((u32 *)ls_gs_rsp_scqe->user_id, SPFC_LS_GS_USERID_LEN); ox_id = ls_gs_rsp_scqe->wd1.ox_id; - hot_tag = ((u16)(ls_gs_rsp_scqe->wd5.hotpooltag) & UNF_ORIGIN_HOTTAG_MASK) - hba->exi_base; + hot_tag = ((u16)ls_gs_rsp_scqe->wd5.hotpooltag) - hba->exi_base; pkg.frame_head.oxid_rxid = (u32)(ls_gs_rsp_scqe->wd1.rx_id) | ox_id << UNF_SHIFT_16; pkg.private_data[PKG_PRIVATE_XCHG_ALLOC_TIME] = ls_gs_rsp_scqe->magic_num; pkg.private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = hot_tag; @@ -1317,8 +1317,7 @@ u32 spfc_scq_recv_els_rsp_sts(struct spfc_hba_info *hba, union spfc_scqe *scqe) pkg.private_data[PKG_PRIVATE_XCHG_ALLOC_TIME] = els_rsp_sts_scqe->magic_num; pkg.frame_head.oxid_rxid = rx_id | (u32)(els_rsp_sts_scqe->wd0.ox_id) << UNF_SHIFT_16; - hot_tag = (u32)((els_rsp_sts_scqe->wd1.hotpooltag & UNF_ORIGIN_HOTTAG_MASK) - - hba->exi_base); + hot_tag = (u32)(els_rsp_sts_scqe->wd1.hotpooltag - hba->exi_base); if (unlikely(SPFC_SCQE_HAS_ERRCODE(scqe))) pkg.status = UNF_IO_FAILED; @@ -1759,7 +1758,7 @@ u32 spfc_scq_recv_marker_sts(struct spfc_hba_info *hba, union spfc_scqe *scqe) tmf_marker_sts_scqe = &scqe->itmf_marker_sts; ox_id = (u32)tmf_marker_sts_scqe->wd1.ox_id; rx_id = (u32)tmf_marker_sts_scqe->wd1.rx_id; - hot_tag = (tmf_marker_sts_scqe->wd4.hotpooltag & UNF_ORIGIN_HOTTAG_MASK) - hba->exi_base; + hot_tag = tmf_marker_sts_scqe->wd4.hotpooltag - hba->exi_base; pkg.frame_head.oxid_rxid = rx_id | (u32)(ox_id) << UNF_SHIFT_16; pkg.private_data[PKG_PRIVATE_XCHG_ALLOC_TIME] = tmf_marker_sts_scqe->magic_num; pkg.frame_head.csctl_sid = tmf_marker_sts_scqe->wd3.sid; @@ -1800,7 +1799,7 @@ u32 spfc_scq_recv_abts_marker_sts(struct spfc_hba_info *hba, union spfc_scqe *sc ox_id = (u32)abts_marker_sts_scqe->wd1.ox_id; rx_id = (u32)abts_marker_sts_scqe->wd1.rx_id; - hot_tag = (abts_marker_sts_scqe->wd4.hotpooltag & UNF_ORIGIN_HOTTAG_MASK) - hba->exi_base; + hot_tag = abts_marker_sts_scqe->wd4.hotpooltag - hba->exi_base; pkg.frame_head.oxid_rxid = rx_id | (u32)(ox_id) << UNF_SHIFT_16; pkg.frame_head.csctl_sid = abts_marker_sts_scqe->wd3.sid; pkg.frame_head.rctl_did = abts_marker_sts_scqe->wd2.did; @@ -1972,8 +1971,7 @@ u32 spfc_scq_free_xid_sts(struct spfc_hba_info *hba, union spfc_scqe *scqe) rx_id = (u32)free_xid_sts_scqe->wd0.rx_id; if (free_xid_sts_scqe->wd1.hotpooltag != INVALID_VALUE16) { - hot_tag = (free_xid_sts_scqe->wd1.hotpooltag & - UNF_ORIGIN_HOTTAG_MASK) - hba->exi_base; + hot_tag = free_xid_sts_scqe->wd1.hotpooltag - hba->exi_base; } FC_DRV_PRINT(UNF_LOG_EQUIP_ATT, UNF_INFO, @@ -1998,7 +1996,7 @@ u32 spfc_scq_exchg_timeout_sts(struct spfc_hba_info *hba, union spfc_scqe *scqe) rx_id = (u32)time_out_scqe->wd0.rx_id; if (time_out_scqe->wd1.hotpooltag != INVALID_VALUE16) - hot_tag = (time_out_scqe->wd1.hotpooltag & UNF_ORIGIN_HOTTAG_MASK) - hba->exi_base; + hot_tag = time_out_scqe->wd1.hotpooltag - hba->exi_base; FC_DRV_PRINT(UNF_LOG_EQUIP_ATT, UNF_INFO, "Port(0x%x) recv timer time out sts hotpooltag(0x%x) magicnum(0x%x) ox_id(0x%x) rxid(0x%x) sts(%d)", @@ -2054,7 +2052,7 @@ u32 spfc_scq_rcv_sq_nop_sts(struct spfc_hba_info *hba, union spfc_scqe *scqe) FC_DRV_PRINT(UNF_LOG_LOGIN_ATT, UNF_INFO, "[info]Port(0x%x) rport_index(0x%x) find suspend sqe.", hba->port_cfg.port_id, rport_index); - if (sqn < sqn_max) { + if ((sqn < sqn_max) && (sqn >= sqn_base)) { ret = spfc_send_nop_cmd(hba, parent_sq_info, magic_num, sqn + 1); } else if (sqn == sqn_max) { if (!cancel_delayed_work(&suspend_sqe->timeout_work)) { @@ -2065,6 +2063,10 @@ u32 spfc_scq_rcv_sq_nop_sts(struct spfc_hba_info *hba, union spfc_scqe *scqe) parent_sq_info->need_offloaded = suspend_sqe->old_offload_sts; ret = spfc_pop_suspend_sqe(hba, prt_qinfo, suspend_sqe); kfree(suspend_sqe); + } else { + FC_DRV_PRINT(UNF_LOG_LOGIN_ATT, UNF_WARN, + "[warn]Port(0x%x) rport(0x%x) rcv error sqn(0x%x)", + hba->port_cfg.port_id, rport_index, sqn); } } else { FC_DRV_PRINT(UNF_LOG_LOGIN_ATT, UNF_WARN, -- 2.32.0

1 0

[PATCH openEuler-1.0-LTS] bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds()
by Yang Yingliang 22 Feb '22

22 Feb '22

From: John Fastabend <john.fastabend(a)gmail.com> mainline inclusion from mainline-v5.7-rc1 commit 294f2fc6da27620a506e6c050241655459ccd6bd category: bugfix bugzilla: NA CVE: CVE-2021-4159 ----------------------------------------------- Currently, for all op verification we call __red_deduce_bounds() and __red_bound_offset() but we only call __update_reg_bounds() in bitwise ops. However, we could benefit from calling __update_reg_bounds() in BPF_ADD, BPF_SUB, and BPF_MUL cases as well. For example, a register with state 'R1_w=invP0' when we subtract from it, w1 -= 2 Before coerce we will now have an smin_value=S64_MIN, smax_value=U64_MAX and unsigned bounds umin_value=0, umax_value=U64_MAX. These will then be clamped to S32_MIN, U32_MAX values by coerce in the case of alu32 op as done in above example. However tnum will be a constant because the ALU op is done on a constant. Without update_reg_bounds() we have a scenario where tnum is a const but our unsigned bounds do not reflect this. By calling update_reg_bounds after coerce to 32bit we further refine the umin_value to U64_MAX in the alu64 case or U32_MAX in the alu32 case above. Signed-off-by: John Fastabend <john.fastabend(a)gmail.com> Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Link: https://lore.kernel.org/bpf/158507151689.15666.566796274289413203.stgit@joh… Signed-off-by: He Fengqing <hefengqing(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Kuohai Xu <xukuohai(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/bpf/verifier.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 446655caa2625..c3c592654cf10 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -3553,6 +3553,7 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env, coerce_reg_to_size(dst_reg, 4); } + __update_reg_bounds(dst_reg); __reg_deduce_bounds(dst_reg); __reg_bound_offset(dst_reg); return 0; -- 2.25.1

1 0

[PATCH OLK-5.10 v3 0/7] Backport zhaoxin enhancement and bugfix
by Zheng Zengkai 22 Feb '22

22 Feb '22

v2->v3: Fix compile warning "ahci_error_intr ISO C90 forbids mixed declarations and code" Backport zhaoxin enhancement and bugfix patches. LeoLiu-oc (7): rtc: Fix set RTC time delay 500ms on some Zhaoxin SOCs XHCI: Fix some device identify fail when enable xHCI runtime suspend EHCI: Clear wakeup signal locked in S0 state when device plug in Fix some bugs like plugin support and sata link stability when user enable ahci RTD3 Add support for disabling PhyRdy Change Interrupt based on actual LPM capability Add support for PxSCT.LPM set based on actual LPM capability x86/tsc: Make cur->adjusted values in package#1 to be the same arch/x86/kernel/tsc_sync.c | 5 +++++ drivers/ata/ahci.c | 24 ++++++++++++++++++++++++ drivers/ata/libahci.c | 15 +++++++++++++++ drivers/ata/libata-eh.c | 7 +++++++ drivers/ata/libata-sata.c | 20 ++++++++++++++++++-- drivers/pci/pci-driver.c | 6 +++++- drivers/rtc/rtc-mc146818-lib.c | 16 ++++++++++++++++ drivers/usb/host/ehci-hcd.c | 21 +++++++++++++++++++++ drivers/usb/host/ehci-pci.c | 4 ++++ drivers/usb/host/ehci.h | 1 + drivers/usb/host/xhci-pci.c | 2 ++ include/linux/libata.h | 4 ++++ 12 files changed, 122 insertions(+), 3 deletions(-) -- 2.20.1

1 7

[PATCH openEuler-1.0-LTS] livepatch/x86: Fix incorrect use of 'strncpy'
by Yang Yingliang 22 Feb '22

22 Feb '22

From: Zheng Yejian <zhengyejian1(a)huawei.com> hulk inclusion category: bugfix bugzilla: 186253, https://gitee.com/openeuler/kernel/issues/I4TYA9 CVE: NA ----------------------------------------------- Refer to following codes, 'strncpy' would stop copying if Null character encountered. For example, when 'code' is "53 be 00 0a 05", 'old_code' would be "53 be 00 00 00". > 276 static unsigned char *klp_old_code(unsigned char *code) > 277 { > 278 static union klp_code_union old_code; > 279 > 280 strncpy(old_code.code, code, JMP_E9_INSN_SIZE); > 281 return old_code.code; > 282 } As a result, the instructions cannot be restored completely, and the system becomes abnormal. Fixes: 7e2ab91ea076 ("livepatch/x86: support livepatch without ftrace") Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> Reviewed-by: Kuohai Xu <xukuohai(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/x86/kernel/livepatch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kernel/livepatch.c b/arch/x86/kernel/livepatch.c index 0e118adf14087..785bba03b77fa 100644 --- a/arch/x86/kernel/livepatch.c +++ b/arch/x86/kernel/livepatch.c @@ -277,7 +277,7 @@ static unsigned char *klp_old_code(unsigned char *code) { static union klp_code_union old_code; - strncpy(old_code.code, code, JMP_E9_INSN_SIZE); + memcpy(old_code.code, code, JMP_E9_INSN_SIZE); return old_code.code; } -- 2.25.1

1 0

[PATCH OLK-5.10 v2] scsi: spfc: Remove redundant mask and spinlock
by Yanling Song 22 Feb '22

22 Feb '22

Ramaxel inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4UA67 CVE: NA Changes from v1: Update description. Fix: 1.Remove UNF_ORIGIN_HOTTAG_MASK and UNF_HOTTAG_FLAG 2.Update some output string 3.Remove spinlock protect in free_parent_sq() because there is spinlock protect in caller function free_parent_queue_info() Signed-off-by: Yanling Song <songyl(a)ramaxel.com> Reviewed-by: Yun Xu <xuyun(a)ramaxel.com> --- drivers/scsi/spfc/common/unf_common.h | 2 -- drivers/scsi/spfc/common/unf_io.c | 3 +-- drivers/scsi/spfc/common/unf_io_abnormal.c | 2 +- drivers/scsi/spfc/common/unf_rport.c | 2 +- drivers/scsi/spfc/common/unf_service.c | 19 +++++-------------- drivers/scsi/spfc/hw/spfc_hba.c | 2 +- drivers/scsi/spfc/hw/spfc_io.c | 2 +- drivers/scsi/spfc/hw/spfc_queue.c | 5 ----- drivers/scsi/spfc/hw/spfc_service.c | 22 ++++++++++++---------- 9 files changed, 22 insertions(+), 37 deletions(-) diff --git a/drivers/scsi/spfc/common/unf_common.h b/drivers/scsi/spfc/common/unf_common.h index bf9d156e07ce..9613649308bf 100644 --- a/drivers/scsi/spfc/common/unf_common.h +++ b/drivers/scsi/spfc/common/unf_common.h @@ -12,8 +12,6 @@ #define SPFC_DRV_DESC "Ramaxel Memory Technology Fibre Channel Driver" #define UNF_MAX_SECTORS 0xffff -#define UNF_ORIGIN_HOTTAG_MASK 0x7fff -#define UNF_HOTTAG_FLAG (1 << 15) #define UNF_PKG_FREE_OXID 0x0 #define UNF_PKG_FREE_RXID 0x1 diff --git a/drivers/scsi/spfc/common/unf_io.c b/drivers/scsi/spfc/common/unf_io.c index b1255ecba88c..5de69f8ddc6d 100644 --- a/drivers/scsi/spfc/common/unf_io.c +++ b/drivers/scsi/spfc/common/unf_io.c @@ -890,8 +890,7 @@ static int unf_send_fcpcmnd(struct unf_lport *lport, struct unf_rport *rport, unf_xchg->private_data[PKG_PRIVATE_XCHG_ALLOC_TIME]; pkg.private_data[PKG_PRIVATE_XCHG_VP_INDEX] = unf_lport->vp_index; pkg.private_data[PKG_PRIVATE_XCHG_RPORT_INDEX] = unf_rport->rport_index; - pkg.private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = - unf_xchg->hotpooltag | UNF_HOTTAG_FLAG; + pkg.private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = unf_xchg->hotpooltag; unf_select_sq(unf_xchg, &pkg); pkg.fcp_cmnd = &unf_xchg->fcp_cmnd; diff --git a/drivers/scsi/spfc/common/unf_io_abnormal.c b/drivers/scsi/spfc/common/unf_io_abnormal.c index fece7aa5f441..4e268ac026ca 100644 --- a/drivers/scsi/spfc/common/unf_io_abnormal.c +++ b/drivers/scsi/spfc/common/unf_io_abnormal.c @@ -763,7 +763,7 @@ int unf_send_scsi_mgmt_cmnd(struct unf_xchg *xchg, struct unf_lport *lport, pkg.xchg_contex = unf_xchg; pkg.private_data[PKG_PRIVATE_XCHG_RPORT_INDEX] = rport->rport_index; pkg.fcp_cmnd = &unf_xchg->fcp_cmnd; - pkg.private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = unf_xchg->hotpooltag | UNF_HOTTAG_FLAG; + pkg.private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = unf_xchg->hotpooltag; pkg.frame_head.csctl_sid = lport->nport_id; pkg.frame_head.rctl_did = rport->nport_id; diff --git a/drivers/scsi/spfc/common/unf_rport.c b/drivers/scsi/spfc/common/unf_rport.c index aa4967fc0ab6..9b06df884524 100644 --- a/drivers/scsi/spfc/common/unf_rport.c +++ b/drivers/scsi/spfc/common/unf_rport.c @@ -352,7 +352,7 @@ struct unf_rport *unf_find_valid_rport(struct unf_lport *lport, u64 wwpn, u32 si spin_unlock_irqrestore(rport_state_lock, flags); FC_DRV_PRINT(UNF_LOG_LOGIN_ATT, UNF_INFO, - "[err]Port(0x%x) RPort(0x%p) find by WWPN(0x%llx) is invalid", + "[info]Port(0x%x) RPort(0x%p) find by WWPN(0x%llx) is invalid", lport->port_id, rport_by_wwpn, wwpn); rport_by_wwpn = NULL; diff --git a/drivers/scsi/spfc/common/unf_service.c b/drivers/scsi/spfc/common/unf_service.c index 8f72f6470647..9c86c99374c8 100644 --- a/drivers/scsi/spfc/common/unf_service.c +++ b/drivers/scsi/spfc/common/unf_service.c @@ -130,7 +130,7 @@ void unf_fill_package(struct unf_frame_pkg *pkg, struct unf_xchg *xchg, pkg->private_data[PKG_PRIVATE_RPORT_RX_SIZE] = rport->max_frame_size; } - pkg->private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = xchg->hotpooltag | UNF_HOTTAG_FLAG; + pkg->private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = xchg->hotpooltag; pkg->private_data[PKG_PRIVATE_XCHG_ALLOC_TIME] = xchg->private_data[PKG_PRIVATE_XCHG_ALLOC_TIME]; pkg->private_data[PKG_PRIVATE_LOWLEVEL_XCHG_ADD] = @@ -250,7 +250,7 @@ u32 unf_send_abts(struct unf_lport *lport, struct unf_xchg *xchg) pkg.unf_cmnd_pload_bl.buffer_ptr = (u8 *)xchg->fcp_sfs_union.sfs_entry.fc_sfs_entry_ptr; pkg.unf_cmnd_pload_bl.buf_dma_addr = xchg->fcp_sfs_union.sfs_entry.sfs_buff_phy_addr; - pkg.private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = xchg->hotpooltag | UNF_HOTTAG_FLAG; + pkg.private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = xchg->hotpooltag; UNF_SET_XCHG_ALLOC_TIME(&pkg, xchg); UNF_SET_ABORT_INFO_IOTYPE(&pkg, xchg); @@ -407,19 +407,10 @@ static u32 unf_els_cmnd_default_handler(struct unf_lport *lport, struct unf_xchg rjt_info.reason_code = UNF_LS_RJT_NOT_SUPPORTED; unf_rport = unf_get_rport_by_nport_id(lport, sid); - if (unf_rport) { - if (unf_rport->rport_index != - xchg->private_data[PKG_PRIVATE_XCHG_RPORT_INDEX]) { - FC_DRV_PRINT(UNF_LOG_LOGIN_ATT, UNF_WARN, - "[warn]Port(0x%x_0x%x) NPort handle(0x%x) from low level is not equal to RPort index(0x%x)", - lport->port_id, lport->nport_id, - xchg->private_data[PKG_PRIVATE_XCHG_RPORT_INDEX], - unf_rport->rport_index); - } + if (unf_rport) ret = unf_send_els_rjt_by_rport(lport, xchg, unf_rport, &rjt_info); - } else { + else ret = unf_send_els_rjt_by_did(lport, xchg, sid, &rjt_info); - } return ret; } @@ -1389,7 +1380,7 @@ static void unf_fill_free_xid_pkg(struct unf_xchg *xchg, struct unf_frame_pkg *p pkg->frame_head.csctl_sid = xchg->sid; pkg->frame_head.rctl_did = xchg->did; pkg->frame_head.oxid_rxid = (u32)(((u32)xchg->oxid << UNF_SHIFT_16) | xchg->rxid); - pkg->private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = xchg->hotpooltag | UNF_HOTTAG_FLAG; + pkg->private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = xchg->hotpooltag; UNF_SET_XCHG_ALLOC_TIME(pkg, xchg); if (xchg->xchg_type == UNF_XCHG_TYPE_SFS) { diff --git a/drivers/scsi/spfc/hw/spfc_hba.c b/drivers/scsi/spfc/hw/spfc_hba.c index e12299c9e2c9..b033dcb78bb3 100644 --- a/drivers/scsi/spfc/hw/spfc_hba.c +++ b/drivers/scsi/spfc/hw/spfc_hba.c @@ -56,7 +56,7 @@ static struct unf_cfg_item spfc_port_cfg_parm[] = { {"port_topology", 0, 0xf, 0x20}, {"port_alpa", 0, 0xdead, 0xffff}, /* alpa address of port */ /* queue depth of originator registered to SCSI midlayer */ - {"max_queue_depth", 0, 128, 128}, + {"max_queue_depth", 0, 512, 512}, {"sest_num", 0, 2048, 2048}, {"max_login", 0, 2048, 2048}, /* nodename from 32 bit to 64 bit */ diff --git a/drivers/scsi/spfc/hw/spfc_io.c b/drivers/scsi/spfc/hw/spfc_io.c index 2b1d1c607b13..7184eb6a10af 100644 --- a/drivers/scsi/spfc/hw/spfc_io.c +++ b/drivers/scsi/spfc/hw/spfc_io.c @@ -1138,7 +1138,7 @@ u32 spfc_scq_recv_iresp(struct spfc_hba_info *hba, union spfc_scqe *wqe) pkg.private_data[PKG_PRIVATE_XCHG_ALLOC_TIME] = iresp->magic_num; pkg.frame_head.oxid_rxid = (((iresp->wd0.ox_id) << UNF_SHIFT_16) | (iresp->wd0.rx_id)); - hot_tag = (u16)iresp->wd2.hotpooltag & UNF_ORIGIN_HOTTAG_MASK; + hot_tag = (u16)iresp->wd2.hotpooltag; /* 2. HotTag validity check */ if (likely(hot_tag >= hba->exi_base && (hot_tag < hba->exi_base + hba->exi_count))) { pkg.status = UNF_IO_SUCCESS; diff --git a/drivers/scsi/spfc/hw/spfc_queue.c b/drivers/scsi/spfc/hw/spfc_queue.c index abcf1ff3f49f..fa4295832da7 100644 --- a/drivers/scsi/spfc/hw/spfc_queue.c +++ b/drivers/scsi/spfc/hw/spfc_queue.c @@ -2138,11 +2138,9 @@ static void spfc_free_parent_sq(struct spfc_hba_info *hba, u32 uidelaycnt = 0; struct list_head *list = NULL; struct spfc_suspend_sqe_info *suspend_sqe = NULL; - ulong flag = 0; sq_info = &parq_info->parent_sq_info; - spin_lock_irqsave(&parq_info->parent_queue_state_lock, flag); while (!list_empty(&sq_info->suspend_sqe_list)) { list = UNF_OS_LIST_NEXT(&sq_info->suspend_sqe_list); list_del(list); @@ -2156,7 +2154,6 @@ static void spfc_free_parent_sq(struct spfc_hba_info *hba, kfree(suspend_sqe); } } - spin_unlock_irqrestore(&parq_info->parent_queue_state_lock, flag); /* Free data cos */ spfc_update_cos_rport_cnt(hba, parq_info->queue_data_cos); @@ -4475,9 +4472,7 @@ void spfc_free_parent_queue_info(void *handle, struct spfc_parent_queue_info *pa * with the sq in the queue of the parent */ - spin_unlock_irqrestore(prtq_state_lock, flag); spfc_free_parent_sq(hba, parent_queue_info); - spin_lock_irqsave(prtq_state_lock, flag); /* The initialization of all queue id is invalid */ parent_queue_info->parent_cmd_scq_info.cqm_queue_id = INVALID_VALUE32; diff --git a/drivers/scsi/spfc/hw/spfc_service.c b/drivers/scsi/spfc/hw/spfc_service.c index e99802df50a2..1da58e3f9fbe 100644 --- a/drivers/scsi/spfc/hw/spfc_service.c +++ b/drivers/scsi/spfc/hw/spfc_service.c @@ -742,7 +742,7 @@ u32 spfc_scq_recv_abts_rsp(struct spfc_hba_info *hba, union spfc_scqe *scqe) ox_id = (u32)(abts_rsp->wd0.ox_id); - hot_tag = abts_rsp->wd1.hotpooltag & UNF_ORIGIN_HOTTAG_MASK; + hot_tag = abts_rsp->wd1.hotpooltag; if (unlikely(hot_tag < (u32)hba->exi_base || hot_tag >= (u32)(hba->exi_base + hba->exi_count))) { FC_DRV_PRINT(UNF_LOG_LOGIN_ATT, UNF_ERR, @@ -1210,7 +1210,7 @@ u32 spfc_scq_recv_ls_gs_rsp(struct spfc_hba_info *hba, union spfc_scqe *scqe) spfc_swap_16_in_32((u32 *)ls_gs_rsp_scqe->user_id, SPFC_LS_GS_USERID_LEN); ox_id = ls_gs_rsp_scqe->wd1.ox_id; - hot_tag = ((u16)(ls_gs_rsp_scqe->wd5.hotpooltag) & UNF_ORIGIN_HOTTAG_MASK) - hba->exi_base; + hot_tag = ((u16)ls_gs_rsp_scqe->wd5.hotpooltag) - hba->exi_base; pkg.frame_head.oxid_rxid = (u32)(ls_gs_rsp_scqe->wd1.rx_id) | ox_id << UNF_SHIFT_16; pkg.private_data[PKG_PRIVATE_XCHG_ALLOC_TIME] = ls_gs_rsp_scqe->magic_num; pkg.private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = hot_tag; @@ -1317,8 +1317,7 @@ u32 spfc_scq_recv_els_rsp_sts(struct spfc_hba_info *hba, union spfc_scqe *scqe) pkg.private_data[PKG_PRIVATE_XCHG_ALLOC_TIME] = els_rsp_sts_scqe->magic_num; pkg.frame_head.oxid_rxid = rx_id | (u32)(els_rsp_sts_scqe->wd0.ox_id) << UNF_SHIFT_16; - hot_tag = (u32)((els_rsp_sts_scqe->wd1.hotpooltag & UNF_ORIGIN_HOTTAG_MASK) - - hba->exi_base); + hot_tag = (u32)(els_rsp_sts_scqe->wd1.hotpooltag - hba->exi_base); if (unlikely(SPFC_SCQE_HAS_ERRCODE(scqe))) pkg.status = UNF_IO_FAILED; @@ -1759,7 +1758,7 @@ u32 spfc_scq_recv_marker_sts(struct spfc_hba_info *hba, union spfc_scqe *scqe) tmf_marker_sts_scqe = &scqe->itmf_marker_sts; ox_id = (u32)tmf_marker_sts_scqe->wd1.ox_id; rx_id = (u32)tmf_marker_sts_scqe->wd1.rx_id; - hot_tag = (tmf_marker_sts_scqe->wd4.hotpooltag & UNF_ORIGIN_HOTTAG_MASK) - hba->exi_base; + hot_tag = tmf_marker_sts_scqe->wd4.hotpooltag - hba->exi_base; pkg.frame_head.oxid_rxid = rx_id | (u32)(ox_id) << UNF_SHIFT_16; pkg.private_data[PKG_PRIVATE_XCHG_ALLOC_TIME] = tmf_marker_sts_scqe->magic_num; pkg.frame_head.csctl_sid = tmf_marker_sts_scqe->wd3.sid; @@ -1800,7 +1799,7 @@ u32 spfc_scq_recv_abts_marker_sts(struct spfc_hba_info *hba, union spfc_scqe *sc ox_id = (u32)abts_marker_sts_scqe->wd1.ox_id; rx_id = (u32)abts_marker_sts_scqe->wd1.rx_id; - hot_tag = (abts_marker_sts_scqe->wd4.hotpooltag & UNF_ORIGIN_HOTTAG_MASK) - hba->exi_base; + hot_tag = abts_marker_sts_scqe->wd4.hotpooltag - hba->exi_base; pkg.frame_head.oxid_rxid = rx_id | (u32)(ox_id) << UNF_SHIFT_16; pkg.frame_head.csctl_sid = abts_marker_sts_scqe->wd3.sid; pkg.frame_head.rctl_did = abts_marker_sts_scqe->wd2.did; @@ -1972,8 +1971,7 @@ u32 spfc_scq_free_xid_sts(struct spfc_hba_info *hba, union spfc_scqe *scqe) rx_id = (u32)free_xid_sts_scqe->wd0.rx_id; if (free_xid_sts_scqe->wd1.hotpooltag != INVALID_VALUE16) { - hot_tag = (free_xid_sts_scqe->wd1.hotpooltag & - UNF_ORIGIN_HOTTAG_MASK) - hba->exi_base; + hot_tag = free_xid_sts_scqe->wd1.hotpooltag - hba->exi_base; } FC_DRV_PRINT(UNF_LOG_EQUIP_ATT, UNF_INFO, @@ -1998,7 +1996,7 @@ u32 spfc_scq_exchg_timeout_sts(struct spfc_hba_info *hba, union spfc_scqe *scqe) rx_id = (u32)time_out_scqe->wd0.rx_id; if (time_out_scqe->wd1.hotpooltag != INVALID_VALUE16) - hot_tag = (time_out_scqe->wd1.hotpooltag & UNF_ORIGIN_HOTTAG_MASK) - hba->exi_base; + hot_tag = time_out_scqe->wd1.hotpooltag - hba->exi_base; FC_DRV_PRINT(UNF_LOG_EQUIP_ATT, UNF_INFO, "Port(0x%x) recv timer time out sts hotpooltag(0x%x) magicnum(0x%x) ox_id(0x%x) rxid(0x%x) sts(%d)", @@ -2054,7 +2052,7 @@ u32 spfc_scq_rcv_sq_nop_sts(struct spfc_hba_info *hba, union spfc_scqe *scqe) FC_DRV_PRINT(UNF_LOG_LOGIN_ATT, UNF_INFO, "[info]Port(0x%x) rport_index(0x%x) find suspend sqe.", hba->port_cfg.port_id, rport_index); - if (sqn < sqn_max) { + if ((sqn < sqn_max) && (sqn >= sqn_base)) { ret = spfc_send_nop_cmd(hba, parent_sq_info, magic_num, sqn + 1); } else if (sqn == sqn_max) { if (!cancel_delayed_work(&suspend_sqe->timeout_work)) { @@ -2065,6 +2063,10 @@ u32 spfc_scq_rcv_sq_nop_sts(struct spfc_hba_info *hba, union spfc_scqe *scqe) parent_sq_info->need_offloaded = suspend_sqe->old_offload_sts; ret = spfc_pop_suspend_sqe(hba, prt_qinfo, suspend_sqe); kfree(suspend_sqe); + } else { + FC_DRV_PRINT(UNF_LOG_LOGIN_ATT, UNF_WARN, + "[warn]Port(0x%x) rport(0x%x) rcv error sqn(0x%x)", + hba->port_cfg.port_id, rport_index, sqn); } } else { FC_DRV_PRINT(UNF_LOG_LOGIN_ATT, UNF_WARN, -- 2.32.0

1 0

[PATCH OLK-5.10 v2 0/5] net/spnic: spnic bugfix series
by Yanling Song 22 Feb '22

22 Feb '22

Fix 5 bugs: 1. Fix array bounds error in ethtool get_link_ksettings 2. Fix ethtool loopback command failure 3. Fix xor checksum error when sending a non 4B-aligned message to firmware 4. Fix an error when netdev failed to link up 5. Reduce the timeout of the channel between driver and firmware Yanling Song (5): net/spnic: Fix array bounds error in ethtool get_link_ksettings net/spnic: Fix ethtool loopback command failure net/spnic: Fix xor checksum error when sending a non 4B-aligned message to firmware net/spnic: Fix an error when netdev failed to link up net/spnic: Reduce the timeout of the channel between driver and firmware .../net/ethernet/ramaxel/spnic/hw/sphw_cmdq.c | 2 +- .../net/ethernet/ramaxel/spnic/hw/sphw_mbox.c | 10 ++-- .../net/ethernet/ramaxel/spnic/hw/sphw_mgmt.c | 2 +- .../ramaxel/spnic/spnic_ethtool_stats.c | 4 +- .../ethernet/ramaxel/spnic/spnic_mag_cfg.c | 2 +- .../ethernet/ramaxel/spnic/spnic_nic_cfg_vf.c | 49 ++++++++++++------- 6 files changed, 41 insertions(+), 28 deletions(-) -- 2.32.0

1 5

[PATCH OLK-5.10] configs: enable CONFIG_NTB_INTEL
by Chao Liu 22 Feb '22

22 Feb '22

euler inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4UP2Q CVE: NA -------------------------------- Enable CONFIG_NTB_INTEL in openeuler_defconfig for x86. Support Intel NTB on capable Xeon and Atom hardware. Signed-off-by: Chao Liu <liuchao173(a)huawei.com> --- arch/x86/configs/openeuler_defconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 316c4122a859..7cda312e96a3 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -7121,7 +7121,7 @@ CONFIG_NTB=m # CONFIG_NTB_MSI is not set # CONFIG_NTB_AMD is not set # CONFIG_NTB_IDT is not set -# CONFIG_NTB_INTEL is not set +CONFIG_NTB_INTEL=m # CONFIG_NTB_SWITCHTEC is not set # CONFIG_NTB_PINGPONG is not set # CONFIG_NTB_TOOL is not set -- 2.23.0

2 1

[PATCH OLK-5.10] uce: copy_from_user scenario support kernel recovery
by Tong Tiangen 22 Feb '22

22 Feb '22

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4PM10 CVE: NA -------------------------------- This patch add uce kernel recovery path support in copy_from_user. Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- arch/arm64/Kconfig | 9 ++ arch/arm64/include/asm/exception.h | 12 +++ arch/arm64/lib/copy_from_user.S | 5 + arch/arm64/mm/fault.c | 154 +++++++++++++++++++++++++++++ include/linux/kernel.h | 4 + kernel/sysctl.c | 11 +++ 6 files changed, 195 insertions(+) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index c0f6a275f798..f0198d7f8333 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -2155,6 +2155,15 @@ config ARCH_HIBERNATION_HEADER config ARCH_SUSPEND_POSSIBLE def_bool y +config UCE_KERNEL_RECOVERY + bool "uce kernel recovery from special scenario" + def_bool y + help + With ARM v8.2 RAS Extension, SEA are usually triggered when memory errors + are consumed. In some cases, if the error address is in a user page there + is a chance to recover. Such as error occurs in COW and pagecache reading + scenario, we can isolate this page and killing process instead of die. + endmenu menu "CPU Power Management" diff --git a/arch/arm64/include/asm/exception.h b/arch/arm64/include/asm/exception.h index 0756191f44f6..bad92fe763fb 100644 --- a/arch/arm64/include/asm/exception.h +++ b/arch/arm64/include/asm/exception.h @@ -53,4 +53,16 @@ void do_cp15instr(unsigned int esr, struct pt_regs *regs); void do_el0_svc(struct pt_regs *regs); void do_el0_svc_compat(struct pt_regs *regs); void do_ptrauth_fault(struct pt_regs *regs, unsigned int esr); + +#ifdef CONFIG_UCE_KERNEL_RECOVERY +struct uce_kernel_recovery_info { + int (*fn)(void); + const char *name; + unsigned long addr; + unsigned long size; +}; + +extern int copy_from_user_sea_fallback(void); +#endif + #endif /* __ASM_EXCEPTION_H */ diff --git a/arch/arm64/lib/copy_from_user.S b/arch/arm64/lib/copy_from_user.S index 2cf999e41d30..ffd07e9822f2 100644 --- a/arch/arm64/lib/copy_from_user.S +++ b/arch/arm64/lib/copy_from_user.S @@ -60,6 +60,11 @@ SYM_FUNC_START(__arch_copy_from_user) #include "copy_template.S" mov x0, #0 // Nothing to copy ret + + .global copy_from_user_sea_fallback +copy_from_user_sea_fallback: + mov x0, #-1 + ret SYM_FUNC_END(__arch_copy_from_user) EXPORT_SYMBOL(__arch_copy_from_user) diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c index 3fc5aceb72eb..7f76e277daa3 100644 --- a/arch/arm64/mm/fault.c +++ b/arch/arm64/mm/fault.c @@ -634,6 +634,127 @@ static int do_bad(unsigned long addr, unsigned int esr, struct pt_regs *regs) return 1; /* "fault" */ } +#ifdef CONFIG_UCE_KERNEL_RECOVERY +int kernel_access_sea_recovery; + +#define UCE_KER_REC_NUM ARRAY_SIZE(reco_info) +static struct uce_kernel_recovery_info reco_info[] = { + {NULL, NULL, 0, 0}, + {NULL, NULL, 0, 0}, + {copy_from_user_sea_fallback, "__arch_copy_from_user", (unsigned long)__arch_copy_from_user, 0}, +}; + +static int __init kernel_access_sea_recovery_init(void) +{ + unsigned long addr, size, offset; + unsigned int i; + + for (i = 0; i < UCE_KER_REC_NUM; i++) { + addr = reco_info[i].addr; + if (!kallsyms_lookup_size_offset(addr, &size, &offset)) { + pr_info("UCE: symbol %s lookup addr fail.\n", + reco_info[i].name); + size = 0; + } + + reco_info[i].size = size; + } + + return 1; +} +fs_initcall(kernel_access_sea_recovery_init); + +static int __init enable_kernel_access_sea_recovery(char *str) +{ + int max = (1 << UCE_KER_REC_NUM) - 1; + int val; + + if (kstrtoint(str, 0, &val)) + return -EINVAL; + + if (val < 0 || val > max) { + pr_info("UCE: invalid uce_kernel_recovery value %d", val); + return -EINVAL; + } + + kernel_access_sea_recovery = val; + + return 1; +} +__setup("uce_kernel_recovery=", enable_kernel_access_sea_recovery); + +/* + * what is kernel recovery? + * If the process's private data is accessed in the kernel mode to trigger + * special sea fault, it can controlled by killing the process and isolating + * the failure pages instead of die. + */ +static int is_in_kernel_recovery(unsigned int esr, struct pt_regs *regs) +{ + /* + * target insn: ldp-pre, ldp-post, ldp-offset, + * ldr-64bit-pre/pose, ldr-32bit-pre/post, ldrb-pre/post, ldrh-pre/post + */ + u32 target_insn[] = {0xa8c, 0xa9c, 0xa94, 0xf84, 0x784, 0x384, 0xb84}; + void *pc = (void *)instruction_pointer(regs); + struct uce_kernel_recovery_info *info; + bool insn_match = false; + u32 insn; + int i; + + pr_emerg("UCE: %s-%d, kernel recovery: 0x%x, esr: 0x%08x -- %s, %pS\n", + current->comm, current->pid, kernel_access_sea_recovery, esr, + esr_get_class_string(esr), pc); + + if (aarch64_insn_read((void *)pc, &insn)) { + pr_emerg("UCE: insn read fail.\n"); + return -EFAULT; + } + + /* + * We process special ESR: + * EC : 0b100101 Data Abort taken without a change in Exception level. + * DFSC : 0b010000 Synchronous External abort, not on translation table + * walk or hardware update of translation table. + * eg: 0x96000610 + */ + if (ESR_ELx_EC(esr) != ESR_ELx_EC_DABT_CUR || + (esr & ESR_ELx_FSC) != ESR_ELx_FSC_EXTABT) { + pr_emerg("UCE: esr not match.\n"); + return -EINVAL; + } + + insn = (insn >> 20) & 0xffc; + for (i = 0; i < ARRAY_SIZE(target_insn); i++) { + if (insn == target_insn[i]) { + insn_match = true; + break; + } + } + + if (!insn_match) { + pr_emerg("UCE: insn 0x%x is not match.\n", insn); + return -EINVAL; + } + + for (i = 0; i < UCE_KER_REC_NUM; i++) { + if (!((kernel_access_sea_recovery >> i) & 0x1)) + continue; + + info = &reco_info[i]; + if (info->fn && regs->pc >= info->addr && + regs->pc < (info->addr + info->size)) { + pr_emerg("UCE: total match %s success.\n", info->name); + return i; + } + } + + pr_emerg("UCE: symbol is not match or switch if off, kernel recovery %d.\n", + kernel_access_sea_recovery); + return -EINVAL; +} +#endif + static int do_sea(unsigned long addr, unsigned int esr, struct pt_regs *regs) { const struct fault_info *inf; @@ -649,6 +770,39 @@ static int do_sea(unsigned long addr, unsigned int esr, struct pt_regs *regs) return 0; } +#ifdef CONFIG_UCE_KERNEL_RECOVERY + if (!user_mode(regs)) { + int idx; + + if (!current->mm || !kernel_access_sea_recovery) { + pr_emerg("UCE: kernel recovery %d, %s-%d is %s-thread.\n", + kernel_access_sea_recovery, + current->comm, current->pid, + (current->mm) ? "user" : "kernel"); + die("Uncorrected hardware memory error in kernel-access\n", + regs, esr); + } + + idx = is_in_kernel_recovery(esr, regs); + if (idx >= 0 && idx < UCE_KER_REC_NUM) { + current->thread.fault_address = 0; + current->thread.fault_code = esr; + regs->pc = (unsigned long)reco_info[idx].fn; + + if (esr & ESR_ELx_FnV) + siaddr = NULL; + else + siaddr = (void __user *)addr; + + arm64_force_sig_fault(inf->sig, inf->code, siaddr, + "Uncorrected hardware memory use with kernel recovery in kernel-access\n"); + } else { + die("Uncorrected hardware memory error (not match idx or sence switch is off) in kernel-access\n", + regs, esr); + } + } +#endif + if (esr & ESR_ELx_FnV) siaddr = NULL; else diff --git a/include/linux/kernel.h b/include/linux/kernel.h index 78a0907f0b04..b634fb1cce38 100644 --- a/include/linux/kernel.h +++ b/include/linux/kernel.h @@ -558,6 +558,10 @@ extern int sysctl_panic_on_stackoverflow; extern bool crash_kexec_post_notifiers; +#ifdef CONFIG_UCE_KERNEL_RECOVERY +extern int kernel_access_sea_recovery; +#endif + /* * panic_cpu is used for synchronizing panic() and crash_kexec() execution. It * holds a CPU number which is executing panic() currently. A value of diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 89ef0c1a1642..e38fff657683 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -2711,6 +2711,17 @@ static struct ctl_table kern_table[] = { .extra1 = &one_hundred, .extra2 = &one_thousand, }, +#endif +#if defined(CONFIG_UCE_KERNEL_RECOVERY) + { + .procname = "uce_kernel_recovery", + .data = &kernel_access_sea_recovery, + .maxlen = sizeof(kernel_access_sea_recovery), + .mode = 0644, + .proc_handler = proc_dointvec_minmax, + .extra1 = &four, + .extra2 = &four, + }, #endif { } }; -- 2.18.0.huawei.25

1 0

[PATCH openEuler-1.0-LTS 1/2] yam: fix a memory leak in yam_siocdevprivate()
by Yang Yingliang 22 Feb '22

22 Feb '22

From: Hangyu Hua <hbh25y(a)gmail.com> mainline inclusion from mainline-v5.17 commit 29eb31542787e1019208a2e1047bb7c76c069536 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4U4NY CVE: CVE-2022-24959 ----------------------------------------------- ym needs to be free when ym->cmd != SIOCYAMSMCS. Fixes: 0781168e23a2 ("yam: fix a missing-check bug") Signed-off-by: Hangyu Hua <hbh25y(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> conflict: The bug is in function yam_siocdevprivate() in mainline, but it is in function yam_ioctl() because the function name is changed in 25ec92fbdd("hamradio: use ndo_siocdevprivate") in mainline. Signed-off-by: Lu Wei <luwei32(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/net/hamradio/yam.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/net/hamradio/yam.c b/drivers/net/hamradio/yam.c index ba9df430fca6e..f124ceab5f5e1 100644 --- a/drivers/net/hamradio/yam.c +++ b/drivers/net/hamradio/yam.c @@ -966,9 +966,7 @@ static int yam_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) sizeof(struct yamdrv_ioctl_mcs)); if (IS_ERR(ym)) return PTR_ERR(ym); - if (ym->cmd != SIOCYAMSMCS) - return -EINVAL; - if (ym->bitrate > YAM_MAXBITRATE) { + if (ym->cmd != SIOCYAMSMCS || ym->bitrate > YAM_MAXBITRATE) { kfree(ym); return -EINVAL; } -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS] yam: fix a memory leak in yam_siocdevprivate()
by Yang Yingliang 21 Feb '22

21 Feb '22

From: Hangyu Hua <hbh25y(a)gmail.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4U4NY CVE: CVE-2022-24959 ------------------------------------------------- ym needs to be free when ym->cmd != SIOCYAMSMCS. Fixes: 0781168e23a2 ("yam: fix a missing-check bug") Signed-off-by: Hangyu Hua <hbh25y(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> conflict: The bug is in function yam_siocdevprivate() in mainline, but it is in function yam_ioctl() because the function name is changed in 25ec92fbdd("hamradio: use ndo_siocdevprivate") in mainline. Signed-off-by: Lu Wei <luwei32(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/net/hamradio/yam.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/net/hamradio/yam.c b/drivers/net/hamradio/yam.c index ba9df430fca6e..f124ceab5f5e1 100644 --- a/drivers/net/hamradio/yam.c +++ b/drivers/net/hamradio/yam.c @@ -966,9 +966,7 @@ static int yam_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) sizeof(struct yamdrv_ioctl_mcs)); if (IS_ERR(ym)) return PTR_ERR(ym); - if (ym->cmd != SIOCYAMSMCS) - return -EINVAL; - if (ym->bitrate > YAM_MAXBITRATE) { + if (ym->cmd != SIOCYAMSMCS || ym->bitrate > YAM_MAXBITRATE) { kfree(ym); return -EINVAL; } -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] ipmi_si: Phytium S2500 missing timeout counter reset in intf_mem_inw
by Yang Yingliang 21 Feb '22

21 Feb '22

From: Laibin Qiu <qiulaibin(a)huawei.com> phytium inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4RK58 CVE: NA -------------------------------- The system would hang up when the Phytium S2500 communicates with some BMCs after several rounds of transactions, unless we reset the controller timeout counter manually by calling firmware through SMC. The reset in intf_mem_inw was missed previously. Fixes: 88f04d8bd2d27 ("ipmi_si: Phytium S2500 workaround for MMIO-based IPMI") Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> Reviewed-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/char/ipmi/ipmi_si_mem_io.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/char/ipmi/ipmi_si_mem_io.c b/drivers/char/ipmi/ipmi_si_mem_io.c index 9403e35a19934..bb4ed90a11535 100644 --- a/drivers/char/ipmi/ipmi_si_mem_io.c +++ b/drivers/char/ipmi/ipmi_si_mem_io.c @@ -84,6 +84,8 @@ static void intf_mem_outb(const struct si_sm_io *io, unsigned int offset, static unsigned char intf_mem_inw(const struct si_sm_io *io, unsigned int offset) { + ipmi_phytium_workaround(); + return (readw((io->addr)+(offset * io->regspacing)) >> io->regshift) & 0xff; } -- 2.25.1

1 0

[PATCH OLK-5.10 V2 00/44] intel-icelake: 22.03 support SGX
by Laibin Qiu 21 Feb '22

21 Feb '22

bugzilla: https://gitee.com/openeuler/kernel/issues/I4SIGI Borislav Petkov (1): x86/sgx: Fix sgx_ioc_enclave_provision() kernel-doc Daniel Vetter (1): x86/sgx: Drop racy follow_pfn() check Dave Hansen (3): x86/sgx: Clarify 'laundry_list' locking selftests/sgx: Improve error detection and messages selftests/sgx: remove checks for file execute permissions Ira Weiny (1): x86/sgx: Remove unnecessary kmap() from sgx_ioc_enclave_init() Jarkko Sakkinen (25): x86/sgx: Add SGX architectural data structures x86/sgx: Add wrappers for ENCLS functions x86/cpu/intel: Add a nosgx kernel parameter x86/sgx: Add SGX page allocator functions x86/sgx: Add an SGX misc driver interface x86/sgx: Add SGX_IOC_ENCLAVE_CREATE x86/sgx: Add SGX_IOC_ENCLAVE_ADD_PAGES x86/sgx: Add SGX_IOC_ENCLAVE_INIT x86/sgx: Add SGX_IOC_ENCLAVE_PROVISION selftests/x86: Add a selftest for SGX x86/sgx: Add a page reclaimer x86/sgx: Add ptrace() support for the SGX driver Documentation/x86: Document SGX kernel architecture x86/sgx: Update MAINTAINERS x86/sgx: Return -ERESTARTSYS in sgx_ioc_enclave_add_pages() x86/sgx: Return -EINVAL on a zero length buffer in sgx_ioc_enclave_add_pages() x86/sgx: Maintain encl->refcount for each encl->mm_list entry x86/sgx: Replace section->init_laundry_list with sgx_dirty_page_list x86/sgx: Add a basic NUMA allocation scheme to sgx_alloc_epc_page() selftests/sgx: Use a statically generated 3072-bit RSA key selftests/sgx: Rename 'eenter' and 'sgx_call_vdso' selftests/sgx: Migrate to kselftest harness selftests/sgx: Dump enclave memory map selftests/sgx: Add EXPECT_EEXIT() macro selftests/sgx: Refine the test enclave to have storage Sami Tolvanen (1): x86/sgx: Fix the return type of sgx_init() Sean Christopherson (9): x86/cpufeatures: Add Intel SGX hardware bits x86/{cpufeatures,msr}: Add Intel SGX Launch Control hardware bits x86/sgx: Initialize metadata for Enclave Page Cache (EPC) sections x86/cpu/intel: Detect SGX support mm: Add 'mprotect' hook to struct vm_operations_struct x86/vdso: Add support for exception fixup in vDSO functions x86/fault: Add a helper function to sanitize error code x86/vdso: Implement a vDSO for Intel SGX enclave call x86/sgx: Expose SGX architectural definitions to the kernel Tianjia Zhang (2): selftests/sgx: Use getauxval() to simplify test code selftests/sgx: Fix Q1 and Q2 calculation in sigstruct.c root (1): x86/traps: Attempt to fixup exceptions in vDSO before signaling .../admin-guide/kernel-parameters.txt | 2 + .../userspace-api/ioctl/ioctl-number.rst | 1 + Documentation/x86/index.rst | 1 + Documentation/x86/sgx.rst | 211 +++++ MAINTAINERS | 14 + arch/x86/Kconfig | 18 + arch/x86/entry/vdso/Makefile | 8 +- arch/x86/entry/vdso/extable.c | 46 ++ arch/x86/entry/vdso/extable.h | 28 + arch/x86/entry/vdso/vdso-layout.lds.S | 9 +- arch/x86/entry/vdso/vdso.lds.S | 1 + arch/x86/entry/vdso/vdso2c.h | 50 +- arch/x86/entry/vdso/vsgx.S | 151 ++++ arch/x86/include/asm/cpufeatures.h | 2 + arch/x86/include/asm/disabled-features.h | 8 +- arch/x86/include/asm/enclu.h | 9 + arch/x86/include/asm/msr-index.h | 8 + arch/x86/include/asm/sgx.h | 348 ++++++++ arch/x86/include/asm/vdso.h | 5 + arch/x86/include/uapi/asm/sgx.h | 168 ++++ arch/x86/kernel/cpu/Makefile | 1 + arch/x86/kernel/cpu/feat_ctl.c | 38 +- arch/x86/kernel/cpu/sgx/Makefile | 5 + arch/x86/kernel/cpu/sgx/driver.c | 197 +++++ arch/x86/kernel/cpu/sgx/driver.h | 29 + arch/x86/kernel/cpu/sgx/encl.c | 737 +++++++++++++++++ arch/x86/kernel/cpu/sgx/encl.h | 119 +++ arch/x86/kernel/cpu/sgx/encls.h | 231 ++++++ arch/x86/kernel/cpu/sgx/ioctl.c | 718 ++++++++++++++++ arch/x86/kernel/cpu/sgx/main.c | 768 ++++++++++++++++++ arch/x86/kernel/cpu/sgx/sgx.h | 83 ++ arch/x86/kernel/traps.c | 10 + arch/x86/mm/fault.c | 32 +- include/linux/mm.h | 7 + mm/mprotect.c | 7 + tools/testing/selftests/Makefile | 1 + tools/testing/selftests/sgx/.gitignore | 2 + tools/testing/selftests/sgx/Makefile | 57 ++ tools/testing/selftests/sgx/call.S | 44 + tools/testing/selftests/sgx/defines.h | 31 + tools/testing/selftests/sgx/load.c | 305 +++++++ tools/testing/selftests/sgx/main.c | 293 +++++++ tools/testing/selftests/sgx/main.h | 41 + tools/testing/selftests/sgx/sign_key.S | 12 + tools/testing/selftests/sgx/sign_key.pem | 39 + tools/testing/selftests/sgx/sigstruct.c | 382 +++++++++ tools/testing/selftests/sgx/test_encl.c | 35 + tools/testing/selftests/sgx/test_encl.lds | 41 + .../selftests/sgx/test_encl_bootstrap.S | 89 ++ 49 files changed, 5423 insertions(+), 19 deletions(-) create mode 100644 Documentation/x86/sgx.rst create mode 100644 arch/x86/entry/vdso/extable.c create mode 100644 arch/x86/entry/vdso/extable.h create mode 100644 arch/x86/entry/vdso/vsgx.S create mode 100644 arch/x86/include/asm/enclu.h create mode 100644 arch/x86/include/asm/sgx.h create mode 100644 arch/x86/include/uapi/asm/sgx.h create mode 100644 arch/x86/kernel/cpu/sgx/Makefile create mode 100644 arch/x86/kernel/cpu/sgx/driver.c create mode 100644 arch/x86/kernel/cpu/sgx/driver.h create mode 100644 arch/x86/kernel/cpu/sgx/encl.c create mode 100644 arch/x86/kernel/cpu/sgx/encl.h create mode 100644 arch/x86/kernel/cpu/sgx/encls.h create mode 100644 arch/x86/kernel/cpu/sgx/ioctl.c create mode 100644 arch/x86/kernel/cpu/sgx/main.c create mode 100644 arch/x86/kernel/cpu/sgx/sgx.h create mode 100644 tools/testing/selftests/sgx/.gitignore create mode 100644 tools/testing/selftests/sgx/Makefile create mode 100644 tools/testing/selftests/sgx/call.S create mode 100644 tools/testing/selftests/sgx/defines.h create mode 100644 tools/testing/selftests/sgx/load.c create mode 100644 tools/testing/selftests/sgx/main.c create mode 100644 tools/testing/selftests/sgx/main.h create mode 100644 tools/testing/selftests/sgx/sign_key.S create mode 100644 tools/testing/selftests/sgx/sign_key.pem create mode 100644 tools/testing/selftests/sgx/sigstruct.c create mode 100644 tools/testing/selftests/sgx/test_encl.c create mode 100644 tools/testing/selftests/sgx/test_encl.lds create mode 100644 tools/testing/selftests/sgx/test_encl_bootstrap.S -- 2.22.0

3 64

[PATCH RESEND OLK-5.10 0/3] Add support for kunpeng920 Ultrasoc System Memory Buffer driver
by Qi Liu 21 Feb '22

21 Feb '22

Add support for kunpeng920 Ultrasoc System Memory Buffer driver Qi Liu (3): coresight: etm4x: Modify core-commit to avoid HiSilicon ETM overflow drivers/coresight: Add Ultrasoc System Memory Buffer driver arm64: openeuler_defconfig: Enable config for ultrasoc driver arch/arm64/configs/openeuler_defconfig | 7 +- drivers/hwtracing/coresight/Kconfig | 20 + drivers/hwtracing/coresight/Makefile | 1 + .../coresight/coresight-etm4x-core.c | 98 +++ drivers/hwtracing/coresight/coresight-etm4x.h | 8 + drivers/hwtracing/coresight/ultrasoc-smb.c | 602 ++++++++++++++++++ drivers/hwtracing/coresight/ultrasoc-smb.h | 100 +++ 7 files changed, 835 insertions(+), 1 deletion(-) create mode 100644 drivers/hwtracing/coresight/ultrasoc-smb.c create mode 100644 drivers/hwtracing/coresight/ultrasoc-smb.h -- 2.33.0

2 4

[PATCH openEuler-1.0-LTS] mm,hwpoison: Fix use-after-free in memory_failure()
by Yang Yingliang 21 Feb '22

21 Feb '22

From: Ma Wupeng <mawupeng1(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4LE22 CVE: NA -------------------------------- BUG: KASAN: use-after-free in __mutex_lock.isra.1+0x77c/0x860 Read of size 4 at addr ffff8000d8382040 by task syz-executor658/454 CPU: 3 PID: 454 Comm: syz-executor658 Not tainted 4.19.90+ #8 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x0/0x3f0 show_stack+0x28/0x38 dump_stack+0x170/0x1dc print_address_description+0x68/0x2c8 kasan_report+0x130/0x2e8 __asan_report_load4_noabort+0x30/0x40 __mutex_lock.isra.1+0x77c/0x860 __mutex_lock_slowpath+0x24/0x30 mutex_lock+0x4c/0x58 memory_failure+0x1a8/0xf00 do_madvise+0x8bc/0x12b0 __arm64_sys_madvise+0x74/0x218 el0_svc_common+0x134/0x570 el0_svc_handler+0x190/0x260 el0_svc+0x10/0x218 Allocated by task 423: kasan_kmalloc+0xdc/0x190 kasan_slab_alloc+0x14/0x20 kmem_cache_alloc_node+0xec/0x2a0 copy_process.isra.7.part.8+0x117c/0x58f0 _do_fork+0x188/0x8f0 __arm64_sys_clone+0xb0/0x108 el0_svc_common+0x134/0x570 el0_svc_handler+0x190/0x260 el0_svc+0x10/0x218 Freed by task 19: __kasan_slab_free+0x120/0x228 kasan_slab_free+0x10/0x18 kmem_cache_free+0x1b8/0x270 free_task+0xb8/0xe0 __put_task_struct+0x248/0x318 delayed_put_task_struct+0x58/0x210 rcu_nocb_kthread+0x2b0/0x508 kthread+0x2c8/0x348 ret_from_fork+0x10/0x18 After commit 02d80b17ba49 ("mm/memory-failure: use a mutex to avoid memory_failure() races"), all the error paths in memory_failure() need unlock mf_mutx, or the above use-after-free occurred, fix the missing one if try_to_split_thp_page() fails. Fixes: a668355ac487 ("mm,hwpoison: unify THP handling for hard and soft offline") Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- mm/memory-failure.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index cd3394dd70e16..578859c94866f 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -1408,7 +1408,8 @@ int memory_failure(unsigned long pfn, int flags) if (PageTransHuge(hpage)) { if (try_to_split_thp_page(p, "Memory Failure") < 0) { action_result(pfn, MF_MSG_UNSPLIT_THP, MF_IGNORED); - return -EBUSY; + res = -EBUSY; + goto unlock_mutex; } VM_BUG_ON_PAGE(!page_count(p), p); } -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] dm-mpath: fix UAF in multipath_message()
by Yang Yingliang 21 Feb '22

21 Feb '22

From: Luo Meng <luomeng12(a)huawei.com> hulk inclusion category: bugfix bugzilla: 186184 CVE: NA -------------------------------- If dm_get_device() create dd in multipath_message(), and then call table_deps() after dm_put_table_device(), it will lead to concurrency UAF bugs. One of the concurrency UAF can be shown as below: (USE) | (FREE) | target_message | multipath_message | dm_put_device | dm_put_table_device # | kfree(td) # table_device *td ioctl # DM_TABLE_DEPS_CMD | ... table_deps | ... dm_get_live_or_inactive_table | ... retrieve_dep | ... list_for_each_entry | ... deps->dev[count++] = | ... huge_encode_dev | ... (dd->dm_dev->bdev->bd_dev) | list_del(&dd->list) | kfree(dd) # dm_dev_internal The root cause of UAF bugs is that find_device() failed in dm_get_device() and will create dd and refcount set 1, kfree() in dm_put_table() is not protected. When td, which there are still pointers point to, is released, the concurrency UAF bug will happen. This patch add a flag to determine whether to create a new dd. Signed-off-by: Luo Meng <luomeng12(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/md/dm-mpath.c | 2 +- drivers/md/dm-table.c | 43 +++++++++++++++++++++-------------- include/linux/device-mapper.h | 2 ++ 3 files changed, 29 insertions(+), 18 deletions(-) diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c index bced42f082b02..e0bfa16aab379 100644 --- a/drivers/md/dm-mpath.c +++ b/drivers/md/dm-mpath.c @@ -1962,7 +1962,7 @@ static int multipath_message(struct dm_target *ti, unsigned argc, char **argv, goto out; } - r = dm_get_device(ti, argv[1], dm_table_get_mode(ti->table), &dev); + r = __dm_get_device(ti, argv[1], dm_table_get_mode(ti->table), &dev, false); if (r) { DMWARN("message: error getting device %s", argv[1]); diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c index 5c590895c14c3..f01c639f83875 100644 --- a/drivers/md/dm-table.c +++ b/drivers/md/dm-table.c @@ -361,12 +361,8 @@ dev_t dm_get_dev_t(const char *path) } EXPORT_SYMBOL_GPL(dm_get_dev_t); -/* - * Add a device to the list, or just increment the usage count if - * it's already present. - */ -int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode, - struct dm_dev **result) +int __dm_get_device(struct dm_target *ti, const char *path, fmode_t mode, + struct dm_dev **result, bool create_dd) { int r; dev_t dev; @@ -390,19 +386,21 @@ int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode, dd = find_device(&t->devices, dev); if (!dd) { - dd = kmalloc(sizeof(*dd), GFP_KERNEL); - if (!dd) - return -ENOMEM; - - if ((r = dm_get_table_device(t->md, dev, mode, &dd->dm_dev))) { - kfree(dd); - return r; - } + if (create_dd) { + dd = kmalloc(sizeof(*dd), GFP_KERNEL); + if (!dd) + return -ENOMEM; - refcount_set(&dd->count, 1); - list_add(&dd->list, &t->devices); - goto out; + if ((r = dm_get_table_device(t->md, dev, mode, &dd->dm_dev))) { + kfree(dd); + return r; + } + refcount_set(&dd->count, 1); + list_add(&dd->list, &t->devices); + goto out; + } else + return -ENODEV; } else if (dd->dm_dev->mode != (mode | dd->dm_dev->mode)) { r = upgrade_mode(dd, mode, t->md); if (r) @@ -413,6 +411,17 @@ int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode, *result = dd->dm_dev; return 0; } +EXPORT_SYMBOL(__dm_get_device); + +/* + * Add a device to the list, or just increment the usage count if + * it's already present. + */ +int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode, + struct dm_dev **result) +{ + return __dm_get_device(ti, path, mode, result, true); +} EXPORT_SYMBOL(dm_get_device); static int dm_set_device_limits(struct dm_target *ti, struct dm_dev *dev, diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h index 50cc070cb1f7c..47db4a14c9258 100644 --- a/include/linux/device-mapper.h +++ b/include/linux/device-mapper.h @@ -162,6 +162,8 @@ dev_t dm_get_dev_t(const char *path); int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode, struct dm_dev **result); void dm_put_device(struct dm_target *ti, struct dm_dev *d); +int __dm_get_device(struct dm_target *ti, const char *path, fmode_t mode, + struct dm_dev **result, bool create_dd); /* * Information about a target type -- 2.25.1

1 0

Re: [PATCH OLK-5.10 1/3] coresight: etm4x: Modify core-commit to avoid HiSilicon ETM overflow
by Xie XiuQi 19 Feb '22

19 Feb '22

你需要订阅 kernel(a)openeuler.org 邮件列表，不然别人都收不到你这个邮件。 On 2022/2/19 15:19, Qi Liu wrote: > > driver inclusion > ategory: feature > bugzilla: https://gitee.com/openeuler/kernel/issues/I4UA33 你这个不断的来源是哪里的，如果是上游社区的，不断作者应该是原作者。并标明补丁的上游 commit。如果还没进入上游版本，也需要给出上游讨论的链接。 > > ----------------------------------------- > > The ETM device can't keep up with the core pipeline when cpu core > is at full speed. This may cause overflow within core and its ETM. > This is a common phenomenon on ETM devices. > > On HiSilicon Hip08 platform, a specific feature is added to set > core pipeline. So commit rate can be reduced manually to avoid ETM > overflow. > > Reviewed-by: Suzuki K Poulose <suzuki.poulose(a)arm.com> > Signed-off-by: Qi Liu <liuqi115(a)huawei.com> > [Modified changelog title and Kconfig description] > Signed-off-by: Mathieu Poirier <mathieu.poirier(a)linaro.org> > Link: https://lore.kernel.org/r/20201208182651.1597945-4-mathieu.poirier@linaro.o… > Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> 看这个补丁签名，社区应该是要讨论的。你如果要推送到 openEuler 社区，需要有你自己的签名。表明你对这个补丁负责。 > --- > drivers/hwtracing/coresight/Kconfig | 8 ++ > .../coresight/coresight-etm4x-core.c | 98 +++++++++++++++++++ > drivers/hwtracing/coresight/coresight-etm4x.h | 8 ++ > 3 files changed, 114 insertions(+) > > diff --git a/drivers/hwtracing/coresight/Kconfig b/drivers/hwtracing/coresight/Kconfig > index c1198245461d..7b44ba22cbe1 100644 > --- a/drivers/hwtracing/coresight/Kconfig > +++ b/drivers/hwtracing/coresight/Kconfig > @@ -110,6 +110,14 @@ config CORESIGHT_SOURCE_ETM4X > To compile this driver as a module, choose M here: the > module will be called coresight-etm4x. > > +config ETM4X_IMPDEF_FEATURE > + bool "Control implementation defined overflow support in ETM 4.x driver" > + depends on CORESIGHT_SOURCE_ETM4X > + help > + This control provides implementation define control for CoreSight > + ETM 4.x tracer module that can't reduce commit rate automatically. > + This avoids overflow between the ETM tracer module and the cpu core. > + > config CORESIGHT_STM > tristate "CoreSight System Trace Macrocell driver" > depends on (ARM && !(CPU_32v3 || CPU_32v4 || CPU_32v4T)) || ARM64 > diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c > index 74d3e2fe43d4..02d0b92cf510 100644 > --- a/drivers/hwtracing/coresight/coresight-etm4x-core.c > +++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c > @@ -3,6 +3,7 @@ > * Copyright (c) 2014, The Linux Foundation. All rights reserved. > */ > > +#include <linux/bitops.h> > #include <linux/kernel.h> > #include <linux/moduleparam.h> > #include <linux/init.h> > @@ -28,7 +29,9 @@ > #include <linux/perf_event.h> > #include <linux/pm_runtime.h> > #include <linux/property.h> > + > #include <asm/sections.h> > +#include <asm/sysreg.h> > #include <asm/local.h> > #include <asm/virt.h> > > @@ -103,6 +106,97 @@ struct etm4_enable_arg { > int rc; > }; > > +#ifdef CONFIG_ETM4X_IMPDEF_FEATURE > + > +#define HISI_HIP08_AMBA_ID 0x000b6d01 > +#define ETM4_AMBA_MASK 0xfffff > +#define HISI_HIP08_CORE_COMMIT_MASK 0x3000 > +#define HISI_HIP08_CORE_COMMIT_SHIFT 12 > +#define HISI_HIP08_CORE_COMMIT_FULL 0b00 > +#define HISI_HIP08_CORE_COMMIT_LVL_1 0b01 > +#define HISI_HIP08_CORE_COMMIT_REG sys_reg(3, 1, 15, 2, 5) > + > +struct etm4_arch_features { > + void (*arch_callback)(bool enable); > +}; > + > +static bool etm4_hisi_match_pid(unsigned int id) > +{ > + return (id & ETM4_AMBA_MASK) == HISI_HIP08_AMBA_ID; > +} > + > +static void etm4_hisi_config_core_commit(bool enable) > +{ > + u8 commit = enable ? HISI_HIP08_CORE_COMMIT_LVL_1 : > + HISI_HIP08_CORE_COMMIT_FULL; > + u64 val; > + > + /* > + * bit 12 and 13 of HISI_HIP08_CORE_COMMIT_REG are used together > + * to set core-commit, 2'b00 means cpu is at full speed, 2'b01, > + * 2'b10, 2'b11 mean reduce pipeline speed, and 2'b01 means level-1 > + * speed(minimun value). So bit 12 and 13 should be cleared together. > + */ > + val = read_sysreg_s(HISI_HIP08_CORE_COMMIT_REG); > + val &= ~HISI_HIP08_CORE_COMMIT_MASK; > + val |= commit << HISI_HIP08_CORE_COMMIT_SHIFT; > + write_sysreg_s(val, HISI_HIP08_CORE_COMMIT_REG); > +} > + > +static struct etm4_arch_features etm4_features[] = { > + [ETM4_IMPDEF_HISI_CORE_COMMIT] = { > + .arch_callback = etm4_hisi_config_core_commit, > + }, > + {}, > +}; > + > +static void etm4_enable_arch_specific(struct etmv4_drvdata *drvdata) > +{ > + struct etm4_arch_features *ftr; > + int bit; > + > + for_each_set_bit(bit, drvdata->arch_features, ETM4_IMPDEF_FEATURE_MAX) { > + ftr = &etm4_features[bit]; > + > + if (ftr->arch_callback) > + ftr->arch_callback(true); > + } > +} > + > +static void etm4_disable_arch_specific(struct etmv4_drvdata *drvdata) > +{ > + struct etm4_arch_features *ftr; > + int bit; > + > + for_each_set_bit(bit, drvdata->arch_features, ETM4_IMPDEF_FEATURE_MAX) { > + ftr = &etm4_features[bit]; > + > + if (ftr->arch_callback) > + ftr->arch_callback(false); > + } > +} > + > +static void etm4_check_arch_features(struct etmv4_drvdata *drvdata, > + unsigned int id) > +{ > + if (etm4_hisi_match_pid(id)) > + set_bit(ETM4_IMPDEF_HISI_CORE_COMMIT, drvdata->arch_features); > +} > +#else > +static void etm4_enable_arch_specific(struct etmv4_drvdata *drvdata) > +{ > +} > + > +static void etm4_disable_arch_specific(struct etmv4_drvdata *drvdata) > +{ > +} > + > +static void etm4_check_arch_features(struct etmv4_drvdata *drvdata, > + unsigned int id) > +{ > +} > +#endif /* CONFIG_ETM4X_IMPDEF_FEATURE */ > + > static int etm4_enable_hw(struct etmv4_drvdata *drvdata) > { > int i, rc; > @@ -110,6 +204,7 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata) > struct device *etm_dev = &drvdata->csdev->dev; > > CS_UNLOCK(drvdata->base); > + etm4_enable_arch_specific(drvdata); > > etm4_os_unlock(drvdata); > > @@ -480,6 +575,7 @@ static void etm4_disable_hw(void *info) > int i; > > CS_UNLOCK(drvdata->base); > + etm4_disable_arch_specific(drvdata); > > if (!drvdata->skip_power_up) { > /* power can be removed from the trace unit now */ > @@ -1563,6 +1659,8 @@ static int etm4_probe(struct amba_device *adev, const struct amba_id *id) > drvdata->boot_enable = true; > } > > + etm4_check_arch_features(drvdata, id->id); > + > return 0; > } > > diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h > index eefc7371c6c4..3dd3e0633328 100644 > --- a/drivers/hwtracing/coresight/coresight-etm4x.h > +++ b/drivers/hwtracing/coresight/coresight-etm4x.h > @@ -8,6 +8,7 @@ > > #include <asm/local.h> > #include <linux/spinlock.h> > +#include <linux/types.h> > #include "coresight-priv.h" > > /* > @@ -203,6 +204,11 @@ > /* Interpretation of resource numbers change at ETM v4.3 architecture */ > #define ETM4X_ARCH_4V3 0x43 > > +enum etm_impdef_type { > + ETM4_IMPDEF_HISI_CORE_COMMIT, > + ETM4_IMPDEF_FEATURE_MAX, > +}; > + > /** > * struct etmv4_config - configuration information related to an ETMv4 > * @mode: Controls various modes supported by this ETM. > @@ -415,6 +421,7 @@ struct etmv4_save_state { > * @state_needs_restore: True when there is context to restore after PM exit > * @skip_power_up: Indicates if an implementation can skip powering up > * the trace unit. > + * @arch_features: Bitmap of arch features of etmv4 devices. > */ > struct etmv4_drvdata { > void __iomem *base; > @@ -463,6 +470,7 @@ struct etmv4_drvdata { > struct etmv4_save_state *save_state; > bool state_needs_restore; > bool skip_power_up; > + DECLARE_BITMAP(arch_features, ETM4_IMPDEF_FEATURE_MAX); > }; > > /* Address comparator access types */ >

1 0

[PATCH OLK-5.10] scsi: spfc: Remove redundant mask and spinlock
by Yanling Song 18 Feb '22

18 Feb '22

Ramaxel inclusion from OLK-5.10 commit dff67aa564e7 ("scsi: spfc: initial commit the spfc module") category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4UA67 CVE: NA Fix: 1.Remove UNF_ORIGIN_HOTTAG_MASK and UNF_HOTTAG_FLAG 2.Update some output string 3.Remove spinlock protect in free_parent_sq() because there is spinlock protect in caller function free_parent_queue_info() Signed-off-by: Yanling Song <songyl(a)ramaxel.com> Reviewed-by: Yun Xu <xuyun(a)ramaxel.com> --- drivers/scsi/spfc/common/unf_common.h | 2 -- drivers/scsi/spfc/common/unf_io.c | 3 +-- drivers/scsi/spfc/common/unf_io_abnormal.c | 2 +- drivers/scsi/spfc/common/unf_rport.c | 2 +- drivers/scsi/spfc/common/unf_service.c | 19 +++++-------------- drivers/scsi/spfc/hw/spfc_hba.c | 2 +- drivers/scsi/spfc/hw/spfc_io.c | 2 +- drivers/scsi/spfc/hw/spfc_queue.c | 5 ----- drivers/scsi/spfc/hw/spfc_service.c | 22 ++++++++++++---------- 9 files changed, 22 insertions(+), 37 deletions(-) diff --git a/drivers/scsi/spfc/common/unf_common.h b/drivers/scsi/spfc/common/unf_common.h index bf9d156e07ce..9613649308bf 100644 --- a/drivers/scsi/spfc/common/unf_common.h +++ b/drivers/scsi/spfc/common/unf_common.h @@ -12,8 +12,6 @@ #define SPFC_DRV_DESC "Ramaxel Memory Technology Fibre Channel Driver" #define UNF_MAX_SECTORS 0xffff -#define UNF_ORIGIN_HOTTAG_MASK 0x7fff -#define UNF_HOTTAG_FLAG (1 << 15) #define UNF_PKG_FREE_OXID 0x0 #define UNF_PKG_FREE_RXID 0x1 diff --git a/drivers/scsi/spfc/common/unf_io.c b/drivers/scsi/spfc/common/unf_io.c index b1255ecba88c..5de69f8ddc6d 100644 --- a/drivers/scsi/spfc/common/unf_io.c +++ b/drivers/scsi/spfc/common/unf_io.c @@ -890,8 +890,7 @@ static int unf_send_fcpcmnd(struct unf_lport *lport, struct unf_rport *rport, unf_xchg->private_data[PKG_PRIVATE_XCHG_ALLOC_TIME]; pkg.private_data[PKG_PRIVATE_XCHG_VP_INDEX] = unf_lport->vp_index; pkg.private_data[PKG_PRIVATE_XCHG_RPORT_INDEX] = unf_rport->rport_index; - pkg.private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = - unf_xchg->hotpooltag | UNF_HOTTAG_FLAG; + pkg.private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = unf_xchg->hotpooltag; unf_select_sq(unf_xchg, &pkg); pkg.fcp_cmnd = &unf_xchg->fcp_cmnd; diff --git a/drivers/scsi/spfc/common/unf_io_abnormal.c b/drivers/scsi/spfc/common/unf_io_abnormal.c index fece7aa5f441..4e268ac026ca 100644 --- a/drivers/scsi/spfc/common/unf_io_abnormal.c +++ b/drivers/scsi/spfc/common/unf_io_abnormal.c @@ -763,7 +763,7 @@ int unf_send_scsi_mgmt_cmnd(struct unf_xchg *xchg, struct unf_lport *lport, pkg.xchg_contex = unf_xchg; pkg.private_data[PKG_PRIVATE_XCHG_RPORT_INDEX] = rport->rport_index; pkg.fcp_cmnd = &unf_xchg->fcp_cmnd; - pkg.private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = unf_xchg->hotpooltag | UNF_HOTTAG_FLAG; + pkg.private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = unf_xchg->hotpooltag; pkg.frame_head.csctl_sid = lport->nport_id; pkg.frame_head.rctl_did = rport->nport_id; diff --git a/drivers/scsi/spfc/common/unf_rport.c b/drivers/scsi/spfc/common/unf_rport.c index aa4967fc0ab6..9b06df884524 100644 --- a/drivers/scsi/spfc/common/unf_rport.c +++ b/drivers/scsi/spfc/common/unf_rport.c @@ -352,7 +352,7 @@ struct unf_rport *unf_find_valid_rport(struct unf_lport *lport, u64 wwpn, u32 si spin_unlock_irqrestore(rport_state_lock, flags); FC_DRV_PRINT(UNF_LOG_LOGIN_ATT, UNF_INFO, - "[err]Port(0x%x) RPort(0x%p) find by WWPN(0x%llx) is invalid", + "[info]Port(0x%x) RPort(0x%p) find by WWPN(0x%llx) is invalid", lport->port_id, rport_by_wwpn, wwpn); rport_by_wwpn = NULL; diff --git a/drivers/scsi/spfc/common/unf_service.c b/drivers/scsi/spfc/common/unf_service.c index 8f72f6470647..9c86c99374c8 100644 --- a/drivers/scsi/spfc/common/unf_service.c +++ b/drivers/scsi/spfc/common/unf_service.c @@ -130,7 +130,7 @@ void unf_fill_package(struct unf_frame_pkg *pkg, struct unf_xchg *xchg, pkg->private_data[PKG_PRIVATE_RPORT_RX_SIZE] = rport->max_frame_size; } - pkg->private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = xchg->hotpooltag | UNF_HOTTAG_FLAG; + pkg->private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = xchg->hotpooltag; pkg->private_data[PKG_PRIVATE_XCHG_ALLOC_TIME] = xchg->private_data[PKG_PRIVATE_XCHG_ALLOC_TIME]; pkg->private_data[PKG_PRIVATE_LOWLEVEL_XCHG_ADD] = @@ -250,7 +250,7 @@ u32 unf_send_abts(struct unf_lport *lport, struct unf_xchg *xchg) pkg.unf_cmnd_pload_bl.buffer_ptr = (u8 *)xchg->fcp_sfs_union.sfs_entry.fc_sfs_entry_ptr; pkg.unf_cmnd_pload_bl.buf_dma_addr = xchg->fcp_sfs_union.sfs_entry.sfs_buff_phy_addr; - pkg.private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = xchg->hotpooltag | UNF_HOTTAG_FLAG; + pkg.private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = xchg->hotpooltag; UNF_SET_XCHG_ALLOC_TIME(&pkg, xchg); UNF_SET_ABORT_INFO_IOTYPE(&pkg, xchg); @@ -407,19 +407,10 @@ static u32 unf_els_cmnd_default_handler(struct unf_lport *lport, struct unf_xchg rjt_info.reason_code = UNF_LS_RJT_NOT_SUPPORTED; unf_rport = unf_get_rport_by_nport_id(lport, sid); - if (unf_rport) { - if (unf_rport->rport_index != - xchg->private_data[PKG_PRIVATE_XCHG_RPORT_INDEX]) { - FC_DRV_PRINT(UNF_LOG_LOGIN_ATT, UNF_WARN, - "[warn]Port(0x%x_0x%x) NPort handle(0x%x) from low level is not equal to RPort index(0x%x)", - lport->port_id, lport->nport_id, - xchg->private_data[PKG_PRIVATE_XCHG_RPORT_INDEX], - unf_rport->rport_index); - } + if (unf_rport) ret = unf_send_els_rjt_by_rport(lport, xchg, unf_rport, &rjt_info); - } else { + else ret = unf_send_els_rjt_by_did(lport, xchg, sid, &rjt_info); - } return ret; } @@ -1389,7 +1380,7 @@ static void unf_fill_free_xid_pkg(struct unf_xchg *xchg, struct unf_frame_pkg *p pkg->frame_head.csctl_sid = xchg->sid; pkg->frame_head.rctl_did = xchg->did; pkg->frame_head.oxid_rxid = (u32)(((u32)xchg->oxid << UNF_SHIFT_16) | xchg->rxid); - pkg->private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = xchg->hotpooltag | UNF_HOTTAG_FLAG; + pkg->private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = xchg->hotpooltag; UNF_SET_XCHG_ALLOC_TIME(pkg, xchg); if (xchg->xchg_type == UNF_XCHG_TYPE_SFS) { diff --git a/drivers/scsi/spfc/hw/spfc_hba.c b/drivers/scsi/spfc/hw/spfc_hba.c index e12299c9e2c9..b033dcb78bb3 100644 --- a/drivers/scsi/spfc/hw/spfc_hba.c +++ b/drivers/scsi/spfc/hw/spfc_hba.c @@ -56,7 +56,7 @@ static struct unf_cfg_item spfc_port_cfg_parm[] = { {"port_topology", 0, 0xf, 0x20}, {"port_alpa", 0, 0xdead, 0xffff}, /* alpa address of port */ /* queue depth of originator registered to SCSI midlayer */ - {"max_queue_depth", 0, 128, 128}, + {"max_queue_depth", 0, 512, 512}, {"sest_num", 0, 2048, 2048}, {"max_login", 0, 2048, 2048}, /* nodename from 32 bit to 64 bit */ diff --git a/drivers/scsi/spfc/hw/spfc_io.c b/drivers/scsi/spfc/hw/spfc_io.c index 2b1d1c607b13..7184eb6a10af 100644 --- a/drivers/scsi/spfc/hw/spfc_io.c +++ b/drivers/scsi/spfc/hw/spfc_io.c @@ -1138,7 +1138,7 @@ u32 spfc_scq_recv_iresp(struct spfc_hba_info *hba, union spfc_scqe *wqe) pkg.private_data[PKG_PRIVATE_XCHG_ALLOC_TIME] = iresp->magic_num; pkg.frame_head.oxid_rxid = (((iresp->wd0.ox_id) << UNF_SHIFT_16) | (iresp->wd0.rx_id)); - hot_tag = (u16)iresp->wd2.hotpooltag & UNF_ORIGIN_HOTTAG_MASK; + hot_tag = (u16)iresp->wd2.hotpooltag; /* 2. HotTag validity check */ if (likely(hot_tag >= hba->exi_base && (hot_tag < hba->exi_base + hba->exi_count))) { pkg.status = UNF_IO_SUCCESS; diff --git a/drivers/scsi/spfc/hw/spfc_queue.c b/drivers/scsi/spfc/hw/spfc_queue.c index abcf1ff3f49f..fa4295832da7 100644 --- a/drivers/scsi/spfc/hw/spfc_queue.c +++ b/drivers/scsi/spfc/hw/spfc_queue.c @@ -2138,11 +2138,9 @@ static void spfc_free_parent_sq(struct spfc_hba_info *hba, u32 uidelaycnt = 0; struct list_head *list = NULL; struct spfc_suspend_sqe_info *suspend_sqe = NULL; - ulong flag = 0; sq_info = &parq_info->parent_sq_info; - spin_lock_irqsave(&parq_info->parent_queue_state_lock, flag); while (!list_empty(&sq_info->suspend_sqe_list)) { list = UNF_OS_LIST_NEXT(&sq_info->suspend_sqe_list); list_del(list); @@ -2156,7 +2154,6 @@ static void spfc_free_parent_sq(struct spfc_hba_info *hba, kfree(suspend_sqe); } } - spin_unlock_irqrestore(&parq_info->parent_queue_state_lock, flag); /* Free data cos */ spfc_update_cos_rport_cnt(hba, parq_info->queue_data_cos); @@ -4475,9 +4472,7 @@ void spfc_free_parent_queue_info(void *handle, struct spfc_parent_queue_info *pa * with the sq in the queue of the parent */ - spin_unlock_irqrestore(prtq_state_lock, flag); spfc_free_parent_sq(hba, parent_queue_info); - spin_lock_irqsave(prtq_state_lock, flag); /* The initialization of all queue id is invalid */ parent_queue_info->parent_cmd_scq_info.cqm_queue_id = INVALID_VALUE32; diff --git a/drivers/scsi/spfc/hw/spfc_service.c b/drivers/scsi/spfc/hw/spfc_service.c index e99802df50a2..1da58e3f9fbe 100644 --- a/drivers/scsi/spfc/hw/spfc_service.c +++ b/drivers/scsi/spfc/hw/spfc_service.c @@ -742,7 +742,7 @@ u32 spfc_scq_recv_abts_rsp(struct spfc_hba_info *hba, union spfc_scqe *scqe) ox_id = (u32)(abts_rsp->wd0.ox_id); - hot_tag = abts_rsp->wd1.hotpooltag & UNF_ORIGIN_HOTTAG_MASK; + hot_tag = abts_rsp->wd1.hotpooltag; if (unlikely(hot_tag < (u32)hba->exi_base || hot_tag >= (u32)(hba->exi_base + hba->exi_count))) { FC_DRV_PRINT(UNF_LOG_LOGIN_ATT, UNF_ERR, @@ -1210,7 +1210,7 @@ u32 spfc_scq_recv_ls_gs_rsp(struct spfc_hba_info *hba, union spfc_scqe *scqe) spfc_swap_16_in_32((u32 *)ls_gs_rsp_scqe->user_id, SPFC_LS_GS_USERID_LEN); ox_id = ls_gs_rsp_scqe->wd1.ox_id; - hot_tag = ((u16)(ls_gs_rsp_scqe->wd5.hotpooltag) & UNF_ORIGIN_HOTTAG_MASK) - hba->exi_base; + hot_tag = ((u16)ls_gs_rsp_scqe->wd5.hotpooltag) - hba->exi_base; pkg.frame_head.oxid_rxid = (u32)(ls_gs_rsp_scqe->wd1.rx_id) | ox_id << UNF_SHIFT_16; pkg.private_data[PKG_PRIVATE_XCHG_ALLOC_TIME] = ls_gs_rsp_scqe->magic_num; pkg.private_data[PKG_PRIVATE_XCHG_HOT_POOL_INDEX] = hot_tag; @@ -1317,8 +1317,7 @@ u32 spfc_scq_recv_els_rsp_sts(struct spfc_hba_info *hba, union spfc_scqe *scqe) pkg.private_data[PKG_PRIVATE_XCHG_ALLOC_TIME] = els_rsp_sts_scqe->magic_num; pkg.frame_head.oxid_rxid = rx_id | (u32)(els_rsp_sts_scqe->wd0.ox_id) << UNF_SHIFT_16; - hot_tag = (u32)((els_rsp_sts_scqe->wd1.hotpooltag & UNF_ORIGIN_HOTTAG_MASK) - - hba->exi_base); + hot_tag = (u32)(els_rsp_sts_scqe->wd1.hotpooltag - hba->exi_base); if (unlikely(SPFC_SCQE_HAS_ERRCODE(scqe))) pkg.status = UNF_IO_FAILED; @@ -1759,7 +1758,7 @@ u32 spfc_scq_recv_marker_sts(struct spfc_hba_info *hba, union spfc_scqe *scqe) tmf_marker_sts_scqe = &scqe->itmf_marker_sts; ox_id = (u32)tmf_marker_sts_scqe->wd1.ox_id; rx_id = (u32)tmf_marker_sts_scqe->wd1.rx_id; - hot_tag = (tmf_marker_sts_scqe->wd4.hotpooltag & UNF_ORIGIN_HOTTAG_MASK) - hba->exi_base; + hot_tag = tmf_marker_sts_scqe->wd4.hotpooltag - hba->exi_base; pkg.frame_head.oxid_rxid = rx_id | (u32)(ox_id) << UNF_SHIFT_16; pkg.private_data[PKG_PRIVATE_XCHG_ALLOC_TIME] = tmf_marker_sts_scqe->magic_num; pkg.frame_head.csctl_sid = tmf_marker_sts_scqe->wd3.sid; @@ -1800,7 +1799,7 @@ u32 spfc_scq_recv_abts_marker_sts(struct spfc_hba_info *hba, union spfc_scqe *sc ox_id = (u32)abts_marker_sts_scqe->wd1.ox_id; rx_id = (u32)abts_marker_sts_scqe->wd1.rx_id; - hot_tag = (abts_marker_sts_scqe->wd4.hotpooltag & UNF_ORIGIN_HOTTAG_MASK) - hba->exi_base; + hot_tag = abts_marker_sts_scqe->wd4.hotpooltag - hba->exi_base; pkg.frame_head.oxid_rxid = rx_id | (u32)(ox_id) << UNF_SHIFT_16; pkg.frame_head.csctl_sid = abts_marker_sts_scqe->wd3.sid; pkg.frame_head.rctl_did = abts_marker_sts_scqe->wd2.did; @@ -1972,8 +1971,7 @@ u32 spfc_scq_free_xid_sts(struct spfc_hba_info *hba, union spfc_scqe *scqe) rx_id = (u32)free_xid_sts_scqe->wd0.rx_id; if (free_xid_sts_scqe->wd1.hotpooltag != INVALID_VALUE16) { - hot_tag = (free_xid_sts_scqe->wd1.hotpooltag & - UNF_ORIGIN_HOTTAG_MASK) - hba->exi_base; + hot_tag = free_xid_sts_scqe->wd1.hotpooltag - hba->exi_base; } FC_DRV_PRINT(UNF_LOG_EQUIP_ATT, UNF_INFO, @@ -1998,7 +1996,7 @@ u32 spfc_scq_exchg_timeout_sts(struct spfc_hba_info *hba, union spfc_scqe *scqe) rx_id = (u32)time_out_scqe->wd0.rx_id; if (time_out_scqe->wd1.hotpooltag != INVALID_VALUE16) - hot_tag = (time_out_scqe->wd1.hotpooltag & UNF_ORIGIN_HOTTAG_MASK) - hba->exi_base; + hot_tag = time_out_scqe->wd1.hotpooltag - hba->exi_base; FC_DRV_PRINT(UNF_LOG_EQUIP_ATT, UNF_INFO, "Port(0x%x) recv timer time out sts hotpooltag(0x%x) magicnum(0x%x) ox_id(0x%x) rxid(0x%x) sts(%d)", @@ -2054,7 +2052,7 @@ u32 spfc_scq_rcv_sq_nop_sts(struct spfc_hba_info *hba, union spfc_scqe *scqe) FC_DRV_PRINT(UNF_LOG_LOGIN_ATT, UNF_INFO, "[info]Port(0x%x) rport_index(0x%x) find suspend sqe.", hba->port_cfg.port_id, rport_index); - if (sqn < sqn_max) { + if ((sqn < sqn_max) && (sqn >= sqn_base)) { ret = spfc_send_nop_cmd(hba, parent_sq_info, magic_num, sqn + 1); } else if (sqn == sqn_max) { if (!cancel_delayed_work(&suspend_sqe->timeout_work)) { @@ -2065,6 +2063,10 @@ u32 spfc_scq_rcv_sq_nop_sts(struct spfc_hba_info *hba, union spfc_scqe *scqe) parent_sq_info->need_offloaded = suspend_sqe->old_offload_sts; ret = spfc_pop_suspend_sqe(hba, prt_qinfo, suspend_sqe); kfree(suspend_sqe); + } else { + FC_DRV_PRINT(UNF_LOG_LOGIN_ATT, UNF_WARN, + "[warn]Port(0x%x) rport(0x%x) rcv error sqn(0x%x)", + hba->port_cfg.port_id, rport_index, sqn); } } else { FC_DRV_PRINT(UNF_LOG_LOGIN_ATT, UNF_WARN, -- 2.32.0

1 0

[PATCH openEuler-1.0-LTS 1/2] usb: gadget: don't release an existing dev->buf
by Yang Yingliang 18 Feb '22

18 Feb '22

From: Hangyu Hua <hbh25y(a)gmail.com> mainline inclusion from mainline-v5.17-rc1 commit 89f3594d0de58e8a57d92d497dea9fee3d4b9cda category: bugfix bugzilla: NA CVE: CVE-2022-24958 -------------------------------- dev->buf does not need to be released if it already exists before executing dev_config. Acked-by: Alan Stern <stern(a)rowland.harvard.edu> Signed-off-by: Hangyu Hua <hbh25y(a)gmail.com> Link: https://lore.kernel.org/r/20211231172138.7993-2-hbh25y@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/usb/gadget/legacy/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c index f91d403da3141..a1488de12d450 100644 --- a/drivers/usb/gadget/legacy/inode.c +++ b/drivers/usb/gadget/legacy/inode.c @@ -1829,8 +1829,9 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) spin_lock_irq (&dev->lock); value = -EINVAL; if (dev->buf) { + spin_unlock_irq(&dev->lock); kfree(kbuf); - goto fail; + return value; } dev->buf = kbuf; -- 2.25.1

1 1

[PATCH OLK-5.10 0/5] net/spnic: fix bugs:Remove unused functions about ceq
by Yanling Song 18 Feb '22

18 Feb '22

Fix 5 bugs: 1. Fix array bounds error in ethtool get_link_ksettings 2. Fix ethtool loopback command failure 3. Fix xor checksum error when sending a non 4B-aligned message to firmware 4. Fix an error when netdev failed to link up 5. Reduce the timeout of the channel between driver and firmware Yanling Song (5): net/spnic: Fix array bounds error in ethtool get_link_ksettings net/spnic: Fix ethtool loopback command failure net/spnic: Fix xor checksum error when sending a non 4B-aligned message to firmware net/spnic: Fix an error when netdev failed to link up net/spnic: Reduce the timeout of the channel between driver and firmware .../net/ethernet/ramaxel/spnic/hw/sphw_cmdq.c | 2 +- .../net/ethernet/ramaxel/spnic/hw/sphw_mbox.c | 10 ++-- .../net/ethernet/ramaxel/spnic/hw/sphw_mgmt.c | 2 +- .../ramaxel/spnic/spnic_ethtool_stats.c | 4 +- .../ethernet/ramaxel/spnic/spnic_mag_cfg.c | 2 +- .../ethernet/ramaxel/spnic/spnic_nic_cfg_vf.c | 49 ++++++++++++------- 6 files changed, 41 insertions(+), 28 deletions(-) -- 2.32.0

1 5

[PATCH openEuler-1.0-LTS 1/2] cgroup-v1: Require capabilities to set release_agent
by Yang Yingliang 17 Feb '22

17 Feb '22

From: "Eric W. Biederman" <ebiederm(a)xmission.com> stable inclusion from stable-v4.19.229 commit 939f8b491887c27585933ea7dc5ad4123de58ff3 CVE: CVE-2022-0492 ------------------------------- commit 24f6008564183aa120d07c03d9289519c2fe02af upstream. The cgroup release_agent is called with call_usermodehelper. The function call_usermodehelper starts the release_agent with a full set fo capabilities. Therefore require capabilities when setting the release_agaent. Reported-by: Tabitha Sable <tabitha.c.sable(a)gmail.com> Tested-by: Tabitha Sable <tabitha.c.sable(a)gmail.com> Fixes: 81a6a5cdd2c5 ("Task Control Groups: automatic userspace notification of idle cgroups") Cc: stable(a)vger.kernel.org # v2.6.24+ Signed-off-by: "Eric W. Biederman" <ebiederm(a)xmission.com> Signed-off-by: Tejun Heo <tj(a)kernel.org> [mkoutny: Adjust for pre-fs_context, duplicate mount/remount check, drop log messages.] Acked-by: Michal Koutný <mkoutny(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/cgroup/cgroup-v1.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c index f833fe71fa5f6..c4cc6c1ddacde 100644 --- a/kernel/cgroup/cgroup-v1.c +++ b/kernel/cgroup/cgroup-v1.c @@ -580,6 +580,14 @@ static ssize_t cgroup_release_agent_write(struct kernfs_open_file *of, BUILD_BUG_ON(sizeof(cgrp->root->release_agent_path) < PATH_MAX); + /* + * Release agent gets called with all capabilities, + * require capabilities to set release agent. + */ + if ((of->file->f_cred->user_ns != &init_user_ns) || + !capable(CAP_SYS_ADMIN)) + return -EPERM; + cgrp = cgroup_kn_lock_live(of->kn, false); if (!cgrp) return -ENODEV; @@ -1054,6 +1062,7 @@ static int cgroup1_remount(struct kernfs_root *kf_root, int *flags, char *data) { int ret = 0; struct cgroup_root *root = cgroup_root_from_kf(kf_root); + struct cgroup_namespace *ns = current->nsproxy->cgroup_ns; struct cgroup_sb_opts opts; u16 added_mask, removed_mask; @@ -1067,6 +1076,12 @@ static int cgroup1_remount(struct kernfs_root *kf_root, int *flags, char *data) if (opts.subsys_mask != root->subsys_mask || opts.release_agent) pr_warn("option changes via remount are deprecated (pid=%d comm=%s)\n", task_tgid_nr(current), current->comm); + /* See cgroup1_mount release_agent handling */ + if (opts.release_agent && + ((ns->user_ns != &init_user_ns) || !capable(CAP_SYS_ADMIN))) { + ret = -EINVAL; + goto out_unlock; + } added_mask = opts.subsys_mask & ~root->subsys_mask; removed_mask = root->subsys_mask & ~opts.subsys_mask; @@ -1205,6 +1220,15 @@ struct dentry *cgroup1_mount(struct file_system_type *fs_type, int flags, ret = -EPERM; goto out_unlock; } + /* + * Release agent gets called with all capabilities, + * require capabilities to set release agent. + */ + if (opts.release_agent && + ((ns->user_ns != &init_user_ns) || !capable(CAP_SYS_ADMIN))) { + ret = -EINVAL; + goto out_unlock; + } root = kzalloc(sizeof(*root), GFP_KERNEL); if (!root) { -- 2.25.1

1 1

[PATCH openEuler-5.10 1/9] livepatch: Fix kobject refcount bug on klp_init_patch_early failure path
by Zheng Zengkai 17 Feb '22

17 Feb '22

From: David Vernet <void(a)manifault.com> mainline inclusion from mainline-v5.17-rc1 commit 5ef3dd20555e8e878ac390a71e658db5fd02845c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4TF7T Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When enabling a klp patch with klp_enable_patch(), klp_init_patch_early() is invoked to initialize the kobjects for the patch itself, as well as the 'struct klp_object' and 'struct klp_func' objects that comprise it. However, there are some error paths in klp_enable_patch() where some kobjects may have been initialized with kobject_init(), but an error code is still returned due to e.g. a 'struct klp_object' having a NULL funcs pointer. In these paths, the initial reference of the kobject of the 'struct klp_patch' may never be released, along with one or more of its objects and their functions, as kobject_put() is not invoked on the cleanup path if klp_init_patch_early() returns an error code. For example, if an object entry such as the following were added to the sample livepatch module's klp patch, it would cause the vmlinux klp_object, and its klp_func which updates 'cmdline_proc_show', to never be released: static struct klp_object objs[] = { { /* name being NULL means vmlinux */ .funcs = funcs, }, { /* NULL funcs -- would cause reference leak */ .name = "kvm", }, { } }; Without this change, if CONFIG_DEBUG_KOBJECT is enabled, and the sample klp patch is loaded, the kobjects (the patch, the vmlinux 'struct klp_object', and its func) are observed as initialized, but never released, in the dmesg log output. With the change, these kobject references no longer fail to be released as the error case is properly handled before they are initialized. Since 81fd525cedd9 ("[Huawei] livepatch: Add klp_{register,unregister}_patch for stop_machine model"), klp_register_patch was born out of klp_enable_patch with similar issue, we also fix it in this patch. Signed-off-by: David Vernet <void(a)manifault.com> Reviewed-by: Petr Mladek <pmladek(a)suse.com> Acked-by: Miroslav Benes <mbenes(a)suse.cz> Acked-by: Josh Poimboeuf <jpoimboe(a)redhat.com> Signed-off-by: Petr Mladek <pmladek(a)suse.com> Conflicts: kernel/livepatch/core.c Fixes: 0430f78bf38f ("livepatch: Consolidate klp_free functions") Fixes: c33e42836a74 ("livepatch/core: Allow implementation without ftrace") Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- kernel/livepatch/core.c | 50 +++++++++++++++++------------------------ 1 file changed, 20 insertions(+), 30 deletions(-) diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c index b46ef236424d..b0f54d4c663b 100644 --- a/kernel/livepatch/core.c +++ b/kernel/livepatch/core.c @@ -1146,14 +1146,11 @@ static void klp_init_object_early(struct klp_patch *patch, #endif } -static int klp_init_patch_early(struct klp_patch *patch) +static void klp_init_patch_early(struct klp_patch *patch) { struct klp_object *obj; struct klp_func *func; - if (!patch->objs) - return -EINVAL; - INIT_LIST_HEAD(&patch->list); INIT_LIST_HEAD(&patch->obj_list); kobject_init(&patch->kobj, &klp_ktype_patch); @@ -1163,26 +1160,12 @@ static int klp_init_patch_early(struct klp_patch *patch) init_completion(&patch->finish); klp_for_each_object_static(patch, obj) { - if (!obj->funcs) - return -EINVAL; - klp_init_object_early(patch, obj); klp_for_each_func_static(obj, func) { klp_init_func_early(obj, func); } } - - /* - * For stop_machine model, we only need to module_get and module_put once when - * enable_patch and disable_patch respectively. - */ -#ifdef CONFIG_LIVEPATCH_PER_TASK_CONSISTENCY - if (!try_module_get(patch->mod)) - return -ENODEV; -#endif - - return 0; } static int klp_init_patch(struct klp_patch *patch) @@ -1431,10 +1414,16 @@ static int __klp_enable_patch(struct klp_patch *patch) int klp_enable_patch(struct klp_patch *patch) { int ret; + struct klp_object *obj; - if (!patch || !patch->mod) + if (!patch || !patch->mod || !patch->objs) return -EINVAL; + klp_for_each_object_static(patch, obj) { + if (!obj->funcs) + return -EINVAL; + } + if (!is_livepatch_module(patch->mod)) { pr_err("module %s is not marked as a livepatch module\n", patch->mod->name); @@ -1458,11 +1447,10 @@ int klp_enable_patch(struct klp_patch *patch) return -EINVAL; } - ret = klp_init_patch_early(patch); - if (ret) { - mutex_unlock(&klp_mutex); - return ret; - } + if (!try_module_get(patch->mod)) + return -ENODEV; + + klp_init_patch_early(patch); ret = klp_init_patch(patch); if (ret) @@ -1609,10 +1597,16 @@ static int __klp_enable_patch(struct klp_patch *patch) int klp_register_patch(struct klp_patch *patch) { int ret; + struct klp_object *obj; - if (!patch || !patch->mod) + if (!patch || !patch->mod || !patch->objs) return -EINVAL; + klp_for_each_object_static(patch, obj) { + if (!obj->funcs) + return -EINVAL; + } + if (!is_livepatch_module(patch->mod)) { pr_err("module %s is not marked as a livepatch module\n", patch->mod->name); @@ -1629,11 +1623,7 @@ int klp_register_patch(struct klp_patch *patch) return -EINVAL; } - ret = klp_init_patch_early(patch); - if (ret) { - mutex_unlock(&klp_mutex); - return ret; - } + klp_init_patch_early(patch); ret = klp_init_patch(patch); if (ret) -- 2.20.1

1 8

[PATCH openEuler-1.0-LTS 1/2] NFSv4: Handle case where the lookup of a directory fails
by Yang Yingliang 16 Feb '22

16 Feb '22

From: Trond Myklebust <trond.myklebust(a)hammerspace.com> mainline inclusion from mainline-v5.16 commit ac795161c93699d600db16c1a8cc23a65a1eceaf category: bugfix bugzilla: 186205 CVE: CVE-2022-24448 ----------------------------------------------- If the application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() will punt to doing a regular lookup. If the server then returns a regular file, we will happily return a file descriptor with uninitialised open state. The fix is to return the expected ENOTDIR error in these cases. Reported-by: Lyu Tao <tao.lyu(a)epfl.ch> Fixes: 0dd2b474d0b6 ("nfs: implement i_op->atomic_open()") Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Anna Schumaker <Anna.Schumaker(a)Netapp.com> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/nfs/dir.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c index ff9129c0572d9..757a83556b003 100644 --- a/fs/nfs/dir.c +++ b/fs/nfs/dir.c @@ -1637,6 +1637,19 @@ int nfs_atomic_open(struct inode *dir, struct dentry *dentry, no_open: res = nfs_lookup(dir, dentry, lookup_flags); + if (!res) { + inode = d_inode(dentry); + if ((lookup_flags & LOOKUP_DIRECTORY) && inode && + !S_ISDIR(inode->i_mode)) + res = ERR_PTR(-ENOTDIR); + } else if (!IS_ERR(res)) { + inode = d_inode(res); + if ((lookup_flags & LOOKUP_DIRECTORY) && inode && + !S_ISDIR(inode->i_mode)) { + dput(res); + res = ERR_PTR(-ENOTDIR); + } + } if (switched) { d_lookup_done(dentry); if (!res) -- 2.25.1

1 1

openEuler kernel 双周例会
by openEuler conference 15 Feb '22

15 Feb '22

您好！ Kernel SIG 邀请您参加 2022-02-18 14:00 召开的ZOOM会议(自动录制) 会议主题：openEuler kernel 双周例会会议内容：议题1: Intel sgx特性介绍及合入议题2: 申请适配toa开源插件议题3: 实现ima namespace的digest list 会议链接：https://us06web.zoom.us/j/81827052778?pwd=c2MxN2RzMXR4cEh2RVFieFlUNDk4Zz09 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the ZOOM conference(auto recording) will be held at 2022-02-18 14:00, The subject of the conference is openEuler kernel 双周例会, Summary: 议题1: Intel sgx特性介绍及合入议题2: 申请适配toa开源插件议题3: 实现ima namespace的digest list You can join the meeting at https://us06web.zoom.us/j/81827052778?pwd=c2MxN2RzMXR4cEh2RVFieFlUNDk4Zz09. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS] configfs: fix a race in configfs_{,un}register_subsystem()
by Yang Yingliang 15 Feb '22

15 Feb '22

From: ChenXiaoSong <chenxiaosong2(a)huawei.com> hulk inclusion category: bugfix bugzilla: 186233, https://gitee.com/src-openeuler/kernel/issues/I4TLA2?from=project-issue CVE: NA ----------------------------------------------- When configfs_register_subsystem() or configfs_unregister_subsystem() is executing link_group() or unlink_group(), it is possible that two processes add or delete list concurrently. Some unfortunate interleavings of them can cause kernel panic. One of cases is: A --> B --> C --> D A <-- B <-- C <-- D delete list_head *B | delete list_head *C --------------------------------|----------------------------------- configfs_unregister_subsystem | configfs_unregister_subsystem unlink_group | unlink_group unlink_obj | unlink_obj list_del_init | list_del_init __list_del_entry | __list_del_entry __list_del | __list_del // next == C | next->prev = prev | | next->prev = prev prev->next = next | | // prev == B | prev->next = next Fix this by adding mutex when calling link_group() or unlink_group(), but parent configfs_subsystem is NULL when config_item is root. So I create a mutex configfs_subsystem_mutex. Fixes: 7063fbf22611 ("[PATCH] configfs: User-driven configuration filesystem") Signed-off-by: ChenXiaoSong <chenxiaosong2(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> Reviewed-by: yangerkun <yangerkun(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/configfs/dir.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c index 2cc6b1c49d348..9b43611e1bb35 100644 --- a/fs/configfs/dir.c +++ b/fs/configfs/dir.c @@ -50,6 +50,14 @@ DECLARE_RWSEM(configfs_rename_sem); */ DEFINE_SPINLOCK(configfs_dirent_lock); +/* + * All of link_obj/unlink_obj/link_group/unlink_group require that + * subsys->su_mutex is held. + * But parent configfs_subsystem is NULL when config_item is root. + * Use this mutex when config_item is root. + */ +static DEFINE_MUTEX(configfs_subsystem_mutex); + static void configfs_d_iput(struct dentry * dentry, struct inode * inode) { @@ -1936,7 +1944,9 @@ int configfs_register_subsystem(struct configfs_subsystem *subsys) group->cg_item.ci_name = group->cg_item.ci_namebuf; sd = root->d_fsdata; + mutex_lock(&configfs_subsystem_mutex); link_group(to_config_group(sd->s_element), group); + mutex_unlock(&configfs_subsystem_mutex); inode_lock_nested(d_inode(root), I_MUTEX_PARENT); @@ -1961,7 +1971,9 @@ int configfs_register_subsystem(struct configfs_subsystem *subsys) inode_unlock(d_inode(root)); if (err) { + mutex_lock(&configfs_subsystem_mutex); unlink_group(group); + mutex_unlock(&configfs_subsystem_mutex); configfs_release_fs(); } put_fragment(frag); @@ -2007,7 +2019,9 @@ void configfs_unregister_subsystem(struct configfs_subsystem *subsys) dput(dentry); + mutex_lock(&configfs_subsystem_mutex); unlink_group(group); + mutex_unlock(&configfs_subsystem_mutex); configfs_release_fs(); } -- 2.25.1

1 0

Re: [OLK-5.10 v2] block: update io_ticks when io hang
by Hou Tao 15 Feb '22

15 Feb '22

1 0

Re: [Tc] Re: [Dev] openEuler 技术委员会例会
by Xie XiuQi 14 Feb '22

14 Feb '22

这个议题先在 kernel sig 讨论吧。可以在 https://gitee.com/openeuler/kernel/issues 提个 issue。我把这个提议报到 kernel sig。 On 2022/2/14 16:39, Jianmin Wang wrote: > Hi，王书，您好， > > 感谢提交议题，因为和 kernel 密切相关，是否有 Kernel SIG 的意见以及对应的 PR / Issue 提前发出来呢？ > > ——王建民 > >> On 14 Feb 2022, at 4:18 PM, 王书 <wangshu(a)uniontech.com> wrote: >> >> 议题申报： >> 《推送TOA模块到内核sig组申请》---统信刘冬华 >> >> >> ------------------ Original ------------------ >> From: "叶青龙"<yeqinglong(a)uniontech.com>; >> Date: Mon, Feb 14, 2022 03:22 PM >> To: "王书"<wangshu(a)uniontech.com>; >> Subject: Fw:[Dev] Fwd: openEuler 技术委员会例会 >> >> 请在例会通知邮件上申报议题。 >> >> >> >> >> >>> 服务器OS与云计算产线叶青龙 >>> >>> 联系电话：18991378194 >>> >>> 地址：西安市雁塔区天谷八路西安软件新城软件研发基地2期 >> >> >> >> >> ------------------ Original ------------------ >> From: "王建民"<jianmin(a)iscas.ac.cn>; >> Date: Tue, Feb 8, 2022 04:43 PM >> To: "tc"<tc(a)openeuler.org>; "dev"<dev(a)openeuler.org>; >> Subject: [Dev] Fwd: openEuler 技术委员会例会 >> >> 大家新年好， >> >> 春节后第一次 TC 例会将于 2022 年 2 月 16 日进行，欢迎大家回复邮件提交议题。 >> >> 谢谢。 >> >> -王建民 >> >> Hello, Everyone, >> >> Happy New Year! >> >> The first bi-weekly meeting of openEuler TC will be held on 2022/02/16 Wednesday. >> >> Welcome to submit topics by replying to the email. >> >> >> Best Regards, >> Jianmin Wang >> >> >> Begin forwarded message: >> >> From: openEuler conference <public(a)openeuler.org> >> Date: 8 February 2022 at 2:28:47 PM GMT+8 >> Subject: [Dev] openEuler 技术委员会例会 >> >> 您好！ >> >> TC SIG 邀请您参加 2022-02-16 10:00 召开的ZOOM会议 >> >> 会议主题：openEuler 技术委员会例会 >> >> 会议链接：https://us06web.zoom.us/j/82775432385?pwd=Y2hkOGZkeklrMzJVaUVnM2dONTBxdz09 >> >> 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID >> >> 更多资讯尽在：https://openeuler.org/zh/ >> >> >> >> >> Hello! >> >> openEuler TC SIG invites you to attend the ZOOM conference will be held at 2022-02-16 10:00, >> >> The subject of the conference is openEuler 技术委员会例会, >> >> You can join the meeting at https://us06web.zoom.us/j/82775432385?pwd=Y2hkOGZkeklrMzJVaUVnM2dONTBxdz09. >> >> Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. >> >> More information: https://openeuler.org/en/ >> >> _______________________________________________ >> Dev mailing list -- dev(a)openeuler.org >> To unsubscribe send an email to dev-leave(a)openeuler.org >> _______________________________________________ >> Dev mailing list -- dev(a)openeuler.org >> To unsubscribe send an email to dev-leave(a)openeuler.org > > _______________________________________________ > Tc mailing list -- tc(a)openeuler.org > To unsubscribe send an email to tc-leave(a)openeuler.org >

1 0

[PATCH openEuler-1.0-LTS] fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once()
by Yang Yingliang 14 Feb '22

14 Feb '22

From: Eric Biggers <ebiggers(a)google.com> mainline inclusion from mainline-5.7-rc1 commit 26c5d78c976ca298e59a56f6101a97b618ba3539 category: bugfix bugzilla: 34247 CVE: NA --------------------------- After request_module(), nothing is stopping the module from being unloaded until someone takes a reference to it via try_get_module(). The WARN_ONCE() in get_fs_type() is thus user-reachable, via userspace running 'rmmod' concurrently. Since WARN_ONCE() is for kernel bugs only, not for user-reachable situations, downgrade this warning to pr_warn_once(). Keep it printed once only, since the intent of this warning is to detect a bug in modprobe at boot time. Printing the warning more than once wouldn't really provide any useful extra information. Fixes: 41124db869b7 ("fs: warn in case userspace lied about modprobe return") Signed-off-by: Eric Biggers <ebiggers(a)google.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Reviewed-by: Jessica Yu <jeyu(a)kernel.org> Cc: Alexei Starovoitov <ast(a)kernel.org> Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Cc: Jeff Vander Stoep <jeffv(a)google.com> Cc: Jessica Yu <jeyu(a)kernel.org> Cc: Kees Cook <keescook(a)chromium.org> Cc: Luis Chamberlain <mcgrof(a)kernel.org> Cc: NeilBrown <neilb(a)suse.com> Cc: <stable(a)vger.kernel.org> [4.13+] Link: http://lkml.kernel.org/r/20200312202552.241885-3-ebiggers@kernel.org Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/filesystems.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/filesystems.c b/fs/filesystems.c index b03f57b1105b3..181200daeeba7 100644 --- a/fs/filesystems.c +++ b/fs/filesystems.c @@ -267,7 +267,9 @@ struct file_system_type *get_fs_type(const char *name) fs = __get_fs_type(name, len); if (!fs && (request_module("fs-%.*s", len, name) == 0)) { fs = __get_fs_type(name, len); - WARN_ONCE(!fs, "request_module fs-%.*s succeeded, but still no fs?\n", len, name); + if (!fs) + pr_warn_once("request_module fs-%.*s succeeded, but still no fs?\n", + len, name); } if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) { -- 2.25.1

1 0

[PATCH openEuler-5.10 1/5] mm/page_alloc: print node fallback order
by Zheng Zengkai 11 Feb '22

11 Feb '22

From: Bharata B Rao <bharata(a)amd.com> mainline inclusion from mainline-v5.16-rc1 commit 6cf253925df72e522c06dac09ede7e81a6e38121 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4T0ML CVE: NA ------------------------------------------------- Patch series "Fix NUMA nodes fallback list ordering". For a NUMA system that has multiple nodes at same distance from other nodes, the fallback list generation prefers same node order for them instead of round-robin thereby penalizing one node over others. This series fixes it. More description of the problem and the fix is present in the patch description. This patch (of 2): Print information message about the allocation fallback order for each NUMA node during boot. No functional changes here. This makes it easier to illustrate the problem in the node fallback list generation, which the next patch fixes. Link: https://lkml.kernel.org/r/20210830121603.1081-1-bharata@amd.com Link: https://lkml.kernel.org/r/20210830121603.1081-2-bharata@amd.com Signed-off-by: Bharata B Rao <bharata(a)amd.com> Acked-by: Mel Gorman <mgorman(a)suse.de> Reviewed-by: Anshuman Khandual <anshuman.khandual(a)arm.com> Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu(a)jp.fujitsu.com> Cc: Lee Schermerhorn <lee.schermerhorn(a)hp.com> Cc: Krupa Ramakrishnan <krupa.ramakrishnan(a)amd.com> Cc: Sadagopan Srinivasan <Sadagopan.Srinivasan(a)amd.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Peng Liu <liupeng256(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- mm/page_alloc.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 3791bdc958bd..4e67b4506238 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -6067,6 +6067,10 @@ static void build_zonelists(pg_data_t *pgdat) build_zonelists_in_node_order(pgdat, node_order, nr_nodes); build_thisnode_zonelists(pgdat); + pr_info("Fallback order for Node %d: ", local_node); + for (node = 0; node < nr_nodes; node++) + pr_cont("%d ", node_order[node]); + pr_cont("\n"); } #ifdef CONFIG_HAVE_MEMORYLESS_NODES -- 2.20.1

1 4

[PATCH openEuler-5.10] arm64: openeuler_defconfig: Enable Kunpeng related configs
by Zheng Zengkai 11 Feb '22

11 Feb '22

driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4SJLU CVE: NA ----------------------------------------- Enable following configs in arm64 openeuler_defconfig for Kunpeng platform: CONFIG_PCIE_EDR=y CONFIG_HISI_PCIE_PMU=m CONFIG_MLX5_ESWITCH=y Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Reviewed-by: Chao Liu <liuchao173(a)huawei.com> Acked-by: Xinwei Kong<kong.kongxinwei(a)hisilicon.com> Reviewed-by: Yicong Yang <yangyicong(a)huawei.com> Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index a86e97dd015e..a93616556d12 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -1915,7 +1915,7 @@ CONFIG_PCIEASPM_DEFAULT=y CONFIG_PCIE_PME=y CONFIG_PCIE_DPC=y # CONFIG_PCIE_PTM is not set -# CONFIG_PCIE_EDR is not set +CONFIG_PCIE_EDR=y CONFIG_PCI_MSI=y CONFIG_PCI_MSI_IRQ_DOMAIN=y CONFIG_PCI_QUIRKS=y @@ -2757,7 +2757,7 @@ CONFIG_MLX5_CORE_EN=y CONFIG_MLX5_EN_ARFS=y CONFIG_MLX5_EN_RXNFC=y CONFIG_MLX5_MPFS=y -# CONFIG_MLX5_ESWITCH is not set +CONFIG_MLX5_ESWITCH=y CONFIG_MLX5_CORE_EN_DCB=y CONFIG_MLX5_CORE_IPOIB=y # CONFIG_MLX5_IPSEC is not set @@ -6070,6 +6070,7 @@ CONFIG_THUNDERX2_PMU=m CONFIG_XGENE_PMU=y CONFIG_ARM_SPE_PMU=y CONFIG_HISI_PMU=m +CONFIG_HISI_PCIE_PMU=m # end of Performance monitor support CONFIG_RAS=y -- 2.20.1

3 2

[PATCH] configs: enable CONFIG_INTEGRITY_PLATFORM_KEYRING and CONFIG_LOAD_UEFI_KEYS
by Chao Liu 11 Feb '22

11 Feb '22

euler inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4T7MX CVE: NA -------------------------------- Provide a separate, distinct keyring for platform trusted keys which is used in secure boot. Signed-off-by: Chao Liu <liuchao173(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 3 ++- arch/x86/configs/openeuler_defconfig | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index a86e97dd015e..08cf4f419553 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -6502,7 +6502,8 @@ CONFIG_INTEGRITY=y CONFIG_INTEGRITY_SIGNATURE=y CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y CONFIG_INTEGRITY_TRUSTED_KEYRING=y -# CONFIG_INTEGRITY_PLATFORM_KEYRING is not set +CONFIG_INTEGRITY_PLATFORM_KEYRING=y +CONFIG_LOAD_UEFI_KEYS=y CONFIG_INTEGRITY_AUDIT=y CONFIG_IMA=y # CONFIG_IMA_KEXEC is not set diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index febdd7627f8b..316c4122a859 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -7603,7 +7603,8 @@ CONFIG_INTEGRITY=y CONFIG_INTEGRITY_SIGNATURE=y CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y CONFIG_INTEGRITY_TRUSTED_KEYRING=y -# CONFIG_INTEGRITY_PLATFORM_KEYRING is not set +CONFIG_INTEGRITY_PLATFORM_KEYRING=y +CONFIG_LOAD_UEFI_KEYS=y CONFIG_INTEGRITY_AUDIT=y CONFIG_IMA=y CONFIG_IMA_MEASURE_PCR_IDX=10 -- 2.23.0

3 2

Re: [PATCH -next] ext4: fix underflow in ext4_max_bitmap_size()
by weiyongjun (A) 11 Feb '22

11 Feb '22

在 2022/2/11 16:12, Zhang Yi 写道: > The same to commit 1c2d14212b15 ("ext2: Fix underflow in ext2_max_size()") > in ext2 filesystem, ext4 driver has the same issue with 64K block size > and ^huge_file, fix this issue the same as ext2. This patch also revert > commit 75ca6ad408f4 ("ext4: fix loff_t overflow in ext4_max_bitmap_size()") > because it's no longer needed. > > Signed-off-by: Zhang Yi <yi.zhang(a)huawei.com> > --- > fs/ext4/super.c | 46 +++++++++++++++++++++++++++++++--------------- > 1 file changed, 31 insertions(+), 15 deletions(-) > Looks good to me

1 0

Re: [PATCH -next] ext2: correct max file size computing
by weiyongjun (A) 11 Feb '22

11 Feb '22

在 2022/2/11 16:12, Zhang Yi 写道: > We need to calculate the max file size accurately if the total blocks > that can address by block tree exceed the upper_limit. But this check is > not correct now, it only compute the total data blocks but missing > metadata blocks are needed. So in the case of "data blocks < upper_limit > && total blocks > upper_limit", we will get wrong result. Fortunately, > this case could not happen in reality, but it's confused and better to > correct the computing. > > bits data blocks metadatablocks upper_limit > 10 16843020 66051 2147483647 > 11 134480396 263171 1073741823 > 12 1074791436 1050627 536870911 (*) > 13 8594130956 4198403 268435455 (*) > 14 68736258060 16785411 134217727 (*) > 15 549822930956 67125251 67108863 (*) > 16 4398314962956 268468227 33554431 (*) > > [*] Need to calculate in depth. > > Fixes: 1c2d14212b15 ("ext2: Fix underflow in ext2_max_size()") > Signed-off-by: Zhang Yi <yi.zhang(a)huawei.com> Looks good to me

1 0

[PATCH openEuler-1.0-LTS] drm/i915: Flush TLBs before releasing backing store
by Yang Yingliang 11 Feb '22

11 Feb '22

From: Tvrtko Ursulin <tvrtko.ursulin(a)intel.com> stable inclusion from linux-4.19.227 commit b188780649081782e341e52223db47c49f172712 CVE: CVE-2022-0330 -------------------------------- commit 7938d61591d33394a21bdd7797a245b65428f44c upstream. We need to flush TLBs before releasing backing store otherwise userspace is able to encounter stale entries if a) it is not declaring access to certain buffers and b) it races with the backing store release from a such undeclared execution already executing on the GPU in parallel. The approach taken is to mark any buffer objects which were ever bound to the GPU and to trigger a serialized TLB flush when their backing store is released. Alternatively the flushing could be done on VMA unbind, at which point we would be able to ascertain whether there is potential a parallel GPU execution (which could race), but essentially it boils down to paying the cost of TLB flushes potentially needlessly at VMA unbind time (when the backing store is not known to be going away so not needed for safety), versus potentially needlessly at backing store relase time (since we at that point cannot tell whether there is anything executing on the GPU which uses that object). Thereforce simplicity of implementation has been chosen for now with scope to benchmark and refine later as required. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin(a)intel.com> Reported-by: Sushma Venkatesh Reddy <sushma.venkatesh.reddy(a)intel.com> Reviewed-by: Daniel Vetter <daniel.vetter(a)ffwll.ch> Acked-by: Dave Airlie <airlied(a)redhat.com> Cc: Daniel Vetter <daniel.vetter(a)ffwll.ch> Cc: Jon Bloomfield <jon.bloomfield(a)intel.com> Cc: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> Cc: Jani Nikula <jani.nikula(a)intel.com> Cc: stable(a)vger.kernel.org Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/gpu/drm/i915/i915_drv.h | 2 + drivers/gpu/drm/i915/i915_gem.c | 83 ++++++++++++++++++++++++++ drivers/gpu/drm/i915/i915_gem_object.h | 1 + drivers/gpu/drm/i915/i915_reg.h | 6 ++ drivers/gpu/drm/i915/i915_vma.c | 4 ++ 5 files changed, 96 insertions(+) diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h index db2e9af49ae6f..b65f3e38208a3 100644 --- a/drivers/gpu/drm/i915/i915_drv.h +++ b/drivers/gpu/drm/i915/i915_drv.h @@ -1593,6 +1593,8 @@ struct drm_i915_private { struct intel_uncore uncore; + struct mutex tlb_invalidate_lock; + struct i915_virtual_gpu vgpu; struct intel_gvt *gvt; diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index 3139047f72465..b1b207747f39f 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -2443,6 +2443,78 @@ static void __i915_gem_object_reset_page_iter(struct drm_i915_gem_object *obj) rcu_read_unlock(); } +struct reg_and_bit { + i915_reg_t reg; + u32 bit; +}; + +static struct reg_and_bit +get_reg_and_bit(const struct intel_engine_cs *engine, + const i915_reg_t *regs, const unsigned int num) +{ + const unsigned int class = engine->class; + struct reg_and_bit rb = { .bit = 1 }; + + if (WARN_ON_ONCE(class >= num || !regs[class].reg)) + return rb; + + rb.reg = regs[class]; + if (class == VIDEO_DECODE_CLASS) + rb.reg.reg += 4 * engine->instance; /* GEN8_M2TCR */ + + return rb; +} + +static void invalidate_tlbs(struct drm_i915_private *dev_priv) +{ + static const i915_reg_t gen8_regs[] = { + [RENDER_CLASS] = GEN8_RTCR, + [VIDEO_DECODE_CLASS] = GEN8_M1TCR, /* , GEN8_M2TCR */ + [VIDEO_ENHANCEMENT_CLASS] = GEN8_VTCR, + [COPY_ENGINE_CLASS] = GEN8_BTCR, + }; + const unsigned int num = ARRAY_SIZE(gen8_regs); + const i915_reg_t *regs = gen8_regs; + struct intel_engine_cs *engine; + enum intel_engine_id id; + + if (INTEL_GEN(dev_priv) < 8) + return; + + GEM_TRACE("\n"); + + assert_rpm_wakelock_held(dev_priv); + + mutex_lock(&dev_priv->tlb_invalidate_lock); + intel_uncore_forcewake_get(dev_priv, FORCEWAKE_ALL); + + for_each_engine(engine, dev_priv, id) { + /* + * HW architecture suggest typical invalidation time at 40us, + * with pessimistic cases up to 100us and a recommendation to + * cap at 1ms. We go a bit higher just in case. + */ + const unsigned int timeout_us = 100; + const unsigned int timeout_ms = 4; + struct reg_and_bit rb; + + rb = get_reg_and_bit(engine, regs, num); + if (!i915_mmio_reg_offset(rb.reg)) + continue; + + I915_WRITE_FW(rb.reg, rb.bit); + if (__intel_wait_for_register_fw(dev_priv, + rb.reg, rb.bit, 0, + timeout_us, timeout_ms, + NULL)) + DRM_ERROR_RATELIMITED("%s TLB invalidation did not complete in %ums!\n", + engine->name, timeout_ms); + } + + intel_uncore_forcewake_put(dev_priv, FORCEWAKE_ALL); + mutex_unlock(&dev_priv->tlb_invalidate_lock); +} + static struct sg_table * __i915_gem_object_unset_pages(struct drm_i915_gem_object *obj) { @@ -2472,6 +2544,15 @@ __i915_gem_object_unset_pages(struct drm_i915_gem_object *obj) __i915_gem_object_reset_page_iter(obj); obj->mm.page_sizes.phys = obj->mm.page_sizes.sg = 0; + if (test_and_clear_bit(I915_BO_WAS_BOUND_BIT, &obj->flags)) { + struct drm_i915_private *i915 = to_i915(obj->base.dev); + + if (intel_runtime_pm_get_if_in_use(i915)) { + invalidate_tlbs(i915); + intel_runtime_pm_put(i915); + } + } + return pages; } @@ -5789,6 +5870,8 @@ int i915_gem_init_early(struct drm_i915_private *dev_priv) spin_lock_init(&dev_priv->fb_tracking.lock); + mutex_init(&dev_priv->tlb_invalidate_lock); + err = i915_gemfs_init(dev_priv); if (err) DRM_NOTE("Unable to create a private tmpfs mount, hugepage support will be disabled(%d).\n", err); diff --git a/drivers/gpu/drm/i915/i915_gem_object.h b/drivers/gpu/drm/i915/i915_gem_object.h index 83e5e01fa9eaa..2e3a713e9bcd8 100644 --- a/drivers/gpu/drm/i915/i915_gem_object.h +++ b/drivers/gpu/drm/i915/i915_gem_object.h @@ -136,6 +136,7 @@ struct drm_i915_gem_object { * activity? */ #define I915_BO_ACTIVE_REF 0 +#define I915_BO_WAS_BOUND_BIT 1 /* * Is the object to be mapped as read-only to the GPU diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h index a6f4f32dd71ce..830049985e56d 100644 --- a/drivers/gpu/drm/i915/i915_reg.h +++ b/drivers/gpu/drm/i915/i915_reg.h @@ -2431,6 +2431,12 @@ enum i915_power_well_id { #define GAMT_CHKN_DISABLE_DYNAMIC_CREDIT_SHARING (1 << 28) #define GAMT_CHKN_DISABLE_I2M_CYCLE_ON_WR_PORT (1 << 24) +#define GEN8_RTCR _MMIO(0x4260) +#define GEN8_M1TCR _MMIO(0x4264) +#define GEN8_M2TCR _MMIO(0x4268) +#define GEN8_BTCR _MMIO(0x426c) +#define GEN8_VTCR _MMIO(0x4270) + #if 0 #define PRB0_TAIL _MMIO(0x2030) #define PRB0_HEAD _MMIO(0x2034) diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c index 98358b4b36dea..9aceacc43f4b7 100644 --- a/drivers/gpu/drm/i915/i915_vma.c +++ b/drivers/gpu/drm/i915/i915_vma.c @@ -335,6 +335,10 @@ int i915_vma_bind(struct i915_vma *vma, enum i915_cache_level cache_level, return ret; vma->flags |= bind_flags; + + if (vma->obj) + set_bit(I915_BO_WAS_BOUND_BIT, &vma->obj->flags); + return 0; } -- 2.25.1

1 0

Re: [PATCH] modify arm64 and x86 configs
by Kai Liu 11 Feb '22

11 Feb '22

On 2022/02/11 Fri 11:38, 郑振鹏 wrote: >好的, 麻烦给个示例, 我以后按照示例的格式提交. 你前面就有两个来自于Zheng Zengkai和Cao Liu的修改kconfig的patch，可以参考。 Regards, Kai

1 0

[PATCH openEuler-1.0-LTS 1/2] memstick: rtsx_usb_ms: fix UAF
by Yang Yingliang 11 Feb '22

11 Feb '22

From: Tong Zhang <ztong0001(a)gmail.com> mainline inclusion from mainline-v5.14-rc1 commit 42933c8aa14be1caa9eda41f65cde8a3a95d3e39 category: bugfix bugzilla: NA CVE: CVE-2022-0487 -------------------------------- This patch fixes the following issues: 1. memstick_free_host() will free the host, so the use of ms_dev(host) after it will be a problem. To fix this, move memstick_free_host() after when we are done with ms_dev(host). 2. In rtsx_usb_ms_drv_remove(), pm need to be disabled before we remove and free host otherwise memstick_check will be called and UAF will happen. [ 11.351173] BUG: KASAN: use-after-free in rtsx_usb_ms_drv_remove+0x94/0x140 [rtsx_usb_ms] [ 11.357077] rtsx_usb_ms_drv_remove+0x94/0x140 [rtsx_usb_ms] [ 11.357376] platform_remove+0x2a/0x50 [ 11.367531] Freed by task 298: [ 11.368537] kfree+0xa4/0x2a0 [ 11.368711] device_release+0x51/0xe0 [ 11.368905] kobject_put+0xa2/0x120 [ 11.369090] rtsx_usb_ms_drv_remove+0x8c/0x140 [rtsx_usb_ms] [ 11.369386] platform_remove+0x2a/0x50 [ 12.038408] BUG: KASAN: use-after-free in __mutex_lock.isra.0+0x3ec/0x7c0 [ 12.045432] mutex_lock+0xc9/0xd0 [ 12.046080] memstick_check+0x6a/0x578 [memstick] [ 12.046509] process_one_work+0x46d/0x750 [ 12.052107] Freed by task 297: [ 12.053115] kfree+0xa4/0x2a0 [ 12.053272] device_release+0x51/0xe0 [ 12.053463] kobject_put+0xa2/0x120 [ 12.053647] rtsx_usb_ms_drv_remove+0xc4/0x140 [rtsx_usb_ms] [ 12.053939] platform_remove+0x2a/0x50 Signed-off-by: Tong Zhang <ztong0001(a)gmail.com> Co-developed-by: Ulf Hansson <ulf.hansson(a)linaro.org> Link: https://lore.kernel.org/r/20210511163944.1233295-1-ztong0001@gmail.com Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Conflicts: drivers/memstick/host/rtsx_usb_ms.c [yyl: rtsx_usb_ms_drv_probe() don't need to fix] Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/memstick/host/rtsx_usb_ms.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/drivers/memstick/host/rtsx_usb_ms.c b/drivers/memstick/host/rtsx_usb_ms.c index 4f64563df7ded..aee62f0618c70 100644 --- a/drivers/memstick/host/rtsx_usb_ms.c +++ b/drivers/memstick/host/rtsx_usb_ms.c @@ -798,9 +798,6 @@ static int rtsx_usb_ms_drv_remove(struct platform_device *pdev) mutex_unlock(&host->host_mutex); wait_for_completion(&host->detect_ms_exit); - memstick_remove_host(msh); - memstick_free_host(msh); - /* Balance possible unbalanced usage count * e.g. unconditional module removal */ @@ -808,10 +805,11 @@ static int rtsx_usb_ms_drv_remove(struct platform_device *pdev) pm_runtime_put(ms_dev(host)); pm_runtime_disable(&pdev->dev); - platform_set_drvdata(pdev, NULL); - + memstick_remove_host(msh); dev_dbg(&(pdev->dev), ": Realtek USB Memstick controller has been removed\n"); + memstick_free_host(msh); + platform_set_drvdata(pdev, NULL); return 0; } -- 2.25.1

1 1

[PATCH] modify arm64 and x86 configs
by Chao Liu 11 Feb '22

11 Feb '22

euler inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4T7MX CVE: NA -------------------------------- Ensure the netswift 10G NIC driver ko can be distributed in ISO on arm64 and provide a separate, distinct keyring for platform trusted keys which is used in secure boot Signed-off-by: Chao Liu <liuchao173(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 6 ++++-- arch/x86/configs/openeuler_defconfig | 3 ++- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index a86e97dd015e..66853efd6431 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -2742,7 +2742,8 @@ CONFIG_I40EVF=m CONFIG_ICE=m CONFIG_FM10K=m # CONFIG_IGC is not set -# CONFIG_NET_VENDOR_NETSWIFT is not set +CONFIG_NET_VENDOR_NETSWIFT=y +CONFIG_TXGBE=m # CONFIG_JME is not set # CONFIG_NET_VENDOR_MARVELL is not set CONFIG_NET_VENDOR_MELLANOX=y @@ -6502,7 +6503,8 @@ CONFIG_INTEGRITY=y CONFIG_INTEGRITY_SIGNATURE=y CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y CONFIG_INTEGRITY_TRUSTED_KEYRING=y -# CONFIG_INTEGRITY_PLATFORM_KEYRING is not set +CONFIG_INTEGRITY_PLATFORM_KEYRING=y +CONFIG_LOAD_UEFI_KEYS=y CONFIG_INTEGRITY_AUDIT=y CONFIG_IMA=y # CONFIG_IMA_KEXEC is not set diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index febdd7627f8b..316c4122a859 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -7603,7 +7603,8 @@ CONFIG_INTEGRITY=y CONFIG_INTEGRITY_SIGNATURE=y CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y CONFIG_INTEGRITY_TRUSTED_KEYRING=y -# CONFIG_INTEGRITY_PLATFORM_KEYRING is not set +CONFIG_INTEGRITY_PLATFORM_KEYRING=y +CONFIG_LOAD_UEFI_KEYS=y CONFIG_INTEGRITY_AUDIT=y CONFIG_IMA=y CONFIG_IMA_MEASURE_PCR_IDX=10 -- 2.23.0

2 1

[PATCH openEuler-5.10 1/6] sysctl: returns -EINVAL when a negative value is passed to proc_doulongvec_minmax
by Zheng Zengkai 10 Feb '22

10 Feb '22

From: Baokun Li <libaokun1(a)huawei.com> mainline inclusion from mainline-5.17-rc1 commit 1622ed7d0743201293094162c26019d2573ecacb category: bugfix bugzilla: 185873, https://gitee.com/openeuler/kernel/issues/I4MTTR Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- When we pass a negative value to the proc_doulongvec_minmax() function, the function returns 0, but the corresponding interface value does not change. we can easily reproduce this problem with the following commands: cd /proc/sys/fs/epoll echo -1 > max_user_watches; echo $?; cat max_user_watches This function requires a non-negative number to be passed in, so when a negative number is passed in, -EINVAL is returned. Link: https://lkml.kernel.org/r/20211220092627.3744624-1-libaokun1@huawei.com Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reported-by: Hulk Robot <hulkci(a)huawei.com> Acked-by: Luis Chamberlain <mcgrof(a)kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- kernel/sysctl.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/kernel/sysctl.c b/kernel/sysctl.c index d7473cd5e72b..89ef0c1a1642 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -1186,10 +1186,11 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, err = proc_get_long(&p, &left, &val, &neg, proc_wspace_sep, sizeof(proc_wspace_sep), NULL); - if (err) + if (err || neg) { + err = -EINVAL; break; - if (neg) - continue; + } + val = convmul * val / convdiv; if ((min && val < *min) || (max && val > *max)) { err = -EINVAL; -- 2.20.1

1 5

[PATCH openEuler-5.10 01/23] arm64: ensure ERET from kthread is illegal
by Zheng Zengkai 10 Feb '22

10 Feb '22

From: Mark Rutland <mark.rutland(a)arm.com> mainline inclusion from mainline-v5.11-rc1 commit f80d034086d5bfcfd3bf4ab6f52b2df78c3ad2fa category: performance bugzilla: https://e.gitee.com/open_euler/issues/list?issue=I4SCW7 CVE: NA ------------------------------------------------------------------------- For consistency, all tasks have a pt_regs reserved at the highest portion of their task stack. Among other things, this ensures that a task's SP is always pointing within its stack rather than pointing immediately past the end. While it is never legitimate to ERET from a kthread, we take pains to initialize pt_regs for kthreads as if this were legitimate. As this is never legitimate, the effects of an erroneous return are rarely tested. Let's simplify things by initializing a kthread's pt_regs such that an ERET is caught as an illegal exception return, and removing the explicit initialization of other exception context. Note that as spectre_v4_enable_task_mitigation() only manipulates the PSTATE within the unused regs this is safe to remove. As user tasks will have their exception context initialized via start_thread() or start_compat_thread(), this should only impact cases where something has gone very wrong and we'd like that to be clearly indicated. Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Cc: Christoph Hellwig <hch(a)lst.de> Cc: James Morse <james.morse(a)arm.com> Cc: Will Deacon <will(a)kernel.org> Link: https://lore.kernel.org/r/20201113124937.20574-2-mark.rutland@arm.com Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Signed-off-by: Zhen Lei <thunder.leizhen(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- arch/arm64/kernel/process.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c index 1e5202080895..a55d518ee868 100644 --- a/arch/arm64/kernel/process.c +++ b/arch/arm64/kernel/process.c @@ -430,16 +430,15 @@ int copy_thread(unsigned long clone_flags, unsigned long stack_start, if (clone_flags & CLONE_SETTLS) p->thread.uw.tp_value = tls; } else { + /* + * A kthread has no context to ERET to, so ensure any buggy + * ERET is treated as an illegal exception return. + * + * When a user task is created from a kthread, childregs will + * be initialized by start_thread() or start_compat_thread(). + */ memset(childregs, 0, sizeof(struct pt_regs)); - childregs->pstate = PSR_MODE_EL1h; - if (IS_ENABLED(CONFIG_ARM64_UAO) && - cpus_have_const_cap(ARM64_HAS_UAO)) - childregs->pstate |= PSR_UAO_BIT; - - spectre_v4_enable_task_mitigation(p); - - if (system_uses_irq_prio_masking()) - childregs->pmr_save = GIC_PRIO_IRQON; + childregs->pstate = PSR_MODE_EL1h | PSR_IL_BIT; p->thread.cpu_context.x19 = stack_start; p->thread.cpu_context.x20 = stk_sz; -- 2.20.1

1 22

[PATCH openEuler-1.0-LTS] ext4:fix file system corrupted when rmdir non empty directory with IO error
by Yang Yingliang 10 Feb '22

10 Feb '22

From: Ye Bin <yebin10(a)huawei.com> hulk inclusion category: bugfix bugzilla: 186220, https://gitee.com/openeuler/kernel/issues/I4T50S ----------------------------------------------- We inject IO error when rmdir non empty direcory, then got issue as follows: step1: mkfs.ext4 -F /dev/sda step2: mount /dev/sda test step3: cd test step4: mkdir -p 1/2 step5: rmdir 1 [ 110.920551] ext4_empty_dir: inject fault [ 110.921926] EXT4-fs warning (device sda): ext4_rmdir:3113: inode #12: comm rmdir: empty directory '1' has too many links (3) step6: cd .. step7: umount test step8: fsck.ext4 -f /dev/sda e2fsck 1.42.9 (28-Dec-2013) Pass 1: Checking inodes, blocks, and sizes Pass 2: Checking directory structure Entry '..' in .../??? (13) has deleted/unused inode 12. Clear<y>? yes Pass 3: Checking directory connectivity Unconnected directory inode 13 (...) Connect to /lost+found<y>? yes Pass 4: Checking reference counts Inode 13 ref count is 3, should be 2. Fix<y>? yes Pass 5: Checking group summary information /dev/sda: ***** FILE SYSTEM WAS MODIFIED ***** /dev/sda: 12/131072 files (0.0% non-contiguous), 26157/524288 blocks ext4_rmdir if (!ext4_empty_dir(inode)) goto end_rmdir; ext4_empty_dir bh = ext4_read_dirblock(inode, 0, DIRENT_HTREE); if (IS_ERR(bh)) return true; Now if read directory block failed, 'ext4_empty_dir' will return true, assume directory is empty. Obviously, it will lead to above issue. To solve this issue, if read directory block failed 'ext4_empty_dir' just return false. Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/ext4/namei.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c index 58dd74b804805..84f68e15e853b 100644 --- a/fs/ext4/namei.c +++ b/fs/ext4/namei.c @@ -2750,7 +2750,7 @@ bool ext4_empty_dir(struct inode *inode) */ bh = ext4_read_dirblock(inode, 0, DIRENT_HTREE); if (IS_ERR(bh)) - return true; + return false; de = (struct ext4_dir_entry_2 *) bh->b_data; if (ext4_check_dir_entry(inode, NULL, de, bh, bh->b_data, bh->b_size, @@ -2781,7 +2781,7 @@ bool ext4_empty_dir(struct inode *inode) continue; } if (IS_ERR(bh)) - return true; + return false; } de = (struct ext4_dir_entry_2 *) (bh->b_data + (offset & (sb->s_blocksize - 1))); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/3] bpf: Use dedicated bpf_trace_printk event instead of trace_printk()
by Yang Yingliang 10 Feb '22

10 Feb '22

From: Alan Maguire <alan.maguire(a)oracle.com> mainline inclusion from mainline-v5.9-rc1 commit ac5a72ea5c8989871e61f6bb0852e0f91de51ebe category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4PKDW CVE: NA -------------------------------- The bpf helper bpf_trace_printk() uses trace_printk() under the hood. This leads to an alarming warning message originating from trace buffer allocation which occurs the first time a program using bpf_trace_printk() is loaded. We can instead create a trace event for bpf_trace_printk() and enable it in-kernel when/if we encounter a program using the bpf_trace_printk() helper. With this approach, trace_printk() is not used directly and no warning message appears. This work was started by Steven (see Link) and finished by Alan; added Steven's Signed-off-by with his permission. Signed-off-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org> Signed-off-by: Alan Maguire <alan.maguire(a)oracle.com> Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Acked-by: Andrii Nakryiko <andriin(a)fb.com> Link: https://lore.kernel.org/r/20200628194334.6238b933@oasis.local.home Link: https://lore.kernel.org/bpf/1594641154-18897-2-git-send-email-alan.maguire@… Signed-off-by: Liu Xinpeng <liuxp11(a)chinatelecom.cn> # openEuler_contributor Signed-off-by: Ctyun Kernel <ctyuncommiter01(a)chinatelecom.cn> # openEuler_contributor Signed-off-by: Pu Lehui <pulehui(a)huawei.com> Reviewed-by: Yang Jihong <yangjihong1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/trace/Makefile | 2 ++ kernel/trace/bpf_trace.c | 42 +++++++++++++++++++++++++++++++++++----- kernel/trace/bpf_trace.h | 34 ++++++++++++++++++++++++++++++++ 3 files changed, 73 insertions(+), 5 deletions(-) create mode 100644 kernel/trace/bpf_trace.h diff --git a/kernel/trace/Makefile b/kernel/trace/Makefile index f81dadbc7c4ac..846b6b0d025e9 100644 --- a/kernel/trace/Makefile +++ b/kernel/trace/Makefile @@ -28,6 +28,8 @@ ifdef CONFIG_GCOV_PROFILE_FTRACE GCOV_PROFILE := y endif +CFLAGS_bpf_trace.o := -I$(src) + CFLAGS_trace_benchmark.o := -I$(src) CFLAGS_trace_events_filter.o := -I$(src) diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index e0b0e921f1ab7..f359f79d9b690 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -11,12 +11,16 @@ #include <linux/uaccess.h> #include <linux/ctype.h> #include <linux/kprobes.h> +#include <linux/spinlock.h> #include <linux/syscalls.h> #include <linux/error-injection.h> #include "trace_probe.h" #include "trace.h" +#define CREATE_TRACE_POINTS +#include "bpf_trace.h" + #ifdef CONFIG_MODULES struct bpf_trace_module { struct module *module; @@ -318,6 +322,30 @@ static const struct bpf_func_proto *bpf_get_probe_write_proto(void) return &bpf_probe_write_user_proto; } +static DEFINE_RAW_SPINLOCK(trace_printk_lock); + +#define BPF_TRACE_PRINTK_SIZE 1024 + +static inline __printf(1, 0) int bpf_do_trace_printk(const char *fmt, ...) +{ + static char buf[BPF_TRACE_PRINTK_SIZE]; + unsigned long flags; + va_list ap; + int ret; + + raw_spin_lock_irqsave(&trace_printk_lock, flags); + va_start(ap, fmt); + ret = vsnprintf(buf, sizeof(buf), fmt, ap); + va_end(ap); + /* vsnprintf() will not append null for zero-length strings */ + if (ret == 0) + buf[0] = '\0'; + trace_bpf_trace_printk(buf); + raw_spin_unlock_irqrestore(&trace_printk_lock, flags); + + return ret; +} + /* * Only limited trace_printk() conversion specifiers allowed: * %d %i %u %x %ld %li %lu %lx %lld %lli %llu %llx %p %s @@ -408,8 +436,7 @@ BPF_CALL_5(bpf_trace_printk, char *, fmt, u32, fmt_size, u64, arg1, */ #define __BPF_TP_EMIT() __BPF_ARG3_TP() #define __BPF_TP(...) \ - __trace_printk(0 /* Fake ip */, \ - fmt, ##__VA_ARGS__) + bpf_do_trace_printk(fmt, ##__VA_ARGS__) #define __BPF_ARG1_TP(...) \ ((mod[0] == 2 || (mod[0] == 1 && __BITS_PER_LONG == 64)) \ @@ -446,10 +473,15 @@ static const struct bpf_func_proto bpf_trace_printk_proto = { const struct bpf_func_proto *bpf_get_trace_printk_proto(void) { /* - * this program might be calling bpf_trace_printk, - * so allocate per-cpu printk buffers + * This program might be calling bpf_trace_printk, + * so enable the associated bpf_trace/bpf_trace_printk event. + * Repeat this each time as it is possible a user has + * disabled bpf_trace_printk events. By loading a program + * calling bpf_trace_printk() however the user has expressed + * the intent to see such events. */ - trace_printk_init_buffers(); + if (trace_set_clr_event("bpf_trace", "bpf_trace_printk", 1)) + pr_warn_ratelimited("could not enable bpf_trace_printk events"); return &bpf_trace_printk_proto; } diff --git a/kernel/trace/bpf_trace.h b/kernel/trace/bpf_trace.h new file mode 100644 index 0000000000000..9acbc11ac7bbc --- /dev/null +++ b/kernel/trace/bpf_trace.h @@ -0,0 +1,34 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#undef TRACE_SYSTEM +#define TRACE_SYSTEM bpf_trace + +#if !defined(_TRACE_BPF_TRACE_H) || defined(TRACE_HEADER_MULTI_READ) + +#define _TRACE_BPF_TRACE_H + +#include <linux/tracepoint.h> + +TRACE_EVENT(bpf_trace_printk, + + TP_PROTO(const char *bpf_string), + + TP_ARGS(bpf_string), + + TP_STRUCT__entry( + __string(bpf_string, bpf_string) + ), + + TP_fast_assign( + __assign_str(bpf_string, bpf_string); + ), + + TP_printk("%s", __get_str(bpf_string)) +); + +#endif /* _TRACE_BPF_TRACE_H */ + +#undef TRACE_INCLUDE_PATH +#define TRACE_INCLUDE_PATH . +#define TRACE_INCLUDE_FILE bpf_trace + +#include <trace/define_trace.h> -- 2.25.1

1 2

[PATCH openEuler-1.0-LTS] net: cipso: fix warnings in netlbl_cipsov4_add_std
by Yang Yingliang 10 Feb '22

10 Feb '22

From: Pavel Skripkin <paskripkin(a)gmail.com> mainline inclusion from mainline-v5.15-rc1 commit 8ca34a13f7f9b3fa2c464160ffe8cc1a72088204 category: bugfix bugzilla: 186065 CVE: NA ------------------------------------------------- Syzbot reported warning in netlbl_cipsov4_add(). The problem was in too big doi_def->map.std->lvl.local_size passed to kcalloc(). Since this value comes from userpace there is no need to warn if value is not correct. The same problem may occur with other kcalloc() calls in this function, so, I've added __GFP_NOWARN flag to all kcalloc() calls there. Reported-and-tested-by: syzbot+cdd51ee2e6b0b2e18c0d(a)syzkaller.appspotmail.com Fixes: 96cb8e3313c7 ("[NetLabel]: CIPSOv4 and Unlabeled packet integration") Acked-by: Paul Moore <paul(a)paul-moore.com> Signed-off-by: Pavel Skripkin <paskripkin(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/netlabel/netlabel_cipso_v4.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c index 3e3494c8d42f8..0559d442ad807 100644 --- a/net/netlabel/netlabel_cipso_v4.c +++ b/net/netlabel/netlabel_cipso_v4.c @@ -198,14 +198,14 @@ static int netlbl_cipsov4_add_std(struct genl_info *info, } doi_def->map.std->lvl.local = kcalloc(doi_def->map.std->lvl.local_size, sizeof(u32), - GFP_KERNEL); + GFP_KERNEL | __GFP_NOWARN); if (doi_def->map.std->lvl.local == NULL) { ret_val = -ENOMEM; goto add_std_failure; } doi_def->map.std->lvl.cipso = kcalloc(doi_def->map.std->lvl.cipso_size, sizeof(u32), - GFP_KERNEL); + GFP_KERNEL | __GFP_NOWARN); if (doi_def->map.std->lvl.cipso == NULL) { ret_val = -ENOMEM; goto add_std_failure; @@ -273,7 +273,7 @@ static int netlbl_cipsov4_add_std(struct genl_info *info, doi_def->map.std->cat.local = kcalloc( doi_def->map.std->cat.local_size, sizeof(u32), - GFP_KERNEL); + GFP_KERNEL | __GFP_NOWARN); if (doi_def->map.std->cat.local == NULL) { ret_val = -ENOMEM; goto add_std_failure; @@ -281,7 +281,7 @@ static int netlbl_cipsov4_add_std(struct genl_info *info, doi_def->map.std->cat.cipso = kcalloc( doi_def->map.std->cat.cipso_size, sizeof(u32), - GFP_KERNEL); + GFP_KERNEL | __GFP_NOWARN); if (doi_def->map.std->cat.cipso == NULL) { ret_val = -ENOMEM; goto add_std_failure; -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] xsk: Use struct_size() helper
by Yang Yingliang 09 Feb '22

09 Feb '22

From: Magnus Karlsson <magnus.karlsson(a)intel.com> mainline inclusion from mainline-v5.6-rc1 commit 1d9cb1f381860b529edec57cf7a08133f40366eb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4SGA9?from=project-issue CVE: NA -------------------------------- Improve readability and maintainability by using the struct_size() helper when allocating the AF_XDP rings. Signed-off-by: Magnus Karlsson <magnus.karlsson(a)intel.com> Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Link: https://lore.kernel.org/bpf/1576759171-28550-13-git-send-email-magnus.karls… Signed-off-by: Huang Guobin <huangguobin4(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/xdp/xsk_queue.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/net/xdp/xsk_queue.c b/net/xdp/xsk_queue.c index 6c32e92e98fcb..de10bd9401f84 100644 --- a/net/xdp/xsk_queue.c +++ b/net/xdp/xsk_queue.c @@ -15,14 +15,14 @@ void xskq_set_umem(struct xsk_queue *q, struct xdp_umem_props *umem_props) q->umem_props = *umem_props; } -static u32 xskq_umem_get_ring_size(struct xsk_queue *q) +static size_t xskq_get_ring_size(struct xsk_queue *q, bool umem_queue) { - return sizeof(struct xdp_umem_ring) + q->nentries * sizeof(u64); -} + struct xdp_umem_ring *umem_ring; + struct xdp_rxtx_ring *rxtx_ring; -static u32 xskq_rxtx_get_ring_size(struct xsk_queue *q) -{ - return sizeof(struct xdp_ring) + q->nentries * sizeof(struct xdp_desc); + if (umem_queue) + return struct_size(umem_ring, desc, q->nentries); + return struct_size(rxtx_ring, desc, q->nentries); } struct xsk_queue *xskq_create(u32 nentries, bool umem_queue) @@ -40,8 +40,7 @@ struct xsk_queue *xskq_create(u32 nentries, bool umem_queue) gfp_flags = GFP_KERNEL | __GFP_ZERO | __GFP_NOWARN | __GFP_COMP | __GFP_NORETRY; - size = umem_queue ? xskq_umem_get_ring_size(q) : - xskq_rxtx_get_ring_size(q); + size = xskq_get_ring_size(q, umem_queue); q->ring = (struct xdp_ring *)__get_free_pages(gfp_flags, get_order(size)); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 01/16] mm,hwpoison: cleanup unused PageHuge() check
by Yang Yingliang 09 Feb '22

09 Feb '22

From: Naoya Horiguchi <naoya.horiguchi(a)nec.com> mainline inclusion from linux-v5.10-rc1 commit 7d9d46ac87f91b8dedad5241d64382b650e26487 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4LE22 CVE: NA -------------------------------- Drop the PageHuge check, which is dead code since memory_failure() forks into memory_failure_hugetlb() for hugetlb pages. memory_failure() and memory_failure_hugetlb() shares some functions like hwpoison_user_mappings() and identify_page_state(), so they should properly handle 4kB page, thp, and hugetlb. Signed-off-by: Naoya Horiguchi <naoya.horiguchi(a)nec.com> Signed-off-by: Oscar Salvador <osalvador(a)suse.de> Reviewed-by: Mike Kravetz <mike.kravetz(a)oracle.com> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> Reviewed-by: tong tiangen <tongtiangen(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- mm/memory-failure.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 72e1746e5386f..a432ba37e132a 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -1373,10 +1373,7 @@ int memory_failure(unsigned long pfn, int flags) * page_remove_rmap() in try_to_unmap_one(). So to determine page status * correctly, we save a copy of the page flags at this time. */ - if (PageHuge(p)) - page_flags = hpage->flags; - else - page_flags = p->flags; + page_flags = p->flags; /* * unpoison always clear PG_hwpoison inside page lock -- 2.25.1

1 15

[PATCH openEuler-1.0-LTS] scsi: Revert "target: iscsi: Wait for all commands to finish before freeing a session"
by Yang Yingliang 09 Feb '22

09 Feb '22

From: Bart Van Assche <bvanassche(a)acm.org> mainline inclusion from mainline-v5.6-rc3 commit 807b9515b7d044cf77df31f1af9d842a76ecd5cb category: bugfix bugzilla: 186215 CVE: NA -------------------------------- Since commit e9d3009cb936 introduced a regression and since the fix for that regression was not perfect, revert this commit. Link: https://marc.info/?l=target-devel&m=158157054906195 Cc: Rahul Kundu <rahul.kundu(a)chelsio.com> Cc: Mike Marciniszyn <mike.marciniszyn(a)intel.com> Cc: Sagi Grimberg <sagi(a)grimberg.me> Reported-by: Dakshaja Uppalapati <dakshaja(a)chelsio.com> Fixes: e9d3009cb936 ("scsi: target: iscsi: Wait for all commands to finish before freeing a session") Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/target/iscsi/iscsi_target.c | 10 ++-------- include/scsi/iscsi_proto.h | 1 - 2 files changed, 2 insertions(+), 9 deletions(-) diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c index 92843e8db711b..58ccded1be857 100644 --- a/drivers/target/iscsi/iscsi_target.c +++ b/drivers/target/iscsi/iscsi_target.c @@ -1156,9 +1156,7 @@ int iscsit_setup_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd, hdr->cmdsn, be32_to_cpu(hdr->data_length), payload_length, conn->cid); - if (target_get_sess_cmd(&cmd->se_cmd, true) < 0) - return iscsit_add_reject_cmd(cmd, - ISCSI_REASON_WAITING_FOR_LOGOUT, buf); + target_get_sess_cmd(&cmd->se_cmd, true); cmd->sense_reason = transport_lookup_cmd_lun(&cmd->se_cmd, scsilun_to_int(&hdr->lun)); @@ -2012,9 +2010,7 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd, conn->sess->se_sess, 0, DMA_NONE, TCM_SIMPLE_TAG, cmd->sense_buffer + 2); - if (target_get_sess_cmd(&cmd->se_cmd, true) < 0) - return iscsit_add_reject_cmd(cmd, - ISCSI_REASON_WAITING_FOR_LOGOUT, buf); + target_get_sess_cmd(&cmd->se_cmd, true); /* * TASK_REASSIGN for ERL=2 / connection stays inside of @@ -4230,8 +4226,6 @@ int iscsit_close_connection( * must wait until they have completed. */ iscsit_check_conn_usage_count(conn); - target_sess_cmd_list_set_waiting(sess->se_sess); - target_wait_for_sess_cmds(sess->se_sess); ahash_request_free(conn->conn_tx_hash); if (conn->conn_rx_hash) { diff --git a/include/scsi/iscsi_proto.h b/include/scsi/iscsi_proto.h index f0a01a54bd153..df156f1d50b2d 100644 --- a/include/scsi/iscsi_proto.h +++ b/include/scsi/iscsi_proto.h @@ -638,7 +638,6 @@ struct iscsi_reject { #define ISCSI_REASON_BOOKMARK_INVALID 9 #define ISCSI_REASON_BOOKMARK_NO_RESOURCES 10 #define ISCSI_REASON_NEGOTIATION_RESET 11 -#define ISCSI_REASON_WAITING_FOR_LOGOUT 12 /* Max. number of Key=Value pairs in a text message */ #define MAX_KEY_VALUE_PAIRS 8192 -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] mm: Modify sharepool sp_mmap() page_offset
by Yang Yingliang 09 Feb '22

09 Feb '22

From: Guo Mengqi <guomengqi3(a)huawei.com> ascend inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4SPNL CVE: NA ----------------------------------- In sp_mmap(), if use offset = va - MMAP_BASE/DVPP_BASE, then normal sp_alloc pgoff may have same value with DVPP pgoff, causing DVPP and sp_alloc mapped to overlapped part of file unexpectedly. To fix the problem, pass VA value as mmap offset, for in this scenario, VA value in one task address space will not be same. Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> Reviewed-by: Ding Tianhong <dingtianhong(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- mm/share_pool.c | 21 +++++---------------- 1 file changed, 5 insertions(+), 16 deletions(-) diff --git a/mm/share_pool.c b/mm/share_pool.c index ef74de39053b2..90733b807f12e 100644 --- a/mm/share_pool.c +++ b/mm/share_pool.c @@ -57,6 +57,11 @@ #define spg_valid(spg) ((spg)->is_alive == true) +/* Use spa va address as mmap offset. This can work because spa_file + * is setup with 64-bit address space. So va shall be well covered. + */ +#define addr_offset(spa) ((spa)->va_start) + #define byte2kb(size) ((size) >> 10) #define byte2mb(size) ((size) >> 20) #define page2kb(page_num) ((page_num) << (PAGE_SHIFT - 10)) @@ -950,22 +955,6 @@ static bool is_device_addr(unsigned long addr) return false; } -static loff_t addr_offset(struct sp_area *spa) -{ - unsigned long addr; - - if (unlikely(!spa)) { - WARN(1, "invalid spa when calculate addr offset\n"); - return 0; - } - addr = spa->va_start; - - if (!is_device_addr(addr)) - return (loff_t)(addr - MMAP_SHARE_POOL_START); - - return (loff_t)(addr - sp_dev_va_start[spa->device_id]); -} - static struct sp_group *create_spg(int spg_id) { int ret; -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/2] uce: copy_from_user scenario support kernel recovery
by Yang Yingliang 09 Feb '22

09 Feb '22

From: Tong Tiangen <tongtiangen(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4SK3S CVE: NA -------------------------------- This patch add uce kernel recovery path support in copy_from_user. Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/arm64/include/asm/exception.h | 1 + arch/arm64/lib/copy_from_user.S | 6 ++++++ arch/arm64/mm/fault.c | 17 +++++++++++++++-- kernel/sysctl.c | 3 ++- 4 files changed, 24 insertions(+), 3 deletions(-) diff --git a/arch/arm64/include/asm/exception.h b/arch/arm64/include/asm/exception.h index 559d86ad9e5d5..d0c8a1fda453a 100644 --- a/arch/arm64/include/asm/exception.h +++ b/arch/arm64/include/asm/exception.h @@ -51,6 +51,7 @@ struct uce_kernel_recovery_info { extern int copy_page_cow_sea_fallback(void); extern int copy_generic_read_sea_fallback(void); +extern int copy_from_user_sea_fallback(void); #endif #endif /* __ASM_EXCEPTION_H */ diff --git a/arch/arm64/lib/copy_from_user.S b/arch/arm64/lib/copy_from_user.S index 7cd6eeaa216cf..d1afb61df158b 100644 --- a/arch/arm64/lib/copy_from_user.S +++ b/arch/arm64/lib/copy_from_user.S @@ -72,6 +72,12 @@ ENTRY(__arch_copy_from_user) uaccess_disable_not_uao x3, x4 mov x0, #0 // Nothing to copy ret + + .global copy_from_user_sea_fallback +copy_from_user_sea_fallback: + uaccess_disable_not_uao x3, x4 + mov x0, #-1 + ret ENDPROC(__arch_copy_from_user) .section .fixup,"ax" diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c index 08040fe73199a..50e37f4097ccc 100644 --- a/arch/arm64/mm/fault.c +++ b/arch/arm64/mm/fault.c @@ -660,9 +660,18 @@ static int do_bad(unsigned long addr, unsigned int esr, struct pt_regs *regs) int kernel_access_sea_recovery; #define UCE_KER_REC_NUM ARRAY_SIZE(reco_info) +/* + * One entry corresponds to one scene, and the scene switch is controlled by the + * corresponding bit of kernel_access_sea_recovery + * (the first entry corresponds to bit0, the second entry corresponds to bit1...), + * and the switch is visible to the user, so the order of eatch entry here cannot + * be easily change. Now the maximum entry is limited by the type of variable + * kernel_access_sea_recovery. + */ static struct uce_kernel_recovery_info reco_info[] = { {copy_page_cow_sea_fallback, "copy_page_cow", (unsigned long)copy_page_cow, 0}, {copy_generic_read_sea_fallback, "__arch_copy_to_user_generic_read", (unsigned long)__arch_copy_to_user_generic_read, 0}, + {copy_from_user_sea_fallback, "__arch_copy_from_user", (unsigned long)__arch_copy_from_user, 0}, }; static int __init kernel_access_sea_recovery_init(void) @@ -769,6 +778,9 @@ static int is_in_kernel_recovery(unsigned int esr, struct pt_regs *regs) } for (i = 0; i < UCE_KER_REC_NUM; i++) { + if (!((kernel_access_sea_recovery >> i) & 0x1)) + continue; + info = &reco_info[i]; if (info->fn && regs->pc >= info->addr && regs->pc < (info->addr + info->size)) { @@ -777,7 +789,8 @@ static int is_in_kernel_recovery(unsigned int esr, struct pt_regs *regs) } } - pr_emerg("UCE: symbol is not match.\n"); + pr_emerg("UCE: symbol is not match or switch if off, kernel recovery %d.\n", + kernel_access_sea_recovery); return -EINVAL; } #endif @@ -847,7 +860,7 @@ static int do_sea(unsigned long addr, unsigned int esr, struct pt_regs *regs) "Uncorrected hardware memory use with kernel recovery in kernel-access\n", current); } else { - die("Uncorrected hardware memory error (kernel recovery on but not match idx) in kernel-access\n", + die("Uncorrected hardware memory error (not match idx or sence switch is off) in kernel-access\n", regs, esr); } diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 542611081c610..302cc4c7de4df 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -130,6 +130,7 @@ static int __maybe_unused two = 2; static int __maybe_unused three = 3; static int __maybe_unused four = 4; static int __maybe_unused five = 5; +static int __maybe_unused seven = 7; static unsigned long zero_ul; static unsigned long one_ul = 1; static unsigned long long_max = LONG_MAX; @@ -1280,7 +1281,7 @@ static struct ctl_table kern_table[] = { .mode = 0644, .proc_handler = proc_dointvec_minmax, .extra1 = &zero, - .extra2 = &three, + .extra2 = &seven, }, #endif -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/5] share_pool: Fix flags conflict
by Yang Yingliang 09 Feb '22

09 Feb '22

From: Wang Wensheng <wangwensheng4(a)huawei.com> ascend inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4SON8 CVE: NA ------------------------------------------------- MAP_SHARE_POOL and MAP_FIXED_NOREPLACE have the same value. Redefine MAP_SHARE_POOL to fix it. Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/share_pool.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/share_pool.h b/include/linux/share_pool.h index cd4c305449dd9..88ef96ac0bfb3 100644 --- a/include/linux/share_pool.h +++ b/include/linux/share_pool.h @@ -170,7 +170,7 @@ struct sp_walk_data { pmd_t *pmd; }; -#define MAP_SHARE_POOL 0x100000 +#define MAP_SHARE_POOL 0x200000 #define MMAP_TOP_4G_SIZE 0x100000000UL -- 2.25.1

1 4

[PATCH openEuler-1.0-LTS 01/36] mm/memory_hotplug: drop "online" parameter from add_memory_resource()
by Yang Yingliang 09 Feb '22

09 Feb '22

From: David Hildenbrand <david(a)redhat.com> mainline inclusion from linux-5.0-rc1 commit f29d8e9c0191a2a02500945db505e5c89159c3f4 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4SK3S CVE: NA -------------------------------- Userspace should always be in charge of how to online memory and if memory should be onlined automatically in the kernel. Let's drop the parameter to overwrite this - XEN passes memhp_auto_online, just like add_memory(), so we can directly use that instead internally. Link: http://lkml.kernel.org/r/20181123123740.27652-1-david@redhat.com Signed-off-by: David Hildenbrand <david(a)redhat.com> Acked-by: Michal Hocko <mhocko(a)suse.com> Reviewed-by: Oscar Salvador <osalvador(a)suse.de> Acked-by: Juergen Gross <jgross(a)suse.com> Cc: Boris Ostrovsky <boris.ostrovsky(a)oracle.com> Cc: Stefano Stabellini <sstabellini(a)kernel.org> Cc: Dan Williams <dan.j.williams(a)intel.com> Cc: Pavel Tatashin <pasha.tatashin(a)oracle.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: Joonsoo Kim <iamjoonsoo.kim(a)lge.com> Cc: Arun KS <arunks(a)codeaurora.org> Cc: Mathieu Malaterre <malat(a)debian.org> Cc: Stephen Rothwell <sfr(a)canb.auug.org.au> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/xen/balloon.c | 2 +- include/linux/memory_hotplug.h | 2 +- mm/memory_hotplug.c | 6 +++--- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c index 7703ac47062fa..e692dcf576d66 100644 --- a/drivers/xen/balloon.c +++ b/drivers/xen/balloon.c @@ -352,7 +352,7 @@ static enum bp_state reserve_additional_memory(void) mutex_unlock(&balloon_mutex); /* add_memory_resource() requires the device_hotplug lock */ lock_device_hotplug(); - rc = add_memory_resource(nid, resource, memhp_auto_online); + rc = add_memory_resource(nid, resource); unlock_device_hotplug(); mutex_lock(&balloon_mutex); diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h index 8782f0e993704..9d28fca5bbde8 100644 --- a/include/linux/memory_hotplug.h +++ b/include/linux/memory_hotplug.h @@ -326,7 +326,7 @@ extern int walk_memory_range(unsigned long start_pfn, unsigned long end_pfn, void *arg, int (*func)(struct memory_block *, void *)); extern int __add_memory(int nid, u64 start, u64 size); extern int add_memory(int nid, u64 start, u64 size); -extern int add_memory_resource(int nid, struct resource *resource, bool online); +extern int add_memory_resource(int nid, struct resource *resource); extern int arch_add_memory(int nid, u64 start, u64 size, struct vmem_altmap *altmap, bool want_memblock); extern void move_pfn_range_to_zone(struct zone *zone, unsigned long start_pfn, diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c index 1e20ad038496d..f13144a65b127 100644 --- a/mm/memory_hotplug.c +++ b/mm/memory_hotplug.c @@ -1051,7 +1051,7 @@ static int online_memory_block(struct memory_block *mem, void *arg) * * we are OK calling __meminit stuff here - we have CONFIG_MEMORY_HOTPLUG */ -int __ref add_memory_resource(int nid, struct resource *res, bool online) +int __ref add_memory_resource(int nid, struct resource *res) { u64 start, size; bool new_node = false; @@ -1114,7 +1114,7 @@ int __ref add_memory_resource(int nid, struct resource *res, bool online) mem_hotplug_done(); /* online pages if requested */ - if (online) + if (memhp_auto_online) walk_memory_range(PFN_DOWN(start), PFN_UP(start + size - 1), NULL, online_memory_block); @@ -1138,7 +1138,7 @@ int __ref __add_memory(int nid, u64 start, u64 size) if (IS_ERR(res)) return PTR_ERR(res); - ret = add_memory_resource(nid, res, memhp_auto_online); + ret = add_memory_resource(nid, res); if (ret < 0) release_memory_resource(res); return ret; -- 2.25.1

1 34

Re: [PATCH -next] dm: make sure dm_table is binded before queue request
by weiyongjun (A) 09 Feb '22

09 Feb '22

在 2022/2/9 10:55, Zhang Yi 写道: > We found a NULL pointer dereference problem when using dm-mpath target. > The problem is if we submit IO between loading and binding the table, > we could neither get a valid dm_target nor a valid dm table when > submitting request in dm_mq_queue_rq(). BIO based dm target could > handle this case in dm_submit_bio(). This patch fix this by checking > the valid live table before submitting request. > > Signed-off-by: Zhang Yi <yi.zhang(a)huawei.com> > --- > drivers/md/dm-rq.c | 11 +++++++++-- > 1 file changed, 9 insertions(+), 2 deletions(-) > Looks good to me

1 0

[PATCH openEuler-1.0-LTS v3 0/2]Add copy_from_user and get_user support uce kernel recovery
by Tong Tiangen 08 Feb '22

08 Feb '22

v3 -> v2: make is_get_user_kernel_recovery_enable() inline. v2 -> v1: update commit message. Tong Tiangen (2): uce: copy_from_user scenario support kernel recovery uce: get_user scenario support kernel recovery arch/arm64/include/asm/exception.h | 6 +++ arch/arm64/include/asm/uaccess.h | 67 ++++++++++++++++++++++++++++++ arch/arm64/lib/Makefile | 2 + arch/arm64/lib/copy_from_user.S | 6 +++ arch/arm64/lib/get_user.c | 20 +++++++++ arch/arm64/mm/fault.c | 29 +++++++++++-- include/linux/sched.h | 1 + kernel/sysctl.c | 3 +- mm/internal.h | 1 + 9 files changed, 130 insertions(+), 5 deletions(-) create mode 100644 arch/arm64/lib/get_user.c -- 2.18.0.huawei.25

1 2

[PATCH openEuler-1.0-LTS] ext4: fix e2fsprogs checksum failure for mounted filesystem
by Yang Yingliang 08 Feb '22

08 Feb '22

From: Jan Kara <jack(a)suse.cz> mainline inclusion from mainline-v5.15-rc1 commit b2bbb92f7042e8075fb036bf97043339576330c3 category: bugfix bugzilla: 186203 CVE: NA -------------------------------- Commit 81414b4dd48 ("ext4: remove redundant sb checksum recomputation") removed checksum recalculation after updating superblock free space / inode counters in ext4_fill_super() based on the fact that we will recalculate the checksum on superblock writeout. That is correct assumption but until the writeout happens (which can take a long time) the checksum is incorrect in the buffer cache and if programs such as tune2fs or resize2fs is called shortly after a file system is mounted can fail. So return back the checksum recalculation and add a comment explaining why. Fixes: 81414b4dd48f ("ext4: remove redundant sb checksum recomputation") Cc: stable(a)kernel.org Reported-by: Boyang Xue <bxue(a)redhat.com> Signed-off-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Link: https://lore.kernel.org/r/20210812124737.21981-1-jack@suse.cz Signed-off-by: Zheng Liang <zhengliang6(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/ext4/super.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index b89f431ec78d3..59637e70f9e32 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -4693,6 +4693,14 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) err = percpu_counter_init(&sbi->s_freeinodes_counter, freei, GFP_KERNEL); } + /* + * Update the checksum after updating free space/inode + * counters. Otherwise the superblock can have an incorrect + * checksum in the buffer cache until it is written out and + * e2fsprogs programs trying to open a file system immediately + * after it is mounted can fail. + */ + ext4_superblock_csum_set(sb); if (!err) err = percpu_counter_init(&sbi->s_dirs_counter, ext4_count_dirs(sb), GFP_KERNEL); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/2] mm/memcg_memfs_info: show files that having pages charged in mem_cgroup
by Yang Yingliang 08 Feb '22

08 Feb '22

From: Liu Shixin <liushixin2(a)huawei.com> hulk inclusion category: feature bugzilla: 186182, https://gitee.com/openeuler/kernel/issues/I4SBQX CVE: NA -------------------------------- Support to print rootfs files and tmpfs files that having pages charged in given memory cgroup. The files infomations can be printed through interface "memory.memfs_files_info" or printed when OOM is triggered. In order not to flush memory logs, we limit the maximum number of files to be printed when oom through interface "max_print_files_in_oom". And in order to filter out small files, we limit the minimum size of files that can be printed through interface "size_threshold". Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- Documentation/vm/memcg_memfs_info.rst | 40 ++++ include/linux/memcg_memfs_info.h | 21 ++ init/Kconfig | 10 + mm/Makefile | 1 + mm/memcg_memfs_info.c | 321 ++++++++++++++++++++++++++ mm/memcontrol.c | 11 + 6 files changed, 404 insertions(+) create mode 100644 Documentation/vm/memcg_memfs_info.rst create mode 100644 include/linux/memcg_memfs_info.h create mode 100644 mm/memcg_memfs_info.c diff --git a/Documentation/vm/memcg_memfs_info.rst b/Documentation/vm/memcg_memfs_info.rst new file mode 100644 index 0000000000000..aff432d125e52 --- /dev/null +++ b/Documentation/vm/memcg_memfs_info.rst @@ -0,0 +1,40 @@ +.. SPDX-License-Identifier: GPL-2.0+ + +================ +Memcg Memfs Info +================ + +Overview +======== + +Support to print rootfs files and tmpfs files that having pages charged +in given memory cgroup. The files infomations can be printed through +interface "memory.memfs_files_info" or printed when OOM is triggered. + +User control +============ + +1. /sys/kernel/mm/memcg_memfs_info/enable +----------------------------------------- + +Boolean type. The default value is 0, set it to 1 to enable the feature. + +2. /sys/kernel/mm/memcg_memfs_info/max_print_files_in_oom +--------------------------------------------------------- + +Unsigned long type. The default value is 500, indicating that the maximum of +files can be print to console when OOM is triggered. + +3. /sys/kernel/mm/memcg_memfs_info/size_threshold +------------------------------------------------- + +Unsigned long type. The default value is 0, indicating that the minimum size of +files that can be printed. + +4. /sys/fs/cgroup/memory/<memory>/memory.memfs_files_info +--------------------------------------------------------- + +Outputs the files who use memory in this memory cgroup. + +--- +Liu Shixin, Jan 2022 diff --git a/include/linux/memcg_memfs_info.h b/include/linux/memcg_memfs_info.h new file mode 100644 index 0000000000000..658a91e22bd7e --- /dev/null +++ b/include/linux/memcg_memfs_info.h @@ -0,0 +1,21 @@ +/* SPDX-License-Identifier: GPL-2.0+ */ +#ifndef _LINUX_MEMCG_MEMFS_INFO_H +#define _LINUX_MEMCG_MEMFS_INFO_H + +#include <linux/memcontrol.h> +#include <linux/seq_file.h> + +#ifdef CONFIG_MEMCG_MEMFS_INFO +void mem_cgroup_print_memfs_info(struct mem_cgroup *memcg, struct seq_file *m); +int mem_cgroup_memfs_files_show(struct seq_file *m, void *v); +void mem_cgroup_memfs_info_init(void); +#else +static inline void mem_cgroup_print_memfs_info(struct mem_cgroup *memcg, + struct seq_file *m) +{ +} +static inline void mem_cgroup_memfs_info_init(void) +{ +} +#endif +#endif diff --git a/init/Kconfig b/init/Kconfig index a338519692d54..1a0b15c5a82b9 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -733,6 +733,16 @@ config MEMCG_KMEM depends on MEMCG && !SLOB default y +config MEMCG_MEMFS_INFO + bool "Show memfs files that have pages charged in given memory cgroup" + depends on MEMCG + default n + help + Support to print rootfs files and tmpfs files that having pages + charged in given memory cgroup. The files infomations can be printed + through interface "memory.memfs_files_info" or printed when OOM is + triggered. + config BLK_CGROUP bool "IO controller" depends on BLOCK diff --git a/mm/Makefile b/mm/Makefile index deee05d22a853..8fba091be3868 100644 --- a/mm/Makefile +++ b/mm/Makefile @@ -108,3 +108,4 @@ obj-$(CONFIG_MEMFD_CREATE) += memfd.o obj-$(CONFIG_ASCEND_AUTO_TUNING_HUGEPAGE) += hugepage_tuning.o obj-$(CONFIG_PIN_MEMORY) += pin_mem.o obj-$(CONFIG_ASCEND_SHARE_POOL) += share_pool.o +obj-$(CONFIG_MEMCG_MEMFS_INFO) += memcg_memfs_info.o diff --git a/mm/memcg_memfs_info.c b/mm/memcg_memfs_info.c new file mode 100644 index 0000000000000..346175026cae6 --- /dev/null +++ b/mm/memcg_memfs_info.c @@ -0,0 +1,321 @@ +// SPDX-License-Identifier: GPL-2.0+ + +#include <linux/memcg_memfs_info.h> +#include <linux/fs.h> +#include <linux/sysfs.h> +#include <linux/kobject.h> +#include <linux/slab.h> +#include "../fs/mount.h" + +#define SEQ_printf(m, x...) \ +do { \ + if (m) \ + seq_printf(m, x); \ + else \ + pr_info(x); \ +} while (0) + +struct print_files_control { + struct mem_cgroup *memcg; + struct seq_file *m; + unsigned long size_threshold; + unsigned long max_print_files; + + char *pathbuf; + unsigned long pathbuf_size; + + const char *fs_type_name; + struct vfsmount *vfsmnt; + unsigned long total_print_files; + unsigned long total_files_size; +}; + +static bool memfs_enable; +static unsigned long memfs_size_threshold; +static unsigned long memfs_max_print_files = 500; + +static const char *const fs_type_names[] = { + "rootfs", + "tmpfs", +}; + +static struct vfsmount *memfs_get_vfsmount(struct super_block *sb) +{ + struct mount *mnt; + struct vfsmount *vfsmnt; + + lock_mount_hash(); + list_for_each_entry(mnt, &sb->s_mounts, mnt_instance) { + /* + * There may be multiple mount points for a super_block, + * just need to print one of these mount points to determine + * the file path. + */ + vfsmnt = mntget(&mnt->mnt); + unlock_mount_hash(); + return vfsmnt; + } + unlock_mount_hash(); + + return NULL; +} + +static unsigned long memfs_count_in_mem_cgroup(struct mem_cgroup *memcg, + struct address_space *mapping) +{ + struct radix_tree_iter iter; + unsigned long size = 0; + struct page *page, *head; + void __rcu **slot; + + rcu_read_lock(); + radix_tree_for_each_slot(slot, &mapping->i_pages, &iter, 0) { + page = radix_tree_deref_slot(slot); + + if (unlikely(!page)) + continue; + if (radix_tree_exception(page)) { + if (radix_tree_deref_retry(page)) + slot = radix_tree_iter_retry(&iter); + continue; + } + + head = compound_head(page); + if (memcg == head->mem_cgroup) + size += PAGE_SIZE; + } + rcu_read_unlock(); + return size; +} + +static void memfs_show_file_in_mem_cgroup(void *data, struct inode *inode) +{ + struct print_files_control *pfc = data; + struct dentry *dentry; + unsigned long size; + struct path path; + char *filepath; + + size = memfs_count_in_mem_cgroup(pfc->memcg, inode->i_mapping); + if (!size || size < pfc->size_threshold) + return; + + dentry = d_find_alias(inode); + if (!dentry) + return; + path.mnt = pfc->vfsmnt; + path.dentry = dentry; + filepath = d_absolute_path(&path, pfc->pathbuf, pfc->pathbuf_size); + if (!filepath || IS_ERR(filepath)) + filepath = "(too long)"; + pfc->total_print_files++; + pfc->total_files_size += size; + dput(dentry); + + /* + * To prevent excessive logs, limit the amount of data + * that can be output to logs. + */ + if (!pfc->m && pfc->total_print_files > pfc->max_print_files) + return; + + SEQ_printf(pfc->m, "%lukB %llukB %s\n", + size >> 10, inode->i_size >> 10, filepath); +} + +static void memfs_show_files_in_mem_cgroup(struct super_block *sb, void *data) +{ + struct print_files_control *pfc = data; + struct inode *inode, *toput_inode = NULL; + + if (strncmp(sb->s_type->name, + pfc->fs_type_name, strlen(pfc->fs_type_name))) + return; + + pfc->vfsmnt = memfs_get_vfsmount(sb); + if (!pfc->vfsmnt) + return; + + spin_lock(&sb->s_inode_list_lock); + list_for_each_entry(inode, &sb->s_inodes, i_sb_list) { + spin_lock(&inode->i_lock); + + if ((inode->i_state & (I_FREEING|I_WILL_FREE|I_NEW)) || + (inode->i_mapping->nrpages == 0 && !need_resched())) { + spin_unlock(&inode->i_lock); + continue; + } + __iget(inode); + spin_unlock(&inode->i_lock); + spin_unlock(&sb->s_inode_list_lock); + + memfs_show_file_in_mem_cgroup(pfc, inode); + + iput(toput_inode); + toput_inode = inode; + + cond_resched(); + spin_lock(&sb->s_inode_list_lock); + } + spin_unlock(&sb->s_inode_list_lock); + iput(toput_inode); + mntput(pfc->vfsmnt); +} + +void mem_cgroup_print_memfs_info(struct mem_cgroup *memcg, struct seq_file *m) +{ + struct print_files_control pfc = { + .memcg = memcg, + .m = m, + .max_print_files = memfs_max_print_files, + .size_threshold = memfs_size_threshold, + }; + char *pathbuf; + int i; + + if (!memfs_enable || !memcg) + return; + + pathbuf = kmalloc(PATH_MAX, GFP_KERNEL); + if (!pathbuf) { + SEQ_printf(m, "Show memfs failed due to OOM\n"); + return; + } + pfc.pathbuf = pathbuf; + pfc.pathbuf_size = PATH_MAX; + + for (i = 0; i < ARRAY_SIZE(fs_type_names); i++) { + pfc.fs_type_name = fs_type_names[i]; + pfc.total_print_files = 0; + pfc.total_files_size = 0; + + SEQ_printf(m, "Show %s files (memory-size > %lukB):\n", + pfc.fs_type_name, pfc.size_threshold >> 10); + SEQ_printf(m, "<memory-size> <file-size> <path>\n"); + iterate_supers(memfs_show_files_in_mem_cgroup, &pfc); + + SEQ_printf(m, "total files: %lu, total memory-size: %lukB\n", + pfc.total_print_files, pfc.total_files_size >> 10); + } + + kfree(pfc.pathbuf); +} + +int mem_cgroup_memfs_files_show(struct seq_file *m, void *v) +{ + struct mem_cgroup *memcg = mem_cgroup_from_css(seq_css(m)); + + mem_cgroup_print_memfs_info(memcg, m); + return 0; +} + +static ssize_t memfs_size_threshold_show(struct kobject *kobj, + struct kobj_attribute *attr, + char *buf) +{ + return sprintf(buf, "%lu\n", memfs_size_threshold); +} + +static ssize_t memfs_size_threshold_store(struct kobject *kobj, + struct kobj_attribute *attr, + const char *buf, size_t len) +{ + unsigned long count; + int err; + + err = kstrtoul(buf, 10, &count); + if (err) + return err; + memfs_size_threshold = count; + return len; +} + +static struct kobj_attribute memfs_size_threshold_attr = { + .attr = {"size_threshold", 0644}, + .show = &memfs_size_threshold_show, + .store = &memfs_size_threshold_store, +}; + +static ssize_t memfs_max_print_files_show(struct kobject *kobj, + struct kobj_attribute *attr, + char *buf) +{ + return sprintf(buf, "%lu\n", memfs_max_print_files); +} + +static ssize_t memfs_max_print_files_store(struct kobject *kobj, + struct kobj_attribute *attr, + const char *buf, size_t len) +{ + unsigned long count; + int err; + + err = kstrtoul(buf, 10, &count); + if (err) + return err; + memfs_max_print_files = count; + return len; +} + +static struct kobj_attribute memfs_max_print_files_attr = { + .attr = {"max_print_files_in_oom", 0644}, + .show = &memfs_max_print_files_show, + .store = &memfs_max_print_files_store, +}; + +static ssize_t memfs_enable_show(struct kobject *kobj, + struct kobj_attribute *attr, char *buf) +{ + return sprintf(buf, "%u\n", memfs_enable); +} + +static ssize_t memfs_enable_store(struct kobject *kobj, + struct kobj_attribute *attr, + const char *buf, size_t len) +{ + bool enable; + int err; + + err = kstrtobool(buf, &enable); + if (err) + return err; + + memfs_enable = enable; + return len; +} + +static struct kobj_attribute memfs_enable_attr = { + .attr = {"enable", 0644}, + .show = &memfs_enable_show, + .store = &memfs_enable_store, +}; + +static struct attribute *memfs_attr[] = { + &memfs_size_threshold_attr.attr, + &memfs_max_print_files_attr.attr, + &memfs_enable_attr.attr, + NULL, +}; + +static struct attribute_group memfs_attr_group = { + .attrs = memfs_attr, +}; + +void mem_cgroup_memfs_info_init(void) +{ + struct kobject *memcg_memfs_kobj; + + if (mem_cgroup_disabled()) + return; + + memcg_memfs_kobj = kobject_create_and_add("memcg_memfs_info", mm_kobj); + if (unlikely(!memcg_memfs_kobj)) { + pr_err("failed to create memcg_memfs kobject\n"); + return; + } + + if (sysfs_create_group(memcg_memfs_kobj, &memfs_attr_group)) { + pr_err("failed to register memcg_memfs group\n"); + kobject_put(memcg_memfs_kobj); + } +} diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 974fc5dc6dc81..18b5660dc2459 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -66,6 +66,7 @@ #include <linux/lockdep.h> #include <linux/file.h> #include <linux/tracehook.h> +#include <linux/memcg_memfs_info.h> #include "internal.h" #include <net/sock.h> #include <net/ip.h> @@ -1484,6 +1485,8 @@ void mem_cgroup_print_oom_meminfo(struct mem_cgroup *memcg) pr_cont("\n"); } + + mem_cgroup_print_memfs_info(memcg, NULL); } /* @@ -4705,6 +4708,12 @@ static struct cftype mem_cgroup_legacy_files[] = { .write_s64 = memcg_qos_write, }, #endif +#ifdef CONFIG_MEMCG_MEMFS_INFO + { + .name = "memfs_files_info", + .seq_show = mem_cgroup_memfs_files_show, + }, +#endif #ifdef CONFIG_NUMA { .name = "numa_stat", @@ -6916,6 +6925,8 @@ static int __init mem_cgroup_init(void) soft_limit_tree.rb_tree_per_node[node] = rtpn; } + mem_cgroup_memfs_info_init(); + return 0; } subsys_initcall(mem_cgroup_init); -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS] drm/vmwgfx: Fix stale file descriptors on failed usercopy
by Yang Yingliang 07 Feb '22

07 Feb '22

From: Mathias Krause <minipli(a)grsecurity.net> stable inclusion from linux-4.19.227 commit 0008a0c78fc33a84e2212a7c04e6b21a36ca6f4d CVE: CVE-2022-22942 -------------------------------- commit a0f90c8815706981c483a652a6aefca51a5e191c upstream. A failing usercopy of the fence_rep object will lead to a stale entry in the file descriptor table as put_unused_fd() won't release it. This enables userland to refer to a dangling 'file' object through that still valid file descriptor, leading to all kinds of use-after-free exploitation scenarios. Fix this by deferring the call to fd_install() until after the usercopy has succeeded. Fixes: c906965dee22 ("drm/vmwgfx: Add export fence to file descriptor support") Signed-off-by: Mathias Krause <minipli(a)grsecurity.net> Signed-off-by: Zack Rusin <zackr(a)vmware.com> Signed-off-by: Dave Airlie <airlied(a)redhat.com> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 5 ++-- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 34 ++++++++++++------------- drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 2 +- 4 files changed, 21 insertions(+), 22 deletions(-) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h index 1abe21758b0d7..bca0b8980c0e7 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h @@ -855,15 +855,14 @@ extern int vmw_execbuf_fence_commands(struct drm_file *file_priv, struct vmw_private *dev_priv, struct vmw_fence_obj **p_fence, uint32_t *p_handle); -extern void vmw_execbuf_copy_fence_user(struct vmw_private *dev_priv, +extern int vmw_execbuf_copy_fence_user(struct vmw_private *dev_priv, struct vmw_fpriv *vmw_fp, int ret, struct drm_vmw_fence_rep __user *user_fence_rep, struct vmw_fence_obj *fence, uint32_t fence_handle, - int32_t out_fence_fd, - struct sync_file *sync_file); + int32_t out_fence_fd); extern int vmw_validate_single_buffer(struct vmw_private *dev_priv, struct ttm_buffer_object *bo, bool interruptible, diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c index 3834aa71c9c4c..e65554f5a89d5 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c @@ -3873,20 +3873,19 @@ int vmw_execbuf_fence_commands(struct drm_file *file_priv, * object so we wait for it immediately, and then unreference the * user-space reference. */ -void +int vmw_execbuf_copy_fence_user(struct vmw_private *dev_priv, struct vmw_fpriv *vmw_fp, int ret, struct drm_vmw_fence_rep __user *user_fence_rep, struct vmw_fence_obj *fence, uint32_t fence_handle, - int32_t out_fence_fd, - struct sync_file *sync_file) + int32_t out_fence_fd) { struct drm_vmw_fence_rep fence_rep; if (user_fence_rep == NULL) - return; + return 0; memset(&fence_rep, 0, sizeof(fence_rep)); @@ -3914,20 +3913,14 @@ vmw_execbuf_copy_fence_user(struct vmw_private *dev_priv, * and unreference the handle. */ if (unlikely(ret != 0) && (fence_rep.error == 0)) { - if (sync_file) - fput(sync_file->file); - - if (fence_rep.fd != -1) { - put_unused_fd(fence_rep.fd); - fence_rep.fd = -1; - } - ttm_ref_object_base_unref(vmw_fp->tfile, fence_handle, TTM_REF_USAGE); DRM_ERROR("Fence copy error. Syncing.\n"); (void) vmw_fence_obj_wait(fence, false, false, VMW_FENCE_WAIT_TIMEOUT); } + + return ret ? -EFAULT : 0; } /** @@ -4287,16 +4280,23 @@ int vmw_execbuf_process(struct drm_file *file_priv, (void) vmw_fence_obj_wait(fence, false, false, VMW_FENCE_WAIT_TIMEOUT); + } + } + + ret = vmw_execbuf_copy_fence_user(dev_priv, vmw_fpriv(file_priv), ret, + user_fence_rep, fence, handle, out_fence_fd); + + if (sync_file) { + if (ret) { + /* usercopy of fence failed, put the file object */ + fput(sync_file->file); + put_unused_fd(out_fence_fd); } else { /* Link the fence with the FD created earlier */ fd_install(out_fence_fd, sync_file->file); } } - vmw_execbuf_copy_fence_user(dev_priv, vmw_fpriv(file_priv), ret, - user_fence_rep, fence, handle, - out_fence_fd, sync_file); - /* Don't unreference when handing fence out */ if (unlikely(out_fence != NULL)) { *out_fence = fence; @@ -4315,7 +4315,7 @@ int vmw_execbuf_process(struct drm_file *file_priv, */ vmw_resource_list_unreference(sw_context, &resource_list); - return 0; + return ret; out_unlock_binding: mutex_unlock(&dev_priv->binding_mutex); diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c index 3d546d4093341..72a75316d472b 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c @@ -1169,7 +1169,7 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data, } vmw_execbuf_copy_fence_user(dev_priv, vmw_fp, 0, user_fence_rep, fence, - handle, -1, NULL); + handle, -1); vmw_fence_obj_unreference(&fence); return 0; out_no_create: diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c index 6a712a8d59e93..248d92c85cf69 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c @@ -2662,7 +2662,7 @@ void vmw_kms_helper_buffer_finish(struct vmw_private *dev_priv, if (file_priv) vmw_execbuf_copy_fence_user(dev_priv, vmw_fpriv(file_priv), ret, user_fence_rep, fence, - handle, -1, NULL); + handle, -1); if (out_fence) *out_fence = fence; else -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 01/92] x86/pkeys: Provide *pkru() helpers
by Yang Yingliang 30 Jan '22

30 Jan '22

From: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> mainline inclusion from mainline-v5.2-rc1 commit c806e88734b9e9aea260bf2261c129aa23968fca category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4MKP4 CVE: NA -------------------------------- Dave Hansen asked for __read_pkru() and __write_pkru() to be symmetrical. As part of the series __write_pkru() will read back the value and only write it if it is different. In order to make both functions symmetrical, move the function containing only the opcode asm into a function called like the instruction itself. __write_pkru() will just invoke wrpkru() but in a follow-up patch will also read back the value. [ bp: Convert asm opcode wrapper names to rd/wrpkru(). ] Suggested-by: Dave Hansen <dave.hansen(a)intel.com> Signed-off-by: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Signed-off-by: Borislav Petkov <bp(a)suse.de> Reviewed-by: Dave Hansen <dave.hansen(a)intel.com> Reviewed-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: Andi Kleen <ak(a)linux.intel.com> Cc: Andy Lutomirski <luto(a)kernel.org> Cc: "H. Peter Anvin" <hpa(a)zytor.com> Cc: Ingo Molnar <mingo(a)redhat.com> Cc: "Jason A. Donenfeld" <Jason(a)zx2c4.com> Cc: Joerg Roedel <jroedel(a)suse.de> Cc: Juergen Gross <jgross(a)suse.com> Cc: "Kirill A. Shutemov" <kirill.shutemov(a)linux.intel.com> Cc: kvm ML <kvm(a)vger.kernel.org> Cc: Michal Hocko <mhocko(a)suse.cz> Cc: Paolo Bonzini <pbonzini(a)redhat.com> Cc: "Radim Krčmář" <rkrcmar(a)redhat.com> Cc: Rik van Riel <riel(a)surriel.com> Cc: x86-ml <x86(a)kernel.org> Link: https://lkml.kernel.org/r/20190403164156.19645-13-bigeasy@linutronix.de Signed-off-by: Jackie Liu <liuyun01(a)kylinos.cn> #openEuler_contributor Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> Reviewed-by: Wei Li <liwei391(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/x86/include/asm/pgtable.h | 2 +- arch/x86/include/asm/special_insns.h | 12 +++++++++--- arch/x86/kvm/vmx.c | 2 +- 3 files changed, 11 insertions(+), 5 deletions(-) diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h index 6f4bc1d890d0f..fe6f9e7f15bb5 100644 --- a/arch/x86/include/asm/pgtable.h +++ b/arch/x86/include/asm/pgtable.h @@ -128,7 +128,7 @@ static inline int pte_dirty(pte_t pte) static inline u32 read_pkru(void) { if (boot_cpu_has(X86_FEATURE_OSPKE)) - return __read_pkru(); + return rdpkru(); return 0; } diff --git a/arch/x86/include/asm/special_insns.h b/arch/x86/include/asm/special_insns.h index 317fc59b512c5..cddf923d405ce 100644 --- a/arch/x86/include/asm/special_insns.h +++ b/arch/x86/include/asm/special_insns.h @@ -92,7 +92,7 @@ static inline void native_write_cr8(unsigned long val) #endif #ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS -static inline u32 __read_pkru(void) +static inline u32 rdpkru(void) { u32 ecx = 0; u32 edx, pkru; @@ -107,7 +107,7 @@ static inline u32 __read_pkru(void) return pkru; } -static inline void __write_pkru(u32 pkru) +static inline void wrpkru(u32 pkru) { u32 ecx = 0, edx = 0; @@ -118,8 +118,14 @@ static inline void __write_pkru(u32 pkru) asm volatile(".byte 0x0f,0x01,0xef\n\t" : : "a" (pkru), "c"(ecx), "d"(edx)); } + +static inline void __write_pkru(u32 pkru) +{ + wrpkru(pkru); +} + #else -static inline u32 __read_pkru(void) +static inline u32 rdpkru(void) { return 0; } diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c index b8fceac285f67..aa0045ce56eae 100644 --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -10989,7 +10989,7 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) */ if (static_cpu_has(X86_FEATURE_PKU) && kvm_read_cr4_bits(vcpu, X86_CR4_PKE)) { - vcpu->arch.pkru = __read_pkru(); + vcpu->arch.pkru = rdpkru(); if (vcpu->arch.pkru != vmx->host_pkru) __write_pkru(vmx->host_pkru); } -- 2.25.1

1 91

[PATCH openEuler-1.0-LTS v2 0/2]Add copy_from_user and get_user support uce kernel recovery
by Tong Tiangen 30 Jan '22

30 Jan '22

v2 -> v1: update commit message. Tong Tiangen (2): uce: copy_from_user scenario support kernel recovery uce: get_user scenario support kernel recovery arch/arm64/include/asm/exception.h | 6 +++ arch/arm64/include/asm/uaccess.h | 67 ++++++++++++++++++++++++++++++ arch/arm64/lib/Makefile | 2 + arch/arm64/lib/copy_from_user.S | 6 +++ arch/arm64/lib/get_user.c | 20 +++++++++ arch/arm64/mm/fault.c | 29 +++++++++++-- include/linux/sched.h | 1 + kernel/sysctl.c | 3 +- mm/internal.h | 1 + 9 files changed, 130 insertions(+), 5 deletions(-) create mode 100644 arch/arm64/lib/get_user.c -- 2.18.0.huawei.25

1 2

[PATCH openEuler-1.0-LTS] arm64: move jump_label_init() before parse_early_param()
by Yang Yingliang 30 Jan '22

30 Jan '22

From: Kees Cook <keescook(a)chromium.org> mainline inclusion from linux-v5.3-rc1 commit ba5c5e4a5da443e80a3722e67515de5e37375b18 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4RIZO CVE: NA -------------------------------- While jump_label_init() was moved earlier in the boot process in efd9e03facd0 ("arm64: Use static keys for CPU features"), it wasn't early enough for early params to use it. The old state of things was as described here... init/main.c calls out to arch-specific things before general jump label and early param handling: asmlinkage __visible void __init start_kernel(void) { ... setup_arch(&command_line); ... smp_prepare_boot_cpu(); ... /* parameters may set static keys */ jump_label_init(); parse_early_param(); ... } x86 setup_arch() wants those earlier, so it handles jump label and early param: void __init setup_arch(char **cmdline_p) { ... jump_label_init(); ... parse_early_param(); ... } arm64 setup_arch() only had early param: void __init setup_arch(char **cmdline_p) { ... parse_early_param(); ... } with jump label later in smp_prepare_boot_cpu(): void __init smp_prepare_boot_cpu(void) { ... jump_label_init(); ... } This moves arm64 jump_label_init() from smp_prepare_boot_cpu() to setup_arch(), as done already on x86, in preparation from early param usage in the init_on_alloc/free() series: https://lkml.kernel.org/r/1561572949.5154.81.camel@lca.pw Link: http://lkml.kernel.org/r/201906271003.005303B52@keescook Signed-off-by: Kees Cook <keescook(a)chromium.org> Acked-by: Ard Biesheuvel <ard.biesheuvel(a)linaro.org> Acked-by: Catalin Marinas <catalin.marinas(a)arm.com> Cc: Alexander Potapenko <glider(a)google.com> Cc: Qian Cai <cai(a)lca.pw> Cc: Will Deacon <will(a)kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> Reviewed-by: Kefeng Wang<wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/arm64/kernel/setup.c | 5 +++++ arch/arm64/kernel/smp.c | 5 ----- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c index e23b804773874..6d7bb45717e0a 100644 --- a/arch/arm64/kernel/setup.c +++ b/arch/arm64/kernel/setup.c @@ -341,6 +341,11 @@ void __init setup_arch(char **cmdline_p) setup_machine_fdt(__fdt_pointer); + /* + * Initialise the static keys early as they may be enabled by the + * cpufeature code and early parameters. + */ + jump_label_init(); parse_early_param(); /* diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c index f09c10863867b..4ef5bdb65b9db 100644 --- a/arch/arm64/kernel/smp.c +++ b/arch/arm64/kernel/smp.c @@ -614,11 +614,6 @@ void __init smp_cpus_done(unsigned int max_cpus) void __init smp_prepare_boot_cpu(void) { set_my_cpu_offset(per_cpu_offset(smp_processor_id())); - /* - * Initialise the static keys early as they may be enabled by the - * cpufeature code. - */ - jump_label_init(); cpuinfo_store_boot_cpu(); /* -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] sysctl: returns -EINVAL when a negative value is passed to proc_doulongvec_minmax
by Yang Yingliang 30 Jan '22

30 Jan '22

From: Baokun Li <libaokun1(a)huawei.com> mainline inclusion from mainline-5.17-rc1 commit 1622ed7d0743201293094162c26019d2573ecacb category: bugfix bugzilla: 185873, https://gitee.com/openeuler/kernel/issues/I4MTTR CVE: NA ------------------------------------------------- When we pass a negative value to the proc_doulongvec_minmax() function, the function returns 0, but the corresponding interface value does not change. we can easily reproduce this problem with the following commands: cd /proc/sys/fs/epoll echo -1 > max_user_watches; echo $?; cat max_user_watches This function requires a non-negative number to be passed in, so when a negative number is passed in, -EINVAL is returned. Link: https://lkml.kernel.org/r/20211220092627.3744624-1-libaokun1@huawei.com Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reported-by: Hulk Robot <hulkci(a)huawei.com> Acked-by: Luis Chamberlain <mcgrof(a)kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/sysctl.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 35512e2ea8a34..31c35a65fbb78 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -3017,10 +3017,11 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int err = proc_get_long(&p, &left, &val, &neg, proc_wspace_sep, sizeof(proc_wspace_sep), NULL); - if (err) + if (err || neg) { + err = -EINVAL; break; - if (neg) - continue; + } + val = convmul * val / convdiv; if ((min && val < *min) || (max && val > *max)) { err = -EINVAL; -- 2.25.1

1 0

[PATCH openEuler-5.10 1/3] perf tools: Update powerpc's syscall.tbl copy from the kernel sources
by Zheng Zengkai 29 Jan '22

29 Jan '22

From: Tiezhu Yang <yangtiezhu(a)loongson.cn> mainline inclusion from mainline-v5.11-rc1 commit c5ef52944a2d category: bugfix bugzilla: 186175, https://gitee.com/openeuler/kernel/issues/I4S77Z CVE: NA ------------------------------------------------- This silences the following tools/perf/ build warning: Warning: Kernel ABI header at 'tools/perf/arch/powerpc/entry/syscalls/syscall.tbl' differs from latest version at 'arch/powerpc/kernel/syscalls/syscall.tbl' Just make them same: cp arch/powerpc/kernel/syscalls/syscall.tbl tools/perf/arch/powerpc/entry/syscalls/syscall.tbl Signed-off-by: Tiezhu Yang <yangtiezhu(a)loongson.cn> Reviewed-by: Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com> Cc: Alexander Shishkin <alexander.shishkin(a)linux.intel.com> Cc: Ingo Molnar <mingo(a)redhat.com> Cc: Jiri Olsa <jolsa(a)redhat.com> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Namhyung Kim <namhyung(a)kernel.org> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Xuefeng Li <lixuefeng(a)loongson.cn> Link: http://lore.kernel.org/lkml/1608278364-6733-4-git-send-email-yangtiezhu@loo… [ There were updates after Tiezhu's post, so I just updated the copy ] Signed-off-by: Arnaldo Carvalho de Melo <acme(a)redhat.com> [liwei391(a)huawei.com: remove 441] Signed-off-by: Wei Li <liwei391(a)huawei.com> Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- .../arch/powerpc/entry/syscalls/syscall.tbl | 25 +++++++++++++------ 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/tools/perf/arch/powerpc/entry/syscalls/syscall.tbl b/tools/perf/arch/powerpc/entry/syscalls/syscall.tbl index b168364ac050..1275daec7fec 100644 --- a/tools/perf/arch/powerpc/entry/syscalls/syscall.tbl +++ b/tools/perf/arch/powerpc/entry/syscalls/syscall.tbl @@ -9,7 +9,9 @@ # 0 nospu restart_syscall sys_restart_syscall 1 nospu exit sys_exit -2 nospu fork ppc_fork +2 32 fork ppc_fork sys_fork +2 64 fork sys_fork +2 spu fork sys_ni_syscall 3 common read sys_read 4 common write sys_write 5 common open sys_open compat_sys_open @@ -158,7 +160,9 @@ 119 32 sigreturn sys_sigreturn compat_sys_sigreturn 119 64 sigreturn sys_ni_syscall 119 spu sigreturn sys_ni_syscall -120 nospu clone ppc_clone +120 32 clone ppc_clone sys_clone +120 64 clone sys_clone +120 spu clone sys_ni_syscall 121 common setdomainname sys_setdomainname 122 common uname sys_newuname 123 common modify_ldt sys_ni_syscall @@ -240,7 +244,9 @@ 186 spu sendfile sys_sendfile64 187 common getpmsg sys_ni_syscall 188 common putpmsg sys_ni_syscall -189 nospu vfork ppc_vfork +189 32 vfork ppc_vfork sys_vfork +189 64 vfork sys_vfork +189 spu vfork sys_ni_syscall 190 common ugetrlimit sys_getrlimit compat_sys_getrlimit 191 common readahead sys_readahead compat_sys_readahead 192 32 mmap2 sys_mmap2 compat_sys_mmap2 @@ -316,8 +322,8 @@ 248 32 clock_nanosleep sys_clock_nanosleep_time32 248 64 clock_nanosleep sys_clock_nanosleep 248 spu clock_nanosleep sys_clock_nanosleep -249 32 swapcontext ppc_swapcontext ppc32_swapcontext -249 64 swapcontext ppc64_swapcontext +249 32 swapcontext ppc_swapcontext compat_sys_swapcontext +249 64 swapcontext sys_swapcontext 249 spu swapcontext sys_ni_syscall 250 common tgkill sys_tgkill 251 32 utimes sys_utimes_time32 @@ -456,7 +462,7 @@ 361 common bpf sys_bpf 362 nospu execveat sys_execveat compat_sys_execveat 363 32 switch_endian sys_ni_syscall -363 64 switch_endian ppc_switch_endian +363 64 switch_endian sys_switch_endian 363 spu switch_endian sys_ni_syscall 364 common userfaultfd sys_userfaultfd 365 common membarrier sys_membarrier @@ -516,6 +522,11 @@ 432 common fsmount sys_fsmount 433 common fspick sys_fspick 434 common pidfd_open sys_pidfd_open -435 nospu clone3 ppc_clone3 +435 32 clone3 ppc_clone3 sys_clone3 +435 64 clone3 sys_clone3 +435 spu clone3 sys_ni_syscall +436 common close_range sys_close_range 437 common openat2 sys_openat2 438 common pidfd_getfd sys_pidfd_getfd +439 common faccessat2 sys_faccessat2 +440 common process_madvise sys_process_madvise -- 2.20.1

1 2

[PATCH openEuler-1.0-LTS] tcp: fix memleak when tcp internal pacing is used
by Yang Yingliang 29 Jan '22

29 Jan '22

From: Zhang Changzhong <zhangchangzhong(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4S8PN CVE: NA -------------------------------- The sock_hold() in tcp_internal_pacing() is expected to pair with sock_put() in tcp_pace_kick(). But in some path tcp_internal_pacing() is called without checking if pacing timer is already armed, causing sock_hold() to be called one more time and tcp sock can't be released. As Neal pointed out, this could happen from some of the retransmission code paths that don't use tcp_xmit_retransmit_queue(), such as tcp_retransmit_timer() and tcp_send_loss_probe(). The fix is provided by Eric, it extends the timer to cover all these points that Neal mentioned. Following is the reproduce procedure provided by Jason: 0) cat /proc/slabinfo | grep TCP 1) switch net.ipv4.tcp_congestion_control to bbr 2) using wrk tool something like that to send packages 3) using tc to increase the delay and loss to simulate the RTO case. 4) cat /proc/slabinfo | grep TCP 5) kill the wrk command and observe the number of objects and slabs in TCP. 6) at last, you could notice that the number would not decrease. Link: https://lore.kernel.org/all/CANn89i+7-wE4xr5D9DpH+N-xkL1SB8oVghCKgz+CT5eG1O… Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/ipv4/tcp_output.c | 31 +++++++++++++++++++++++-------- 1 file changed, 23 insertions(+), 8 deletions(-) diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index 6710056fd1b23..44250df02ee18 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -1021,6 +1021,8 @@ enum hrtimer_restart tcp_pace_kick(struct hrtimer *timer) static void tcp_internal_pacing(struct sock *sk, const struct sk_buff *skb) { + struct tcp_sock *tp = tcp_sk(sk); + ktime_t expire, now; u64 len_ns; u32 rate; @@ -1032,12 +1034,28 @@ static void tcp_internal_pacing(struct sock *sk, const struct sk_buff *skb) len_ns = (u64)skb->len * NSEC_PER_SEC; do_div(len_ns, rate); - hrtimer_start(&tcp_sk(sk)->pacing_timer, - ktime_add_ns(ktime_get(), len_ns), + now = ktime_get(); + /* If hrtimer is already armed, then our caller has not + * used tcp_pacing_check(). + */ + if (unlikely(hrtimer_is_queued(&tp->pacing_timer))) { + expire = hrtimer_get_softexpires(&tp->pacing_timer); + if (ktime_after(expire, now)) + now = expire; + if (hrtimer_try_to_cancel(&tp->pacing_timer) == 1) + __sock_put(sk); + } + hrtimer_start(&tp->pacing_timer, ktime_add_ns(now, len_ns), HRTIMER_MODE_ABS_PINNED_SOFT); sock_hold(sk); } +static bool tcp_pacing_check(const struct sock *sk) +{ + return tcp_needs_internal_pacing(sk) && + hrtimer_is_queued(&tcp_sk(sk)->pacing_timer); +} + static void tcp_update_skb_after_send(struct tcp_sock *tp, struct sk_buff *skb) { skb->skb_mstamp = tp->tcp_mstamp; @@ -2174,6 +2192,9 @@ static int tcp_mtu_probe(struct sock *sk) if (!tcp_can_coalesce_send_queue_head(sk, probe_size)) return -1; + if (tcp_pacing_check(sk)) + return -1; + /* We're allowed to probe. Build it now. */ nskb = sk_stream_alloc_skb(sk, probe_size, GFP_ATOMIC, false); if (!nskb) @@ -2247,12 +2268,6 @@ static int tcp_mtu_probe(struct sock *sk) return -1; } -static bool tcp_pacing_check(const struct sock *sk) -{ - return tcp_needs_internal_pacing(sk) && - hrtimer_is_queued(&tcp_sk(sk)->pacing_timer); -} - /* TCP Small Queues : * Control number of packets in qdisc/devices to two packets / or ~1 ms. * (These limits are doubled for retransmits) -- 2.25.1

1 0

[PATCH openEuler-5.10 1/9] fget: clarify and improve __fget_files() implementation
by Zheng Zengkai 29 Jan '22

29 Jan '22

From: Linus Torvalds <torvalds(a)linux-foundation.org> mainline inclusion from mainline-5.16-rc6 commit e386dfc56f837da66d00a078e5314bc8382fab83 category: perf bugzilla: https://gitee.com/openeuler/kernel/issues/I4S0SZ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- Commit 054aa8d439b9 ("fget: check that the fd still exists after getting a ref to it") fixed a race with getting a reference to a file just as it was being closed. It was a fairly minimal patch, and I didn't think re-checking the file pointer lookup would be a measurable overhead, since it was all right there and cached. But I was wrong, as pointed out by the kernel test robot. The 'poll2' case of the will-it-scale.per_thread_ops benchmark regressed quite noticeably. Admittedly it seems to be a very artificial test: doing "poll()" system calls on regular files in a very tight loop in multiple threads. That means that basically all the time is spent just looking up file descriptors without ever doing anything useful with them (not that doing 'poll()' on a regular file is useful to begin with). And as a result it shows the extra "re-check fd" cost as a sore thumb. Happily, the regression is fixable by just writing the code to loook up the fd to be better and clearer. There's still a cost to verify the file pointer, but now it's basically in the noise even for that benchmark that does nothing else - and the code is more understandable and has better comments too. [ Side note: this patch is also a classic case of one that looks very messy with the default greedy Myers diff - it's much more legible with either the patience of histogram diff algorithm ] Link: https://lore.kernel.org/lkml/20211210053743.GA36420@xsang-OptiPlex-9020/ Link: https://lore.kernel.org/lkml/20211213083154.GA20853@linux.intel.com/ Reported-by: kernel test robot <oliver.sang(a)intel.com> Tested-by: Carel Si <beibei.si(a)intel.com> Cc: Jann Horn <jannh(a)google.com> Cc: Miklos Szeredi <mszeredi(a)redhat.com> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Conflicts: fs/file.c Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- fs/file.c | 72 ++++++++++++++++++++++++++++++++++++++++++------------- 1 file changed, 56 insertions(+), 16 deletions(-) diff --git a/fs/file.c b/fs/file.c index e4c168ddd8e7..0aa251ca02a6 100644 --- a/fs/file.c +++ b/fs/file.c @@ -866,28 +866,68 @@ void do_close_on_exec(struct files_struct *files) spin_unlock(&files->file_lock); } -static struct file *__fget_files(struct files_struct *files, unsigned int fd, - fmode_t mask, unsigned int refs) +static inline struct file *__fget_files_rcu(struct files_struct *files, + unsigned int fd, fmode_t mask, unsigned int refs) { - struct file *file; + for (;;) { + struct file *file; + struct fdtable *fdt = rcu_dereference_raw(files->fdt); + struct file __rcu **fdentry; - rcu_read_lock(); -loop: - file = fcheck_files(files, fd); - if (file) { - /* File object ref couldn't be taken. - * dup2() atomicity guarantee is the reason - * we loop to catch the new file (or NULL pointer) + if (unlikely(fd >= fdt->max_fds)) + return NULL; + + fdentry = fdt->fd + array_index_nospec(fd, fdt->max_fds); + file = rcu_dereference_raw(*fdentry); + if (unlikely(!file)) + return NULL; + + if (unlikely(file->f_mode & mask)) + return NULL; + + /* + * Ok, we have a file pointer. However, because we do + * this all locklessly under RCU, we may be racing with + * that file being closed. + * + * Such a race can take two forms: + * + * (a) the file ref already went down to zero, + * and get_file_rcu_many() fails. Just try + * again: */ - if (file->f_mode & mask) - file = NULL; - else if (!get_file_rcu_many(file, refs)) - goto loop; - else if (__fcheck_files(files, fd) != file) { + if (unlikely(!get_file_rcu_many(file, refs))) + continue; + + /* + * (b) the file table entry has changed under us. + * Note that we don't need to re-check the 'fdt->fd' + * pointer having changed, because it always goes + * hand-in-hand with 'fdt'. + * + * If so, we need to put our refs and try again. + */ + if (unlikely(rcu_dereference_raw(files->fdt) != fdt) || + unlikely(rcu_dereference_raw(*fdentry) != file)) { fput_many(file, refs); - goto loop; + continue; } + + /* + * Ok, we have a ref to the file, and checked that it + * still exists. + */ + return file; } +} + +static struct file *__fget_files(struct files_struct *files, unsigned int fd, + fmode_t mask, unsigned int refs) +{ + struct file *file; + + rcu_read_lock(); + file = __fget_files_rcu(files, fd, mask, refs); rcu_read_unlock(); return file; -- 2.20.1

1 8

[PATCH openEuler-1.0-LTS 0/2]Add copy_from_user and get_user support uce kernel recovery
by Tong Tiangen 29 Jan '22

29 Jan '22

Tong Tiangen (2): uce: copy_from_user scenario support kernel recovery uce: get_user scenario support kernel recovery arch/arm64/include/asm/exception.h | 6 +++ arch/arm64/include/asm/uaccess.h | 67 ++++++++++++++++++++++++++++++ arch/arm64/lib/Makefile | 2 + arch/arm64/lib/copy_from_user.S | 6 +++ arch/arm64/lib/get_user.c | 20 +++++++++ arch/arm64/mm/fault.c | 29 +++++++++++-- include/linux/sched.h | 1 + kernel/sysctl.c | 3 +- mm/internal.h | 1 + 9 files changed, 130 insertions(+), 5 deletions(-) create mode 100644 arch/arm64/lib/get_user.c -- 2.18.0.huawei.25

1 2

help
by chunni＠nfschina.com 29 Jan '22

29 Jan '22

Best Regards, hcni

1 0

[PATCH openEuler-5.10 00/15] kabi: Adding more padding to base
by Zheng Zengkai 29 Jan '22

29 Jan '22

Adding some more kabi reserve padding to base structures before kernel freeze. Ard Biesheuvel (7): riscv: rely on core code to keep thread_info::cpu updated powerpc: smp: remove hack to obtain offset of task_struct::cpu arm64: add CPU field to struct thread_info x86: add CPU field to struct thread_info s390: add CPU field to struct thread_info powerpc: add CPU field to struct thread_info sched: move CPU field back into thread_info if THREAD_INFO_IN_TASK=y Chen Jiahao (2): KABI: reserve space for several i2c structures KABI: reserve space for struct input_dev Guan Jing (1): KABI: add reserve space for sched structures Guo Zihua (1): KABI: KABI reservation for IMA namespace Wang Hai (1): kabi: net: reserve space for some net subsystems related structure Wang ShaoBo (1): kabi: reserve space for arm64 SME in thread_struct Wenchao Hao (1): kabi:fuse: reserve space for future expansion Yu Liao (1): kabi: Reserve space for struct acpi_device_power arch/arm64/include/asm/processor.h | 9 +++++++++ arch/arm64/include/asm/thread_info.h | 1 + arch/arm64/kernel/asm-offsets.c | 1 + arch/powerpc/Makefile | 8 -------- arch/powerpc/include/asm/smp.h | 17 +--------------- arch/powerpc/include/asm/thread_info.h | 3 +++ arch/powerpc/kernel/asm-offsets.c | 4 +--- arch/powerpc/kernel/smp.c | 2 +- arch/riscv/kernel/asm-offsets.c | 1 - arch/riscv/kernel/entry.S | 5 ----- arch/riscv/kernel/head.S | 1 - arch/s390/include/asm/thread_info.h | 1 + arch/x86/include/asm/thread_info.h | 3 +++ fs/fuse/fuse_i.h | 10 +++++++++ include/acpi/acpi_bus.h | 3 +++ include/linux/fs.h | 2 ++ include/linux/i2c.h | 12 +++++++++++ include/linux/inetdevice.h | 4 ++++ include/linux/input.h | 4 ++++ include/linux/key-type.h | 2 ++ include/linux/key.h | 2 ++ include/linux/nsproxy.h | 9 +++++++++ include/linux/proc_ns.h | 2 +- include/linux/sched.h | 28 +++++++++++++++----------- include/net/devlink.h | 4 ++++ include/net/flow_dissector.h | 6 ++++++ include/net/sch_generic.h | 1 + include/net/tls.h | 10 +++++++++ include/net/xsk_buff_pool.h | 3 +++ kernel/sched/sched.h | 17 ++++++++++++---- 30 files changed, 123 insertions(+), 52 deletions(-) -- 2.20.1

1 15

[PATCH openEuler-5.10 00/41] Backport 5.10.91 LTS
by Zheng Zengkai 28 Jan '22

28 Jan '22

Backport 5.10.91 LTS patches from upstream. Arthur Kiyanovski (2): net: ena: Fix undefined state when tx request id is out of bounds net: ena: Fix error handling when calculating max IO queues number Chao Yu (1): f2fs: quota: fix potential deadlock Christoph Hellwig (1): netrom: fix copying in user data in nr_setsockopt Chunfeng Yun (1): usb: mtu3: fix interval value for intr and isoc David Ahern (7): ipv4: Check attribute length for RTA_GATEWAY in multipath route ipv4: Check attribute length for RTA_FLOW in multipath route ipv6: Check attribute length for RTA_GATEWAY in multipath route ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route lwtunnel: Validate RTA_ENCAP_TYPE attribute length ipv6: Continue processing multipath route even if gateway attribute is invalid ipv6: Do cleanup if attribute validation fails in multipath route Di Zhu (1): i40e: fix use-after-free in i40e_sync_filters_subtask() Eric Dumazet (1): sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc Jedrzej Jagielski (1): i40e: Fix incorrect netdev's real number of RX/TX queues Jiasheng Jiang (1): RDMA/uverbs: Check for null return of kmalloc_array Jiri Olsa (1): ftrace/samples: Add missing prototypes direct functions Karen Sornek (1): iavf: Fix limit of total number of queues to active queues of VF Lai, Derek (1): drm/amd/display: Added power down for DCN10 Leon Romanovsky (1): RDMA/core: Don't infoleak GRH fields Linus Lüssing (1): batman-adv: mcast: don't send link-local multicast to mcast routers Linus Walleij (1): power: supply: core: Break capacity loop Lixiaokeng (1): scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown() Martin Habets (1): sfc: The RX page_ring is optional Mateusz Palczewski (2): i40e: Fix to not show opcode msg on unsuccessful VF MAC change i40e: Fix for displaying message regarding NVM version Nathan Chancellor (1): power: reset: ltc2952: Fix use of floating point literals Naveen N. Rao (2): tracing: Fix check for trace_percpu_buffer validity in get_trace_buf() tracing: Tag trace_percpu_buffer as a percpu pointer Nikita Travkin (1): Input: zinitix - make sure the IRQ is allocated before it gets enabled Pavel Skripkin (1): ieee802154: atusb: fix uninit value in atusb_set_extended_addr Phil Elwell (1): ARM: dts: gpio-ranges property is now required Shuah Khan (1): selftests: x86: fix [-Wstringop-overread] warn in test_process_vm_readv() Tamir Duberstein (1): ipv6: raw: check passed optlen before reading Thomas Toye (1): rndis_host: support Hytera digital radios Tom Rix (1): mac80211: initialize variable have_higher_than_11mbit William Zhao (1): ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate Yauhen Kharuzhy (1): power: bq25890: Enable continuous conversion for ADC at charging Zekun Shen (1): atlantic: Fix buff_ring OOB in aq_ring_rx_clean wolfgang huang (1): mISDN: change function names to avoid conflicts yangxingwu (1): net: udp: fix alignment problem in udp4_seq_show() arch/arm/boot/dts/bcm2711.dtsi | 2 + arch/arm/boot/dts/bcm283x.dtsi | 2 + .../gpu/drm/amd/display/dc/dcn10/dcn10_init.c | 1 + drivers/infiniband/core/uverbs_marshall.c | 2 +- drivers/infiniband/core/uverbs_uapi.c | 3 + drivers/input/touchscreen/zinitix.c | 16 ++--- drivers/isdn/mISDN/core.c | 6 +- drivers/isdn/mISDN/core.h | 4 +- drivers/isdn/mISDN/layer1.c | 4 +- drivers/net/ethernet/amazon/ena/ena_netdev.c | 38 ++++++------ .../net/ethernet/aquantia/atlantic/aq_ring.c | 8 +++ drivers/net/ethernet/intel/i40e/i40e_main.c | 60 ++++++++++++++++--- .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 40 ++++++++++--- drivers/net/ethernet/intel/iavf/iavf_main.c | 5 +- drivers/net/ethernet/sfc/falcon/rx.c | 5 ++ drivers/net/ethernet/sfc/rx_common.c | 5 ++ drivers/net/ieee802154/atusb.c | 10 ++-- drivers/net/usb/rndis_host.c | 5 ++ drivers/power/reset/ltc2952-poweroff.c | 4 +- drivers/power/supply/bq25890_charger.c | 4 +- drivers/power/supply/power_supply_core.c | 4 ++ drivers/scsi/libiscsi.c | 6 +- drivers/usb/mtu3/mtu3_gadget.c | 4 +- fs/f2fs/checkpoint.c | 3 +- kernel/trace/trace.c | 6 +- net/batman-adv/multicast.c | 15 +++-- net/batman-adv/multicast.h | 10 ++-- net/batman-adv/soft-interface.c | 7 ++- net/core/lwtunnel.c | 4 ++ net/ipv4/fib_semantics.c | 49 +++++++++++++-- net/ipv4/udp.c | 2 +- net/ipv6/ip6_vti.c | 2 + net/ipv6/raw.c | 3 + net/ipv6/route.c | 32 +++++++++- net/mac80211/mlme.c | 2 +- net/netrom/af_netrom.c | 2 +- net/sched/sch_qfq.c | 6 +- samples/ftrace/ftrace-direct-modify.c | 3 + samples/ftrace/ftrace-direct-too.c | 3 + samples/ftrace/ftrace-direct.c | 2 + tools/testing/selftests/x86/test_vsyscall.c | 2 +- 41 files changed, 297 insertions(+), 94 deletions(-) -- 2.20.1

1 41

[PATCH openEuler-5.10 00/47] Backport 5.10.90 LTS
by Zheng Zengkai 28 Jan '22

28 Jan '22

Backport 5.10.90 LTS patches from upstream. Adrian Hunter (1): perf script: Fix CPU filtering of a script's switch events Aleksander Jan Bajkowski (1): net: lantiq_xrx200: fix statistics of received bytes Alex Deucher (1): drm/amdgpu: add support for IP discovery gc_info table v2 Alexey Makhalov (1): scsi: vmw_pvscsi: Set residual data length conditionally Amir Tzin (1): net/mlx5e: Wrap the tx reporter dump callback to extract the sq Christophe JAILLET (2): net: ag71xx: Fix a potential double free in error handling paths ionic: Initialize the 'lif->dbid_inuse' bitmap Chunfeng Yun (3): usb: mtu3: add memory barrier before set GPD's HWO usb: mtu3: fix list_head check warning usb: mtu3: set interval of FS intr and isoc endpoint Coco Li (2): udp: using datalen to cap ipv6 udp max gso segments selftests: Calculate udpgso segment count without header adjustment Dan Carpenter (1): scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write() Daniel Borkmann (1): bpf: Add kconfig knob for disabling unpriv bpf by default Dmitry V. Levin (1): uapi: fix linux/nfc.h userspace compilation errors Dmitry Vyukov (1): tomoyo: Check exceeded quota early in tomoyo_domain_quota_is_ok(). Dust Li (2): net/smc: don't send CDC/LLC message if link not ready net/smc: fix kernel panic caused by race of smc_sock Gal Pressman (1): net/mlx5e: Fix wrong features assignment in case of error Heiko Carstens (1): recordmcount.pl: fix typo in s390 mcount regex Helge Deller (1): parisc: Clear stale IIR value on instruction access rights trap Jackie Liu (1): memblock: fix memblock_phys_alloc() section mismatch error James McLaughlin (1): igc: Fix TX timestamp support for non-MSI-X platforms Jiasheng Jiang (1): net/ncsi: check for error return from call to nla_put_u32 Karsten Graul (2): net/smc: fix using of uninitialized completions net/smc: improved fix wait on already cleared link Krzysztof Kozlowski (1): nfc: uapi: use kernel size_t to fix user-space builds Leo L. Schwab (1): Input: spaceball - fix parsing of movement data packets Mathias Nyman (1): xhci: Fresco FL1100 controller should not have BROKEN_MSI quirk set. Matthias-Christian Ott (1): net: usb: pegasus: Do not drop long Ethernet frames Maxim Mikityanskiy (1): net/mlx5e: Fix ICOSQ recovery flow for XSK Miaoqian Lin (2): net/mlx5: DR, Fix NULL vs IS_ERR checking in dr_domain_init_resources fsl/fman: Fix missing put_device() call in fman_port_probe Muchun Song (1): net: fix use-after-free in tw_timer_handler Pavel Skripkin (2): i2c: validate user data in compat ioctl Input: appletouch - initialize work before device registration Samuel Čavoj (1): Input: i8042 - enable deferred probe quirk for ASUS UM325UA Takashi Iwai (1): Input: i8042 - add deferred probe support Tetsuo Handa (1): tomoyo: use hwight16() in tomoyo_domain_quota_is_ok() Todd Kjos (1): binder: fix async_free_space accounting for empty parcels Tom Rix (1): selinux: initialize proto variable in selinux_ip_postroute_compat() Vincent Pelletier (1): usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear. Wang Qing (1): platform/x86: apple-gmux: use resource_size() with res Wei Yongjun (1): NFC: st21nfca: Fix memory leak in device probe and remove Xin Long (1): sctp: use call_rcu to free endpoint chen gong (1): drm/amdgpu: When the VCN(1.0) block is suspended, powergating is explicitly enabled wujianguo (1): selftests/net: udpgso_bench_tx: fix dst ip argument .../admin-guide/kernel-parameters.txt | 2 + Documentation/admin-guide/sysctl/kernel.rst | 17 ++++- arch/parisc/kernel/traps.c | 2 + drivers/android/binder_alloc.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 76 +++++++++++++------ drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c | 7 ++ drivers/gpu/drm/amd/include/discovery.h | 49 ++++++++++++ drivers/i2c/i2c-dev.c | 3 + drivers/input/joystick/spaceball.c | 11 ++- drivers/input/mouse/appletouch.c | 4 +- drivers/input/serio/i8042-x86ia64io.h | 21 +++++ drivers/input/serio/i8042.c | 54 ++++++++----- drivers/net/ethernet/atheros/ag71xx.c | 23 ++---- .../net/ethernet/freescale/fman/fman_port.c | 12 +-- drivers/net/ethernet/intel/igc/igc_main.c | 6 ++ drivers/net/ethernet/lantiq_xrx200.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en.h | 3 - .../mellanox/mlx5/core/en/reporter_tx.c | 10 ++- .../net/ethernet/mellanox/mlx5/core/en_main.c | 41 ++++++---- .../mellanox/mlx5/core/steering/dr_domain.c | 5 +- .../net/ethernet/pensando/ionic/ionic_lif.c | 2 +- drivers/net/usb/pegasus.c | 4 +- drivers/nfc/st21nfca/i2c.c | 29 ++++--- drivers/platform/x86/apple-gmux.c | 2 +- drivers/scsi/lpfc/lpfc_debugfs.c | 4 +- drivers/scsi/vmw_pvscsi.c | 7 +- drivers/usb/gadget/function/f_fs.c | 9 ++- drivers/usb/host/xhci-pci.c | 5 +- drivers/usb/mtu3/mtu3_gadget.c | 8 ++ drivers/usb/mtu3/mtu3_qmu.c | 7 +- include/linux/memblock.h | 4 +- include/net/sctp/sctp.h | 6 +- include/net/sctp/structs.h | 3 +- include/uapi/linux/nfc.h | 6 +- init/Kconfig | 10 +++ kernel/bpf/syscall.c | 3 +- kernel/sysctl.c | 29 +++++-- net/ipv4/af_inet.c | 10 +-- net/ipv6/udp.c | 2 +- net/ncsi/ncsi-netlink.c | 6 +- net/sctp/diag.c | 12 +-- net/sctp/endpointola.c | 23 ++++-- net/sctp/socket.c | 23 ++++-- net/smc/smc.h | 5 ++ net/smc/smc_cdc.c | 59 +++++++------- net/smc/smc_cdc.h | 2 +- net/smc/smc_core.c | 47 ++++++++---- net/smc/smc_core.h | 6 ++ net/smc/smc_ib.c | 4 +- net/smc/smc_ib.h | 1 + net/smc/smc_llc.c | 65 ++++++++++++---- net/smc/smc_tx.c | 22 ++---- net/smc/smc_wr.c | 51 +++---------- net/smc/smc_wr.h | 17 ++++- scripts/recordmcount.pl | 2 +- security/selinux/hooks.c | 2 +- security/tomoyo/util.c | 31 ++++---- tools/perf/builtin-script.c | 2 +- tools/testing/selftests/net/udpgso.c | 12 +-- tools/testing/selftests/net/udpgso_bench_tx.c | 8 +- 60 files changed, 593 insertions(+), 307 deletions(-) -- 2.20.1

1 47

[PATCH openEuler-5.10 000/107] NTFS read-write driver GPL
by Zheng Zengkai 28 Jan '22

28 Jan '22

This patch adds NTFS Read-Write driver to fs/ntfs3. Having decades of expertise in commercial file systems development and huge test coverage, we at Paragon Software GmbH want to make our contribution to the Open Source Community by providing implementation of NTFS Read-Write driver for the Linux Kernel. This is fully functional NTFS Read-Write driver. Current version works with NTFS(including v3.1) and normal/compressed/sparse files and supports journal replaying. We plan to support this version after the codebase once merged, and add new features and fix bugs. For example, full journaling support over JBD will be added in later updates. v2: - patch splitted to chunks (file-wise) - build issues fixed - sparse and checkpatch.pl errors fixed - NULL pointer dereference on mkfs.ntfs-formatted volume mount fixed - cosmetics + code cleanup v3: - added acl, noatime, no_acs_rules, prealloc mount options - added fiemap support - fixed encodings support - removed typedefs - adapted Kernel-way logging mechanisms - fixed typos and corner-case issues v4: - atomic_open() refactored - code style updated - bugfixes v5: - nls/nls_alt mount options added - Unicode conversion fixes - Improved very fragmented files operations - logging cosmetics v6: - Security Descriptors processing changed added system.ntfs_security xattr to set SD - atomic_open() optimized - cosmetics Christophe JAILLET (2): fs/ntfs3: Remove a useless test in 'indx_find()' fs/ntfs3: Remove a useless shadowing variable Colin Ian King (4): fs/ntfs3: Fix various spelling mistakes fs/ntfs3: Fix integer overflow in multiplication fs/ntfs3: Remove redundant initialization of variable err fs/ntfs3: Fix a memory leak on object opts Dan Carpenter (5): fs/ntfs3: add checks for allocation failure fs/ntfs3: fix an error code in ntfs_get_acl_ex() fs/ntfs3: Fix error code in indx_add_allocate() fs/ntfs3: Potential NULL dereference in hdr_find_split() fs/ntfs3: Fix error handling in indx_insert_into_root() Gustavo A. R. Silva (1): fs/ntfs3: Fix fall-through warnings for Clang Jiapeng Chong (1): fs/ntfs3: Remove unused including <linux/version.h> Kari Argillander (54): fs/ntfs3: Use linux/log2 is_power_of_2 function fs/ntfs3: Add ifndef + define to all header files fs/ntfs3: Fix one none utf8 char in source file fs/ntfs3: Restyle comment block in ni_parse_reparse() fs/ntfs3: Use kernel ALIGN macros over driver specific fs/ntfs3: Do not use driver own alloc wrappers fs/ntfs3: Use kcalloc/kmalloc_array over kzalloc/kmalloc fs/ntfs3: Restyle comments to better align with kernel-doc fs/ntfs3: Remove fat ioctl's from ntfs3 driver for now fs/ntfs3: Fix integer overflow in ni_fiemap with fiemap_prep() fs/ntfs3: Remove unnecessary condition checking from ntfs_file_read_iter fs/ntfs3: Remove GPL boilerplates from decompress lib files fs/ntfs3: Change how module init/info messages are displayed fs/ntfs3: Remove unnecesarry mount option noatime fs/ntfs3: Remove unnecesarry remount flag handling fs/ntfs3: Convert mount options to pointer in sbi fs/ntfs3: Use new api for mounting fs/ntfs3: Init spi more in init_fs_context than fill_super fs/ntfs3: Make mount option nohidden more universal fs/ntfs3: Add iocharset= mount option as alias for nls= fs/ntfs3: Rename mount option no_acs_rules > (no)acsrules fs/ntfs3: Show uid/gid always in show_options() fs/ntfs3. Add forward declarations for structs to debug.h fs/ntfs3: Add missing header files to ntfs.h fs/ntfs3: Add missing headers and forward declarations to ntfs_fs.h fs/ntfs3: Add missing header and guards to lib/ headers fs/ntfs3: Change right headers to bitfunc.c fs/ntfs3: Change right headers to upcase.c fs/ntfs3: Change right headers to lznt.c fs/ntfs3: Remove unneeded header files from c files fs/ntfs3: Limit binary search table size fs/ntfs3: Make binary search to search smaller chunks in beginning fs/ntfs3: Always use binary search with entry search fs/ntfs3: Remove '+' before constant in ni_insert_resident() fs/ntfs3: Place Comparisons constant right side of the test fs/ntfs3: Remove braces from single statment block fs/ntfs3: Remove tabs before spaces from comment fs/ntfs3: Fix ntfs_look_for_free_space() does only report -ENOSPC fs/ntfs3: Remove always false condition check fs/ntfs3: Use clamp/max macros instead of comparisons fs/ntfs3: Use min/max macros instated of ternary operators fs/ntfs3: Fix wrong error message $Logfile -> $UpCase fs/ntfs3: Change EINVAL to ENOMEM when d_make_root fails fs/ntfs3: Remove impossible fault condition in fill_super fs/ntfs3: Return straight without goto in fill_super fs/ntfs3: Remove unnecessary variable loading in fill_super fs/ntfs3: Use sb instead of sbi->sb in fill_super fs/ntfs3: Remove tmp var is_ro in ntfs_fill_super fs/ntfs3: Remove tmp pointer bd_inode in fill_super fs/ntfs3: Remove tmp pointer upcase in fill_super fs/ntfs3: Initialize pointer before use place in fill_super fs/ntfs3: Initiliaze sb blocksize only in one place + refactor Doc/fs/ntfs3: Fix rst format and make it cleaner fs/ntfs3: Remove deprecated mount options nls Konstantin Komarov (37): fs/ntfs3: Add headers and misc files fs/ntfs3: Add initialization of super block fs/ntfs3: Add bitmap fs/ntfs3: Add file operations and implementation fs/ntfs3: Add attrib operations fs/ntfs3: Add compression fs/ntfs3: Add NTFS journal fs/ntfs3: Add Kconfig, Makefile and doc fs/ntfs3: Rework file operations fs/ntfs3: Restyle comments to better align with kernel-doc fs/ntfs3: Fix insertion of attr in ni_ins_attr_ext fs/ntfs3: Change max hardlinks limit to 4000 fs/ntfs3: Add sync flag to ntfs_sb_write_run and al_update fs/ntfs3: Fix logical error in ntfs_create_inode fs/ntfs3: Move ni_lock_dir and ni_unlock into ntfs_create_inode fs/ntfs3: Refactor ntfs_get_acl_ex for better readability fs/ntfs3: Pass flags to ntfs_set_ea in ntfs_set_acl_ex fs/ntfs3: Change posix_acl_equiv_mode to posix_acl_update_mode fs/ntfs3: Refactoring lock in ntfs_init_acl fs/ntfs3: Reject mount if boot's cluster size < media sector size fs/ntfs3: Refactoring of ntfs_init_from_boot fs/ntfs3: Check for NULL if ATTR_EA_INFO is incorrect fs/ntfs3: Use available posix_acl_release instead of ntfs_posix_acl_release fs/ntfs3: Remove locked argument in ntfs_set_ea fs/ntfs3: Refactoring of ntfs_set_ea fs/ntfs3: Forbid FALLOC_FL_PUNCH_HOLE for normal files fs/ntfs3: Remove unnecessary functions fs/ntfs3: Keep prealloc for all types of files fs/ntfs3: Fix memory leak if fill_super failed fs/ntfs3: Rework ntfs_utf16_to_nls fs/ntfs3: Refactor ntfs_readlink_hlp fs/ntfs3: Refactor ntfs_create_inode fs/ntfs3: Refactor ni_parse_reparse fs/ntfs3: Refactor ntfs_read_mft fs/ntfs3: Check for NULL pointers in ni_try_remove_attr_list fs/ntfs3: Add MAINTAINERS fs/ntfs3: Add NTFS3 in fs/Kconfig and fs/Makefile Nathan Chancellor (1): fs/ntfs3: Remove unused variable cnt in ntfs_security_init() Yin Xiujiang (2): fs/ntfs3: Fix the issue from backport 5.15 to 5.10 fs/ntfs3: Add ntfs3 module in openeuler_defconfig Documentation/filesystems/index.rst | 1 + Documentation/filesystems/ntfs3.rst | 115 + MAINTAINERS | 9 + arch/arm64/configs/openeuler_defconfig | 4 + arch/x86/configs/openeuler_defconfig | 4 + fs/Kconfig | 1 + fs/Makefile | 1 + fs/ntfs3/Kconfig | 46 + fs/ntfs3/Makefile | 36 + fs/ntfs3/attrib.c | 2083 ++++++++++ fs/ntfs3/attrlist.c | 457 +++ fs/ntfs3/bitfunc.c | 128 + fs/ntfs3/bitmap.c | 1491 +++++++ fs/ntfs3/debug.h | 55 + fs/ntfs3/dir.c | 593 +++ fs/ntfs3/file.c | 1254 ++++++ fs/ntfs3/frecord.c | 3284 +++++++++++++++ fs/ntfs3/fslog.c | 5213 ++++++++++++++++++++++++ fs/ntfs3/fsntfs.c | 2506 ++++++++++++ fs/ntfs3/index.c | 2584 ++++++++++++ fs/ntfs3/inode.c | 1960 +++++++++ fs/ntfs3/lib/decompress_common.c | 319 ++ fs/ntfs3/lib/decompress_common.h | 343 ++ fs/ntfs3/lib/lib.h | 32 + fs/ntfs3/lib/lzx_decompress.c | 670 +++ fs/ntfs3/lib/xpress_decompress.c | 142 + fs/ntfs3/lznt.c | 453 ++ fs/ntfs3/namei.c | 387 ++ fs/ntfs3/ntfs.h | 1224 ++++++ fs/ntfs3/ntfs_fs.h | 1138 ++++++ fs/ntfs3/record.c | 602 +++ fs/ntfs3/run.c | 1111 +++++ fs/ntfs3/super.c | 1507 +++++++ fs/ntfs3/upcase.c | 104 + fs/ntfs3/xattr.c | 991 +++++ 35 files changed, 30848 insertions(+) create mode 100644 Documentation/filesystems/ntfs3.rst create mode 100644 fs/ntfs3/Kconfig create mode 100644 fs/ntfs3/Makefile create mode 100644 fs/ntfs3/attrib.c create mode 100644 fs/ntfs3/attrlist.c create mode 100644 fs/ntfs3/bitfunc.c create mode 100644 fs/ntfs3/bitmap.c create mode 100644 fs/ntfs3/debug.h create mode 100644 fs/ntfs3/dir.c create mode 100644 fs/ntfs3/file.c create mode 100644 fs/ntfs3/frecord.c create mode 100644 fs/ntfs3/fslog.c create mode 100644 fs/ntfs3/fsntfs.c create mode 100644 fs/ntfs3/index.c create mode 100644 fs/ntfs3/inode.c create mode 100644 fs/ntfs3/lib/decompress_common.c create mode 100644 fs/ntfs3/lib/decompress_common.h create mode 100644 fs/ntfs3/lib/lib.h create mode 100644 fs/ntfs3/lib/lzx_decompress.c create mode 100644 fs/ntfs3/lib/xpress_decompress.c create mode 100644 fs/ntfs3/lznt.c create mode 100644 fs/ntfs3/namei.c create mode 100644 fs/ntfs3/ntfs.h create mode 100644 fs/ntfs3/ntfs_fs.h create mode 100644 fs/ntfs3/record.c create mode 100644 fs/ntfs3/run.c create mode 100644 fs/ntfs3/super.c create mode 100644 fs/ntfs3/upcase.c create mode 100644 fs/ntfs3/xattr.c -- 2.20.1

1 107

[PATCH OLK-5.10 v3 000/107] NTFS read-write driver GPL implementation
by Zheng Zengkai 27 Jan '22

27 Jan '22

This patch adds NTFS Read-Write driver to fs/ntfs3. Having decades of expertise in commercial file systems development and huge test coverage, we at Paragon Software GmbH want to make our contribution to the Open Source Community by providing implementation of NTFS Read-Write driver for the Linux Kernel. This is fully functional NTFS Read-Write driver. Current version works with NTFS(including v3.1) and normal/compressed/sparse files and supports journal replaying. We plan to support this version after the codebase once merged, and add new features and fix bugs. For example, full journaling support over JBD will be added in later updates. v2: - patch splitted to chunks (file-wise) - build issues fixed - sparse and checkpatch.pl errors fixed - NULL pointer dereference on mkfs.ntfs-formatted volume mount fixed - cosmetics + code cleanup v3: - added acl, noatime, no_acs_rules, prealloc mount options - added fiemap support - fixed encodings support - removed typedefs - adapted Kernel-way logging mechanisms - fixed typos and corner-case issues v4: - atomic_open() refactored - code style updated - bugfixes v5: - nls/nls_alt mount options added - Unicode conversion fixes - Improved very fragmented files operations - logging cosmetics v6: - Security Descriptors processing changed added system.ntfs_security xattr to set SD - atomic_open() optimized - cosmetics Christophe JAILLET (2): fs/ntfs3: Remove a useless test in 'indx_find()' fs/ntfs3: Remove a useless shadowing variable Colin Ian King (4): fs/ntfs3: Fix various spelling mistakes fs/ntfs3: Fix integer overflow in multiplication fs/ntfs3: Remove redundant initialization of variable err fs/ntfs3: Fix a memory leak on object opts Dan Carpenter (5): fs/ntfs3: add checks for allocation failure fs/ntfs3: fix an error code in ntfs_get_acl_ex() fs/ntfs3: Fix error code in indx_add_allocate() fs/ntfs3: Potential NULL dereference in hdr_find_split() fs/ntfs3: Fix error handling in indx_insert_into_root() Gustavo A. R. Silva (1): fs/ntfs3: Fix fall-through warnings for Clang Jiapeng Chong (1): fs/ntfs3: Remove unused including <linux/version.h> Kari Argillander (54): fs/ntfs3: Use linux/log2 is_power_of_2 function fs/ntfs3: Add ifndef + define to all header files fs/ntfs3: Fix one none utf8 char in source file fs/ntfs3: Restyle comment block in ni_parse_reparse() fs/ntfs3: Use kernel ALIGN macros over driver specific fs/ntfs3: Do not use driver own alloc wrappers fs/ntfs3: Use kcalloc/kmalloc_array over kzalloc/kmalloc fs/ntfs3: Restyle comments to better align with kernel-doc fs/ntfs3: Remove fat ioctl's from ntfs3 driver for now fs/ntfs3: Fix integer overflow in ni_fiemap with fiemap_prep() fs/ntfs3: Remove unnecessary condition checking from ntfs_file_read_iter fs/ntfs3: Remove GPL boilerplates from decompress lib files fs/ntfs3: Change how module init/info messages are displayed fs/ntfs3: Remove unnecesarry mount option noatime fs/ntfs3: Remove unnecesarry remount flag handling fs/ntfs3: Convert mount options to pointer in sbi fs/ntfs3: Use new api for mounting fs/ntfs3: Init spi more in init_fs_context than fill_super fs/ntfs3: Make mount option nohidden more universal fs/ntfs3: Add iocharset= mount option as alias for nls= fs/ntfs3: Rename mount option no_acs_rules > (no)acsrules fs/ntfs3: Show uid/gid always in show_options() fs/ntfs3. Add forward declarations for structs to debug.h fs/ntfs3: Add missing header files to ntfs.h fs/ntfs3: Add missing headers and forward declarations to ntfs_fs.h fs/ntfs3: Add missing header and guards to lib/ headers fs/ntfs3: Change right headers to bitfunc.c fs/ntfs3: Change right headers to upcase.c fs/ntfs3: Change right headers to lznt.c fs/ntfs3: Remove unneeded header files from c files fs/ntfs3: Limit binary search table size fs/ntfs3: Make binary search to search smaller chunks in beginning fs/ntfs3: Always use binary search with entry search fs/ntfs3: Remove '+' before constant in ni_insert_resident() fs/ntfs3: Place Comparisons constant right side of the test fs/ntfs3: Remove braces from single statment block fs/ntfs3: Remove tabs before spaces from comment fs/ntfs3: Fix ntfs_look_for_free_space() does only report -ENOSPC fs/ntfs3: Remove always false condition check fs/ntfs3: Use clamp/max macros instead of comparisons fs/ntfs3: Use min/max macros instated of ternary operators fs/ntfs3: Fix wrong error message $Logfile -> $UpCase fs/ntfs3: Change EINVAL to ENOMEM when d_make_root fails fs/ntfs3: Remove impossible fault condition in fill_super fs/ntfs3: Return straight without goto in fill_super fs/ntfs3: Remove unnecessary variable loading in fill_super fs/ntfs3: Use sb instead of sbi->sb in fill_super fs/ntfs3: Remove tmp var is_ro in ntfs_fill_super fs/ntfs3: Remove tmp pointer bd_inode in fill_super fs/ntfs3: Remove tmp pointer upcase in fill_super fs/ntfs3: Initialize pointer before use place in fill_super fs/ntfs3: Initiliaze sb blocksize only in one place + refactor Doc/fs/ntfs3: Fix rst format and make it cleaner fs/ntfs3: Remove deprecated mount options nls Konstantin Komarov (37): fs/ntfs3: Add headers and misc files fs/ntfs3: Add initialization of super block fs/ntfs3: Add bitmap fs/ntfs3: Add file operations and implementation fs/ntfs3: Add attrib operations fs/ntfs3: Add compression fs/ntfs3: Add NTFS journal fs/ntfs3: Add Kconfig, Makefile and doc fs/ntfs3: Rework file operations fs/ntfs3: Restyle comments to better align with kernel-doc fs/ntfs3: Fix insertion of attr in ni_ins_attr_ext fs/ntfs3: Change max hardlinks limit to 4000 fs/ntfs3: Add sync flag to ntfs_sb_write_run and al_update fs/ntfs3: Fix logical error in ntfs_create_inode fs/ntfs3: Move ni_lock_dir and ni_unlock into ntfs_create_inode fs/ntfs3: Refactor ntfs_get_acl_ex for better readability fs/ntfs3: Pass flags to ntfs_set_ea in ntfs_set_acl_ex fs/ntfs3: Change posix_acl_equiv_mode to posix_acl_update_mode fs/ntfs3: Refactoring lock in ntfs_init_acl fs/ntfs3: Reject mount if boot's cluster size < media sector size fs/ntfs3: Refactoring of ntfs_init_from_boot fs/ntfs3: Check for NULL if ATTR_EA_INFO is incorrect fs/ntfs3: Use available posix_acl_release instead of ntfs_posix_acl_release fs/ntfs3: Remove locked argument in ntfs_set_ea fs/ntfs3: Refactoring of ntfs_set_ea fs/ntfs3: Forbid FALLOC_FL_PUNCH_HOLE for normal files fs/ntfs3: Remove unnecessary functions fs/ntfs3: Keep prealloc for all types of files fs/ntfs3: Fix memory leak if fill_super failed fs/ntfs3: Rework ntfs_utf16_to_nls fs/ntfs3: Refactor ntfs_readlink_hlp fs/ntfs3: Refactor ntfs_create_inode fs/ntfs3: Refactor ni_parse_reparse fs/ntfs3: Refactor ntfs_read_mft fs/ntfs3: Check for NULL pointers in ni_try_remove_attr_list fs/ntfs3: Add MAINTAINERS fs/ntfs3: Add NTFS3 in fs/Kconfig and fs/Makefile Nathan Chancellor (1): fs/ntfs3: Remove unused variable cnt in ntfs_security_init() Yin Xiujiang (2): fs/ntfs3: Fix the issue from backport 5.15 to 5.10 fs/ntfs3: Add ntfs3 module in openeuler_defconfig Documentation/filesystems/index.rst | 1 + Documentation/filesystems/ntfs3.rst | 115 + MAINTAINERS | 9 + arch/arm64/configs/openeuler_defconfig | 4 + arch/x86/configs/openeuler_defconfig | 4 + fs/Kconfig | 1 + fs/Makefile | 1 + fs/ntfs3/Kconfig | 46 + fs/ntfs3/Makefile | 36 + fs/ntfs3/attrib.c | 2083 ++++++++++ fs/ntfs3/attrlist.c | 457 +++ fs/ntfs3/bitfunc.c | 128 + fs/ntfs3/bitmap.c | 1491 +++++++ fs/ntfs3/debug.h | 55 + fs/ntfs3/dir.c | 593 +++ fs/ntfs3/file.c | 1254 ++++++ fs/ntfs3/frecord.c | 3284 +++++++++++++++ fs/ntfs3/fslog.c | 5213 ++++++++++++++++++++++++ fs/ntfs3/fsntfs.c | 2506 ++++++++++++ fs/ntfs3/index.c | 2584 ++++++++++++ fs/ntfs3/inode.c | 1960 +++++++++ fs/ntfs3/lib/decompress_common.c | 319 ++ fs/ntfs3/lib/decompress_common.h | 343 ++ fs/ntfs3/lib/lib.h | 32 + fs/ntfs3/lib/lzx_decompress.c | 670 +++ fs/ntfs3/lib/xpress_decompress.c | 142 + fs/ntfs3/lznt.c | 453 ++ fs/ntfs3/namei.c | 387 ++ fs/ntfs3/ntfs.h | 1224 ++++++ fs/ntfs3/ntfs_fs.h | 1138 ++++++ fs/ntfs3/record.c | 602 +++ fs/ntfs3/run.c | 1111 +++++ fs/ntfs3/super.c | 1507 +++++++ fs/ntfs3/upcase.c | 104 + fs/ntfs3/xattr.c | 991 +++++ 35 files changed, 30848 insertions(+) create mode 100644 Documentation/filesystems/ntfs3.rst create mode 100644 fs/ntfs3/Kconfig create mode 100644 fs/ntfs3/Makefile create mode 100644 fs/ntfs3/attrib.c create mode 100644 fs/ntfs3/attrlist.c create mode 100644 fs/ntfs3/bitfunc.c create mode 100644 fs/ntfs3/bitmap.c create mode 100644 fs/ntfs3/debug.h create mode 100644 fs/ntfs3/dir.c create mode 100644 fs/ntfs3/file.c create mode 100644 fs/ntfs3/frecord.c create mode 100644 fs/ntfs3/fslog.c create mode 100644 fs/ntfs3/fsntfs.c create mode 100644 fs/ntfs3/index.c create mode 100644 fs/ntfs3/inode.c create mode 100644 fs/ntfs3/lib/decompress_common.c create mode 100644 fs/ntfs3/lib/decompress_common.h create mode 100644 fs/ntfs3/lib/lib.h create mode 100644 fs/ntfs3/lib/lzx_decompress.c create mode 100644 fs/ntfs3/lib/xpress_decompress.c create mode 100644 fs/ntfs3/lznt.c create mode 100644 fs/ntfs3/namei.c create mode 100644 fs/ntfs3/ntfs.h create mode 100644 fs/ntfs3/ntfs_fs.h create mode 100644 fs/ntfs3/record.c create mode 100644 fs/ntfs3/run.c create mode 100644 fs/ntfs3/super.c create mode 100644 fs/ntfs3/upcase.c create mode 100644 fs/ntfs3/xattr.c -- 2.20.1

1 5

[PATCH openEuler-1.0-LTS 01/40] fuse: fix page stealing
by Yang Yingliang 27 Jan '22

27 Jan '22

From: Miklos Szeredi <mszeredi(a)redhat.com> stable inclusion from linux-4.19.219 commit 65f1f3eb09a3907c5f5edaff6c473b99e49e6020 -------------------------------- commit 712a951025c0667ff00b25afc360f74e639dfabe upstream. It is possible to trigger a crash by splicing anon pipe bufs to the fuse device. The reason for this is that anon_pipe_buf_release() will reuse buf->page if the refcount is 1, but that page might have already been stolen and its flags modified (e.g. PG_lru added). This happens in the unlikely case of fuse_dev_splice_write() getting around to calling pipe_buf_release() after a page has been stolen, added to the page cache and removed from the page cache. Fix by calling pipe_buf_release() right after the page was inserted into the page cache. In this case the page has an elevated refcount so any release function will know that the page isn't reusable. Reported-by: Frank Dinoff <fdinoff(a)google.com> Link: https://lore.kernel.org/r/CAAmZXrsGg2xsP1CK+cbuEMumtrqdvD-NKnWzhNcvn71RV3c1… Fixes: dd3bb14f44a6 ("fuse: support splice() writing to fuse device") Cc: <stable(a)vger.kernel.org> # v2.6.35 Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/fuse/dev.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c index 498a4fab40801..3fee28ee63745 100644 --- a/fs/fuse/dev.c +++ b/fs/fuse/dev.c @@ -905,6 +905,12 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep) goto out_put_old; } + /* + * Release while we have extra ref on stolen page. Otherwise + * anon_pipe_buf_release() might think the page can be reused. + */ + pipe_buf_release(cs->pipe, buf); + get_page(newpage); if (!(buf->flags & PIPE_BUF_FLAG_LRU)) @@ -2054,8 +2060,12 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe, pipe_lock(pipe); out_free: - for (idx = 0; idx < nbuf; idx++) - pipe_buf_release(pipe, &bufs[idx]); + for (idx = 0; idx < nbuf; idx++) { + struct pipe_buffer *buf = &bufs[idx]; + + if (buf->ops) + pipe_buf_release(pipe, buf); + } pipe_unlock(pipe); kvfree(bufs); -- 2.25.1

1 39

[PATCH openEuler-5.10 01/47] net: add and use skb_unclone_keeptruesize() helper
by Zheng Zengkai 27 Jan '22

27 Jan '22

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v5.16-rc1 commit c4777efa751d293e369aec464ce6875e957be255 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4RYXI CVE: NA -------------------------------- While commit 097b9146c0e2 ("net: fix up truesize of cloned skb in skb_prepare_for_shift()") fixed immediate issues found when KFENCE was enabled/tested, there are still similar issues, when tcp_trim_head() hits KFENCE while the master skb is cloned. This happens under heavy networking TX workloads, when the TX completion might be delayed after incoming ACK. This patch fixes the WARNING in sk_stream_kill_queues when sk->sk_mem_queued/sk->sk_forward_alloc are not zero. Fixes: d3fb45f370d9 ("mm, kfence: insert KFENCE hooks for SLAB") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Acked-by: Marco Elver <elver(a)google.com> Link: https://lore.kernel.org/r/20211102004555.1359210-1-eric.dumazet@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: YueHaibing <yuehaibing(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- include/linux/skbuff.h | 16 ++++++++++++++++ net/core/skbuff.c | 14 +------------- net/ipv4/tcp_output.c | 6 +++--- 3 files changed, 20 insertions(+), 16 deletions(-) diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index d485f17ff33a..e5f61bdd42a8 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -1652,6 +1652,22 @@ static inline int skb_unclone(struct sk_buff *skb, gfp_t pri) return 0; } +/* This variant of skb_unclone() makes sure skb->truesize is not changed */ +static inline int skb_unclone_keeptruesize(struct sk_buff *skb, gfp_t pri) +{ + might_sleep_if(gfpflags_allow_blocking(pri)); + + if (skb_cloned(skb)) { + unsigned int save = skb->truesize; + int res; + + res = pskb_expand_head(skb, 0, 0, pri); + skb->truesize = save; + return res; + } + return 0; +} + /** * skb_header_cloned - is the header a clone * @skb: buffer to check diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 8d73503c8b32..16c74a81b7bf 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -3311,19 +3311,7 @@ EXPORT_SYMBOL(skb_split); */ static int skb_prepare_for_shift(struct sk_buff *skb) { - int ret = 0; - - if (skb_cloned(skb)) { - /* Save and restore truesize: pskb_expand_head() may reallocate - * memory where ksize(kmalloc(S)) != ksize(kmalloc(S)), but we - * cannot change truesize at this point. - */ - unsigned int save_truesize = skb->truesize; - - ret = pskb_expand_head(skb, 0, 0, GFP_ATOMIC); - skb->truesize = save_truesize; - } - return ret; + return skb_unclone_keeptruesize(skb, GFP_ATOMIC); } /** diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index c8420b48de36..da8bcdd90715 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -1613,7 +1613,7 @@ int tcp_fragment(struct sock *sk, enum tcp_queue tcp_queue, return -ENOMEM; } - if (skb_unclone(skb, gfp)) + if (skb_unclone_keeptruesize(skb, gfp)) return -ENOMEM; /* Get a new skb... force flag on. */ @@ -1722,7 +1722,7 @@ int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len) { u32 delta_truesize; - if (skb_unclone(skb, GFP_ATOMIC)) + if (skb_unclone_keeptruesize(skb, GFP_ATOMIC)) return -ENOMEM; delta_truesize = __pskb_trim_head(skb, len); @@ -3236,7 +3236,7 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs) cur_mss, GFP_ATOMIC)) return -ENOMEM; /* We'll try again later. */ } else { - if (skb_unclone(skb, GFP_ATOMIC)) + if (skb_unclone_keeptruesize(skb, GFP_ATOMIC)) return -ENOMEM; diff = tcp_skb_pcount(skb); -- 2.20.1

1 43

[PATCH openEuler-5.10 1/9] crypto: Add PMULL judgment during initialization to prevent oops
by Zheng Zengkai 26 Jan '22

26 Jan '22

From: wangshouping <wangshouping(a)huawei.com> openEuler inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4OKIE?from=project-issue CVE: NA ---------------------------------------- For servers that do not support PMULL on the cpu, execute "modprobe crct10dif-ce", and accur oops. Signed-off-by: wangshouping <wangshouping(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- arch/arm64/crypto/crct10dif-neon_glue.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/arm64/crypto/crct10dif-neon_glue.c b/arch/arm64/crypto/crct10dif-neon_glue.c index e0c4a9acee27..af731b3ec30e 100644 --- a/arch/arm64/crypto/crct10dif-neon_glue.c +++ b/arch/arm64/crypto/crct10dif-neon_glue.c @@ -97,7 +97,11 @@ static struct shash_alg alg = { static int __init crct10dif_arm64_mod_init(void) { - return crypto_register_shash(&alg); + if (cpu_have_named_feature(PMULL)) { + return crypto_register_shash(&alg); + } else { + return -ENODEV; + } } static void __exit crct10dif_arm64_mod_fini(void) -- 2.20.1

1 8

Re: [PATCH openEuler-1.0-LTS V3 34/92] KVM: mmu: Fix SPTE encoding of MMIO generation upper half
by Zenghui Yu 26 Jan '22

26 Jan '22

Reviewed-by: Zenghui Yu <yuzenghui(a)huawei.com>

1 0

Re: [PATCH openEuler-1.0-LTS V3 32/92] KVM: x86: fix overlap between SPTE_MMIO_MASK and generation
by Zenghui Yu 26 Jan '22

26 Jan '22

Reviewed-by: Zenghui Yu <yuzenghui(a)huawei.com>

1 0

[PATCH openEuler-1.0-LTS] ipmi_si: Phytium S2500 workaround for MMIO-based IPMI
by Yang Yingliang 26 Jan '22

26 Jan '22

From: Laibin Qiu <qiulaibin(a)huawei.com> phytium inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4RK58 CVE: NA -------------------------------- The system would hang up when the Phytium S2500 communicates with some BMCs after several rounds of transactions, unless we reset the controller timeout counter manually by calling firmware through SMC. Signed-off-by: Wang Yinfeng <wangyinfeng(a)phytium.com.cn> Signed-off-by: Chen Baozi <chenbaozi(a)phytium.com.cn> #openEuler_contributor Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/char/ipmi/ipmi_si_mem_io.c | 72 ++++++++++++++++++++++++++++++ 1 file changed, 72 insertions(+) diff --git a/drivers/char/ipmi/ipmi_si_mem_io.c b/drivers/char/ipmi/ipmi_si_mem_io.c index 75583612ab105..9403e35a19934 100644 --- a/drivers/char/ipmi/ipmi_si_mem_io.c +++ b/drivers/char/ipmi/ipmi_si_mem_io.c @@ -3,9 +3,75 @@ #include <linux/io.h> #include "ipmi_si.h" +#ifdef CONFIG_ARM_GIC_PHYTIUM_2500 +#include <linux/arm-smccc.h> + +#define CTL_RST_FUNC_ID 0xC2000011 + +static bool apply_phytium2500_workaround; + +struct ipmi_workaround_oem_info { + char oem_id[ACPI_OEM_ID_SIZE + 1]; +}; + +static struct ipmi_workaround_oem_info wa_info[] = { + { + .oem_id = "KPSVVJ", + } +}; + +static void ipmi_check_phytium_workaround(void) +{ +#ifdef CONFIG_ACPI + struct acpi_table_header tbl; + int i; + + if (ACPI_FAILURE(acpi_get_table_header(ACPI_SIG_DSDT, 0, &tbl))) + return; + + for (i = 0; i < ARRAY_SIZE(wa_info); i++) { + if (strncmp(wa_info[i].oem_id, tbl.oem_id, ACPI_OEM_ID_SIZE)) + continue; + + apply_phytium2500_workaround = true; + break; + } +#endif +} + +static void ctl_smc(unsigned long arg0, unsigned long arg1, + unsigned long arg2, unsigned long arg3) +{ + struct arm_smccc_res res; + + arm_smccc_smc(arg0, arg1, arg2, arg3, 0, 0, 0, 0, &res); + if (res.a0 != 0) + pr_err("Error: Firmware call SMC reset Failed: %d, addr: 0x%lx\n", + (int)res.a0, arg2); +} + +static void ctl_timeout_reset(void) +{ + ctl_smc(CTL_RST_FUNC_ID, 0x1, 0x28100208, 0x1); + ctl_smc(CTL_RST_FUNC_ID, 0x1, 0x2810020C, 0x1); +} + +static inline void ipmi_phytium_workaround(void) +{ + if (apply_phytium2500_workaround) + ctl_timeout_reset(); +} + +#else +static inline void ipmi_check_phytium_workaround(void) {} +static inline void ipmi_phytium_workaround(void) {} +#endif + static unsigned char intf_mem_inb(const struct si_sm_io *io, unsigned int offset) { + ipmi_phytium_workaround(); + return readb((io->addr)+(offset * io->regspacing)); } @@ -31,6 +97,8 @@ static void intf_mem_outw(const struct si_sm_io *io, unsigned int offset, static unsigned char intf_mem_inl(const struct si_sm_io *io, unsigned int offset) { + ipmi_phytium_workaround(); + return (readl((io->addr)+(offset * io->regspacing)) >> io->regshift) & 0xff; } @@ -44,6 +112,8 @@ static void intf_mem_outl(const struct si_sm_io *io, unsigned int offset, #ifdef readq static unsigned char mem_inq(const struct si_sm_io *io, unsigned int offset) { + ipmi_phytium_workaround(); + return (readq((io->addr)+(offset * io->regspacing)) >> io->regshift) & 0xff; } @@ -81,6 +151,8 @@ int ipmi_si_mem_setup(struct si_sm_io *io) if (!addr) return -ENODEV; + ipmi_check_phytium_workaround(); + /* * Figure out the actual readb/readw/readl/etc routine to use based * upon the register size. -- 2.25.1

1 0

Re: [PATCH openEuler-1.0-LTS V3 31/92] KVM: x86: assign two bits to track SPTE kinds
by Zenghui Yu 26 Jan '22

26 Jan '22

Reviewed-by: Zenghui Yu <yuzenghui(a)huawei.com>

1 0

Re: [PATCH openEuler-1.0-LTS V3 30/92] KVM: Move the memslot update in-progress flag to bit 63
by Zenghui Yu 26 Jan '22

26 Jan '22

Reviewed-by: Zenghui Yu <yuzenghui(a)huawei.com>

1 0

Re: [PATCH openEuler-1.0-LTS V3 29/92] KVM: Remove the hack to trigger memslot generation wraparound
by Zenghui Yu 26 Jan '22

26 Jan '22

Reviewed-by: Zenghui Yu <yuzenghui(a)huawei.com>

1 0

Re: [PATCH openEuler-1.0-LTS V3 13/92] KVM: x86: Refactor the MMIO SPTE generation handling
by Zenghui Yu 26 Jan '22

26 Jan '22

Reviewed-by: Zenghui Yu <yuzenghui(a)huawei.com>

1 0

Re: [PATCH openEuler-1.0-LTS V3 11/92] KVM: x86: Use a u64 when passing the MMIO gen around
by Zenghui Yu 26 Jan '22

26 Jan '22

Reviewed-by: Zenghui Yu <yuzenghui(a)huawei.com>

1 0

Re: [PATCH openEuler-1.0-LTS V3 12/92] KVM: Explicitly define the "memslot update in-progress" bit
by Zenghui Yu 26 Jan '22

26 Jan '22

Reviewed-by: Zenghui Yu <yuzenghui(a)huawei.com>

1 0