- Kernel - mailweb.openeuler.org

[PATCH 01/30] net: hns3: fix reset bug
by Yang Yingliang 07 Jul '20

07 Jul '20

From: Shengzui You <youshengzui(a)huawei.com> driver inclusion category: bugfix bugzilla: NA CVE: NA ------------------------------ If two interrupts are triggered continuously within 15 seconds, modify the timer and reset again after 15 seconds. Signed-off-by: Shengzui You <youshengzui(a)huawei.com> Reviewed-by: Weiwei Deng <dengweiwei(a)huawei.com> Reviewed-by: Zhaohui Zhong <zhongzhaohui(a)huawei.com> Reviewed-by: Junxin Chen <chenjunxin1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- .../hisilicon/hns3/hns-customer/hns3pf/hclge_main_it.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns-customer/hns3pf/hclge_main_it.c b/drivers/net/ethernet/hisilicon/hns3/hns-customer/hns3pf/hclge_main_it.c index b8cab1665385..01f0e19f1e50 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns-customer/hns3pf/hclge_main_it.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns-customer/hns3pf/hclge_main_it.c @@ -115,13 +115,15 @@ void hclge_reset_event_it(struct pci_dev *pdev, struct hnae3_handle *handle) * not allow it again before 12*HZ times. */ if (time_before(jiffies, (hdev->last_reset_time + - HCLGE_RESET_INTERVAL))) + HCLGE_RESET_INTERVAL))) { + mod_timer(&hdev->reset_timer, jiffies + HCLGE_RESET_INTERVAL); return; - else if (hdev->default_reset_request) + } else if (hdev->default_reset_request) { hdev->reset_level = hclge_get_reset_level(ae_dev, &hdev->default_reset_request); - else if (time_after(jiffies, (hdev->last_reset_time + 4 * 5 * HZ))) + } else if (time_after(jiffies, (hdev->last_reset_time + 4 * 5 * HZ))) { hdev->reset_level = HNAE3_FUNC_RESET; + } dev_info(&hdev->pdev->dev, "IT received reset event, reset type is %d", hdev->reset_level); -- 2.25.1

1 29

[PATCH] sdei_watchdog: fix compile error when CONFIG_HARDLOCKUP_DETECTOR is not set
by Yang Yingliang 07 Jul '20

07 Jul '20

From: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> hulk inclusion category: bugfix bugzilla: NA CVE: NA ----------------------------------------------- sdei_watchdog use function 'watchdog_hardlockup_check()' to check whether a hardlockup exists. This function is included by CONFIG_HARDLOCKUP_DETECTOR. So select CONFIG_HARDLOCKUP_DETECTOR when CONFIG_SDEI_WATCHDOG is set. Otherwise a compile error as below will be shown. arch/arm64/kernel/watchdog_sdei.c: In function ‘watchdog_nmi_enable’: arch/arm64/kernel/watchdog_sdei.c:38:35: error: ‘watchdog_thresh’ undeclared (first use in this function) sdei_api_set_secure_timer_period(watchdog_thresh); ^ arch/arm64/kernel/watchdog_sdei.c:38:35: note: each undeclared identifier is reported only once for each function it appears in arch/arm64/kernel/watchdog_sdei.c: In function ‘watchdog_nmi_probe’: arch/arm64/kernel/watchdog_sdei.c:119:39: error: ‘watchdog_thresh’ undeclared (first use in this function) if (sdei_api_set_secure_timer_period(watchdog_thresh)) { Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- lib/Kconfig.debug | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug index bc65f3b8a8b5..47dca144782b 100644 --- a/lib/Kconfig.debug +++ b/lib/Kconfig.debug @@ -845,6 +845,7 @@ config SDEI_WATCHDOG bool "SDEI NMI Watchdog support" depends on ARM_SDE_INTERFACE && !HARDLOCKUP_CHECK_TIMESTAMP select HAVE_HARDLOCKUP_DETECTOR_ARCH + select HARDLOCKUP_DETECTOR config PMU_WATCHDOG bool "PMU NMI Watchdog support" -- 2.25.1

1 0

[PATCH 1/2] net/hinic: Add support for X86 Arch
by Yang Yingliang 07 Jul '20

07 Jul '20

From: Chiqijun <chiqijun(a)huawei.com> driver inclusion category: feature bugzilla: 4472 ----------------------------------------------------------------------- Add support for X86 Arch. Add the best default interrupt aggregation parameter and LRO parameter on x86 platform. Signed-off-by: Chiqijun <chiqijun(a)huawei.com> Reviewed-by: Zengweiliang <zengweiliang.zengweiliang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/net/ethernet/huawei/Kconfig | 1 - drivers/net/ethernet/huawei/hinic/hinic_hwif.c | 10 ++++++++++ drivers/net/ethernet/huawei/hinic/hinic_hwif.h | 4 ++++ drivers/net/ethernet/huawei/hinic/hinic_lld.c | 17 ++++++++++++++++- drivers/net/ethernet/huawei/hinic/hinic_main.c | 6 ++++++ .../net/ethernet/huawei/hinic/hinic_nic_cfg.h | 14 ++++++++++++++ 6 files changed, 50 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/huawei/Kconfig b/drivers/net/ethernet/huawei/Kconfig index dc48e5163531..c1a95ae4058b 100644 --- a/drivers/net/ethernet/huawei/Kconfig +++ b/drivers/net/ethernet/huawei/Kconfig @@ -5,7 +5,6 @@ config NET_VENDOR_HUAWEI bool "Huawei devices" default y - depends on ARM64 ---help--- If you have a network (Ethernet) card belonging to this class, say Y. Note that the answer to this question doesn't directly affect the diff --git a/drivers/net/ethernet/huawei/hinic/hinic_hwif.c b/drivers/net/ethernet/huawei/hinic/hinic_hwif.c index 1fc0fa57f313..b267084d3672 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_hwif.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_hwif.c @@ -368,7 +368,12 @@ void hinic_free_db_addr(void *hwdev, void __iomem *db_base, hwif = ((struct hinic_hwdev *)hwdev)->hwif; idx = DB_IDX(db_base, hwif->db_base); +#if defined(__aarch64__) /* No need to unmap */ +#else + if (dwqe_base && hwif->chip_mode == CHIP_MODE_NORMAL) + io_mapping_unmap(dwqe_base); +#endif free_db_idx(hwif, idx); } @@ -398,7 +403,12 @@ int hinic_alloc_db_addr(void *hwdev, void __iomem **db_base, offset = ((u64)idx) << PAGE_SHIFT; +#if defined(__aarch64__) *dwqe_base = hwif->dwqe_mapping + offset; +#else + *dwqe_base = io_mapping_map_wc(hwif->dwqe_mapping, offset, + HINIC_DB_PAGE_SIZE); +#endif if (!(*dwqe_base)) { hinic_free_db_addr(hwdev, *db_base, NULL); diff --git a/drivers/net/ethernet/huawei/hinic/hinic_hwif.h b/drivers/net/ethernet/huawei/hinic/hinic_hwif.h index 9cd2ad8c5962..3a58a44b6bfe 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_hwif.h +++ b/drivers/net/ethernet/huawei/hinic/hinic_hwif.h @@ -58,7 +58,11 @@ struct hinic_hwif { u64 db_base_phy; u8 __iomem *db_base; +#if defined(__aarch64__) void __iomem *dwqe_mapping; +#else + struct io_mapping *dwqe_mapping; +#endif struct hinic_free_db_area free_db_area; struct hinic_func_attr attr; diff --git a/drivers/net/ethernet/huawei/hinic/hinic_lld.c b/drivers/net/ethernet/huawei/hinic/hinic_lld.c index 2ad6d2d23207..20e3b0bde8ef 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_lld.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_lld.c @@ -114,7 +114,11 @@ struct hinic_pcidev { u64 db_base_phy; void __iomem *db_base; +#if defined(__aarch64__) void __iomem *dwqe_mapping; +#else + struct io_mapping *dwqe_mapping; +#endif /* lock for attach/detach uld */ struct mutex pdev_mutex; struct hinic_sriov_info sriov_info; @@ -1874,9 +1878,15 @@ static int mapping_bar(struct pci_dev *pdev, struct hinic_pcidev *pci_adapter) dwqe_addr = pci_adapter->db_base_phy + db_dwqe_size; +#if defined(__aarch64__) /* arm do not support call ioremap_wc() */ pci_adapter->dwqe_mapping = __ioremap(dwqe_addr, db_dwqe_size, __pgprot(PROT_DEVICE_nGnRnE)); +#else + pci_adapter->dwqe_mapping = io_mapping_create_wc(dwqe_addr, + db_dwqe_size); + +#endif if (!pci_adapter->dwqe_mapping) { sdk_err(&pci_adapter->pcidev->dev, "Failed to io_mapping_create_wc\n"); goto mapping_dwqe_err; @@ -1898,8 +1908,13 @@ static int mapping_bar(struct pci_dev *pdev, struct hinic_pcidev *pci_adapter) static void unmapping_bar(struct hinic_pcidev *pci_adapter) { - if (pci_adapter->chip_mode == CHIP_MODE_NORMAL) + if (pci_adapter->chip_mode == CHIP_MODE_NORMAL) { +#if defined(__aarch64__) iounmap(pci_adapter->dwqe_mapping); +#else + io_mapping_free(pci_adapter->dwqe_mapping); +#endif + } iounmap(pci_adapter->db_base); iounmap(pci_adapter->intr_reg_base); diff --git a/drivers/net/ethernet/huawei/hinic/hinic_main.c b/drivers/net/ethernet/huawei/hinic/hinic_main.c index dd67d903f739..d78a5e3678b1 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_main.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_main.c @@ -2908,7 +2908,13 @@ static void adaptive_configuration_init(struct hinic_nic_dev *nic_dev) nic_dev->env_info.os = HINIC_OS_HUAWEI; +#if defined(__aarch64__) nic_dev->env_info.cpu = HINIC_CPU_ARM_GENERIC; +#elif defined(__x86_64__) + nic_dev->env_info.cpu = HINIC_CPU_X86_GENERIC; +#else + nic_dev->env_info.cpu = HINIC_CPU_UNKNOWN; +#endif nic_info(&nic_dev->pdev->dev, "Board type %u, OS type %u, CPU type %u\n", diff --git a/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.h b/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.h index e0979df6e209..243265072710 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.h +++ b/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.h @@ -56,6 +56,7 @@ #define HINIC_LRO_RX_TIMER_DEFAULT_PG_10GE 10 #define HINIC_LRO_RX_TIMER_DEFAULT_PG_100GE 8 +#if defined(__aarch64__) #define HINIC_LOWEST_LATENCY 1 #define HINIC_RX_RATE_LOW 400000 #define HINIC_RX_COAL_TIME_LOW 20 @@ -67,6 +68,19 @@ #define HINIC_TX_RATE_THRESH 35000 #define HINIC_RX_RATE_LOW_VM 400000 #define HINIC_RX_PENDING_LIMIT_HIGH_VM 50 +#else +#define HINIC_LOWEST_LATENCY 1 +#define HINIC_RX_RATE_LOW 400000 +#define HINIC_RX_COAL_TIME_LOW 16 +#define HINIC_RX_PENDING_LIMIT_LOW 2 +#define HINIC_RX_RATE_HIGH 1000000 +#define HINIC_RX_COAL_TIME_HIGH 225 +#define HINIC_RX_PENDING_LIMIT_HIGH 8 +#define HINIC_RX_RATE_THRESH 50000 +#define HINIC_TX_RATE_THRESH 50000 +#define HINIC_RX_RATE_LOW_VM 100000 +#define HINIC_RX_PENDING_LIMIT_HIGH_VM 87 +#endif enum hinic_board_type { HINIC_BOARD_UNKNOWN = 0, -- 2.25.1

1 1

[PATCH 00/13] steal tasks to improve CPU utilization
by Yang Yingliang 07 Jul '20

07 Jul '20

Cheng Jian (3): disable stealing by default sched/fair: introduce SCHED_STEAL config: enable CONFIG_SCHED_STEAL by default Steve Sistare (10): sched: Provide sparsemask, a reduced contention bitmap sched/topology: Provide hooks to allocate data shared per LLC sched/topology: Provide cfs_overload_cpus bitmap sched/fair: Dynamically update cfs_overload_cpus sched/fair: Hoist idle_stamp up from idle_balance sched/fair: Generalize the detach_task interface sched/fair: Provide can_migrate_task_llc sched/fair: Steal work from an overloaded CPU when CPU goes idle sched/fair: disable stealing if too many NUMA nodes sched/fair: Provide idle search schedstats arch/arm64/configs/euleros_defconfig | 1 + arch/arm64/configs/hulk_defconfig | 1 + arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/configs/storage_ci_defconfig | 1 + arch/arm64/configs/syzkaller_defconfig | 1 + arch/x86/configs/hulk_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + arch/x86/configs/storage_ci_defconfig | 1 + include/linux/sched/topology.h | 3 + init/Kconfig | 15 + kernel/sched/core.c | 35 ++- kernel/sched/fair.c | 367 ++++++++++++++++++++++-- kernel/sched/features.h | 8 + kernel/sched/sched.h | 20 ++ kernel/sched/sparsemask.h | 210 ++++++++++++++ kernel/sched/stats.c | 15 + kernel/sched/stats.h | 20 ++ kernel/sched/topology.c | 141 ++++++++- 18 files changed, 810 insertions(+), 32 deletions(-) create mode 100644 kernel/sched/sparsemask.h -- 2.25.1

1 13

[PATCH 001/125] net: be more gentle about silly gso requests coming from user
by Yang Yingliang 07 Jul '20

07 Jul '20

From: Eric Dumazet <edumazet(a)google.com> commit 7c6d2ecbda83150b2036a2b36b21381ad4667762 upstream. Recent change in virtio_net_hdr_to_skb() broke some packetdrill tests. When --mss=XXX option is set, packetdrill always provide gso_type & gso_size for its inbound packets, regardless of packet size. if (packet->tcp && packet->mss) { if (packet->ipv4) gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV4; else gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV6; gso.gso_size = packet->mss; } Since many other programs could do the same, relax virtio_net_hdr_to_skb() to no longer return an error, but instead ignore gso settings. This keeps Willem intent to make sure no malicious packet could reach gso stack. Note that TCP stack has a special logic in tcp_set_skb_tso_segs() to clear gso_size for small packets. Fixes: 6dd912f82680 ("net: check untrusted gso_size at kernel entry") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Willem de Bruijn <willemb(a)google.com> Acked-by: Willem de Bruijn <willemb(a)google.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Cc: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- include/linux/virtio_net.h | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h index 1c296f370e46..f32fe7080d2e 100644 --- a/include/linux/virtio_net.h +++ b/include/linux/virtio_net.h @@ -109,16 +109,17 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb, if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) { u16 gso_size = __virtio16_to_cpu(little_endian, hdr->gso_size); + struct skb_shared_info *shinfo = skb_shinfo(skb); - if (skb->len - p_off <= gso_size) - return -EINVAL; - - skb_shinfo(skb)->gso_size = gso_size; - skb_shinfo(skb)->gso_type = gso_type; + /* Too small packets are not really GSO ones. */ + if (skb->len - p_off > gso_size) { + shinfo->gso_size = gso_size; + shinfo->gso_type = gso_type; - /* Header must be checked, and gso_segs computed. */ - skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY; - skb_shinfo(skb)->gso_segs = 0; + /* Header must be checked, and gso_segs computed. */ + shinfo->gso_type |= SKB_GSO_DODGY; + shinfo->gso_segs = 0; + } } return 0; -- 2.25.1

1 124

[PATCH 01/35] selinux: allow labeling before policy is loaded
by Roberto Sassu 06 Jul '20

06 Jul '20

From: Jonathan Lebon <jlebon(a)redhat.com> mainline inclusion from mainline-v5.5-rc1 commit 3e3e24b42043eceb97ed834102c2d094dfd7aaa6 category: bugfix --------------------------- Currently, the SELinux LSM prevents one from setting the `security.selinux` xattr on an inode without a policy first being loaded. However, this restriction is problematic: it makes it impossible to have newly created files with the correct label before actually loading the policy. This is relevant in distributions like Fedora, where the policy is loaded by systemd shortly after pivoting out of the initrd. In such instances, all files created prior to pivoting will be unlabeled. One then has to relabel them after pivoting, an operation which inherently races with other processes trying to access those same files. Going further, there are use cases for creating the entire root filesystem on first boot from the initrd (e.g. Container Linux supports this today[1], and we'd like to support it in Fedora CoreOS as well[2]). One can imagine doing this in two ways: at the block device level (e.g. laying down a disk image), or at the filesystem level. In the former, labeling can simply be part of the image. But even in the latter scenario, one still really wants to be able to set the right labels when populating the new filesystem. This patch enables this by changing behaviour in the following two ways: 1. allow `setxattr` on mounts without `SBLABEL_MNT` (which is all of them if no policy is loaded yet) 2. don't try to set the in-core inode SID if we're not initialized; instead leave it as `LABEL_INVALID` so that revalidation may be attempted at a later time Note the first hunk of this patch is functionally the same as a previously discussed one[3], though it was part of a larger series which wasn't accepted. Co-developed-by: Victor Kamensky <kamensky(a)cisco.com> Signed-off-by: Victor Kamensky <kamensky(a)cisco.com> Signed-off-by: Jonathan Lebon <jlebon(a)redhat.com> [1] https://coreos.com/os/docs/latest/root-filesystem-placement.html [2] https://github.com/coreos/fedora-coreos-tracker/issues/94 [3] https://www.spinics.net/lists/linux-initramfs/msg04593.html --- security/selinux/hooks.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 452254fd89f8..931546d80211 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -3305,7 +3305,7 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name, } sbsec = inode->i_sb->s_security; - if (!(sbsec->flags & SBLABEL_MNT)) + if (!(sbsec->flags & SBLABEL_MNT) && selinux_state.initialized) return -EOPNOTSUPP; if (!inode_owner_or_capable(inode)) @@ -3387,6 +3387,15 @@ static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name, return; } + if (!selinux_state.initialized) { + /* If we haven't even been initialized, then we can't validate + * against a policy, so leave the label as invalid. It may + * resolve to a valid label on the next revalidation try if + * we've since initialized. + */ + return; + } + rc = security_context_to_sid_force(&selinux_state, value, size, &newsid); if (rc) { -- 2.27.GIT

1 4

[PATCH] fs/filescontrol: add a switch to enable / disable accounting of open fds
by Yang Yingliang 02 Jul '20

02 Jul '20

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: 38268 CVE: NA --------------------------- Such switch can only set the accounting of open fds in filescontrol from enable to disable. If it is disabled arealdy, the switch can't enable it. The counter is enabled by default, and it can be disabled by: a. echo 1 > /sys/fs/cgroup/files/files.no_acct b. add "filescontrol.no_acct=1" to boot cmd Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Reviewed-by: zhangyi (F) <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/filescontrol.c | 30 +++++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-) diff --git a/fs/filescontrol.c b/fs/filescontrol.c index 5ec5096383c3..32f3a127579c 100644 --- a/fs/filescontrol.c +++ b/fs/filescontrol.c @@ -25,14 +25,17 @@ #include <linux/seq_file.h> #include <linux/fdtable.h> #include <linux/sched/signal.h> +#include <linux/module.h> #define FILES_MAX D_COUNT_MAX #define FILES_MAX_STR "max" - +static bool no_acct; struct cgroup_subsys files_cgrp_subsys __read_mostly; EXPORT_SYMBOL(files_cgrp_subsys); +module_param(no_acct, bool, 0444); + struct files_cgroup { struct cgroup_subsys_state css; struct page_counter open_handles; @@ -204,7 +207,7 @@ int files_cgroup_alloc_fd(struct files_struct *files, u64 n) * we don't charge their fds, only issue is that files.usage * won't be accurate in root files cgroup. */ - if (files != &init_files) { + if (!no_acct && files != &init_files) { struct page_counter *fail_res; struct files_cgroup *files_cgroup = files_cgroup_from_files(files); @@ -222,7 +225,7 @@ void files_cgroup_unalloc_fd(struct files_struct *files, u64 n) * It's not charged so no need to uncharge, see comments in * files_cgroup_alloc_fd. */ - if (files != &init_files) { + if (!no_acct && files != &init_files) { struct files_cgroup *files_cgroup = files_cgroup_from_files(files); page_counter_uncharge(&files_cgroup->open_handles, n); @@ -230,6 +233,21 @@ void files_cgroup_unalloc_fd(struct files_struct *files, u64 n) } EXPORT_SYMBOL(files_cgroup_unalloc_fd); +static u64 files_disabled_read(struct cgroup_subsys_state *css, + struct cftype *cft) +{ + return no_acct; +} + +static int files_disabled_write(struct cgroup_subsys_state *css, + struct cftype *cft, u64 val) +{ + if (!val) + return -EINVAL; + no_acct = true; + + return 0; +} static int files_limit_read(struct seq_file *sf, void *v) { @@ -291,6 +309,12 @@ static struct cftype files[] = { .name = "usage", .read_u64 = files_usage_read, }, + { + .name = "no_acct", + .flags = CFTYPE_ONLY_ON_ROOT, + .read_u64 = files_disabled_read, + .write_u64 = files_disabled_write, + }, { } }; -- 2.25.1

1 0

[PATCH] usb: usbtest: fix missing kfree(dev->buf) in usbtest_disconnect
by Yang Yingliang 01 Jul '20

01 Jul '20

From: Zqiang <qiang.zhang(a)windriver.com> mainline inclusion from mainline-v5.8-rc3 commit 28ebeb8db77035e058a510ce9bd17c2b9a009dba category: bugfix bugzilla: NA CVE: CVE-2020-15393 --------------------------- BUG: memory leak unreferenced object 0xffff888055046e00 (size 256): comm "kworker/2:9", pid 2570, jiffies 4294942129 (age 1095.500s) hex dump (first 32 bytes): 00 70 04 55 80 88 ff ff 18 bb 5a 81 ff ff ff ff .p.U......Z..... f5 96 78 81 ff ff ff ff 37 de 8e 81 ff ff ff ff ..x.....7....... backtrace: [<00000000d121dccf>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline] [<00000000d121dccf>] slab_post_alloc_hook mm/slab.h:586 [inline] [<00000000d121dccf>] slab_alloc_node mm/slub.c:2786 [inline] [<00000000d121dccf>] slab_alloc mm/slub.c:2794 [inline] [<00000000d121dccf>] kmem_cache_alloc_trace+0x15e/0x2d0 mm/slub.c:2811 [<000000005c3c3381>] kmalloc include/linux/slab.h:555 [inline] [<000000005c3c3381>] usbtest_probe+0x286/0x19d0 drivers/usb/misc/usbtest.c:2790 [<000000001cec6910>] usb_probe_interface+0x2bd/0x870 drivers/usb/core/driver.c:361 [<000000007806c118>] really_probe+0x48d/0x8f0 drivers/base/dd.c:551 [<00000000a3308c3e>] driver_probe_device+0xfc/0x2a0 drivers/base/dd.c:724 [<000000003ef66004>] __device_attach_driver+0x1b6/0x240 drivers/base/dd.c:831 [<00000000eee53e97>] bus_for_each_drv+0x14e/0x1e0 drivers/base/bus.c:431 [<00000000bb0648d0>] __device_attach+0x1f9/0x350 drivers/base/dd.c:897 [<00000000838b324a>] device_initial_probe+0x1a/0x20 drivers/base/dd.c:944 [<0000000030d501c1>] bus_probe_device+0x1e1/0x280 drivers/base/bus.c:491 [<000000005bd7adef>] device_add+0x131d/0x1c40 drivers/base/core.c:2504 [<00000000a0937814>] usb_set_configuration+0xe84/0x1ab0 drivers/usb/core/message.c:2030 [<00000000e3934741>] generic_probe+0x6a/0xe0 drivers/usb/core/generic.c:210 [<0000000098ade0f1>] usb_probe_device+0x90/0xd0 drivers/usb/core/driver.c:266 [<000000007806c118>] really_probe+0x48d/0x8f0 drivers/base/dd.c:551 [<00000000a3308c3e>] driver_probe_device+0xfc/0x2a0 drivers/base/dd.c:724 Acked-by: Alan Stern <stern(a)rowland.harvard.edu> Reported-by: Kyungtae Kim <kt0755(a)gmail.com> Signed-off-by: Zqiang <qiang.zhang(a)windriver.com> Link: https://lore.kernel.org/r/20200612035210.20494-1-qiang.zhang@windriver.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/usb/misc/usbtest.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c index c7f82310e73e..fc3fc9d48a55 100644 --- a/drivers/usb/misc/usbtest.c +++ b/drivers/usb/misc/usbtest.c @@ -2853,6 +2853,7 @@ static void usbtest_disconnect(struct usb_interface *intf) usb_set_intfdata(intf, NULL); dev_dbg(&intf->dev, "disconnect\n"); + kfree(dev->buf); kfree(dev); } -- 2.25.1

1 0

[PATCH] genirq/debugfs: Add missing sanity checks to interrupt injection
by Yang Yingliang 01 Jul '20

01 Jul '20

From: Thomas Gleixner <tglx(a)linutronix.de> mainline inclusion from mainline-v5.6 commit a740a423c36932695b01a3e920f697bc55b05fec category: bugfix bugzilla: 32425 CVE: NA ------------------- Interrupts cannot be injected when the interrupt is not activated and when a replay is already in progress. Fixes: 536e2e34bd00 ("genirq/debugfs: Triggering of interrupts from userspace") Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Acked-by: Marc Zyngier <maz(a)kernel.org> Link: https://lkml.kernel.org/r/20200306130623.500019114@linutronix.de Signed-off-by: Yuan Can <yuancan(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/irq/debugfs.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/kernel/irq/debugfs.c b/kernel/irq/debugfs.c index 0a7365456e72..4eb5c62991fe 100644 --- a/kernel/irq/debugfs.c +++ b/kernel/irq/debugfs.c @@ -206,8 +206,15 @@ static ssize_t irq_debug_write(struct file *file, const char __user *user_buf, chip_bus_lock(desc); raw_spin_lock_irqsave(&desc->lock, flags); - if (irq_settings_is_level(desc) || desc->istate & IRQS_NMI) { - /* Can't do level nor NMIs, sorry */ + /* + * Don't allow injection when the interrupt is: + * - Level or NMI type + * - not activated + * - replaying already + */ + if (irq_settings_is_level(desc) || + !irqd_is_activated(&desc->irq_data) || + (desc->istate & (IRQS_NMI | IRQS_REPLAY))) { err = -EINVAL; } else { desc->istate |= IRQS_PENDING; -- 2.25.1

1 0

[PATCH] perf top: Fix stdio interface input handling with glibc 2.28+
by Yang Yingliang 01 Jul '20

01 Jul '20

From: Tommi Rantala <tommi.t.rantala(a)nokia.com> mainline inclusion from mainline-5.6-rc6 commit 29b4f5f18857 category: bugfix bugzilla: 31774 CVE: NA ------------------------------------------------- Since glibc 2.28 when running 'perf top --stdio', input handling no longer works, but hitting any key always just prints the "Mapped keys" help text. To fix it, call clearerr() in the display_thread() loop to clear any EOF sticky errors, as instructed in the glibc NEWS file (https://sourceware.org/git/?p=glibc.git;a=blob;f=NEWS) * All stdio functions now treat end-of-file as a sticky condition. If you read from a file until EOF, and then the file is enlarged by another process, you must call clearerr or another function with the same effect (e.g. fseek, rewind) before you can read the additional data. This corrects a longstanding C99 conformance bug. It is most likely to affect programs that use stdio to read interactive input from a terminal. (Bug #1190.) Signed-off-by: Tommi Rantala <tommi.t.rantala(a)nokia.com> Tested-by: Arnaldo Carvalho de Melo <acme(a)redhat.com> Cc: Alexander Shishkin <alexander.shishkin(a)linux.intel.com> Cc: Jiri Olsa <jolsa(a)redhat.com> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Namhyung Kim <namhyung(a)kernel.org> Cc: Peter Zijlstra <peterz(a)infradead.org> Link: http://lore.kernel.org/lkml/20200305083714.9381-2-tommi.t.rantala@nokia.com Signed-off-by: Arnaldo Carvalho de Melo <acme(a)redhat.com> Signed-off-by: Wei Li <liwei391(a)huawei.com> Reviewed-by: Jian Cheng <cj.chengjian(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- tools/perf/builtin-top.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c index 781f6cf1cda6..265c074cbe3b 100644 --- a/tools/perf/builtin-top.c +++ b/tools/perf/builtin-top.c @@ -661,7 +661,9 @@ static void *display_thread(void *arg) delay_msecs = top->delay_secs * MSEC_PER_SEC; set_term_quiet_input(&save); /* trash return*/ - getc(stdin); + clearerr(stdin); + if (poll(&stdin_poll, 1, 0) > 0) + getc(stdin); while (!done) { perf_top__print_sym_table(top); -- 2.25.1

1 0