- Kernel - mailweb.openeuler.org

[PATCH] Input: sunkbd - avoid use-after-free in teardown paths
by Yang Yingliang 19 Nov '20

19 Nov '20

From: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> mainline inclusion from mainline-v5.10-rc5 commit 77e70d351db7de07a46ac49b87a6c3c7a60fca7e category: bugfix bugzilla: NA CVE: CVE-2020-25669 -------------------------------- We need to make sure we cancel the reinit work before we tear down the driver structures. Reported-by: Bodong Zhao <nopitydays(a)gmail.com> Tested-by: Bodong Zhao <nopitydays(a)gmail.com> Cc: stable(a)vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/input/keyboard/sunkbd.c | 41 ++++++++++++++++++++++++++------- 1 file changed, 33 insertions(+), 8 deletions(-) diff --git a/drivers/input/keyboard/sunkbd.c b/drivers/input/keyboard/sunkbd.c index ad5d7f94f95a..1c7aa86c92ab 100644 --- a/drivers/input/keyboard/sunkbd.c +++ b/drivers/input/keyboard/sunkbd.c @@ -111,7 +111,8 @@ static irqreturn_t sunkbd_interrupt(struct serio *serio, switch (data) { case SUNKBD_RET_RESET: - schedule_work(&sunkbd->tq); + if (sunkbd->enabled) + schedule_work(&sunkbd->tq); sunkbd->reset = -1; break; @@ -212,16 +213,12 @@ static int sunkbd_initialize(struct sunkbd *sunkbd) } /* - * sunkbd_reinit() sets leds and beeps to a state the computer remembers they - * were in. + * sunkbd_set_leds_beeps() sets leds and beeps to a state the computer remembers + * they were in. */ -static void sunkbd_reinit(struct work_struct *work) +static void sunkbd_set_leds_beeps(struct sunkbd *sunkbd) { - struct sunkbd *sunkbd = container_of(work, struct sunkbd, tq); - - wait_event_interruptible_timeout(sunkbd->wait, sunkbd->reset >= 0, HZ); - serio_write(sunkbd->serio, SUNKBD_CMD_SETLED); serio_write(sunkbd->serio, (!!test_bit(LED_CAPSL, sunkbd->dev->led) << 3) | @@ -234,11 +231,39 @@ static void sunkbd_reinit(struct work_struct *work) SUNKBD_CMD_BELLOFF - !!test_bit(SND_BELL, sunkbd->dev->snd)); } + +/* + * sunkbd_reinit() wait for the keyboard reset to complete and restores state + * of leds and beeps. + */ + +static void sunkbd_reinit(struct work_struct *work) +{ + struct sunkbd *sunkbd = container_of(work, struct sunkbd, tq); + + /* + * It is OK that we check sunkbd->enabled without pausing serio, + * as we only want to catch true->false transition that will + * happen once and we will be woken up for it. + */ + wait_event_interruptible_timeout(sunkbd->wait, + sunkbd->reset >= 0 || !sunkbd->enabled, + HZ); + + if (sunkbd->reset >= 0 && sunkbd->enabled) + sunkbd_set_leds_beeps(sunkbd); +} + static void sunkbd_enable(struct sunkbd *sunkbd, bool enable) { serio_pause_rx(sunkbd->serio); sunkbd->enabled = enable; serio_continue_rx(sunkbd->serio); + + if (!enable) { + wake_up_interruptible(&sunkbd->wait); + cancel_work_sync(&sunkbd->tq); + } } /* -- 2.25.1

1 0

[PATCH v3 kernel-4.19] nbd: don't update block size after device is started
by lining 19 Nov '20

19 Nov '20

From: Ming Lei <ming.lei(a)redhat.com> mainline inclusion from mainline-v5.10-rc2 commit b40813ddcd6b category: bugfix bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1891363 CVE: NA backport: openEuler-20.09 Here is the testcase: 1. rbd create --size 2G rbdpool/foo 2. rbd-nbd map rbdpool/foo 3. mkfs.ext4 /dev/nbd0 4. mount /dev/nbd0 /mnt 5. rbd resize --size 4G rbdpool/foo 6. ls /mnt ls will stuck here forever. -------------------------------- [ Upstream commit b40813ddcd6bf9f01d020804e4cb8febc480b9e4 ] Mounted NBD device can be resized, one use case is rbd-nbd. Fix the issue by setting up default block size, then not touch it in nbd_size_update() any more. This kind of usage is aligned with loop which has same use case too. Cc: stable(a)vger.kernel.org Fixes: c8a83a6b54d0 ("nbd: Use set_blocksize() to set device blocksize") Reported-by: lining <lining2020x(a)163.com> Signed-off-by: Ming Lei <ming.lei(a)redhat.com> Cc: Josef Bacik <josef(a)toxicpanda.com> Cc: Jan Kara <jack(a)suse.cz> Tested-by: lining <lining2020x(a)163.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: lining <lining_yewu(a)cmss.chinamobile.com> --- drivers/block/nbd.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index cdf62fb94fb15..9a0fb2d52a76c 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -268,7 +268,7 @@ static void nbd_size_clear(struct nbd_device *nbd) } } -static void nbd_size_update(struct nbd_device *nbd) +static void nbd_size_update(struct nbd_device *nbd, bool start) { struct nbd_config *config = nbd->config; struct block_device *bdev = bdget_disk(nbd->disk, 0); @@ -279,7 +279,8 @@ static void nbd_size_update(struct nbd_device *nbd) if (bdev) { if (bdev->bd_disk) { bd_set_size(bdev, config->bytesize); - set_blocksize(bdev, config->blksize); + if (start) + set_blocksize(bdev, config->blksize); } else bdev->bd_invalidated = 1; bdput(bdev); @@ -294,7 +295,7 @@ static void nbd_size_set(struct nbd_device *nbd, loff_t blocksize, config->blksize = blocksize; config->bytesize = blocksize * nr_blocks; if (nbd->task_recv != NULL) - nbd_size_update(nbd); + nbd_size_update(nbd, false); } static void nbd_complete_rq(struct request *req) @@ -1231,7 +1232,7 @@ static int nbd_start_device(struct nbd_device *nbd) args->index = i; queue_work(nbd->recv_workq, &args->work); } - nbd_size_update(nbd); + nbd_size_update(nbd, true); return error; } -- 2.27.0

3 2

[PATCH 0/2] backport stable-4.19.157
by Yang Yingliang 19 Nov '20

19 Nov '20

*** BLURB HERE *** Greg Kroah-Hartman (1): Linux 4.19.157 Len Brown (1): powercap: restrict energy meter to root access Makefile | 2 +- drivers/powercap/powercap_sys.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) -- 2.25.1

1 2

[PATCH 00/66] backport stable-4.19.156
by Yang Yingliang 19 Nov '20

19 Nov '20

Alan Stern (1): USB: Add NO_LPM quirk for Kingston flash drive Alexander Aring (1): gfs2: Wake up when sd_glock_disposal becomes zero Artem Lapkin (1): ALSA: usb-audio: add usb vendor id as DSD-capable for Khadas devices Ben Hutchings (1): Revert "btrfs: flush write bio if we loop in extent_write_cache_pages" Chris Wilson (1): drm/i915: Break up error capture compression loops with cond_resched() Claire Chang (1): serial: 8250_mtk: Fix uart_get_baud_rate warning Claudiu Manoil (2): gianfar: Replace skb_realloc_headroom with skb_cow_head for PTP gianfar: Account for Tx PTP timestamp in the skb headroom Clément Péron (1): ARM: dts: sun4i-a10: fix cpu_alert temperature Daniel Vetter (1): vt: Disable KD_FONT_OP_COPY Daniele Palmas (3): net: usb: qmi_wwan: add Telit LE910Cx 0x1230 composition USB: serial: option: add LE910Cx compositions 0x1203, 0x1230, 0x1231 USB: serial: option: add Telit FN980 composition 0x1055 Eddy Wu (1): fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent Filipe Manana (1): Btrfs: fix unwritten extent buffers and hangs on future writeback attempts Gabriel Krisman Bertazi (2): blk-cgroup: Fix memleak on error path blk-cgroup: Pre-allocate tree node on blkg_conf_prep Geoffrey D. Bennett (2): ALSA: usb-audio: Add implicit feedback quirk for Qu-16 ALSA: usb-audio: Add implicit feedback quirk for MODX Greg Kroah-Hartman (1): Linux 4.19.156 Guenter Roeck (1): tools: perf: Fix build error in v4.19.y Hoang Huu Le (1): tipc: fix use-after-free in tipc_bcast_get_mode Hoegeun Kwon (1): drm/vc4: drv: Add error handding for bind Jason Gunthorpe (1): mm: always have io_remap_pfn_range() set pgprot_decrypted() Jeff Vander Stoep (1): vsock: use ns_capable_noaudit() on socket create Johan Hovold (1): USB: serial: cyberjack: fix write-URB completion race Josef Bacik (1): btrfs: flush write bio if we loop in extent_write_cache_pages Kairui Song (1): x86/kexec: Use up-to-dated screen_info copy to fill boot params Keith Winstein (1): ALSA: usb-audio: Add implicit feedback quirk for Zoom UAC-2 Lee Jones (1): Fonts: Replace discarded const qualifier Macpaul Lin (1): usb: mtu3: fix panic in mtu3_gadget_stop() Mark Deneen (1): cadence: force nonlinear buffers to be cloned Mike Galbraith (1): futex: Handle transient "ownerless" rtmutex state correctly Ming Lei (1): scsi: core: Don't start concurrent async scan on same host Oleg Nesterov (1): ptrace: fix task_join_group_stop() for the case when current is traced Pali Rohár (1): arm64: dts: marvell: espressobin: Add ethernet switch aliases Petr Malat (1): sctp: Fix COMM_LOST/CANT_STR_ASSOC err reporting on big-endian platforms Qinglang Miao (1): serial: txx9: add missing platform_driver_unregister() on error in serial_txx9_init Qiujun Huang (1): tracing: Fix out of bounds write in get_trace_buf Qu Wenruo (11): btrfs: extent_io: Kill the forward declaration of flush_write_bio btrfs: extent_io: Move the BUG_ON() in flush_write_bio() one level up btrfs: extent_io: Handle errors better in btree_write_cache_pages() btrfs: extent_io: add proper error handling to lock_extent_buffer_for_io() btrfs: Move btrfs_check_chunk_valid() to tree-check.[ch] and export it btrfs: tree-checker: Make chunk item checker messages more readable btrfs: tree-checker: Make btrfs_check_chunk_valid() return EUCLEAN instead of EIO btrfs: tree-checker: Check chunk item at tree block read time btrfs: tree-checker: Verify dev item btrfs: tree-checker: Fix wrong check on max devid btrfs: tree-checker: fix the error message for transid error Rafael J. Wysocki (1): PM: runtime: Resume the device earlier in __device_release_driver() Shijie Luo (1): mm: mempolicy: fix potential pte_unmap_unlock pte error Steven Rostedt (VMware) (3): ring-buffer: Fix recursion protection transitions between interrupt context ftrace: Fix recursion check for NMI test ftrace: Handle tracing when switching between context Vasily Gorbik (1): lib/crc32test: remove extra local_irq_disable/enable Vinay Kumar Yadav (2): chelsio/chtls: fix memory leaks caused by a race chelsio/chtls: fix always leaking ctrl_skb Vincent Whitchurch (1): of: Fix reserved-memory overlap detection Vineet Gupta (2): ARC: stack unwinding: avoid indefinite looping Revert "ARC: entry: fix potential EFA clobber when TIF_SYSCALL_TRACE" Xiaofei Shen (1): net: dsa: read mac address from DT for slave device YueHaibing (1): sfp: Fix error handing in sfp_probe() Zhang Qilong (1): ACPI: NFIT: Fix comparison to '-ENXIO' Ziyi Cao (1): USB: serial: option: add Quectel EC200T module support Zqiang (1): kthread_worker: prevent queuing delayed work from timer_fn when it is being canceled Makefile | 2 +- arch/arc/kernel/entry.S | 16 +- arch/arc/kernel/stacktrace.c | 7 +- arch/arm/boot/dts/sun4i-a10.dtsi | 2 +- .../dts/marvell/armada-3720-espressobin.dts | 12 +- arch/x86/kernel/kexec-bzimage64.c | 3 +- block/blk-cgroup.c | 15 +- drivers/acpi/nfit/core.c | 2 +- drivers/base/dd.c | 7 +- drivers/crypto/chelsio/chtls/chtls_cm.c | 2 +- drivers/crypto/chelsio/chtls/chtls_hw.c | 3 + drivers/gpu/drm/i915/i915_gpu_error.c | 3 + drivers/gpu/drm/vc4/vc4_drv.c | 1 + drivers/net/ethernet/cadence/macb_main.c | 3 +- drivers/net/ethernet/freescale/gianfar.c | 14 +- drivers/net/phy/sfp.c | 3 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/of/of_reserved_mem.c | 13 +- drivers/scsi/scsi_scan.c | 7 +- drivers/tty/serial/8250/8250_mtk.c | 2 +- drivers/tty/serial/serial_txx9.c | 3 + drivers/tty/vt/vt.c | 24 +- drivers/usb/core/quirks.c | 3 + drivers/usb/mtu3/mtu3_gadget.c | 1 + drivers/usb/serial/cyberjack.c | 7 +- drivers/usb/serial/option.c | 10 + fs/btrfs/extent_io.c | 171 +++++++++---- fs/btrfs/tree-checker.c | 236 +++++++++++++++++- fs/btrfs/tree-checker.h | 4 + fs/btrfs/volumes.c | 123 +-------- fs/btrfs/volumes.h | 9 + fs/gfs2/glock.c | 3 +- include/asm-generic/pgtable.h | 4 - include/linux/mm.h | 9 + include/net/dsa.h | 1 + kernel/fork.c | 10 +- kernel/futex.c | 16 +- kernel/kthread.c | 3 +- kernel/signal.c | 19 +- kernel/trace/ring_buffer.c | 58 ++++- kernel/trace/trace.c | 2 +- kernel/trace/trace.h | 26 +- kernel/trace/trace_selftest.c | 9 +- lib/crc32test.c | 4 - lib/fonts/font_10x18.c | 2 +- lib/fonts/font_6x10.c | 2 +- lib/fonts/font_6x11.c | 2 +- lib/fonts/font_7x14.c | 2 +- lib/fonts/font_8x16.c | 2 +- lib/fonts/font_8x8.c | 2 +- lib/fonts/font_acorn_8x8.c | 2 +- lib/fonts/font_mini_4x6.c | 2 +- lib/fonts/font_pearl_8x8.c | 2 +- lib/fonts/font_sun12x22.c | 2 +- lib/fonts/font_sun8x16.c | 2 +- mm/mempolicy.c | 6 +- net/dsa/dsa2.c | 1 + net/dsa/slave.c | 5 +- net/sctp/sm_sideeffect.c | 4 +- net/tipc/core.c | 5 + net/vmw_vsock/af_vsock.c | 2 +- sound/usb/pcm.c | 6 + sound/usb/quirks.c | 1 + tools/perf/util/util.h | 2 +- 64 files changed, 634 insertions(+), 293 deletions(-) -- 2.25.1

1 66

[PATCH] tools: perf: Fix build error in v4.19.y
by Yang Yingliang 18 Nov '20

18 Nov '20

From: Guenter Roeck <linux(a)roeck-us.net> perf may fail to build in v4.19.y with the following error. util/evsel.c: In function ‘perf_evsel__exit’: util/util.h:25:28: error: passing argument 1 of ‘free’ discards ‘const’ qualifier from pointer target type This is observed (at least) with gcc v6.5.0. The underlying problem is the following statement. zfree(&evsel->pmu_name); evsel->pmu_name is decared 'const *'. zfree in turn is defined as #define zfree(ptr) ({ free(*ptr); *ptr = NULL; }) and thus passes the const * to free(). The problem is not seen in the upstream kernel since zfree() has been rewritten there. The problem has been introduced into v4.19.y with the backport of upstream commit d4953f7ef1a2 (perf parse-events: Fix 3 use after frees found with clang ASAN). One possible fix of this problem would be to not declare pmu_name as const. This patch chooses to typecast the parameter of zfree() to void *, following the guidance from the upstream kernel which does the same since commit 7f7c536f23e6a ("tools lib: Adopt zalloc()/zfree() from tools/perf") Fixes: a0100a363098 ("perf parse-events: Fix 3 use after frees found with clang ASAN") Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- tools/perf/util/util.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/perf/util/util.h b/tools/perf/util/util.h index dc58254a2b69..8c01b2cfdb1a 100644 --- a/tools/perf/util/util.h +++ b/tools/perf/util/util.h @@ -22,7 +22,7 @@ static inline void *zalloc(size_t size) return calloc(1, size); } -#define zfree(ptr) ({ free(*ptr); *ptr = NULL; }) +#define zfree(ptr) ({ free((void *)*ptr); *ptr = NULL; }) struct dirent; struct nsinfo; -- 2.25.1

1 0

[PATCH 01/19] nvme: Fix ctrl use-after-free during sysfs deletion
by Yang Yingliang 18 Nov '20

18 Nov '20

From: Israel Rukshin <israelr(a)mellanox.com> mainline inclusion from mainline-v5.7-rc1 commit b780d7415aacec855e2f2370cbf98f918b224903 category: bugfix bugzilla: NA CVE: NA Link: https://gitee.com/openeuler/kernel/issues/I1WGZE -------------------------------- In case nvme_sysfs_delete() is called by the user before taking the ctrl reference count, the ctrl may be freed during the creation and cause the bug. Take the reference as soon as the controller is externally visible, which is done by cdev_device_add() in nvme_init_ctrl(). Also take the reference count at the core layer instead of taking it on each transport separately. Signed-off-by: Israel Rukshin <israelr(a)mellanox.com> Reviewed-by: Max Gurtovoy <maxg(a)mellanox.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/host/tcp.c [No code about TCP in current version.] Reviewed-by: Chao Leng <lengchao(a)huawei.com> Reviewed-by: Jike Cheng <chengjike.cheng(a)huawei.com> Signed-off-by: Lijie <lijie34(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Acked-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/nvme/host/core.c | 2 ++ drivers/nvme/host/fc.c | 4 +--- drivers/nvme/host/pci.c | 1 - drivers/nvme/host/rdma.c | 3 +-- drivers/nvme/target/loop.c | 3 +-- 5 files changed, 5 insertions(+), 8 deletions(-) diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index b8446637b3c2..b7a40ac4b637 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -3779,6 +3779,7 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev, if (ret) goto out_release_instance; + nvme_get_ctrl(ctrl); cdev_init(&ctrl->cdev, &nvme_dev_fops); ctrl->cdev.owner = ops->module; ret = cdev_device_add(&ctrl->cdev, ctrl->device); @@ -3795,6 +3796,7 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev, return 0; out_free_name: + nvme_put_ctrl(ctrl); kfree_const(ctrl->device->kobj.name); out_release_instance: ida_simple_remove(&nvme_instance_ida, ctrl->instance); diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c index ed88d5021772..d75ae1b201ad 100644 --- a/drivers/nvme/host/fc.c +++ b/drivers/nvme/host/fc.c @@ -3146,10 +3146,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts, goto fail_ctrl; } - nvme_get_ctrl(&ctrl->ctrl); - if (!queue_delayed_work(nvme_wq, &ctrl->connect_work, 0)) { - nvme_put_ctrl(&ctrl->ctrl); dev_err(ctrl->ctrl.device, "NVME-FC{%d}: failed to schedule initial connect\n", ctrl->cnum); @@ -3174,6 +3171,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts, /* initiate nvme ctrl ref counting teardown */ nvme_uninit_ctrl(&ctrl->ctrl); + nvme_put_ctrl(&ctrl->ctrl); /* Remove core ctrl ref. */ nvme_put_ctrl(&ctrl->ctrl); diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c index f194bb7ccb04..1a0eec110614 100644 --- a/drivers/nvme/host/pci.c +++ b/drivers/nvme/host/pci.c @@ -2558,7 +2558,6 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id) dev_info(dev->ctrl.device, "pci function %s\n", dev_name(&pdev->dev)); nvme_reset_ctrl(&dev->ctrl); - nvme_get_ctrl(&dev->ctrl); async_schedule(nvme_async_probe, dev); return 0; diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c index d0cf19e593b2..0e998e85e962 100644 --- a/drivers/nvme/host/rdma.c +++ b/drivers/nvme/host/rdma.c @@ -2050,8 +2050,6 @@ static struct nvme_ctrl *nvme_rdma_create_ctrl(struct device *dev, dev_info(ctrl->ctrl.device, "new ctrl: NQN \"%s\", addr %pISpcs\n", ctrl->ctrl.opts->subsysnqn, &ctrl->addr); - nvme_get_ctrl(&ctrl->ctrl); - mutex_lock(&nvme_rdma_ctrl_mutex); list_add_tail(&ctrl->list, &nvme_rdma_ctrl_list); mutex_unlock(&nvme_rdma_ctrl_mutex); @@ -2061,6 +2059,7 @@ static struct nvme_ctrl *nvme_rdma_create_ctrl(struct device *dev, out_uninit_ctrl: nvme_uninit_ctrl(&ctrl->ctrl); nvme_put_ctrl(&ctrl->ctrl); + nvme_put_ctrl(&ctrl->ctrl); if (ret > 0) ret = -EIO; return ERR_PTR(ret); diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c index 137a27fa369c..e30080c629fd 100644 --- a/drivers/nvme/target/loop.c +++ b/drivers/nvme/target/loop.c @@ -639,8 +639,6 @@ static struct nvme_ctrl *nvme_loop_create_ctrl(struct device *dev, dev_info(ctrl->ctrl.device, "new ctrl: \"%s\"\n", ctrl->ctrl.opts->subsysnqn); - nvme_get_ctrl(&ctrl->ctrl); - changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_LIVE); WARN_ON_ONCE(!changed); @@ -658,6 +656,7 @@ static struct nvme_ctrl *nvme_loop_create_ctrl(struct device *dev, kfree(ctrl->queues); out_uninit_ctrl: nvme_uninit_ctrl(&ctrl->ctrl); + nvme_put_ctrl(&ctrl->ctrl); out_put_ctrl: nvme_put_ctrl(&ctrl->ctrl); if (ret > 0) -- 2.25.1

1 18

[PATCH v2 kernel-4.19] nbd: don't update block size after device is started
by lining 17 Nov '20

17 Nov '20

mainline inclusion from mainline-v5.10-rc2 commit b40813ddcd6b category: bugfix bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1891363 CVE: NA backport: openEuler-20.09 Here is the testcase: 1. rbd create --size 2G rbdpool/foo 2. rbd-nbd map rbdpool/foo 3. mkfs.ext4 /dev/nbd0 4. mount /dev/nbd0 /mnt 5. rbd resize --size 4G rbdpool/foo 6. ls /mnt ls will stuck here forever. -------------------------------- From: Ming Lei <ming.lei(a)redhat.com> [ Upstream commit b40813ddcd6bf9f01d020804e4cb8febc480b9e4 ] Mounted NBD device can be resized, one use case is rbd-nbd. Fix the issue by setting up default block size, then not touch it in nbd_size_update() any more. This kind of usage is aligned with loop which has same use case too. Cc: stable(a)vger.kernel.org Fixes: c8a83a6b54d0 ("nbd: Use set_blocksize() to set device blocksize") Reported-by: lining <lining2020x(a)163.com> Signed-off-by: Ming Lei <ming.lei(a)redhat.com> Cc: Josef Bacik <josef(a)toxicpanda.com> Cc: Jan Kara <jack(a)suse.cz> Tested-by: lining <lining2020x(a)163.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: lining <lining_yewu(a)cmss.chinamobile.com> --- drivers/block/nbd.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index cdf62fb94fb15..9a0fb2d52a76c 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -268,7 +268,7 @@ static void nbd_size_clear(struct nbd_device *nbd) } } -static void nbd_size_update(struct nbd_device *nbd) +static void nbd_size_update(struct nbd_device *nbd, bool start) { struct nbd_config *config = nbd->config; struct block_device *bdev = bdget_disk(nbd->disk, 0); @@ -279,7 +279,8 @@ static void nbd_size_update(struct nbd_device *nbd) if (bdev) { if (bdev->bd_disk) { bd_set_size(bdev, config->bytesize); - set_blocksize(bdev, config->blksize); + if (start) + set_blocksize(bdev, config->blksize); } else bdev->bd_invalidated = 1; bdput(bdev); @@ -294,7 +295,7 @@ static void nbd_size_set(struct nbd_device *nbd, loff_t blocksize, config->blksize = blocksize; config->bytesize = blocksize * nr_blocks; if (nbd->task_recv != NULL) - nbd_size_update(nbd); + nbd_size_update(nbd, false); } static void nbd_complete_rq(struct request *req) @@ -1231,7 +1232,7 @@ static int nbd_start_device(struct nbd_device *nbd) args->index = i; queue_work(nbd->recv_workq, &args->work); } - nbd_size_update(nbd); + nbd_size_update(nbd, true); return error; } -- 2.27.0

2 1

[PATCH openEuler-20.09] nbd: don't update block size after device is started
by lining 17 Nov '20

17 Nov '20

mainline inclusion from mainline-v5.10-rc2 commit b40813ddcd6b category: bugfix bugzilla: 1891363 CVE: NA -------------------------------- Mounted NBD device can be resized, one use case is rbd-nbd. Fix the issue by setting up default block size, then not touch it in nbd_size_update() any more. This kind of usage is aligned with loop which has same use case too. Cc: stable(a)vger.kernel.org Fixes: c8a83a6b54d0 ("nbd: Use set_blocksize() to set device blocksize") Reported-by: lining <lining2020x(a)163.com> Signed-off-by: Ming Lei <ming.lei(a)redhat.com> Cc: Josef Bacik <josef(a)toxicpanda.com> Cc: Jan Kara <jack(a)suse.cz> Tested-by: lining <lining2020x(a)163.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: lining <lining_yewu(a)cmss.chinamobile.com> --- drivers/block/nbd.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 816188aa841f..a913153d0b6b 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -293,7 +293,7 @@ static void nbd_size_clear(struct nbd_device *nbd) } } -static void nbd_size_update(struct nbd_device *nbd) +static void nbd_size_update(struct nbd_device *nbd, bool start) { struct nbd_config *config = nbd->config; struct block_device *bdev = bdget_disk(nbd->disk, 0); @@ -309,7 +309,8 @@ static void nbd_size_update(struct nbd_device *nbd) if (bdev) { if (bdev->bd_disk) { bd_set_size(bdev, config->bytesize); - set_blocksize(bdev, config->blksize); + if (start) + set_blocksize(bdev, config->blksize); } else bdev->bd_invalidated = 1; bdput(bdev); @@ -324,7 +325,7 @@ static void nbd_size_set(struct nbd_device *nbd, loff_t blocksize, config->blksize = blocksize; config->bytesize = blocksize * nr_blocks; if (nbd->task_recv != NULL) - nbd_size_update(nbd); + nbd_size_update(nbd, false); } static void nbd_complete_rq(struct request *req) @@ -1263,7 +1264,7 @@ static int nbd_start_device(struct nbd_device *nbd) args->index = i; queue_work(nbd->recv_workq, &args->work); } - nbd_size_update(nbd); + nbd_size_update(nbd, true); return error; } -- 2.25.1

2 2

[PATCH 00/24] bugfixes for openEuler-1.0-LTS
by Yang Yingliang 16 Nov '20

16 Nov '20

Alexander Duyck (1): e1000: Do not perform reset in reset_task if we are already down Alistair Popple (1): mm/rmap: fixup copying of soft dirty and uffd ptes Aya Levin (2): net/mlx5e: Fix VLAN cleanup flow net/mlx5e: Fix VLAN create flow Chuck Lever (1): svcrdma: Fix leak of transport addresses Cong Wang (1): tipc: fix the skb_unshare() in tipc_buf_append() Dan Aloni (1): svcrdma: fix bounce buffers for unaligned offsets and multiple pages Dumitru Ceara (1): openvswitch: handle DNAT tuple collision Eran Ben Elisha (1): net/mlx5: Don't call timecounter cyc2time directly from 1PPS flow Hanjun Guo (4): irqchip/gicv3: Call acpi_put_table() to fix memory leak tty/amba-pl011: Call acpi_put_table() to fix memory leak cpufreq : CPPC: Break out if HiSilicon CPPC workaround is matched cpufreq: CPPC: put ACPI table after using it Jonathan Lemon (1): mlx4: handle non-napi callers to napi_poll Linus Torvalds (1): tty: make FONTX ioctl use the tty pointer they were actually passed Nikolai Merinov (1): partitions/efi: Fix partition name parsing in GUID partition entry Rohit Maheshwari (1): net/tls: sendfile fails with ktls offload Sabrina Dubroca (1): xfrmi: drop ignore_df check before updating pmtu Tonghao Zhang (2): net: openvswitch: use u64 for meter bucket net: openvswitch: use div_u64() for 64-by-32 divisions Tuong Lien (1): tipc: fix memory leak in service subscripting Yang Shi (1): mm: madvise: fix vma user-after-free Yunsheng Lin (1): net: sch_generic: aviod concurrent reset and enqueue op for lockless qdisc kiyin(尹亮) (1): perf/core: Fix a memory leak in perf_event_parse_addr_filter() block/partitions/efi.c | 35 +++++++++---- block/partitions/efi.h | 2 +- drivers/cpufreq/cppc_cpufreq.c | 8 ++- drivers/irqchip/irq-gic-v3.c | 2 + drivers/net/ethernet/intel/e1000/e1000_main.c | 18 +++++-- drivers/net/ethernet/mellanox/mlx4/en_rx.c | 3 ++ drivers/net/ethernet/mellanox/mlx4/en_tx.c | 2 +- .../net/ethernet/mellanox/mlx5/core/en_fs.c | 14 ++++-- .../ethernet/mellanox/mlx5/core/lib/clock.c | 5 +- drivers/tty/serial/amba-pl011.c | 2 + drivers/tty/vt/vt_ioctl.c | 32 ++++++------ kernel/events/core.c | 12 ++--- mm/madvise.c | 2 +- mm/migrate.c | 9 +++- mm/rmap.c | 7 ++- net/openvswitch/conntrack.c | 22 +++++---- net/openvswitch/meter.c | 4 +- net/openvswitch/meter.h | 2 +- net/sched/sch_generic.c | 49 +++++++++++++------ net/sunrpc/xprtrdma/svc_rdma_backchannel.c | 1 + net/sunrpc/xprtrdma/svc_rdma_sendto.c | 3 +- net/tipc/msg.c | 3 +- net/tipc/topsrv.c | 4 +- net/tls/tls_device.c | 11 +++-- net/xfrm/xfrm_interface.c | 2 +- 25 files changed, 168 insertions(+), 86 deletions(-) -- 2.25.1

1 24

[PATCH 01/10] ascend: mm: add an owner for mm_struct
by Yang Yingliang 16 Nov '20

16 Nov '20

From: Ding Tianhong <dingtianhong(a)huawei.com> ascend inclusion category: feature bugzilla: NA CVE: NA ------------------------------------------------- The mm->owner is only used for MEMCG currently, but the ascend share pool features will use it later, so make it to a general features and select it for CONFIG_MEMCG. Signed-off-by: Tang Yizhou <tangyizhou(a)huawei.com> Signed-off-by: Ding Tianhong <dingtianhong(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/mm_types.h | 2 +- init/Kconfig | 1 + kernel/exit.c | 4 ++-- kernel/fork.c | 4 ++-- mm/Kconfig | 4 ++++ mm/debug.c | 2 +- 6 files changed, 11 insertions(+), 6 deletions(-) diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h index 178e9dee217a..fcfa9a75c18e 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -453,7 +453,7 @@ struct mm_struct { spinlock_t ioctx_lock; struct kioctx_table __rcu *ioctx_table; #endif -#ifdef CONFIG_MEMCG +#ifdef CONFIG_MM_OWNER /* * "owner" points to a task that is regarded as the canonical * user/owner of this mm. All of the following must be true in diff --git a/init/Kconfig b/init/Kconfig index d1427ae4de9e..6880b55901bb 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -705,6 +705,7 @@ config MEMCG bool "Memory controller" select PAGE_COUNTER select EVENTFD + select MM_OWNER help Provides control over the memory footprint of tasks in a cgroup. diff --git a/kernel/exit.c b/kernel/exit.c index 891d65e3ffd5..4d6f941712b6 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -392,7 +392,7 @@ kill_orphaned_pgrp(struct task_struct *tsk, struct task_struct *parent) } } -#ifdef CONFIG_MEMCG +#ifdef CONFIG_MM_OWNER /* * A task is exiting. If it owned this mm, find a new owner for the mm. */ @@ -478,7 +478,7 @@ void mm_update_next_owner(struct mm_struct *mm) task_unlock(c); put_task_struct(c); } -#endif /* CONFIG_MEMCG */ +#endif /* CONFIG_MM_OWNER */ /* * Turn us into a lazy TLB process if we diff --git a/kernel/fork.c b/kernel/fork.c index 768fe41a7ee3..1ac49d1852cf 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -958,7 +958,7 @@ static void mm_init_aio(struct mm_struct *mm) static __always_inline void mm_clear_owner(struct mm_struct *mm, struct task_struct *p) { -#ifdef CONFIG_MEMCG +#ifdef CONFIG_MM_OWNER if (mm->owner == p) WRITE_ONCE(mm->owner, NULL); #endif @@ -966,7 +966,7 @@ static __always_inline void mm_clear_owner(struct mm_struct *mm, static void mm_init_owner(struct mm_struct *mm, struct task_struct *p) { -#ifdef CONFIG_MEMCG +#ifdef CONFIG_MM_OWNER mm->owner = p; #endif } diff --git a/mm/Kconfig b/mm/Kconfig index dddeb30d645e..76c2197a3f99 100644 --- a/mm/Kconfig +++ b/mm/Kconfig @@ -299,6 +299,10 @@ config VIRT_TO_BUS deprecated interface virt_to_bus(). All new architectures should probably not select this. +config MM_OWNER + bool "Enable the ownership the mm owner" + help + This option enables mm_struct's to have an owner. config MMU_NOTIFIER bool diff --git a/mm/debug.c b/mm/debug.c index 362ce581671e..2da184b16bce 100644 --- a/mm/debug.c +++ b/mm/debug.c @@ -129,7 +129,7 @@ void dump_mm(const struct mm_struct *mm) #ifdef CONFIG_AIO "ioctx_table %px\n" #endif -#ifdef CONFIG_MEMCG +#ifdef CONFIG_MM_OWNER "owner %px " #endif "exe_file %px\n" -- 2.25.1

1 9

2025

2024

2023

2022

2021

2020

2019

Kernel