- Kernel - mailweb.openeuler.org

[PATCH kernel-4.19] uio: introduce UIO_MEM_IOVA
by Yang Yingliang 09 Sep '21

09 Sep '21

From: Stephen Hemminger <stephen(a)networkplumber.org> mainline inclusion from mainline-v4.20-rc1 commit bfddabfa230452cea32aae82f9cd85ab22601acf category: bugfix bugzilla: 180968 CVE: NA ------------------------------------------------- Introduce the concept of mapping physical memory locations that are normal memory. The new type UIO_MEM_IOVA are similar to existing UIO_MEM_PHYS but the backing memory is not marked as uncached. Also, indent related switch to the currently used style. Signed-off-by: Stephen Hemminger <sthemmin(a)microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Huang <chenhuang5(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/uio/uio.c | 24 +++++++++++++----------- include/linux/uio_driver.h | 1 + 2 files changed, 14 insertions(+), 11 deletions(-) diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c index 1876e4c4b81a0..f43498e5cfb85 100644 --- a/drivers/uio/uio.c +++ b/drivers/uio/uio.c @@ -738,7 +738,8 @@ static int uio_mmap_physical(struct vm_area_struct *vma) return -EINVAL; vma->vm_ops = &uio_physical_vm_ops; - vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot); + if (idev->info->mem[mi].memtype == UIO_MEM_PHYS) + vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot); /* * We cannot use the vm_iomap_memory() helper here, @@ -795,18 +796,19 @@ static int uio_mmap(struct file *filep, struct vm_area_struct *vma) } switch (idev->info->mem[mi].memtype) { - case UIO_MEM_PHYS: - ret = uio_mmap_physical(vma); - break; - case UIO_MEM_LOGICAL: - case UIO_MEM_VIRTUAL: - ret = uio_mmap_logical(vma); - break; - default: - ret = -EINVAL; + case UIO_MEM_IOVA: + case UIO_MEM_PHYS: + ret = uio_mmap_physical(vma); + break; + case UIO_MEM_LOGICAL: + case UIO_MEM_VIRTUAL: + ret = uio_mmap_logical(vma); + break; + default: + ret = -EINVAL; } -out: + out: mutex_unlock(&idev->info_lock); return ret; } diff --git a/include/linux/uio_driver.h b/include/linux/uio_driver.h index 6f8b68cd460f8..a3cd7cb67a69f 100644 --- a/include/linux/uio_driver.h +++ b/include/linux/uio_driver.h @@ -133,6 +133,7 @@ extern void uio_event_notify(struct uio_info *info); #define UIO_MEM_PHYS 1 #define UIO_MEM_LOGICAL 2 #define UIO_MEM_VIRTUAL 3 +#define UIO_MEM_IOVA 4 /* defines for uio_port->porttype */ #define UIO_PORT_NONE 0 -- 2.25.1

1 0

[PATCH kernel-4.19 1/2] mm/mempolicy.c: check range first in queue_pages_test_walk
by Yang Yingliang 09 Sep '21

09 Sep '21

From: Li Xinhai <lixinhai.lxh(a)gmail.com> mainline inclusion from mainline-v5.5-rc1 commit a18b3ac25bb7be4781cb9e6d31f3e57b3ba01b06 category: bugfix bugzilla: 97909 CVE: NA ------------------------------------------------- Patch series "mm: Fix checking unmapped holes for mbind", v4. This patchset fix checking unmapped holes for mbind(). First patch makes sure the vma been correctly tracked in .test_walk(), so each time when .test_walk() is called, the neighborhood of two vma is correct. Current problem is that the !vma_migratable() check could cause return immediately without update tracking to vma. Second patch fix the inconsistent report of EFAULT when mbind() is called for MPOL_DEFAULT and non MPOL_DEFAULT cases, so application do not need to have workaround code to handle this special behavior. Currently there are two problems, one is that the .test_walk() can not know there is hole at tail side of range, because .test_walk() only call for vma not for hole. The other one is that mbind_range() checks for hole at head side of range but do not consider the MPOL_MF_DISCONTIG_OK flag as done in .test_walk(). This patch (of 2): Checking unmapped hole and updating the previous vma must be handled first, otherwise the unmapped hole could be calculated from a wrong previous vma. Several commits were relevant to this error: - commit 6f4576e3687b ("mempolicy: apply page table walker on queue_pages_range()") This commit was correct, the VM_PFNMAP check was after updating previous vma - commit 48684a65b4e3 ("mm: pagewalk: fix misbehavior of walk_page_range for vma(VM_PFNMAP)") This commit added VM_PFNMAP check before updating previous vma. Then, there were two VM_PFNMAP check did same thing twice. - commit acda0c334028 ("mm/mempolicy.c: get rid of duplicated check for vma(VM_PFNMAP) in queue_page s_range()") This commit tried to fix the duplicated VM_PFNMAP check, but it wrongly removed the one which was after updating vma. Link: http://lkml.kernel.org/r/1573218104-11021-2-git-send-email-lixinhai.lxh@gma… Fixes: acda0c334028 (mm/mempolicy.c: get rid of duplicated check for vma(VM_PFNMAP) in queue_pages_range()) Signed-off-by: Li Xinhai <lixinhai.lxh(a)gmail.com> Reviewed-by: Naoya Horiguchi <n-horiguchi(a)ah.jp.nec.com> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Hugh Dickins <hughd(a)google.com> Cc: linux-man <linux-man(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Nanyong Sun <sunnanyong(a)huawei.com> Reviewed-by: tong tiangen <tongtiangen(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- mm/mempolicy.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/mm/mempolicy.c b/mm/mempolicy.c index 3a835f96c8fea..7b4ba2f355911 100644 --- a/mm/mempolicy.c +++ b/mm/mempolicy.c @@ -657,6 +657,16 @@ static int queue_pages_test_walk(unsigned long start, unsigned long end, unsigned long endvma = vma->vm_end; unsigned long flags = qp->flags; + /* range check first */ + if (!(flags & MPOL_MF_DISCONTIG_OK)) { + if (!vma->vm_next && vma->vm_end < end) + return -EFAULT; + if (qp->prev && qp->prev->vm_end < vma->vm_start) + return -EFAULT; + } + + qp->prev = vma; + /* * Need check MPOL_MF_STRICT to return -EIO if possible * regardless of vma_migratable @@ -670,15 +680,6 @@ static int queue_pages_test_walk(unsigned long start, unsigned long end, if (vma->vm_start > start) start = vma->vm_start; - if (!(flags & MPOL_MF_DISCONTIG_OK)) { - if (!vma->vm_next && vma->vm_end < end) - return -EFAULT; - if (qp->prev && qp->prev->vm_end < vma->vm_start) - return -EFAULT; - } - - qp->prev = vma; - if (flags & MPOL_MF_LAZY) { /* Similar to task_numa_work, skip inaccessible VMAs */ if (!is_vm_hugetlb_page(vma) && -- 2.25.1

1 1

[PATCH kernel-4.19 1/2] share_pool: Free newly generated id only when necessary
by Yang Yingliang 08 Sep '21

08 Sep '21

From: Tang Yizhou <tangyizhou(a)huawei.com> ascend inclusion category: bugfix bugzilla: NA CVE: NA ------------------------------------------------- Once sp group is created, the generated id will be freed in sp_group_drop. Before that, we should call free_sp_group_id() when error occurs. Signed-off-by: Tang Yizhou <tangyizhou(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- mm/share_pool.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/mm/share_pool.c b/mm/share_pool.c index 6a4da9ac83e14..2d9c0a8916211 100644 --- a/mm/share_pool.c +++ b/mm/share_pool.c @@ -349,6 +349,12 @@ static void free_sp_group_id(unsigned int spg_id) ida_free(&sp_group_id_ida, spg_id); } +static void free_new_spg_id(bool new, int spg_id) +{ + if (new) + free_sp_group_id(spg_id); +} + static void free_sp_group(struct sp_group *spg) { fput(spg->file); @@ -665,7 +671,8 @@ int sp_group_add_task(int pid, int spg_id) rcu_read_unlock(); if (ret) { up_write(&sp_group_sem); - goto out_free_id; + free_new_spg_id(id_newly_generated, spg_id); + goto out; } /* @@ -682,12 +689,14 @@ int sp_group_add_task(int pid, int spg_id) */ mm = get_task_mm(tsk->group_leader); if (!mm) { - ret = -ESRCH; up_write(&sp_group_sem); + ret = -ESRCH; + free_new_spg_id(id_newly_generated, spg_id); goto out_put_task; } else if (mm->sp_group) { - ret = -EEXIST; up_write(&sp_group_sem); + ret = -EEXIST; + free_new_spg_id(id_newly_generated, spg_id); goto out_put_mm; } @@ -695,6 +704,7 @@ int sp_group_add_task(int pid, int spg_id) if (IS_ERR(spg)) { up_write(&sp_group_sem); ret = PTR_ERR(spg); + free_new_spg_id(id_newly_generated, spg_id); goto out_put_mm; } @@ -813,9 +823,7 @@ int sp_group_add_task(int pid, int spg_id) mmput(mm); out_put_task: put_task_struct(tsk); -out_free_id: - if (unlikely(ret) && id_newly_generated) - free_sp_group_id((unsigned int)spg_id); +out: return ret == 0 ? spg_id : ret; } EXPORT_SYMBOL_GPL(sp_group_add_task); -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/2] net: qrtr: fix OOB Read in qrtr_endpoint_post
by Yang Yingliang 08 Sep '21

08 Sep '21

From: Pavel Skripkin <paskripkin(a)gmail.com> stable inclusion from linux-4.19.196 commit f8111c0d7ed42ede41a3d0d393b104de0730a8a6 CVE: CVE-2021-3743 -------------------------------- [ Upstream commit ad9d24c9429e2159d1e279dc3a83191ccb4daf1d ] Syzbot reported slab-out-of-bounds Read in qrtr_endpoint_post. The problem was in wrong _size_ type: if (len != ALIGN(size, 4) + hdrlen) goto err; If size from qrtr_hdr is 4294967293 (0xfffffffd), the result of ALIGN(size, 4) will be 0. In case of len == hdrlen and size == 4294967293 in header this check won't fail and skb_put_data(skb, data + hdrlen, size); will read out of bound from data, which is hdrlen allocated block. Fixes: 194ccc88297a ("net: qrtr: Support decoding incoming v2 packets") Reported-and-tested-by: syzbot+1917d778024161609247(a)syzkaller.appspotmail.com Signed-off-by: Pavel Skripkin <paskripkin(a)gmail.com> Reviewed-by: Bjorn Andersson <bjorn.andersson(a)linaro.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/qrtr/qrtr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c index e720763376387..320933db88915 100644 --- a/net/qrtr/qrtr.c +++ b/net/qrtr/qrtr.c @@ -262,7 +262,7 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len) const struct qrtr_hdr_v2 *v2; struct sk_buff *skb; struct qrtr_cb *cb; - unsigned int size; + size_t size; unsigned int ver; size_t hdrlen; -- 2.25.1

1 1

[PATCH kernel-4.19 1/3] mm, slub: stop freeing kmem_cache_node structures on node offline
by Yang Yingliang 08 Sep '21

08 Sep '21

From: Vlastimil Babka <vbabka(a)suse.cz> mainline inclusion from mainline-v5.12-rc1 commit 666716fd267df0007dfbb6480cd79dd5b05da4cc category: bugfix bugzilla: 175589 CVE: NA ------------------------------------------------- Patch series "mm, slab, slub: remove cpu and memory hotplug locks". Some related work caused me to look at how we use get/put_mems_online() and get/put_online_cpus() during kmem cache creation/descruction/shrinking, and realize that it should be actually safe to remove all of that with rather small effort (as e.g. Michal Hocko suspected in some of the past discussions already). This has the benefit to avoid rather heavy locks that have caused locking order issues already in the past. So this is the result, Patches 2 and 3 remove memory hotplug and cpu hotplug locking, respectively. Patch 1 is due to realization that in fact some races exist despite the locks (even if not removed), but the most sane solution is not to introduce more of them, but rather accept some wasted memory in scenarios that should be rare anyway (full memory hot remove), as we do the same in other contexts already. This patch (of 3): Commit e4f8e513c3d3 ("mm/slub: fix a deadlock in show_slab_objects()") has fixed a problematic locking order by removing the memory hotplug lock get/put_online_mems() from show_slab_objects(). During the discussion, it was argued [1] that this is OK, because existing slabs on the node would prevent a hotremove to proceed. That's true, but per-node kmem_cache_node structures are not necessarily allocated on the same node and may exist even without actual slab pages on the same node. Any path that uses get_node() directly or via for_each_kmem_cache_node() (such as show_slab_objects()) can race with freeing of kmem_cache_node even with the !NULL check, resulting in use-after-free. To that end, commit e4f8e513c3d3 argues in a comment that: * We don't really need mem_hotplug_lock (to hold off * slab_mem_going_offline_callback) here because slab's memory hot * unplug code doesn't destroy the kmem_cache->node[] data. While it's true that slab_mem_going_offline_callback() doesn't free the kmem_cache_node, the later callback slab_mem_offline_callback() actually does, so the race and use-after-free exists. Not just for show_slab_objects() after commit e4f8e513c3d3, but also many other places that are not under slab_mutex. And adding slab_mutex locking or other synchronization to SLUB paths such as get_any_partial() would be bad for performance and error-prone. The easiest solution is therefore to make the abovementioned comment true and stop freeing the kmem_cache_node structures, accepting some wasted memory in the full memory node removal scenario. Analogically we also don't free hotremoved pgdat as mentioned in [1], nor the similar per-node structures in SLAB. Importantly this approach will not block the hotremove, as generally such nodes should be movable in order to succeed hotremove in the first place, and thus the GFP_KERNEL allocated kmem_cache_node will come from elsewhere. [1] https://lore.kernel.org/linux-mm/20190924151147.GB23050@dhcp22.suse.cz/ Link: https://lkml.kernel.org/r/20210113131634.3671-1-vbabka@suse.cz Link: https://lkml.kernel.org/r/20210113131634.3671-2-vbabka@suse.cz Signed-off-by: Vlastimil Babka <vbabka(a)suse.cz> Cc: Christoph Lameter <cl(a)linux.com> Cc: Pekka Enberg <penberg(a)kernel.org> Cc: David Rientjes <rientjes(a)google.com> Cc: Joonsoo Kim <iamjoonsoo.kim(a)lge.com> Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com> Cc: Qian Cai <cai(a)redhat.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: Michal Hocko <mhocko(a)kernel.org> Cc: Vlastimil Babka <vbabka(a)suse.cz> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Chengyang Fan <cy.fan(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- mm/slub.c | 28 +++++++++++----------------- 1 file changed, 11 insertions(+), 17 deletions(-) diff --git a/mm/slub.c b/mm/slub.c index 30683ffe18234..983392cdccef9 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -4059,8 +4059,6 @@ static int slab_mem_going_offline_callback(void *arg) static void slab_mem_offline_callback(void *arg) { - struct kmem_cache_node *n; - struct kmem_cache *s; struct memory_notify *marg = arg; int offline_node; @@ -4074,21 +4072,11 @@ static void slab_mem_offline_callback(void *arg) return; mutex_lock(&slab_mutex); - list_for_each_entry(s, &slab_caches, list) { - n = get_node(s, offline_node); - if (n) { - /* - * if n->nr_slabs > 0, slabs still exist on the node - * that is going down. We were unable to free them, - * and offline_pages() function shouldn't call this - * callback. So, we must fail. - */ - BUG_ON(slabs_node(s, offline_node)); - - s->node[offline_node] = NULL; - kmem_cache_free(kmem_cache_node, n); - } - } + /* + * We no longer free kmem_cache_node structures here, as it would be + * racy with all get_node() users, and infeasible to protect them with + * slab_mutex. + */ mutex_unlock(&slab_mutex); } @@ -4114,6 +4102,12 @@ static int slab_mem_going_online_callback(void *arg) */ mutex_lock(&slab_mutex); list_for_each_entry(s, &slab_caches, list) { + /* + * The structure may already exist if the node was previously + * onlined and offlined. + */ + if (get_node(s, nid)) + continue; /* * XXX: kmem_cache_alloc_node will fallback to other nodes * since memory is not yet available from the node that -- 2.25.1

1 2

[PATCH kernel-4.19] kernel/hung_task.c: introduce sysctl to print all traces when a hung task is detected
by Yang Yingliang 07 Sep '21

07 Sep '21

From: "Guilherme G. Piccoli" <gpiccoli(a)canonical.com> mainline inclusion from mainline-v5.8-rc1 commit 0ec9dc9bcba0a62b0844e54c1caf6b8b0bf6b5b4 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I48GW3 CVE: NA --------------------------- Commit 401c636a0eeb ("kernel/hung_task.c: show all hung tasks before panic") introduced a change in that we started to show all CPUs backtraces when a hung task is detected _and_ the sysctl/kernel parameter "hung_task_panic" is set. The idea is good, because usually when observing deadlocks (that may lead to hung tasks), the culprit is another task holding a lock and not necessarily the task detected as hung. The problem with this approach is that dumping backtraces is a slightly expensive task, specially printing that on console (and specially in many CPU machines, as servers commonly found nowadays). So, users that plan to collect a kdump to investigate the hung tasks and narrow down the deadlock definitely don't need the CPUs backtrace on dmesg/console, which will delay the panic and pollute the log (crash tool would easily grab all CPUs traces with 'bt -a' command). Also, there's the reciprocal scenario: some users may be interested in seeing the CPUs backtraces but not have the system panic when a hung task is detected. The current approach hence is almost as embedding a policy in the kernel, by forcing the CPUs backtraces' dump (only) on hung_task_panic. This patch decouples the panic event on hung task from the CPUs backtraces dump, by creating (and documenting) a new sysctl called "hung_task_all_cpu_backtrace", analog to the approach taken on soft/hard lockups, that have both a panic and an "all_cpu_backtrace" sysctl to allow individual control. The new mechanism for dumping the CPUs backtraces on hung task detection respects "hung_task_warnings" by not dumping the traces in case there's no warnings left. Signed-off-by: Guilherme G. Piccoli <gpiccoli(a)canonical.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Reviewed-by: Kees Cook <keescook(a)chromium.org> Cc: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Link: http://lkml.kernel.org/r/20200327223646.20779-1-gpiccoli@canonical.com Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Bixuan Cui <cuibixuan(a)huawei.com> Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- Documentation/sysctl/kernel.txt | 14 ++++++++++++++ include/linux/sched/sysctl.h | 7 +++++++ kernel/hung_task.c | 20 ++++++++++++++++++-- kernel/sysctl.c | 11 +++++++++++ 4 files changed, 50 insertions(+), 2 deletions(-) diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt index f41ae5a3cc8df..7e33d039ea171 100644 --- a/Documentation/sysctl/kernel.txt +++ b/Documentation/sysctl/kernel.txt @@ -337,6 +337,20 @@ Default value is "/sbin/hotplug". ============================================================== +hung_task_all_cpu_backtrace: + +If this option is set, the kernel will send an NMI to all CPUs to dump +their backtraces when a hung task is detected. This file shows up if +CONFIG_DETECT_HUNG_TASK and CONFIG_SMP are enabled. + +0: Won't show all CPUs backtraces when a hung task is detected. +This is the default behavior. + +1: Will non-maskably interrupt all CPUs and dump their backtraces when +a hung task is detected. + +============================================================== + hung_task_panic: Controls the kernel's behavior when a hung task is detected. diff --git a/include/linux/sched/sysctl.h b/include/linux/sched/sysctl.h index 4993c00824a30..cabdc1ed134a0 100644 --- a/include/linux/sched/sysctl.h +++ b/include/linux/sched/sysctl.h @@ -7,6 +7,13 @@ struct ctl_table; #ifdef CONFIG_DETECT_HUNG_TASK + +#ifdef CONFIG_SMP +extern unsigned int sysctl_hung_task_all_cpu_backtrace; +#else +#define sysctl_hung_task_all_cpu_backtrace 2 +#endif /* CONFIG_SMP */ + extern int sysctl_hung_task_check_count; extern unsigned int sysctl_hung_task_panic; extern unsigned long sysctl_hung_task_timeout_secs; diff --git a/kernel/hung_task.c b/kernel/hung_task.c index 4a9191617076f..8a2842bfa4e10 100644 --- a/kernel/hung_task.c +++ b/kernel/hung_task.c @@ -51,9 +51,18 @@ int __read_mostly sysctl_hung_task_warnings = 10; static int __read_mostly did_panic; static bool hung_task_show_lock; static bool hung_task_call_panic; +static bool hung_task_show_all_bt; static struct task_struct *watchdog_task; +#ifdef CONFIG_SMP +/* + * Should we dump all CPUs backtraces in a hung task event? + * Defaults to 0, can be changed via sysctl. + */ +unsigned int __read_mostly sysctl_hung_task_all_cpu_backtrace; +#endif /* CONFIG_SMP */ + /* * Should we panic (and reboot, if panic_timeout= is set) when a * hung task is detected: @@ -135,6 +144,9 @@ static void check_hung_task(struct task_struct *t, unsigned long timeout) " disables this message.\n"); sched_show_task(t); hung_task_show_lock = true; + + if (sysctl_hung_task_all_cpu_backtrace) + hung_task_show_all_bt = true; } touch_nmi_watchdog(); @@ -199,10 +211,14 @@ static void check_hung_uninterruptible_tasks(unsigned long timeout) rcu_read_unlock(); if (hung_task_show_lock) debug_show_all_locks(); - if (hung_task_call_panic) { + + if (hung_task_show_all_bt) { + hung_task_show_all_bt = false; trigger_all_cpu_backtrace(); - panic("hung_task: blocked tasks"); } + + if (hung_task_call_panic) + panic("hung_task: blocked tasks"); } static long hung_timeout_jiffies(unsigned long last_checked, diff --git a/kernel/sysctl.c b/kernel/sysctl.c index f853d7cca977a..5c427c9383164 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -1081,6 +1081,17 @@ static struct ctl_table kern_table[] = { }, #endif #ifdef CONFIG_DETECT_HUNG_TASK +#ifdef CONFIG_SMP + { + .procname = "hung_task_all_cpu_backtrace", + .data = &sysctl_hung_task_all_cpu_backtrace, + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_dointvec_minmax, + .extra1 = &zero, + .extra2 = &one, + }, +#endif /* CONFIG_SMP */ { .procname = "hung_task_panic", .data = &sysctl_hung_task_panic, -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] vt_kdsetmode: extend console locking
by Yang Yingliang 07 Sep '21

07 Sep '21

From: Linus Torvalds <torvalds(a)linux-foundation.org> stable inclusion from linux-4.19.206 commit 0776c1a20babb4ad0b7ce7f2f4e0806a97663187 CVE: CVE-2021-3753 -------------------------------- commit 2287a51ba822384834dafc1c798453375d1107c7 upstream. As per the long-suffering comment. Reported-by: Minh Yuan <yuanmingbuaa(a)gmail.com> Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Cc: Jiri Slaby <jirislaby(a)kernel.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/tty/vt/vt_ioctl.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c index 2e959563af534..13675008d1c71 100644 --- a/drivers/tty/vt/vt_ioctl.c +++ b/drivers/tty/vt/vt_ioctl.c @@ -484,16 +484,19 @@ int vt_ioctl(struct tty_struct *tty, ret = -EINVAL; goto out; } - /* FIXME: this needs the console lock extending */ - if (vc->vc_mode == (unsigned char) arg) + console_lock(); + if (vc->vc_mode == (unsigned char) arg) { + console_unlock(); break; + } vc->vc_mode = (unsigned char) arg; - if (console != fg_console) + if (console != fg_console) { + console_unlock(); break; + } /* * explicitly blank/unblank the screen if switching modes */ - console_lock(); if (arg == KD_TEXT) do_unblank_screen(1); else -- 2.25.1

1 0

Re: [PATCH] cpuidle: menu: Avoid computations when result will be discarded
by chengjian (D) 07 Sep '21

07 Sep '21

嗯，我发现了。不过补丁已经合入了。改的话，得 force push 了。我下次会注意的。谢谢提醒。 On 2021/9/7 15:38, Jackie Liu wrote: > 的 From 写错了，不是 5.14-rc7，而是 4.20-rc1 我是检查看 OLK-5.10 是否需要合入的时候发现的。 ----成坚

1 0

[PATCH kernel-4.19 00/31] backport linux-4.19.206
by Yang Yingliang 07 Sep '21

07 Sep '21

*** BLURB HERE *** Ben Skeggs (1): drm/nouveau/disp: power down unused DP links during init Christophe JAILLET (1): xgene-v2: Fix a resource leak in the error handling path of 'xge_probe()' Daniel Borkmann (1): bpf: Do not use ax register in interpreter on div/mod Denis Efremov (1): Revert "floppy: reintroduce O_NDELAY fix" Florian Westphal (1): netfilter: conntrack: collect all entries in one cycle George Kennedy (1): fbmem: add margin check to fb_check_caps() Gerd Rausch (1): net/rds: dma_map_sg is entitled to merge entries Greg Kroah-Hartman (1): Linux 4.19.206 Guangbin Huang (1): net: hns3: fix get wrong pfc_en when query PFC configuration Guenter Roeck (1): ARC: Fix CONFIG_STACKDEPOT Jerome Brunet (1): usb: gadget: u_audio: fix race condition on endpoint stop Johan Hovold (1): Revert "USB: serial: ch341: fix character loss at high transfer rates" Linus Torvalds (1): vt_kdsetmode: extend console locking Mark Yacoub (1): drm: Copy drm_wait_vblank to user before returning Maxim Kiselev (1): net: marvell: fix MVNETA_TX_IN_PRGRS bit number Michał Mirosław (1): opp: remove WARN when no valid OPPs remain Neeraj Upadhyay (1): vringh: Use wiov->used to check for read/write desc order Parav Pandit (2): virtio: Improve vq->broken access to avoid any compiler optimization virtio_pci: Support surprise removal of virtio pci device Peter Collingbourne (1): net: don't unconditionally copy_from_user a struct ifreq for socket ioctls Sasha Neftin (1): e1000e: Fix the max snoop/no-snoop latency for 10M Sean Christopherson (1): KVM: x86/mmu: Treat NX as used (not reserved) for all !TDP shadow MMUs Shai Malin (2): qed: qed ll2 race condition fixes qed: Fix null-pointer dereference in qed_rdma_create_qp() Shreyansh Chouhan (1): ip_gre: add validation for csum_start Stefan Mätje (1): can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX and TX error counters Thinh Nguyen (1): usb: dwc3: gadget: Fix dwc3_calc_trbs_left() Tuo Li (1): IB/hfi1: Fix possible null-pointer dereference in _extend_sdma_tx_descs() Wesley Cheng (1): usb: dwc3: gadget: Stop EP0 transfers during pullup disable Xiaolong Huang (1): net: qrtr: fix another OOB Read in qrtr_endpoint_post Zhengjun Zhang (1): USB: serial: option: add new VID/PID to support Fibocom FG150 Makefile | 2 +- arch/arc/kernel/vmlinux.lds.S | 2 + arch/x86/kvm/mmu.c | 11 ++- drivers/block/floppy.c | 27 ++++--- drivers/gpu/drm/drm_ioc32.c | 4 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.h | 1 + .../gpu/drm/nouveau/nvkm/engine/disp/outp.c | 9 +++ drivers/infiniband/hw/hfi1/sdma.c | 9 ++- drivers/net/can/usb/esd_usb2.c | 4 +- drivers/net/ethernet/apm/xgene-v2/main.c | 4 +- .../hisilicon/hns3/hns3pf/hclge_dcb.c | 13 +--- drivers/net/ethernet/intel/e1000e/ich8lan.c | 14 +++- drivers/net/ethernet/intel/e1000e/ich8lan.h | 3 + drivers/net/ethernet/marvell/mvneta.c | 2 +- drivers/net/ethernet/qlogic/qed/qed_ll2.c | 20 ++++++ drivers/net/ethernet/qlogic/qed/qed_rdma.c | 3 +- drivers/opp/of.c | 5 +- drivers/tty/vt/vt_ioctl.c | 11 +-- drivers/usb/dwc3/gadget.c | 23 +++--- drivers/usb/gadget/function/u_audio.c | 5 +- drivers/usb/serial/ch341.c | 1 - drivers/usb/serial/option.c | 2 + drivers/vhost/vringh.c | 2 +- drivers/video/fbdev/core/fbmem.c | 4 ++ drivers/virtio/virtio_pci_common.c | 7 ++ drivers/virtio/virtio_ring.c | 6 +- include/linux/netdevice.h | 4 ++ kernel/bpf/core.c | 32 ++++----- net/ipv4/ip_gre.c | 2 + net/netfilter/nf_conntrack_core.c | 71 ++++++------------- net/qrtr/qrtr.c | 2 +- net/rds/ib_frmr.c | 4 +- net/socket.c | 6 +- 34 files changed, 179 insertions(+), 138 deletions(-) -- 2.25.1

1 31

[PATCH kernel-4.19 0/2] virtio_blk: add discard and write zeroes support
by xuliqun 07 Sep '21

07 Sep '21

virtio_blk: add discard and write zeroes support, mainly for guest os xuliqun (2): virtio_blk: add discard and write zeroes support virtio_blk: fix handling single range discard request drivers/block/virtio_blk.c | 98 ++++++++++++++++++++++++++++++++++++++++- include/uapi/linux/virtio_blk.h | 54 +++++++++++++++++++++++ 2 files changed, 150 insertions(+), 2 deletions(-) -- 2.16.2

2 3