- Kernel - mailweb.openeuler.org

[PATCH 001/316] blk-cgroup: prevent rcu_sched detected stalls warnings in blkg_destroy_all()
by Cheng Jian 22 Feb '21

22 Feb '21

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: 46357 CVE: NA --------------------------- test procedures: a. create 20000 cgroups, and echo "8:0 10000" to blkio.throttle.write_bps_device b. echo 1 > /sys/blocd/sda/device/delete test result: rcu: INFO: rcu_sched detected stalls on CPUs/tasks: [5/1143] rcu: 0-...0: (0 ticks this GP) idle=0f2/1/0x4000000000000000 softirq=15507/15507 fq rcu: (detected by 6, t=60012 jiffies, g=119977, q=27153) NMI backtrace for cpu 0 CPU: 0 PID: 443 Comm: bash Not tainted 4.19.95-00061-g0bcc83b30eec #63 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-p4 RIP: 0010:blk_throtl_update_limit_valid.isra.0+0x116/0x2a0 Code: 01 00 00 e8 7c dd 74 ff 48 83 bb 78 01 00 00 00 0f 85 54 01 00 00 48 8d bb 88 01 1 RSP: 0018:ffff8881030bf9f0 EFLAGS: 00000046 RAX: 0000000000000000 RBX: ffff8880b4f37080 RCX: ffffffff95da0afe RDX: dffffc0000000000 RSI: ffff888100373980 RDI: ffff8880b4f37208 RBP: ffff888100deca00 R08: ffffffff9528f951 R09: 0000000000000001 R10: ffffed10159dbf56 R11: ffff8880acedfab3 R12: ffff8880b9fda498 R13: ffff8880b9fda4f4 R14: 0000000000000050 R15: ffffffff98b622c0 FS: 00007feb51c51700(0000) GS:ffff888106200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000561619547080 CR3: 0000000102bc9000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: throtl_pd_offline+0x98/0x100 blkg_destroy+0x133/0x630 ? blkcg_deactivate_policy+0x2c0/0x2c0 ? lock_timer_base+0x65/0x110 blkg_destroy_all+0x7f/0x100 blkcg_exit_queue+0x3f/0xa5 blk_exit_queue+0x69/0xa0 blk_cleanup_queue+0x226/0x360 __scsi_remove_device+0xb4/0x3c0 scsi_remove_device+0x38/0x60 sdev_store_delete+0x74/0x100 ? dev_driver_string+0xb0/0xb0 dev_attr_store+0x41/0x70 sysfs_kf_write+0x89/0xc0 kernfs_fop_write+0x1b6/0x2e0 ? sysfs_kf_bin_read+0x130/0x130 __vfs_write+0xca/0x420 ? kernel_read+0xc0/0xc0 ? __alloc_fd+0x16f/0x2d0 ? __fd_install+0x95/0x1a0 ? handle_mm_fault+0x3e0/0x560 vfs_write+0x11a/0x2f0 ksys_write+0xb9/0x1e0 ? __x64_sys_read+0x60/0x60 ? kasan_check_write+0x20/0x30 ? filp_close+0xb5/0xf0 __x64_sys_write+0x46/0x60 do_syscall_64+0xd9/0x1f0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The usage of so many blkg is very rare, however, such problem do exist in theory. In order to avoid such warnings, release 'q->queue_lock' for a while when a batch of blkg were destroyed. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Tao Hou <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Cheng Jian <cj.chengjian(a)huawei.com> --- block/blk-cgroup.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index e592167449aa..c64f0afa27dc 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -364,16 +364,31 @@ static void blkg_destroy(struct blkcg_gq *blkg) */ static void blkg_destroy_all(struct request_queue *q) { +#define BLKG_DESTROY_BATCH 4096 struct blkcg_gq *blkg, *n; + int count; lockdep_assert_held(q->queue_lock); +again: + count = BLKG_DESTROY_BATCH; list_for_each_entry_safe(blkg, n, &q->blkg_list, q_node) { struct blkcg *blkcg = blkg->blkcg; spin_lock(&blkcg->lock); blkg_destroy(blkg); spin_unlock(&blkcg->lock); + /* + * If the list is too long, the loop can took a long time, + * thus relese the lock for a while when a batch of blkg + * were destroyed. + */ + if (!--count) { + spin_unlock_irq(q->queue_lock); + cond_resched(); + spin_lock_irq(q->queue_lock); + goto again; + } } q->root_blkg = NULL; -- 2.25.1

1 13

[PATCH 001/316] blk-cgroup: prevent rcu_sched detected stalls warnings in blkg_destroy_all()
by Cheng Jian 22 Feb '21

22 Feb '21

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: 46357 CVE: NA --------------------------- test procedures: a. create 20000 cgroups, and echo "8:0 10000" to blkio.throttle.write_bps_device b. echo 1 > /sys/blocd/sda/device/delete test result: rcu: INFO: rcu_sched detected stalls on CPUs/tasks: [5/1143] rcu: 0-...0: (0 ticks this GP) idle=0f2/1/0x4000000000000000 softirq=15507/15507 fq rcu: (detected by 6, t=60012 jiffies, g=119977, q=27153) NMI backtrace for cpu 0 CPU: 0 PID: 443 Comm: bash Not tainted 4.19.95-00061-g0bcc83b30eec #63 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-p4 RIP: 0010:blk_throtl_update_limit_valid.isra.0+0x116/0x2a0 Code: 01 00 00 e8 7c dd 74 ff 48 83 bb 78 01 00 00 00 0f 85 54 01 00 00 48 8d bb 88 01 1 RSP: 0018:ffff8881030bf9f0 EFLAGS: 00000046 RAX: 0000000000000000 RBX: ffff8880b4f37080 RCX: ffffffff95da0afe RDX: dffffc0000000000 RSI: ffff888100373980 RDI: ffff8880b4f37208 RBP: ffff888100deca00 R08: ffffffff9528f951 R09: 0000000000000001 R10: ffffed10159dbf56 R11: ffff8880acedfab3 R12: ffff8880b9fda498 R13: ffff8880b9fda4f4 R14: 0000000000000050 R15: ffffffff98b622c0 FS: 00007feb51c51700(0000) GS:ffff888106200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000561619547080 CR3: 0000000102bc9000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: throtl_pd_offline+0x98/0x100 blkg_destroy+0x133/0x630 ? blkcg_deactivate_policy+0x2c0/0x2c0 ? lock_timer_base+0x65/0x110 blkg_destroy_all+0x7f/0x100 blkcg_exit_queue+0x3f/0xa5 blk_exit_queue+0x69/0xa0 blk_cleanup_queue+0x226/0x360 __scsi_remove_device+0xb4/0x3c0 scsi_remove_device+0x38/0x60 sdev_store_delete+0x74/0x100 ? dev_driver_string+0xb0/0xb0 dev_attr_store+0x41/0x70 sysfs_kf_write+0x89/0xc0 kernfs_fop_write+0x1b6/0x2e0 ? sysfs_kf_bin_read+0x130/0x130 __vfs_write+0xca/0x420 ? kernel_read+0xc0/0xc0 ? __alloc_fd+0x16f/0x2d0 ? __fd_install+0x95/0x1a0 ? handle_mm_fault+0x3e0/0x560 vfs_write+0x11a/0x2f0 ksys_write+0xb9/0x1e0 ? __x64_sys_read+0x60/0x60 ? kasan_check_write+0x20/0x30 ? filp_close+0xb5/0xf0 __x64_sys_write+0x46/0x60 do_syscall_64+0xd9/0x1f0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The usage of so many blkg is very rare, however, such problem do exist in theory. In order to avoid such warnings, release 'q->queue_lock' for a while when a batch of blkg were destroyed. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Tao Hou <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Cheng Jian <cj.chengjian(a)huawei.com> --- block/blk-cgroup.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index e592167449aa..c64f0afa27dc 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -364,16 +364,31 @@ static void blkg_destroy(struct blkcg_gq *blkg) */ static void blkg_destroy_all(struct request_queue *q) { +#define BLKG_DESTROY_BATCH 4096 struct blkcg_gq *blkg, *n; + int count; lockdep_assert_held(q->queue_lock); +again: + count = BLKG_DESTROY_BATCH; list_for_each_entry_safe(blkg, n, &q->blkg_list, q_node) { struct blkcg *blkcg = blkg->blkcg; spin_lock(&blkcg->lock); blkg_destroy(blkg); spin_unlock(&blkcg->lock); + /* + * If the list is too long, the loop can took a long time, + * thus relese the lock for a while when a batch of blkg + * were destroyed. + */ + if (!--count) { + spin_unlock_irq(q->queue_lock); + cond_resched(); + spin_lock_irq(q->queue_lock); + goto again; + } } q->root_blkg = NULL; -- 2.25.1

1 4

openEuler kernel sig meeting
by openEuler conference 19 Feb '21

19 Feb '21

2 1

Re: [Dev] openEuler kernel sig meeting
by gwei3 19 Feb '21

19 Feb '21

申报议题： 2. 讨论设立sig安全联络员及如何缩短sig所属项目的CVE响应时间魏刚 ---Original--- From: "openEuler conference"<public(a)openeuler.io> Date: Thu, Feb 18, 2021 17:12 PM To: "dev"<dev(a)openeuler.org>gt;;"kernel"<kernel(a)openeuler.org>gt;; Subject: [Dev] openEuler kernel sig meeting 您好！ openEuler Kernel SIG 邀请您参加 2021-02-19 10:00 召开的ZOOM会议会议主题：openEuler kernel sig meeting 会议内容：1. 树莓派补丁合入openEuler 5.10 内核讨论会议链接：https://zoom.us/j/92887086207?pwd=emdmSVVFekh5eXRSczNNTngrcWYzUT09 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the ZOOM conference will be held at 2021-02-19 10:00, The subject of the conference is openEuler kernel sig meeting, Summary: 1. 树莓派补丁合入openEuler 5.10 内核讨论 You can join the meeting at https://zoom.us/j/92887086207?pwd=emdmSVVFekh5eXRSczNNTngrcWYzUT09. More information

1 0

[PATCH kernel-4.19 00/18] backport stable-4.19-174
by Yang Yingliang 09 Feb '21

09 Feb '21

Arnold Gozum (1): platform/x86: intel-vbtn: Support for tablet mode on Dell Inspiron 7352 Brian King (1): scsi: ibmvfc: Set default timeout to avoid crash during migration Christian Brauner (1): sysctl: handle overflow in proc_get_long Eric Dumazet (1): net_sched: gen_estimator: support large ewma log Felix Fietkau (1): mac80211: fix fast-rx encryption check Greg Kroah-Hartman (1): Linux 4.19.174 Hans de Goede (1): platform/x86: touchscreen_dmi: Add swap-x-y quirk for Goodix touchscreen on Estar Beauty HD tablet Javed Hasan (1): scsi: libfc: Avoid invoking response handler twice if ep is already completed Josh Poimboeuf (1): objtool: Don't fail on missing symbol table Lijun Pan (1): ibmvnic: Ensure that CRQ entry read are correctly ordered Martin Wilck (1): scsi: scsi_transport_srp: Don't block target in failfast state Michael Ellerman (1): selftests/powerpc: Only test lwm/stmw on big endian Pan Bian (1): net: dsa: bcm_sf2: put device node before return Peter Zijlstra (3): x86: __always_inline __{rd,wr}msr() kthread: Extract KTHREAD_IS_PER_CPU workqueue: Restrict affinity change to rescuer Rafael J. Wysocki (1): ACPI: thermal: Do not call acpi_thermal_check() directly Tony Lindgren (1): phy: cpcap-usb: Fix warning for missing regulator_disable Makefile | 2 +- arch/x86/include/asm/msr.h | 4 +- drivers/acpi/thermal.c | 55 +++++++++++++------ drivers/net/dsa/bcm_sf2.c | 8 ++- drivers/net/ethernet/ibm/ibmvnic.c | 6 ++ drivers/phy/motorola/phy-cpcap-usb.c | 19 +++++-- drivers/platform/x86/intel-vbtn.c | 6 ++ drivers/platform/x86/touchscreen_dmi.c | 18 ++++++ drivers/scsi/ibmvscsi/ibmvfc.c | 4 +- drivers/scsi/libfc/fc_exch.c | 16 +++++- drivers/scsi/scsi_transport_srp.c | 9 ++- include/linux/kthread.h | 3 + kernel/kthread.c | 27 ++++++++- kernel/smpboot.c | 1 + kernel/sysctl.c | 2 + kernel/workqueue.c | 9 +-- net/core/gen_estimator.c | 11 ++-- net/mac80211/rx.c | 2 + tools/objtool/elf.c | 7 ++- .../powerpc/alignment/alignment_handler.c | 5 +- 20 files changed, 168 insertions(+), 46 deletions(-) -- 2.25.1

1 18

[PATCH kernel-4.19 1/3] mmap: fix a compiling error for 'MAP_CHECKNODE'
by Yang Yingliang 09 Feb '21

09 Feb '21

From: Bixuan Cui <cuibixuan(a)huawei.com> hulk inclusion category: bugfix bugzilla: NA CVE: NA MAP_CHECKNODE was defined in uapi/asm-generic/mman.h, that was not automatically included by mm/mmap.c when building on platforms such as mips, and result in following compiling error: mm/mmap.c: In function ‘__do_mmap’: mm/mmap.c:1581:14: error: ‘MAP_CHECKNODE’ undeclared (first use in this function) if (flags & MAP_CHECKNODE) ^ mm/mmap.c:1581:14: note: each undeclared identifier is reported only once for each function it appears in scripts/Makefile.build:303: recipe for target 'mm/mmap.o' failed Fixes: 56a22a261008 ("arm64/ascend: mm: Add MAP_CHECKNODE flag to check node hugetlb") Signed-off-by: Bixuan Cui <cuibixuan(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/alpha/include/uapi/asm/mman.h | 1 + arch/mips/include/uapi/asm/mman.h | 1 + arch/parisc/include/uapi/asm/mman.h | 1 + arch/powerpc/include/uapi/asm/mman.h | 1 + arch/sparc/include/uapi/asm/mman.h | 1 + arch/xtensa/include/uapi/asm/mman.h | 1 + 6 files changed, 6 insertions(+) diff --git a/arch/alpha/include/uapi/asm/mman.h b/arch/alpha/include/uapi/asm/mman.h index b3acfc00c8ec5..1c7ce2716ad37 100644 --- a/arch/alpha/include/uapi/asm/mman.h +++ b/arch/alpha/include/uapi/asm/mman.h @@ -34,6 +34,7 @@ #define MAP_HUGETLB 0x100000 /* create a huge page mapping */ #define MAP_FIXED_NOREPLACE 0x200000/* MAP_FIXED which doesn't unmap underlying mapping */ #define MAP_PA32BIT 0x400000 /* physical address is within 4G */ +#define MAP_CHECKNODE 0x800000 /* hugetlb numa node check */ #define MS_ASYNC 1 /* sync memory asynchronously */ #define MS_SYNC 2 /* synchronous memory sync */ diff --git a/arch/mips/include/uapi/asm/mman.h b/arch/mips/include/uapi/asm/mman.h index 72a00c746e781..4570a54ac1d90 100644 --- a/arch/mips/include/uapi/asm/mman.h +++ b/arch/mips/include/uapi/asm/mman.h @@ -52,6 +52,7 @@ #define MAP_HUGETLB 0x80000 /* create a huge page mapping */ #define MAP_FIXED_NOREPLACE 0x100000 /* MAP_FIXED which doesn't unmap underlying mapping */ #define MAP_PA32BIT 0x400000 /* physical address is within 4G */ +#define MAP_CHECKNODE 0x800000 /* hugetlb numa node check */ /* * Flags for msync diff --git a/arch/parisc/include/uapi/asm/mman.h b/arch/parisc/include/uapi/asm/mman.h index 9e989d649e854..06857eb1bee8f 100644 --- a/arch/parisc/include/uapi/asm/mman.h +++ b/arch/parisc/include/uapi/asm/mman.h @@ -28,6 +28,7 @@ #define MAP_HUGETLB 0x80000 /* create a huge page mapping */ #define MAP_FIXED_NOREPLACE 0x100000 /* MAP_FIXED which doesn't unmap underlying mapping */ #define MAP_PA32BIT 0x400000 /* physical address is within 4G */ +#define MAP_CHECKNODE 0x800000 /* hugetlb numa node check */ #define MS_SYNC 1 /* synchronous memory sync */ #define MS_ASYNC 2 /* sync memory asynchronously */ diff --git a/arch/powerpc/include/uapi/asm/mman.h b/arch/powerpc/include/uapi/asm/mman.h index 95f884ada96f1..24354f792b00d 100644 --- a/arch/powerpc/include/uapi/asm/mman.h +++ b/arch/powerpc/include/uapi/asm/mman.h @@ -30,6 +30,7 @@ #define MAP_STACK 0x20000 /* give out an address that is best suited for process/thread stacks */ #define MAP_HUGETLB 0x40000 /* create a huge page mapping */ #define MAP_PA32BIT 0x400000 /* physical address is within 4G */ +#define MAP_CHECKNODE 0x800000 /* hugetlb numa node check */ /* Override any generic PKEY permission defines */ #define PKEY_DISABLE_EXECUTE 0x4 diff --git a/arch/sparc/include/uapi/asm/mman.h b/arch/sparc/include/uapi/asm/mman.h index 0d1881b8f30d1..214abe17f44a0 100644 --- a/arch/sparc/include/uapi/asm/mman.h +++ b/arch/sparc/include/uapi/asm/mman.h @@ -27,6 +27,7 @@ #define MAP_STACK 0x20000 /* give out an address that is best suited for process/thread stacks */ #define MAP_HUGETLB 0x40000 /* create a huge page mapping */ #define MAP_PA32BIT 0x400000 /* physical address is within 4G */ +#define MAP_CHECKNODE 0x800000 /* hugetlb numa node check */ #endif /* _UAPI__SPARC_MMAN_H__ */ diff --git a/arch/xtensa/include/uapi/asm/mman.h b/arch/xtensa/include/uapi/asm/mman.h index f584a590bb001..2c9d705602382 100644 --- a/arch/xtensa/include/uapi/asm/mman.h +++ b/arch/xtensa/include/uapi/asm/mman.h @@ -59,6 +59,7 @@ #define MAP_HUGETLB 0x80000 /* create a huge page mapping */ #define MAP_FIXED_NOREPLACE 0x100000 /* MAP_FIXED which doesn't unmap underlying mapping */ #define MAP_PA32BIT 0x400000 /* physical address is within 4G */ +#define MAP_CHECKNODE 0x800000 /* hugetlb numa node check */ #ifdef CONFIG_MMAP_ALLOW_UNINITIALIZED # define MAP_UNINITIALIZED 0x4000000 /* For anonymous mmap, memory could be * uninitialized */ -- 2.25.1

1 2

[PATCH kernel-4.19 00/38] backport stable-4.19.173
by Yang Yingliang 09 Feb '21

09 Feb '21

Andrea Righi (1): leds: trigger: fix potential deadlock with libata Baoquan He (1): kernel: kexec: remove the lock operation of system_transition_mutex Bartosz Golaszewski (1): iommu/vt-d: Don't dereference iommu_device if IOMMU_API is not built Claudiu Beznea (1): drivers: soc: atmel: add null entry at the end of at91_soc_allowed_list[] Dan Carpenter (1): can: dev: prevent potential information leak in can_fill_info() David Woodhouse (2): xen: Fix XenStore initialisation for XS_LOCAL iommu/vt-d: Gracefully handle DMAR units with no supported address widths Eyal Birger (1): xfrm: fix disable_xfrm sysctl when used on xfrm interfaces Giacinto Cifelli (1): net: usb: qmi_wwan: added support for Thales Cinterion PLSx3 modem family Greg Kroah-Hartman (1): Linux 4.19.173 Ivan Vecera (1): team: protect features update by RCU to avoid deadlock Jay Zhou (1): KVM: x86: get smi pending status correctly Johannes Berg (4): wext: fix NULL-ptr-dereference with cfg80211's lack of commit() iwlwifi: pcie: use jiffies for memory read spin time limit iwlwifi: pcie: reschedule in long-running memory reads mac80211: pause TX while changing interface type Josef Bacik (1): nbd: freeze the queue while we're adding connections Kai-Heng Feng (1): ACPI: sysfs: Prefer "compatible" modalias Kamal Heib (1): RDMA/cxgb4: Fix the reported max_recv_sge value Koen Vandeputte (1): ARM: dts: imx6qdl-gw52xx: fix duplicate regulator naming Laurent Badel (1): PM: hibernate: flush swap writer after marking Like Xu (1): KVM: x86/pmu: Fix HW_REF_CPU_CYCLES event pseudo-encoding in intel_arch_events[] Lorenzo Bianconi (2): mt7601u: fix kernel crash unplugging the device mt7601u: fix rx buffer refcounting Max Krummenacher (1): ARM: imx: build suspend-imx6.S with arm instruction set Pablo Neira Ayuso (1): netfilter: nft_dynset: add timeout extension to template Pan Bian (2): NFC: fix resource leak when target index is invalid NFC: fix possible resource leak Pengcheng Yang (1): tcp: fix TLP timer not set when CA_STATE changes from DISORDER to OPEN Roger Pau Monne (2): xen/privcmd: allow fetching resource sizes xen-blkfront: allow discard-* nodes to be optional Roi Dayan (1): net/mlx5: Fix memory leak on flow table creation error flow Sean Young (1): media: rc: ensure that uevent can be read directly after rc device register Shmulik Ladkani (1): xfrm: Fix oops in xfrm_replay_advance_bmp Sudeep Holla (1): drivers: soc: atmel: Avoid calling at91_soc_init on non AT91 SoCs Takashi Iwai (1): ALSA: hda/via: Apply the workaround generically for Clevo machines Takeshi Misawa (1): rxrpc: Fix memory leak in rxrpc_lookup_local Trond Myklebust (1): pNFS/NFSv4: Fix a layout segment leak in pnfs_layout_process() Makefile | 2 +- arch/arm/boot/dts/imx6qdl-gw52xx.dtsi | 2 +- arch/arm/mach-imx/suspend-imx6.S | 1 + arch/x86/kvm/pmu_intel.c | 2 +- arch/x86/kvm/x86.c | 5 +++ drivers/acpi/device_sysfs.c | 20 +++------ drivers/block/nbd.c | 8 ++++ drivers/block/xen-blkfront.c | 20 +++------ drivers/infiniband/hw/cxgb4/qp.c | 2 +- drivers/iommu/dmar.c | 45 +++++++++++++------ drivers/leds/led-triggers.c | 10 +++-- drivers/media/rc/rc-main.c | 4 +- drivers/net/can/dev.c | 2 +- .../net/ethernet/mellanox/mlx5/core/fs_core.c | 1 + drivers/net/team/team.c | 6 +-- drivers/net/usb/qmi_wwan.c | 1 + .../net/wireless/intel/iwlwifi/pcie/trans.c | 14 +++--- drivers/net/wireless/mediatek/mt7601u/dma.c | 5 +-- drivers/soc/atmel/soc.c | 13 ++++++ drivers/xen/privcmd.c | 25 ++++++++--- drivers/xen/xenbus/xenbus_probe.c | 31 +++++++++++++ fs/nfs/pnfs.c | 1 + include/linux/intel-iommu.h | 2 + include/net/tcp.h | 2 +- kernel/kexec_core.c | 2 - kernel/power/swap.c | 2 +- net/ipv4/tcp_input.c | 10 +++-- net/ipv4/tcp_recovery.c | 5 ++- net/mac80211/ieee80211_i.h | 1 + net/mac80211/iface.c | 6 +++ net/netfilter/nft_dynset.c | 4 +- net/nfc/netlink.c | 1 + net/nfc/rawsock.c | 2 +- net/rxrpc/call_accept.c | 1 + net/wireless/wext-core.c | 5 ++- net/xfrm/xfrm_input.c | 2 +- net/xfrm/xfrm_policy.c | 4 +- sound/pci/hda/patch_via.c | 2 +- 38 files changed, 183 insertions(+), 88 deletions(-) -- 2.25.1

1 38

[PATCH openEuler-1.0-LTS 1/2] nbd: Fix memory leak in nbd_add_socket
by Yang Yingliang 07 Feb '21

07 Feb '21

From: Zheng Bin <zhengbin13(a)huawei.com> stable inclusion from linux-4.19.133 commit 306290bad932950adccfbf99c27b70c105c2c183 -------------------------------- [ Upstream commit 579dd91ab3a5446b148e7f179b6596b270dace46 ] When adding first socket to nbd, if nsock's allocation failed, the data structure member "config->socks" was reallocated, but the data structure member "config->num_connections" was not updated. A memory leak will occur then because the function "nbd_config_put" will free "config->socks" only when "config->num_connections" is not zero. Fixes: 03bf73c315ed ("nbd: prevent memory leak") Reported-by: syzbot+934037347002901b8d2a(a)syzkaller.appspotmail.com Signed-off-by: Zheng Bin <zhengbin13(a)huawei.com> Reviewed-by: Eric Biggers <ebiggers(a)google.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/block/nbd.c | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 49f98b9b2777..97fcb040056c 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -993,25 +993,26 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg, test_bit(NBD_RT_BOUND, &config->runtime_flags))) { dev_err(disk_to_dev(nbd->disk), "Device being setup by another task"); - sockfd_put(sock); - return -EBUSY; + err = -EBUSY; + goto put_socket; + } + + nsock = kzalloc(sizeof(*nsock), GFP_KERNEL); + if (!nsock) { + err = -ENOMEM; + goto put_socket; } socks = krealloc(config->socks, (config->num_connections + 1) * sizeof(struct nbd_sock *), GFP_KERNEL); if (!socks) { - sockfd_put(sock); - return -ENOMEM; + kfree(nsock); + err = -ENOMEM; + goto put_socket; } config->socks = socks; - nsock = kzalloc(sizeof(struct nbd_sock), GFP_KERNEL); - if (!nsock) { - sockfd_put(sock); - return -ENOMEM; - } - nsock->fallback_index = -1; nsock->dead = false; mutex_init(&nsock->tx_lock); @@ -1023,6 +1024,10 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg, atomic_inc(&config->live_connections); return 0; + +put_socket: + sockfd_put(sock); + return err; } static int nbd_reconnect_socket(struct nbd_device *nbd, unsigned long arg) -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/7] futex: Ensure the correct return value from futex_lock_pi()
by Yang Yingliang 04 Feb '21

04 Feb '21

From: Thomas Gleixner <tglx(a)linutronix.de> stable inclusion from linux-4.19.172 commit 72f38fffa4758b878f819f8a47761b3f03443f36 CVE: CVE-2021-3347 -------------------------------- commit 12bb3f7f1b03d5913b3f9d4236a488aa7774dfe9 upstream In case that futex_lock_pi() was aborted by a signal or a timeout and the task returned without acquiring the rtmutex, but is the designated owner of the futex due to a concurrent futex_unlock_pi() fixup_owner() is invoked to establish consistent state. In that case it invokes fixup_pi_state_owner() which in turn tries to acquire the rtmutex again. If that succeeds then it does not propagate this success to fixup_owner() and futex_lock_pi() returns -EINTR or -ETIMEOUT despite having the futex locked. Return success from fixup_pi_state_owner() in all cases where the current task owns the rtmutex and therefore the futex and propagate it correctly through fixup_owner(). Fixup the other callsite which does not expect a positive return value. Fixes: c1e2f0eaf015 ("futex: Avoid violating the 10th rule of futex") Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Acked-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Wei Li <liwei391(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/futex.c | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/kernel/futex.c b/kernel/futex.c index 28b321e23053..ca9389bd110f 100644 --- a/kernel/futex.c +++ b/kernel/futex.c @@ -2414,8 +2414,8 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q, } if (__rt_mutex_futex_trylock(&pi_state->pi_mutex)) { - /* We got the lock after all, nothing to fix. */ - ret = 0; + /* We got the lock. pi_state is correct. Tell caller. */ + ret = 1; goto out_unlock; } @@ -2431,7 +2431,7 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q, * We raced against a concurrent self; things are * already fixed up. Nothing to do. */ - ret = 0; + ret = 1; goto out_unlock; } newowner = argowner; @@ -2477,7 +2477,7 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q, raw_spin_unlock(&newowner->pi_lock); raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock); - return 0; + return argowner == current; /* * In order to reschedule or handle a page fault, we need to drop the @@ -2519,7 +2519,7 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q, * Check if someone else fixed it for us: */ if (pi_state->owner != oldowner) { - ret = 0; + ret = argowner == current; goto out_unlock; } @@ -2552,8 +2552,6 @@ static long futex_wait_restart(struct restart_block *restart); */ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked) { - int ret = 0; - if (locked) { /* * Got the lock. We might not be the anticipated owner if we @@ -2564,8 +2562,8 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked) * stable state, anything else needs more attention. */ if (q->pi_state->owner != current) - ret = fixup_pi_state_owner(uaddr, q, current); - goto out; + return fixup_pi_state_owner(uaddr, q, current); + return 1; } /* @@ -2576,10 +2574,8 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked) * Another speculative read; pi_state->owner == current is unstable * but needs our attention. */ - if (q->pi_state->owner == current) { - ret = fixup_pi_state_owner(uaddr, q, NULL); - goto out; - } + if (q->pi_state->owner == current) + return fixup_pi_state_owner(uaddr, q, NULL); /* * Paranoia check. If we did not take the lock, then we should not be @@ -2592,8 +2588,7 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked) q->pi_state->owner); } -out: - return ret ? ret : locked; + return 0; } /** @@ -3315,7 +3310,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, if (q.pi_state && (q.pi_state->owner != current)) { spin_lock(q.lock_ptr); ret = fixup_pi_state_owner(uaddr2, &q, current); - if (ret && rt_mutex_owner(&q.pi_state->pi_mutex) == current) { + if (ret < 0 && rt_mutex_owner(&q.pi_state->pi_mutex) == current) { pi_state = q.pi_state; get_pi_state(pi_state); } @@ -3325,6 +3320,11 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, */ put_pi_state(q.pi_state); spin_unlock(q.lock_ptr); + /* + * Adjust the return value. It's either -EFAULT or + * success (1) but the caller expects 0 for success. + */ + ret = ret < 0 ? ret : 0; } } else { struct rt_mutex *pi_mutex; -- 2.25.1

1 6

[PATCH openEuler-1.0-LTS 1/3] netfilter: clear skb->next in NF_HOOK_LIST()
by Yang Yingliang 04 Feb '21

04 Feb '21

From: Cong Wang <cong.wang(a)bytedance.com> stable inclusion from linux-4.19.161 commit 5460d62d661c0fc53bfe83493821b1dc3dc969f4 -------------------------------- NF_HOOK_LIST() uses list_del() to remove skb from the linked list, however, it is not sufficient as skb->next still points to other skb. We should just call skb_list_del_init() to clear skb->next, like the rest places which using skb list. This has been fixed in upstream by commit ca58fbe06c54 ("netfilter: add and use nf_hook_slow_list()"). Fixes: 9f17dbf04ddf ("netfilter: fix use-after-free in NF_HOOK_LIST") Reported-by: liuzx(a)knownsec.com Tested-by: liuzx(a)knownsec.com Cc: Florian Westphal <fw(a)strlen.de> Cc: Edward Cree <ecree(a)solarflare.com> Cc: stable(a)vger.kernel.org # between 4.19 and 5.4 Signed-off-by: Cong Wang <cong.wang(a)bytedance.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/netfilter.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h index 72cb19c3db6a..9460a5635c90 100644 --- a/include/linux/netfilter.h +++ b/include/linux/netfilter.h @@ -300,7 +300,7 @@ NF_HOOK_LIST(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk, INIT_LIST_HEAD(&sublist); list_for_each_entry_safe(skb, next, head, list) { - list_del(&skb->list); + skb_list_del_init(skb); if (nf_hook(pf, hook, net, sk, skb, in, out, okfn) == 1) list_add_tail(&skb->list, &sublist); } -- 2.25.1

1 2

2024

2023

2022

2021

2020

2019

Kernel