- Kernel - mailweb.openeuler.org

[PATCH openEuler-5.10 01/17] slub: fix unreclaimable slab stat for bulk free
by Zheng Zengkai 29 Sep '21

29 Sep '21

From: Shakeel Butt <shakeelb(a)google.com> mainline inclusion from mainline-v5.14-rc4 commit f227f0faf63b46a113c4d1aca633c80195622dd2 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4C12I CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- SLUB uses page allocator for higher order allocations and update unreclaimable slab stat for such allocations. At the moment, the bulk free for SLUB does not share code with normal free code path for these type of allocations and have missed the stat update. So, fix the stat update by common code. The user visible impact of the bug is the potential of inconsistent unreclaimable slab stat visible through meminfo and vmstat. Link: https://lkml.kernel.org/r/20210728155354.3440560-1-shakeelb@google.com Fixes: 6a486c0ad4dc ("mm, sl[ou]b: improve memory accounting") Signed-off-by: Shakeel Butt <shakeelb(a)google.com> Acked-by: Michal Hocko <mhocko(a)suse.com> Acked-by: Roman Gushchin <guro(a)fb.com> Reviewed-by: Muchun Song <songmuchun(a)bytedance.com> Cc: Christoph Lameter <cl(a)linux.com> Cc: Pekka Enberg <penberg(a)kernel.org> Cc: David Rientjes <rientjes(a)google.com> Cc: Joonsoo Kim <iamjoonsoo.kim(a)lge.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Chen Huang <chenhuang5(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- mm/slub.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/mm/slub.c b/mm/slub.c index f06f002bb098..4a83fa347672 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -3164,6 +3164,16 @@ struct detached_freelist { struct kmem_cache *s; }; +static inline void free_nonslab_page(struct page *page) +{ + unsigned int order = compound_order(page); + + VM_BUG_ON_PAGE(!PageCompound(page), page); + kfree_hook(page_address(page)); + mod_lruvec_page_state(page, NR_SLAB_UNRECLAIMABLE_B, -(PAGE_SIZE << order)); + __free_pages(page, order); +} + /* * This function progressively scans the array with free objects (with * a limited look ahead) and extract objects belonging to the same @@ -3200,9 +3210,7 @@ int build_detached_freelist(struct kmem_cache *s, size_t size, if (!s) { /* Handle kalloc'ed objects */ if (unlikely(!PageSlab(page))) { - BUG_ON(!PageCompound(page)); - kfree_hook(object); - __free_pages(page, compound_order(page)); + free_nonslab_page(page); p[size] = NULL; /* mark object processed */ return size; } @@ -4102,13 +4110,7 @@ void kfree(const void *x) page = virt_to_head_page(x); if (unlikely(!PageSlab(page))) { - unsigned int order = compound_order(page); - - BUG_ON(!PageCompound(page)); - kfree_hook(object); - mod_lruvec_page_state(page, NR_SLAB_UNRECLAIMABLE_B, - -(PAGE_SIZE << order)); - __free_pages(page, order); + free_nonslab_page(page); return; } slab_free(page->slab_cache, page, object, NULL, 1, _RET_IP_); -- 2.20.1

1 16

[PATCH openEuler-21.09] eulerfs: add the /proc/idle file.
by Hongyu Li 29 Sep '21

29 Sep '21

From: Hongyu Li <“543306408(a)qq.xn--com-9o0a> openEuler inclusion category: bugfix bugzilla: https://gitee.com/openeuler-competition/summer-2021/issues/I3EBT6 CVE: NA ---------------------------------------------------------------------- The /proc/idle can give higher precision in accounting the CPU idle time compared with the traditional /proc/stat ways. Signed-off-by: Hongyu Li <“543306408(a)qq.xn--com-9o0a> --- fs/proc/Kconfig | 7 ++++ fs/proc/Makefile | 1 + fs/proc/proc_idle.c | 82 ++++++++++++++++++++++++++++++++++++++++++ kernel/sched/cputime.c | 16 +++++++++ kernel/sched/idle.c | 21 +++++++++++ 5 files changed, 127 insertions(+) create mode 100644 fs/proc/proc_idle.c diff --git a/fs/proc/Kconfig b/fs/proc/Kconfig index c930001056f9..46620afe9cac 100644 --- a/fs/proc/Kconfig +++ b/fs/proc/Kconfig @@ -107,3 +107,10 @@ config PROC_PID_ARCH_STATUS config PROC_CPU_RESCTRL def_bool n depends on PROC_FS + +config PROC_IDLE + bool "include /proc/idle file" + depends on PROC_FS + default y + help + Provide the CPU idle time in the /proc/idle file. diff --git a/fs/proc/Makefile b/fs/proc/Makefile index 8704d41dd67c..69dd2da3a080 100644 --- a/fs/proc/Makefile +++ b/fs/proc/Makefile @@ -34,5 +34,6 @@ proc-$(CONFIG_PROC_VMCORE) += vmcore.o proc-$(CONFIG_PRINTK) += kmsg.o proc-$(CONFIG_PROC_PAGE_MONITOR) += page.o proc-$(CONFIG_BOOT_CONFIG) += bootconfig.o +proc-$(CONFIG_PROC_IDLE) += proc_idle.o obj-$(CONFIG_ETMEM_SCAN) += etmem_scan.o obj-$(CONFIG_ETMEM_SWAP) += etmem_swap.o diff --git a/fs/proc/proc_idle.c b/fs/proc/proc_idle.c new file mode 100644 index 000000000000..bbb52e247448 --- /dev/null +++ b/fs/proc/proc_idle.c @@ -0,0 +1,82 @@ +#include <linux/cpumask.h> +#include <linux/device.h> +#include <linux/fs.h> +#include <linux/init.h> +#include <linux/interrupt.h> +#include <linux/kernel.h> +#include <linux/kernel_stat.h> +#include <linux/module.h> +#include <linux/proc_fs.h> +#include <linux/sched.h> +#include <linux/sched/stat.h> +#include <linux/seq_file.h> +#include <linux/slab.h> +#include <linux/time.h> +#include <linux/irqnr.h> +#include <linux/sched/cputime.h> +#include <linux/tick.h> + +#ifdef CONFIG_PROC_IDLE + +#define PROC_NAME "idle" + +extern u64 cpu_rq_get(int cpu); + +static u64 get_idle_sum_exec_runtime(int cpu) +{ + u64 idle = cpu_rq_get(cpu); + + return idle; +} + +static int show_idle(struct seq_file *p, void *v) +{ + int i; + u64 idle; + + idle = 0; + + for_each_possible_cpu(i) { + + idle += get_idle_sum_exec_runtime(i); + + } + + seq_put_decimal_ull(p, "cpu ", nsec_to_clock_t(idle)); + seq_putc(p, '\n'); + + for_each_online_cpu(i) { + + idle = get_idle_sum_exec_runtime(i); + + seq_printf(p, "cpu%d", i); + seq_put_decimal_ull(p, " ", nsec_to_clock_t(idle)); + seq_putc(p, '\n'); + } + + return 0; +} + +static int idle_open(struct inode *inode, struct file *file) +{ + unsigned int size = 1024 + 128 * num_online_cpus(); + + return single_open_size(file, show_idle, NULL, size); +} + +static struct proc_ops idle_procs_ops = { + .proc_open = idle_open, + .proc_read_iter = seq_read_iter, + .proc_lseek = seq_lseek, + .proc_release = single_release, +}; + +static int __init kernel_module_init(void) +{ + proc_create(PROC_NAME, 0, NULL, &idle_procs_ops); + return 0; +} + +fs_initcall(kernel_module_init); + +#endif /*CONFIG_PROC_IDLE*/ diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c index 5a55d2300452..bb280852bb06 100644 --- a/kernel/sched/cputime.c +++ b/kernel/sched/cputime.c @@ -1078,3 +1078,19 @@ void kcpustat_cpu_fetch(struct kernel_cpustat *dst, int cpu) EXPORT_SYMBOL_GPL(kcpustat_cpu_fetch); #endif /* CONFIG_VIRT_CPU_ACCOUNTING_GEN */ + + +#ifdef CONFIG_PROC_IDLE + + +u64 cpu_rq_get(int cpu) +{ + struct rq *rq = cpu_rq(cpu); + struct sched_entity *idle_se = &rq->idle->se; + u64 idle = idle_se->sum_exec_runtime; + + return idle; +} +EXPORT_SYMBOL_GPL(cpu_rq_get); + +#endif /* CONFIG_PROC_IDLE */ diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c index 36b545f17206..e3fb940a61e8 100644 --- a/kernel/sched/idle.c +++ b/kernel/sched/idle.c @@ -424,6 +424,20 @@ static void check_preempt_curr_idle(struct rq *rq, struct task_struct *p, int fl static void put_prev_task_idle(struct rq *rq, struct task_struct *prev) { +#ifdef CONFIG_PROC_IDLE + struct sched_entity *idle_se = &rq->idle->se; + u64 now = sched_clock(); + u64 delta_exec; + + delta_exec = now - idle_se->exec_start; + if (unlikely((s64)delta_exec <= 0)) + return; + + schedstat_set(idle_se->statistics.exec_max, + max(delta_exec, idle_se->statistics.exec_max)); + + idle_se->sum_exec_runtime += delta_exec; +#endif } static void set_next_task_idle(struct rq *rq, struct task_struct *next, bool first) @@ -436,6 +450,13 @@ struct task_struct *pick_next_task_idle(struct rq *rq) { struct task_struct *next = rq->idle; +#ifdef CONFIG_PROC_IDLE + struct sched_entity *idle_se = &rq->idle->se; + u64 now = sched_clock(); + + idle_se->exec_start = now; +#endif + set_next_task_idle(rq, next, true); return next; -- 2.17.1

1 0

[PATCH kernel-4.19] bpf, mips: Validate conditional branch offsets
by Yang Yingliang 29 Sep '21

29 Sep '21

From: Piotr Krysiuk <piotras(a)gmail.com> mainline inclusion from mainline-v5.16 commit 37cb28ec7d3a36a5bace7063a3dba633ab110f8b category: bugfix bugzilla: NA CVE: CVE-2021-38300 ------------------------------------------------- The conditional branch instructions on MIPS use 18-bit signed offsets allowing for a branch range of 128 KBytes (backward and forward). However, this limit is not observed by the cBPF JIT compiler, and so the JIT compiler emits out-of-range branches when translating certain cBPF programs. A specific example of such a cBPF program is included in the "BPF_MAXINSNS: exec all MSH" test from lib/test_bpf.c that executes anomalous machine code containing incorrect branch offsets under JIT. Furthermore, this issue can be abused to craft undesirable machine code, where the control flow is hijacked to execute arbitrary Kernel code. The following steps can be used to reproduce the issue: # echo 1 > /proc/sys/net/core/bpf_jit_enable # modprobe test_bpf test_name="BPF_MAXINSNS: exec all MSH" This should produce multiple warnings from build_bimm() similar to: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 209 at arch/mips/mm/uasm-mips.c:210 build_insn+0x558/0x590 Micro-assembler field overflow Modules linked in: test_bpf(+) CPU: 0 PID: 209 Comm: modprobe Not tainted 5.14.3 #1 Stack : 00000000 807bb824 82b33c9c 801843c0 00000000 00000004 00000000 63c9b5ee 82b33af4 80999898 80910000 80900000 82fd6030 00000001 82b33a98 82087180 00000000 00000000 80873b28 00000000 000000fc 82b3394c 00000000 2e34312e 6d6d6f43 809a180f 809a1836 6f6d203a 80900000 00000001 82b33bac 80900000 00027f80 00000000 00000000 807bb824 00000000 804ed790 001cc317 00000001 [...] Call Trace: [<80108f44>] show_stack+0x38/0x118 [<807a7aac>] dump_stack_lvl+0x5c/0x7c [<807a4b3c>] __warn+0xcc/0x140 [<807a4c3c>] warn_slowpath_fmt+0x8c/0xb8 [<8011e198>] build_insn+0x558/0x590 [<8011e358>] uasm_i_bne+0x20/0x2c [<80127b48>] build_body+0xa58/0x2a94 [<80129c98>] bpf_jit_compile+0x114/0x1e4 [<80613fc4>] bpf_prepare_filter+0x2ec/0x4e4 [<8061423c>] bpf_prog_create+0x80/0xc4 [<c0a006e4>] test_bpf_init+0x300/0xba8 [test_bpf] [<8010051c>] do_one_initcall+0x50/0x1d4 [<801c5e54>] do_init_module+0x60/0x220 [<801c8b20>] sys_finit_module+0xc4/0xfc [<801144d0>] syscall_common+0x34/0x58 [...] ---[ end trace a287d9742503c645 ]--- Then the anomalous machine code executes: => 0xc0a18000: addiu sp,sp,-16 0xc0a18004: sw s3,0(sp) 0xc0a18008: sw s4,4(sp) 0xc0a1800c: sw s5,8(sp) 0xc0a18010: sw ra,12(sp) 0xc0a18014: move s5,a0 0xc0a18018: move s4,zero 0xc0a1801c: move s3,zero # __BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, 0) 0xc0a18020: lui t6,0x8012 0xc0a18024: ori t4,t6,0x9e14 0xc0a18028: li a1,0 0xc0a1802c: jalr t4 0xc0a18030: move a0,s5 0xc0a18034: bnez v0,0xc0a1ffb8 # incorrect branch offset 0xc0a18038: move v0,zero 0xc0a1803c: andi s4,s3,0xf 0xc0a18040: b 0xc0a18048 0xc0a18044: sll s4,s4,0x2 [...] # __BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, 0) 0xc0a1ffa0: lui t6,0x8012 0xc0a1ffa4: ori t4,t6,0x9e14 0xc0a1ffa8: li a1,0 0xc0a1ffac: jalr t4 0xc0a1ffb0: move a0,s5 0xc0a1ffb4: bnez v0,0xc0a1ffb8 # incorrect branch offset 0xc0a1ffb8: move v0,zero 0xc0a1ffbc: andi s4,s3,0xf 0xc0a1ffc0: b 0xc0a1ffc8 0xc0a1ffc4: sll s4,s4,0x2 # __BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, 0) 0xc0a1ffc8: lui t6,0x8012 0xc0a1ffcc: ori t4,t6,0x9e14 0xc0a1ffd0: li a1,0 0xc0a1ffd4: jalr t4 0xc0a1ffd8: move a0,s5 0xc0a1ffdc: bnez v0,0xc0a3ffb8 # correct branch offset 0xc0a1ffe0: move v0,zero 0xc0a1ffe4: andi s4,s3,0xf 0xc0a1ffe8: b 0xc0a1fff0 0xc0a1ffec: sll s4,s4,0x2 [...] # epilogue 0xc0a3ffb8: lw s3,0(sp) 0xc0a3ffbc: lw s4,4(sp) 0xc0a3ffc0: lw s5,8(sp) 0xc0a3ffc4: lw ra,12(sp) 0xc0a3ffc8: addiu sp,sp,16 0xc0a3ffcc: jr ra 0xc0a3ffd0: nop To mitigate this issue, we assert the branch ranges for each emit call that could generate an out-of-range branch. Fixes: 36366e367ee9 ("MIPS: BPF: Restore MIPS32 cBPF JIT") Fixes: c6610de353da ("MIPS: net: Add BPF JIT") Signed-off-by: Piotr Krysiuk <piotras(a)gmail.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Tested-by: Johan Almbladh <johan.almbladh(a)anyfinetworks.com> Acked-by: Johan Almbladh <johan.almbladh(a)anyfinetworks.com> Cc: Paul Burton <paulburton(a)kernel.org> Cc: Thomas Bogendoerfer <tsbogend(a)alpha.franken.de> Link: https://lore.kernel.org/bpf/20210915160437.4080-1-piotras@gmail.com Signed-off-by: Pu Lehui <pulehui(a)huawei.com> Reviewed-by: Kuohai Xu <xukuohai(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/mips/net/bpf_jit.c | 57 +++++++++++++++++++++++++++++++---------- 1 file changed, 43 insertions(+), 14 deletions(-) diff --git a/arch/mips/net/bpf_jit.c b/arch/mips/net/bpf_jit.c index 4d8cb9bb8365d..43e6597c720c2 100644 --- a/arch/mips/net/bpf_jit.c +++ b/arch/mips/net/bpf_jit.c @@ -662,6 +662,11 @@ static void build_epilogue(struct jit_ctx *ctx) ((int)K < 0 ? ((int)K >= SKF_LL_OFF ? func##_negative : func) : \ func##_positive) +static bool is_bad_offset(int b_off) +{ + return b_off > 0x1ffff || b_off < -0x20000; +} + static int build_body(struct jit_ctx *ctx) { const struct bpf_prog *prog = ctx->skf; @@ -728,7 +733,10 @@ static int build_body(struct jit_ctx *ctx) /* Load return register on DS for failures */ emit_reg_move(r_ret, r_zero, ctx); /* Return with error */ - emit_b(b_imm(prog->len, ctx), ctx); + b_off = b_imm(prog->len, ctx); + if (is_bad_offset(b_off)) + return -E2BIG; + emit_b(b_off, ctx); emit_nop(ctx); break; case BPF_LD | BPF_W | BPF_IND: @@ -775,8 +783,10 @@ static int build_body(struct jit_ctx *ctx) emit_jalr(MIPS_R_RA, r_s0, ctx); emit_reg_move(MIPS_R_A0, r_skb, ctx); /* delay slot */ /* Check the error value */ - emit_bcond(MIPS_COND_NE, r_ret, 0, - b_imm(prog->len, ctx), ctx); + b_off = b_imm(prog->len, ctx); + if (is_bad_offset(b_off)) + return -E2BIG; + emit_bcond(MIPS_COND_NE, r_ret, 0, b_off, ctx); emit_reg_move(r_ret, r_zero, ctx); /* We are good */ /* X <- P[1:K] & 0xf */ @@ -855,8 +865,10 @@ static int build_body(struct jit_ctx *ctx) /* A /= X */ ctx->flags |= SEEN_X | SEEN_A; /* Check if r_X is zero */ - emit_bcond(MIPS_COND_EQ, r_X, r_zero, - b_imm(prog->len, ctx), ctx); + b_off = b_imm(prog->len, ctx); + if (is_bad_offset(b_off)) + return -E2BIG; + emit_bcond(MIPS_COND_EQ, r_X, r_zero, b_off, ctx); emit_load_imm(r_ret, 0, ctx); /* delay slot */ emit_div(r_A, r_X, ctx); break; @@ -864,8 +876,10 @@ static int build_body(struct jit_ctx *ctx) /* A %= X */ ctx->flags |= SEEN_X | SEEN_A; /* Check if r_X is zero */ - emit_bcond(MIPS_COND_EQ, r_X, r_zero, - b_imm(prog->len, ctx), ctx); + b_off = b_imm(prog->len, ctx); + if (is_bad_offset(b_off)) + return -E2BIG; + emit_bcond(MIPS_COND_EQ, r_X, r_zero, b_off, ctx); emit_load_imm(r_ret, 0, ctx); /* delay slot */ emit_mod(r_A, r_X, ctx); break; @@ -926,7 +940,10 @@ static int build_body(struct jit_ctx *ctx) break; case BPF_JMP | BPF_JA: /* pc += K */ - emit_b(b_imm(i + k + 1, ctx), ctx); + b_off = b_imm(i + k + 1, ctx); + if (is_bad_offset(b_off)) + return -E2BIG; + emit_b(b_off, ctx); emit_nop(ctx); break; case BPF_JMP | BPF_JEQ | BPF_K: @@ -1056,12 +1073,16 @@ static int build_body(struct jit_ctx *ctx) break; case BPF_RET | BPF_A: ctx->flags |= SEEN_A; - if (i != prog->len - 1) + if (i != prog->len - 1) { /* * If this is not the last instruction * then jump to the epilogue */ - emit_b(b_imm(prog->len, ctx), ctx); + b_off = b_imm(prog->len, ctx); + if (is_bad_offset(b_off)) + return -E2BIG; + emit_b(b_off, ctx); + } emit_reg_move(r_ret, r_A, ctx); /* delay slot */ break; case BPF_RET | BPF_K: @@ -1075,7 +1096,10 @@ static int build_body(struct jit_ctx *ctx) * If this is not the last instruction * then jump to the epilogue */ - emit_b(b_imm(prog->len, ctx), ctx); + b_off = b_imm(prog->len, ctx); + if (is_bad_offset(b_off)) + return -E2BIG; + emit_b(b_off, ctx); emit_nop(ctx); } break; @@ -1133,8 +1157,10 @@ static int build_body(struct jit_ctx *ctx) /* Load *dev pointer */ emit_load_ptr(r_s0, r_skb, off, ctx); /* error (0) in the delay slot */ - emit_bcond(MIPS_COND_EQ, r_s0, r_zero, - b_imm(prog->len, ctx), ctx); + b_off = b_imm(prog->len, ctx); + if (is_bad_offset(b_off)) + return -E2BIG; + emit_bcond(MIPS_COND_EQ, r_s0, r_zero, b_off, ctx); emit_reg_move(r_ret, r_zero, ctx); if (code == (BPF_ANC | SKF_AD_IFINDEX)) { BUILD_BUG_ON(FIELD_SIZEOF(struct net_device, ifindex) != 4); @@ -1244,7 +1270,10 @@ void bpf_jit_compile(struct bpf_prog *fp) /* Generate the actual JIT code */ build_prologue(&ctx); - build_body(&ctx); + if (build_body(&ctx)) { + module_memfree(ctx.target); + goto out; + } build_epilogue(&ctx); /* Update the icache */ -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand()
by Yang Yingliang 29 Sep '21

29 Sep '21

From: Arun Easi <aeasi(a)marvell.com> stable inclusion from linux-4.19.191 commit c5ab9b67d8b061de74e2ca51bf787ee599bd7f89 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4AFG0?from=project-issue CVE: NA -------------------------------- commit 6641df81ab799f28a5d564f860233dd26cca0d93 upstream. RIP: 0010:kmem_cache_free+0xfa/0x1b0 Call Trace: qla2xxx_mqueuecommand+0x2b5/0x2c0 [qla2xxx] scsi_queue_rq+0x5e2/0xa40 __blk_mq_try_issue_directly+0x128/0x1d0 blk_mq_request_issue_directly+0x4e/0xb0 Fix incorrect call to free srb in qla2xxx_mqueuecommand(), as srb is now allocated by upper layers. This fixes smatch warning of srb unintended free. Link: https://lore.kernel.org/r/20210329085229.4367-7-njavali@marvell.com Fixes: af2a0c51b120 ("scsi: qla2xxx: Fix SRB leak on switch command timeout") Cc: stable(a)vger.kernel.org # 5.5 Reported-by: Laurence Oberman <loberman(a)redhat.com> Reported-by: Dan Carpenter <dan.carpenter(a)oracle.com> Reviewed-by: Himanshu Madhani <himanshu.madhani(a)oracle.com> Signed-off-by: Arun Easi <aeasi(a)marvell.com> Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: yin-xiujiang <yinxiujiang(a)kylinos.cn> # openEuler_contributor Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/scsi/qla2xxx/qla_os.c | 7 ------- 1 file changed, 7 deletions(-) diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c index bfbf213b15c0b..8e9d386146ac6 100644 --- a/drivers/scsi/qla2xxx/qla_os.c +++ b/drivers/scsi/qla2xxx/qla_os.c @@ -1028,8 +1028,6 @@ qla2xxx_mqueuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd, if (rval != QLA_SUCCESS) { ql_dbg(ql_dbg_io + ql_dbg_verbose, vha, 0x3078, "Start scsi failed rval=%d for cmd=%p.\n", rval, cmd); - if (rval == QLA_INTERFACE_ERROR) - goto qc24_free_sp_fail_command; goto qc24_host_busy_free_sp; } @@ -1044,11 +1042,6 @@ qla2xxx_mqueuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd, qc24_target_busy: return SCSI_MLQUEUE_TARGET_BUSY; -qc24_free_sp_fail_command: - sp->free(sp); - CMD_SP(cmd) = NULL; - qla2xxx_rel_qpair_sp(sp->qpair, sp); - qc24_fail_command: cmd->scsi_done(cmd); -- 2.25.1

1 0

[PATCH kernel-4.19] crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd()
by Yang Yingliang 28 Sep '21

28 Sep '21

From: Dan Carpenter <dan.carpenter(a)oracle.com> mainline inclusion from mainline-v5.16 commit 505d9dcb0f7ddf9d075e729523a33d38642ae680 category: bugfix bugzilla: NA CVE: CVE-2021-3764, CVE-2021-3744 --------------------------- There are three bugs in this code: 1) If we ccp_init_data() fails for &src then we need to free aad. Use goto e_aad instead of goto e_ctx. 2) The label to free the &final_wa was named incorrectly as "e_tag" but it should have been "e_final_wa". One error path leaked &final_wa. 3) The &tag was leaked on one error path. In that case, I added a free before the goto because the resource was local to that block. Fixes: 36cf515b9bbe ("crypto: ccp - Enable support for AES GCM on v5 CCPs") Reported-by: "minihanshen(沈明航)" <minihanshen(a)tencent.com> Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Reviewed-by: John Allen <john.allen(a)amd.com> Tested-by: John Allen <john.allen(a)amd.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: weiyang wang <wangweiyang2(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/crypto/ccp/ccp-ops.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c index 4dca1c7b9d47b..cdffff7c8abb9 100644 --- a/drivers/crypto/ccp/ccp-ops.c +++ b/drivers/crypto/ccp/ccp-ops.c @@ -768,7 +768,7 @@ static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, in_place ? DMA_BIDIRECTIONAL : DMA_TO_DEVICE); if (ret) - goto e_ctx; + goto e_aad; if (in_place) { dst = src; @@ -853,7 +853,7 @@ static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, op.u.aes.size = 0; ret = cmd_q->ccp->vdata->perform->aes(&op); if (ret) - goto e_dst; + goto e_final_wa; if (aes->action == CCP_AES_ACTION_ENCRYPT) { /* Put the ciphered tag after the ciphertext. */ @@ -863,17 +863,19 @@ static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, ret = ccp_init_dm_workarea(&tag, cmd_q, authsize, DMA_BIDIRECTIONAL); if (ret) - goto e_tag; + goto e_final_wa; ret = ccp_set_dm_area(&tag, 0, p_tag, 0, authsize); - if (ret) - goto e_tag; + if (ret) { + ccp_dm_free(&tag); + goto e_final_wa; + } ret = crypto_memneq(tag.address, final_wa.address, authsize) ? -EBADMSG : 0; ccp_dm_free(&tag); } -e_tag: +e_final_wa: ccp_dm_free(&final_wa); e_dst: -- 2.25.1

1 0

[PATCH OLK-5.10 0/2] net: spnic: initial commit Ramaxel NIC driver
by Yanling Song 28 Sep '21

28 Sep '21

This initial commit contains Ramaxel's spnic module Yanling Song (2): spnic: initial commit the common module of Ramaxel NIC driver spnic: add NIC layer arch/arm64/configs/openeuler_defconfig | 2 + arch/x86/configs/openeuler_defconfig | 2 + drivers/net/ethernet/Kconfig | 1 + drivers/net/ethernet/Makefile | 1 + drivers/net/ethernet/ramaxel/Kconfig | 20 + drivers/net/ethernet/ramaxel/Makefile | 6 + drivers/net/ethernet/ramaxel/spnic/Kconfig | 15 + drivers/net/ethernet/ramaxel/spnic/Makefile | 40 + .../ethernet/ramaxel/spnic/hw/sphw_api_cmd.c | 1165 +++++++++++ .../ethernet/ramaxel/spnic/hw/sphw_api_cmd.h | 277 +++ .../ethernet/ramaxel/spnic/hw/sphw_cfg_cmd.h | 126 ++ .../net/ethernet/ramaxel/spnic/hw/sphw_cmdq.c | 1606 +++++++++++++++ .../net/ethernet/ramaxel/spnic/hw/sphw_cmdq.h | 196 ++ .../ethernet/ramaxel/spnic/hw/sphw_comm_cmd.h | 60 + .../ramaxel/spnic/hw/sphw_comm_msg_intf.h | 273 +++ .../ethernet/ramaxel/spnic/hw/sphw_common.c | 88 + .../ethernet/ramaxel/spnic/hw/sphw_common.h | 118 ++ .../net/ethernet/ramaxel/spnic/hw/sphw_crm.h | 984 +++++++++ .../net/ethernet/ramaxel/spnic/hw/sphw_csr.h | 171 ++ .../net/ethernet/ramaxel/spnic/hw/sphw_eqs.c | 1374 +++++++++++++ .../net/ethernet/ramaxel/spnic/hw/sphw_eqs.h | 157 ++ .../net/ethernet/ramaxel/spnic/hw/sphw_hw.h | 649 ++++++ .../ethernet/ramaxel/spnic/hw/sphw_hw_cfg.c | 1339 ++++++++++++ .../ethernet/ramaxel/spnic/hw/sphw_hw_cfg.h | 327 +++ .../ethernet/ramaxel/spnic/hw/sphw_hw_comm.c | 1253 ++++++++++++ .../ethernet/ramaxel/spnic/hw/sphw_hw_comm.h | 42 + .../ethernet/ramaxel/spnic/hw/sphw_hwdev.c | 1402 +++++++++++++ .../ethernet/ramaxel/spnic/hw/sphw_hwdev.h | 93 + .../net/ethernet/ramaxel/spnic/hw/sphw_hwif.c | 911 +++++++++ .../net/ethernet/ramaxel/spnic/hw/sphw_hwif.h | 102 + .../net/ethernet/ramaxel/spnic/hw/sphw_mbox.c | 1808 +++++++++++++++++ .../net/ethernet/ramaxel/spnic/hw/sphw_mbox.h | 274 +++ .../net/ethernet/ramaxel/spnic/hw/sphw_mgmt.c | 1382 +++++++++++++ .../net/ethernet/ramaxel/spnic/hw/sphw_mgmt.h | 156 ++ .../ramaxel/spnic/hw/sphw_mgmt_msg_base.h | 19 + .../net/ethernet/ramaxel/spnic/hw/sphw_mt.h | 534 +++++ .../ramaxel/spnic/hw/sphw_prof_adap.c | 94 + .../ramaxel/spnic/hw/sphw_prof_adap.h | 49 + .../ethernet/ramaxel/spnic/hw/sphw_profile.h | 36 + .../net/ethernet/ramaxel/spnic/hw/sphw_wq.c | 152 ++ .../net/ethernet/ramaxel/spnic/hw/sphw_wq.h | 119 ++ .../net/ethernet/ramaxel/spnic/spnic_dbg.c | 753 +++++++ .../net/ethernet/ramaxel/spnic/spnic_dcb.c | 965 +++++++++ .../net/ethernet/ramaxel/spnic/spnic_dcb.h | 56 + .../ethernet/ramaxel/spnic/spnic_dev_mgmt.c | 811 ++++++++ .../ethernet/ramaxel/spnic/spnic_dev_mgmt.h | 78 + .../ethernet/ramaxel/spnic/spnic_ethtool.c | 983 +++++++++ .../ramaxel/spnic/spnic_ethtool_stats.c | 1035 ++++++++++ .../net/ethernet/ramaxel/spnic/spnic_filter.c | 412 ++++ .../net/ethernet/ramaxel/spnic/spnic_irq.c | 178 ++ .../net/ethernet/ramaxel/spnic/spnic_lld.c | 937 +++++++++ .../net/ethernet/ramaxel/spnic/spnic_lld.h | 75 + .../ethernet/ramaxel/spnic/spnic_mag_cfg.c | 778 +++++++ .../ethernet/ramaxel/spnic/spnic_mag_cmd.h | 643 ++++++ .../net/ethernet/ramaxel/spnic/spnic_main.c | 925 +++++++++ .../ramaxel/spnic/spnic_mgmt_interface.h | 617 ++++++ .../ethernet/ramaxel/spnic/spnic_netdev_ops.c | 1526 ++++++++++++++ .../net/ethernet/ramaxel/spnic/spnic_nic.h | 148 ++ .../ethernet/ramaxel/spnic/spnic_nic_cfg.c | 1321 ++++++++++++ .../ethernet/ramaxel/spnic/spnic_nic_cfg.h | 724 +++++++ .../ethernet/ramaxel/spnic/spnic_nic_cfg_vf.c | 647 ++++++ .../ethernet/ramaxel/spnic/spnic_nic_cmd.h | 105 + .../ethernet/ramaxel/spnic/spnic_nic_dbg.c | 151 ++ .../ethernet/ramaxel/spnic/spnic_nic_dbg.h | 16 + .../ethernet/ramaxel/spnic/spnic_nic_dev.h | 353 ++++ .../ethernet/ramaxel/spnic/spnic_nic_event.c | 506 +++++ .../net/ethernet/ramaxel/spnic/spnic_nic_io.c | 1124 ++++++++++ .../net/ethernet/ramaxel/spnic/spnic_nic_io.h | 309 +++ .../net/ethernet/ramaxel/spnic/spnic_nic_qp.h | 421 ++++ .../net/ethernet/ramaxel/spnic/spnic_ntuple.c | 841 ++++++++ .../ethernet/ramaxel/spnic/spnic_pci_id_tbl.h | 13 + .../net/ethernet/ramaxel/spnic/spnic_rss.c | 750 +++++++ .../net/ethernet/ramaxel/spnic/spnic_rss.h | 48 + .../ethernet/ramaxel/spnic/spnic_rss_cfg.c | 391 ++++ drivers/net/ethernet/ramaxel/spnic/spnic_rx.c | 1250 ++++++++++++ drivers/net/ethernet/ramaxel/spnic/spnic_rx.h | 118 ++ .../net/ethernet/ramaxel/spnic/spnic_sriov.c | 200 ++ .../net/ethernet/ramaxel/spnic/spnic_sriov.h | 24 + drivers/net/ethernet/ramaxel/spnic/spnic_tx.c | 879 ++++++++ drivers/net/ethernet/ramaxel/spnic/spnic_tx.h | 129 ++ 80 files changed, 38663 insertions(+) create mode 100644 drivers/net/ethernet/ramaxel/Kconfig create mode 100644 drivers/net/ethernet/ramaxel/Makefile create mode 100644 drivers/net/ethernet/ramaxel/spnic/Kconfig create mode 100644 drivers/net/ethernet/ramaxel/spnic/Makefile create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_api_cmd.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_api_cmd.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_cfg_cmd.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_cmdq.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_cmdq.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_comm_cmd.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_comm_msg_intf.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_common.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_common.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_crm.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_csr.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_eqs.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_eqs.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hw.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hw_cfg.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hw_cfg.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hw_comm.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hw_comm.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hwdev.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hwdev.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hwif.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hwif.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_mbox.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_mbox.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_mgmt.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_mgmt.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_mgmt_msg_base.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_mt.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_prof_adap.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_prof_adap.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_profile.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_wq.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_wq.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_dbg.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_dcb.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_dcb.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_dev_mgmt.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_dev_mgmt.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_ethtool.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_ethtool_stats.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_filter.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_irq.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_lld.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_lld.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_mag_cfg.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_mag_cmd.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_main.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_mgmt_interface.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_netdev_ops.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_cfg.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_cfg.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_cfg_vf.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_cmd.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_dbg.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_dbg.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_dev.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_event.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_io.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_io.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_qp.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_ntuple.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_pci_id_tbl.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_rss.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_rss.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_rss_cfg.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_rx.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_rx.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_sriov.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_sriov.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_tx.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_tx.h -- 2.30.0

1 2

[PATCH OLK-5.10 01/31] mm: fix page_owner initializing issue for arm32
by Zheng Zengkai 28 Sep '21

28 Sep '21

From: Zhenhua Huang <zhenhuah(a)codeaurora.org> mainline inclusion from mainline-v5.11-rc1 commit 7fb7ab6d618a4dc7ea3f3eafc92388a35b4f8894 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I49LXW CVE: NA ------------------------------------------------- Page owner of pages used by page owner itself used is missing on arm32 targets. The reason is dummy_handle and failure_handle is not initialized correctly. Buddy allocator is used to initialize these two handles. However, buddy allocator is not ready when page owner calls it. This change fixed that by initializing page owner after buddy initialization. The working flow before and after this change are: original logic: 1. allocated memory for page_ext(using memblock). 2. invoke the init callback of page_ext_ops like page_owner(using buddy allocator). 3. initialize buddy. after this change: 1. allocated memory for page_ext(using memblock). 2. initialize buddy. 3. invoke the init callback of page_ext_ops like page_owner(using buddy allocator). with the change, failure/dummy_handle can get its correct value and page owner output for example has the one for page owner itself: Page allocated via order 2, mask 0x6202c0(GFP_USER|__GFP_NOWARN), pid 1006, ts 67278156558 ns PFN 543776 type Unmovable Block 531 type Unmovable Flags 0x0() init_page_owner+0x28/0x2f8 invoke_init_callbacks_flatmem+0x24/0x34 start_kernel+0x33c/0x5d8 Link: https://lkml.kernel.org/r/1603104925-5888-1-git-send-email-zhenhuah@codeaur… Signed-off-by: Zhenhua Huang <zhenhuah(a)codeaurora.org> Acked-by: Vlastimil Babka <vbabka(a)suse.cz> Cc: Joonsoo Kim <iamjoonsoo.kim(a)lge.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> (cherry picked from commit 7fb7ab6d618a4dc7ea3f3eafc92388a35b4f8894) Signed-off-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yuanzheng Song <songyuanzheng(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- include/linux/page_ext.h | 8 ++++++++ init/main.c | 2 ++ mm/page_ext.c | 10 ++++++++-- 3 files changed, 18 insertions(+), 2 deletions(-) diff --git a/include/linux/page_ext.h b/include/linux/page_ext.h index cfce186f0c4e..aff81ba31bd8 100644 --- a/include/linux/page_ext.h +++ b/include/linux/page_ext.h @@ -44,8 +44,12 @@ static inline void page_ext_init_flatmem(void) { } extern void page_ext_init(void); +static inline void page_ext_init_flatmem_late(void) +{ +} #else extern void page_ext_init_flatmem(void); +extern void page_ext_init_flatmem_late(void); static inline void page_ext_init(void) { } @@ -76,6 +80,10 @@ static inline void page_ext_init(void) { } +static inline void page_ext_init_flatmem_late(void) +{ +} + static inline void page_ext_init_flatmem(void) { } diff --git a/init/main.c b/init/main.c index fc0277a9e7a3..f6fe37a744b7 100644 --- a/init/main.c +++ b/init/main.c @@ -830,6 +830,8 @@ static void __init mm_init(void) init_debug_pagealloc(); report_meminit(); mem_init(); + /* page_owner must be initialized after buddy is ready */ + page_ext_init_flatmem_late(); kmem_cache_init(); kmemleak_init(); pgtable_init(); diff --git a/mm/page_ext.c b/mm/page_ext.c index cf931ebb58d7..df6f74aac8e1 100644 --- a/mm/page_ext.c +++ b/mm/page_ext.c @@ -99,12 +99,19 @@ static void __init invoke_init_callbacks(void) } } +#ifndef CONFIG_SPARSEMEM +void __init page_ext_init_flatmem_late(void) +{ + invoke_init_callbacks(); +} +#endif + static inline struct page_ext *get_entry(void *base, unsigned long index) { return base + page_ext_size * index; } -#if !defined(CONFIG_SPARSEMEM) +#ifndef CONFIG_SPARSEMEM void __meminit pgdat_page_ext_init(struct pglist_data *pgdat) @@ -177,7 +184,6 @@ void __init page_ext_init_flatmem(void) goto fail; } pr_info("allocated %ld bytes of page_ext\n", total_usage); - invoke_init_callbacks(); return; fail: -- 2.20.1

1 30

[PATCH openEuler-1.0-LTS] net:fix tcp timeout retransmits are always missing 2 times
by jiazhenyuan 28 Sep '21

28 Sep '21

mainline inclusion from mainline-v5.3.0 commit 3256a2d6ab1f71f9a1bd2d7f6f18eb8108c48d17 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4AFRJ?from=project-issue CVE: NA --------------------------------------------------------------- tcp: adjust rto_base in retransmits_timed_out() The cited commit exposed an old retransmits_timed_out() bug which assumed it could call tcp_model_timeout() with TCP_RTO_MIN as rto_base for all states. But flows in SYN_SENT or SYN_RECV state uses a different RTO base (1 sec instead of 200 ms, unless BPF choses another value) This caused a reduction of SYN retransmits from 6 to 4 with the default /proc/sys/net/ipv4/tcp_syn_retries value. Fixes: a41e8a8 ("tcp: better handle TCP_USER_TIMEOUT in SYN_SENT state") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Yuchung Cheng <ycheng(a)google.com> Cc: Marek Majkowski <marek(a)cloudflare.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: jiazhenyuan <jiazhenyuan(a)uniontech.com> --- net/ipv4/tcp_timer.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c index 681882a40968..81a47e87c35d 100644 --- a/net/ipv4/tcp_timer.c +++ b/net/ipv4/tcp_timer.c @@ -190,7 +190,7 @@ static bool retransmits_timed_out(struct sock *sk, unsigned int boundary, unsigned int timeout) { - const unsigned int rto_base = TCP_RTO_MIN; + unsigned int rto_base = TCP_RTO_MIN; unsigned int linear_backoff_thresh, start_ts; if (!inet_csk(sk)->icsk_retransmits) @@ -201,6 +201,9 @@ static bool retransmits_timed_out(struct sock *sk, return false; if (likely(timeout == 0)) { + if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) + rto_base = tcp_timeout_init(sk); + linear_backoff_thresh = ilog2(TCP_RTO_MAX/rto_base); if (boundary <= linear_backoff_thresh) -- 2.27.0

2 1

[PATCH openEuler-1.0-LTS 01/14] Revert "bpf: Fix truncation handling for mod32 dst reg wrt zero"
by Yang Yingliang 28 Sep '21

28 Sep '21

From: He Fengqing <hefengqing(a)huawei.com> hulk inclusion category: bugfix bugzilla: NA CVE: CVE-2021-3444 ------------------------------------------------- This reverts commit 946dd60de74146a418f62275e5a6f83496f74dcd. Signed-off-by: He Fengqing <hefengqing(a)huawei.com> Reviewed-by: Kuohai Xu <xukuohai(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/bpf/verifier.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 962dc7c48430f..61a535eec0a9b 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -6322,7 +6322,7 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env) bool isdiv = BPF_OP(insn->code) == BPF_DIV; struct bpf_insn *patchlet; struct bpf_insn chk_and_div[] = { - /* [R,W]x div 0 -> 0 */ + /* Rx div 0 -> 0 */ BPF_RAW_INSN((is64 ? BPF_JMP : BPF_JMP32) | BPF_JNE | BPF_K, insn->src_reg, 0, 2, 0), @@ -6331,18 +6331,16 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env) *insn, }; struct bpf_insn chk_and_mod[] = { - /* [R,W]x mod 0 -> [R,W]x */ + /* Rx mod 0 -> Rx */ BPF_RAW_INSN((is64 ? BPF_JMP : BPF_JMP32) | BPF_JEQ | BPF_K, insn->src_reg, - 0, 1 + (is64 ? 0 : 1), 0), + 0, 1, 0), *insn, - BPF_JMP_IMM(BPF_JA, 0, 0, 1), - BPF_MOV32_REG(insn->dst_reg, insn->dst_reg), }; patchlet = isdiv ? chk_and_div : chk_and_mod; cnt = isdiv ? ARRAY_SIZE(chk_and_div) : - ARRAY_SIZE(chk_and_mod) - (is64 ? 2 : 0); + ARRAY_SIZE(chk_and_mod); new_prog = bpf_patch_insn_data(env, i + delta, patchlet, cnt); if (!new_prog) -- 2.25.1

1 13

[PATCH openEuler-1.0-LTS] net:fix tcp timeout retransmits are always missing 2 times
by jiazhenyuan 28 Sep '21

28 Sep '21

mainline inclusion from mainline-v5.3.0 commit 3256a2d6ab1f71f9a1bd2d7f6f18eb8108c48d17 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4AFRJ?from=project-issue CVE: NA --------------------------------------------------------------- tcp: adjust rto_base in retransmits_timed_out() The cited commit exposed an old retransmits_timed_out() bug which assumed it could call tcp_model_timeout() with TCP_RTO_MIN as rto_base for all states. But flows in SYN_SENT or SYN_RECV state uses a different RTO base (1 sec instead of 200 ms, unless BPF choses another value) This caused a reduction of SYN retransmits from 6 to 4 with the default /proc/sys/net/ipv4/tcp_syn_retries value. Fixes: a41e8a8 ("tcp: better handle TCP_USER_TIMEOUT in SYN_SENT state") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Yuchung Cheng <ycheng(a)google.com> Cc: Marek Majkowski <marek(a)cloudflare.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: jiazhenyuan <jiazhenyuan(a)uniontech.com> --- net/ipv4/tcp_timer.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c index 681882a40968..81a47e87c35d 100644 --- a/net/ipv4/tcp_timer.c +++ b/net/ipv4/tcp_timer.c @@ -190,7 +190,7 @@ static bool retransmits_timed_out(struct sock *sk, unsigned int boundary, unsigned int timeout) { - const unsigned int rto_base = TCP_RTO_MIN; + unsigned int rto_base = TCP_RTO_MIN; unsigned int linear_backoff_thresh, start_ts; if (!inet_csk(sk)->icsk_retransmits) @@ -201,6 +201,9 @@ static bool retransmits_timed_out(struct sock *sk, return false; if (likely(timeout == 0)) { + if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) + rto_base = tcp_timeout_init(sk); + linear_backoff_thresh = ilog2(TCP_RTO_MAX/rto_base); if (boundary <= linear_backoff_thresh) -- 2.27.0

3 2

2025

2024

2023

2022

2021

2020

2019

Kernel