- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] iommu/iova: increase the iova_rcache depot max size to 128
by Zhang Zekun 26 Jun '23

26 Jun '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7ASVH CVE: NA --------------------------------------- In fio test with iodepth=256 with allowd cpus to 0-255, we observe a serve performance decrease. The statistic of cache hit rate are relatively low. Here are some statistics about the iova_cpu_rcahe of all cpus: iova alloc order 0 1 2 3 4 5 ---------------------------------------------------------------------- average cpu_rcache hit rate 0.9941 0.7408 0.8109 0.8854 0.9082 0.8887 Jobs: 12 (f=12): [R(12)][20.0%][r=1091MiB/s][r=279k IOPS][eta 00m:28s] Jobs: 12 (f=12): [R(12)][22.2%][r=1426MiB/s][r=365k IOPS][eta 00m:28s] Jobs: 12 (f=12): [R(12)][25.0%][r=1607MiB/s][r=411k IOPS][eta 00m:27s] Jobs: 12 (f=12): [R(12)][27.8%][r=1501MiB/s][r=384k IOPS][eta 00m:26s] Jobs: 12 (f=12): [R(12)][30.6%][r=1486MiB/s][r=380k IOPS][eta 00m:25s] Jobs: 12 (f=12): [R(12)][33.3%][r=1393MiB/s][r=357k IOPS][eta 00m:24s] Jobs: 12 (f=12): [R(12)][36.1%][r=1550MiB/s][r=397k IOPS][eta 00m:23s] Jobs: 12 (f=12): [R(12)][38.9%][r=1485MiB/s][r=380k IOPS][eta 00m:22s] The under lying hisi sas driver has 16 thread irqs to free iova, but these irq call back function will only free iovas on 16 certain cpus(cpu{0, 16,32...,240}). For example, thread irq which smp affinity is 0-15, will only free iova on cpu 0. However, the driver will alloc iova on all cpus(cpu{0-255}), cpus without free iova in local cpu_rcache need to get free iovas from iova_rcache->depot. The current size of iova_rcache->depot max size is 32, and it seems to be too small for 256 users (16 cpus will put iovas to iova_rcache->depot and 240 cpus will try to get iova from it). Set iova_rcache->depot to 128 can fix the performance issue, and the performance can return to normal. iova alloc order 0 1 2 3 4 5 ---------------------------------------------------------------------- average cpu_rcache hit rate 0.9925 0.9736 0.9789 0.9867 0.9889 0.9906 Jobs: 12 (f=12): [R(12)][12.9%][r=7526MiB/s][r=1927k IOPS][eta 04m:30s] Jobs: 12 (f=12): [R(12)][13.2%][r=7527MiB/s][r=1927k IOPS][eta 04m:29s] Jobs: 12 (f=12): [R(12)][13.5%][r=7529MiB/s][r=1927k IOPS][eta 04m:28s] Jobs: 12 (f=12): [R(12)][13.9%][r=7531MiB/s][r=1928k IOPS][eta 04m:27s] Jobs: 12 (f=12): [R(12)][14.2%][r=7529MiB/s][r=1928k IOPS][eta 04m:26s] Jobs: 12 (f=12): [R(12)][14.5%][r=7528MiB/s][r=1927k IOPS][eta 04m:25s] Jobs: 12 (f=12): [R(12)][14.8%][r=7527MiB/s][r=1927k IOPS][eta 04m:24s] Jobs: 12 (f=12): [R(12)][15.2%][r=7525MiB/s][r=1926k IOPS][eta 04m:23s] Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/iommu/Kconfig | 10 ++++++++++ include/linux/iova.h | 2 +- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig index f04a2bde0018..54d4a8cc3876 100644 --- a/drivers/iommu/Kconfig +++ b/drivers/iommu/Kconfig @@ -437,5 +437,15 @@ config SMMU_BYPASS_DEV This feature will be replaced by ACPI IORT RMR node, which will be upstreamed in mainline. +config IOVA_MAX_GLOBAL_MAGS + int "Set the max iova global magzines in iova rcache" + range 16 2048 + default "32" + help + Iova rcache global magizine is shared among every cpu. The size of + it can be a bottle neck when lots of cpus are contending to use it. + If you are suffering from the speed of allocing iova with more than + 128 cpus, try to tune this config larger. + endif # IOMMU_SUPPORT diff --git a/include/linux/iova.h b/include/linux/iova.h index dfa51ae49666..3cb469b366d7 100644 --- a/include/linux/iova.h +++ b/include/linux/iova.h @@ -26,7 +26,7 @@ struct iova_magazine; struct iova_cpu_rcache; #define IOVA_RANGE_CACHE_MAX_SIZE 6 /* log of max cached IOVA range size (in pages) */ -#define MAX_GLOBAL_MAGS 32 /* magazines per bin */ +#define MAX_GLOBAL_MAGS CONFIG_IOVA_MAX_GLOBAL_MAGS /* magazines per bin */ struct iova_rcache { spinlock_t lock; -- 2.17.1

3 2

[PATCH OLK-5.10] media: dm1105: Fix use after free bug in dm1105_remove due to race condition
by Pu Lehui 26 Jun '23

26 Jun '23

From: Zheng Wang <zyytlz.wz(a)163.com> stable inclusion from stable-v5.10.180 commit e9d64e90a0ada4d00ac6562e351ef10ae7d9b911 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7F1RG CVE: CVE-2023-35824 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5abda7a16698d4d1f47af1168d8fa2c640116b4a ] In dm1105_probe, it called dm1105_ir_init and bound &dm1105->ir.work with dm1105_emit_key. When it handles IRQ request with dm1105_irq, it may call schedule_work to start the work. When we call dm1105_remove to remove the driver, there may be a sequence as follows: Fix it by finishing the work before cleanup in dm1105_remove CPU0 CPU1 |dm1105_emit_key dm1105_remove | dm1105_ir_exit | rc_unregister_device | rc_free_device | rc_dev_release | kfree(dev); | | | rc_keydown | //use Fixes: 34d2f9bf189c ("V4L/DVB: dm1105: use dm1105_dev & dev instead of dm1105dvb") Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> Reviewed-by: Xu Kuohai <xukuohai(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> --- drivers/media/pci/dm1105/dm1105.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/pci/dm1105/dm1105.c b/drivers/media/pci/dm1105/dm1105.c index 9dce31d2b525..d2e194a24e7e 100644 --- a/drivers/media/pci/dm1105/dm1105.c +++ b/drivers/media/pci/dm1105/dm1105.c @@ -1178,6 +1178,7 @@ static void dm1105_remove(struct pci_dev *pdev) struct dvb_demux *dvbdemux = &dev->demux; struct dmx_demux *dmx = &dvbdemux->dmx; + cancel_work_sync(&dev->ir.work); dm1105_ir_exit(dev); dmx->close(dmx); dvb_net_release(&dev->dvbnet); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] media: dm1105: Fix use after free bug in dm1105_remove due to race condition
by Yongqiang Liu 26 Jun '23

26 Jun '23

From: Zheng Wang <zyytlz.wz(a)163.com> stable inclusion from stable-v4.19.283 commit 722c156c6eab40a6e7dda98dfa66724f9d5aeceb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7EDYO CVE: CVE-2023-35824 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5abda7a16698d4d1f47af1168d8fa2c640116b4a ] In dm1105_probe, it called dm1105_ir_init and bound &dm1105->ir.work with dm1105_emit_key. When it handles IRQ request with dm1105_irq, it may call schedule_work to start the work. When we call dm1105_remove to remove the driver, there may be a sequence as follows: Fix it by finishing the work before cleanup in dm1105_remove CPU0 CPU1 |dm1105_emit_key dm1105_remove | dm1105_ir_exit | rc_unregister_device | rc_free_device | rc_dev_release | kfree(dev); | | | rc_keydown | //use Fixes: 34d2f9bf189c ("V4L/DVB: dm1105: use dm1105_dev & dev instead of dm1105dvb") Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> Reviewed-by: Xu Kuohai <xukuohai(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/media/pci/dm1105/dm1105.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/pci/dm1105/dm1105.c b/drivers/media/pci/dm1105/dm1105.c index 1ddb0576fb7b..dc3fc69e4480 100644 --- a/drivers/media/pci/dm1105/dm1105.c +++ b/drivers/media/pci/dm1105/dm1105.c @@ -1188,6 +1188,7 @@ static void dm1105_remove(struct pci_dev *pdev) struct dvb_demux *dvbdemux = &dev->demux; struct dmx_demux *dmx = &dvbdemux->dmx; + cancel_work_sync(&dev->ir.work); dm1105_ir_exit(dev); dmx->close(dmx); dvb_net_release(&dev->dvbnet); -- 2.25.1

1 0

[PATCH v3 OLK-5.10 0/8] Per-memcg swap control
by Liu Shixin 25 Jun '23

25 Jun '23

This series patches add swap control for memory cgroup. Patch[2] add page type in memory.reclaim interface to support reclaim anon pages. Patch[4] add memory.force_swapin interface to support swap back pages proactively. Patch[5] add memory.swap.max interface to limit usage of swap for memory cgroup. Patch[6-7] add memory.swapfile interface to limit available swap device for memory cgroup. v2->v3: Enable memcg swap qos for x86_64 and arm64 by default. v1->v2: Rebase on the latest version and fix merge conflicts. Liu Shixin (7): memcg: add page type to memory.reclaim interface memcg: introduce memcg swap qos feature memcg: introduce per-memcg swapin interface memcg: add restrict to swap to cgroup1 mm/swapfile: introduce per-memcg swapfile control mm: swap_slots: add per-type slot cache config: enable memcg swap qos for x86_64 and arm64 by default Yosry Ahmed (1): mm: vmpressure: don't count proactive reclaim in vmpressure .../admin-guide/cgroup-v1/memory.rst | 3 + Documentation/admin-guide/cgroup-v2.rst | 16 +- arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/linux/memcontrol.h | 31 ++ include/linux/mm.h | 1 + include/linux/swap.h | 17 +- include/linux/swap_slots.h | 2 +- mm/Kconfig | 9 + mm/madvise.c | 19 + mm/memcontrol.c | 425 +++++++++++++++++- mm/swap_slots.c | 151 ++++++- mm/swapfile.c | 102 ++++- mm/vmscan.c | 36 +- 14 files changed, 769 insertions(+), 45 deletions(-) -- 2.25.1

2 9

[PATCH openEuler-1.0-LTS] sched: Fix memory leak for smart grid
by Zhang Changzhong 25 Jun '23

25 Jun '23

From: Hui Tang <tanghui20(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7FBJM CVE: NA ---------------------------------------- Free ad->domains_orig[] in 'free_affinity_domains', otherwise the memory will leak. Fixes: 713cfd2684fa ("sched: Introduce smart grid scheduling strategy for cfs") Signed-off-by: Hui Tang <tanghui20(a)huawei.com> Reviewed-by: Zhang Qiao <zhangqiao22(a)huawei.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- kernel/sched/fair.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 2115d79..2e6a37d 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -5584,7 +5584,9 @@ void free_affinity_domains(struct affinity_domain *ad) for (i = 0; i < ad->dcount; i++) { kfree(ad->domains[i]); + kfree(ad->domains_orig[i]); ad->domains[i] = NULL; + ad->domains_orig[i] = NULL; } ad->dcount = 0; } @@ -5605,7 +5607,7 @@ static int init_affinity_domains_orig(struct affinity_domain *ad) err: for (j = 0; j < i; j++) { kfree(ad->domains_orig[j]); - ad->domains_orig[i] = NULL; + ad->domains_orig[j] = NULL; } return -ENOMEM; } @@ -5671,7 +5673,7 @@ int init_auto_affinity(struct task_group *tg) struct auto_affinity *auto_affi; int ret; - auto_affi = kmalloc(sizeof(*auto_affi), GFP_KERNEL); + auto_affi = kzalloc(sizeof(*auto_affi), GFP_KERNEL); if (!auto_affi) return -ENOMEM; -- 2.9.5

1 0

[PATCH openEuler-1.0-LTS] sched: Delete redundant updates to p->prefer_cpus
by Zhang Changzhong 25 Jun '23

25 Jun '23

From: Hui Tang <tanghui20(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7F7KV CVE: NA ------------------------------- Delete redundant updates to p->prefer_cpus when smart grid used. Add missed check for p->prefer_cpus when !CONFIG_QOS_SCHED_SMART_GRID. Fixes: 21e5d85e205f ("sched: Fix possible deadlock in tg_set_dynamic_affinity_mode") Signed-off-by: Hui Tang <tanghui20(a)huawei.com> Reviewed-by: Zhang Qiao <zhangqiao22(a)huawei.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- kernel/sched/core.c | 11 ----------- kernel/sched/fair.c | 8 ++++++-- 2 files changed, 6 insertions(+), 13 deletions(-) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index c7016a4..67bda87 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -6534,9 +6534,6 @@ void sched_move_task(struct task_struct *tsk) DEQUEUE_SAVE | DEQUEUE_MOVE | DEQUEUE_NOCLOCK; struct rq_flags rf; struct rq *rq; -#ifdef CONFIG_QOS_SCHED_SMART_GRID - struct affinity_domain *ad; -#endif rq = task_rq_lock(tsk, &rf); update_rq_clock(rq); @@ -6557,14 +6554,6 @@ void sched_move_task(struct task_struct *tsk) set_curr_task(rq, tsk); task_rq_unlock(rq, tsk, &rf); - -#ifdef CONFIG_QOS_SCHED_SMART_GRID - if (smart_grid_used()) { - ad = &task_group(tsk)->auto_affinity->ad; - set_prefer_cpus_ptr(tsk, ad->domains[ad->curr_level]); - } -#endif - } static inline struct task_group *css_tg(struct cgroup_subsys_state *css) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 2115d79..a7401df 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -5714,17 +5714,21 @@ static void destroy_auto_affinity(struct task_group *tg) static void destroy_auto_affinity(struct task_group *tg) {} #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY +static inline bool prefer_cpus_valid(struct task_struct *p); + static inline struct cpumask *task_prefer_cpus(struct task_struct *p) { return p->prefer_cpus; } -#endif static inline int dynamic_affinity_mode(struct task_struct *p) { + if (!prefer_cpus_valid(p)) + return -1; + return 0; } - +#endif #endif /************************************************** -- 2.9.5

1 0

[PATCH OLK-5.10 0/1] x86/fpu: KABI_BROKEN_REMOVE "union fpregs_state
by Zheng Zengkai 25 Jun '23

25 Jun '23

5a2451f10550 ("x86/fpu: Avoid kabi change caused by struct fpu") will lead to performance degradation of libmicro pthread_create testcase. Assuming that no 3rd party driver will reach into struct fpu, replace kabi fix macro from KABI_DEPRECATE to KABI_BROKEN_REMOVE for element "union fpregs_state state" of struct fpu. Zheng Zengkai (1): x86/fpu: KABI_BROKEN_REMOVE "union fpregs_state state" from struct fpu arch/x86/include/asm/fpu/types.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) -- 2.20.1

2 2

[PATCH OLK-5.10 0/7] Per-memcg swap control
by Liu Shixin 25 Jun '23

25 Jun '23

This series patches add swap control for memory cgroup. Patch[2] add page type in memory.reclaim interface to support reclaim anon pages. Patch[4] add memory.force_swapin interface to support swap back pages proactively. Patch[5] add memory.swap.max interface to limit usage of swap for memory cgroup. Patch[6-7] add memory.swapfile interface to limit available swap device for memory cgroup. Liu Shixin (6): memcg: add page type to memory.reclaim interface memcg: introduce memcg swap qos feature memcg: introduce per-memcg swapin interface memcg: add restrict to swap to cgroup1 mm/swapfile: introduce per-memcg swapfile control mm: swap_slots: add per-type slot cache Yosry Ahmed (1): mm: vmpressure: don't count proactive reclaim in vmpressure .../admin-guide/cgroup-v1/memory.rst | 3 + Documentation/admin-guide/cgroup-v2.rst | 16 +- include/linux/memcontrol.h | 31 ++ include/linux/mm.h | 1 + include/linux/swap.h | 17 +- include/linux/swap_slots.h | 2 +- mm/Kconfig | 9 + mm/madvise.c | 19 + mm/memcontrol.c | 425 +++++++++++++++++- mm/swap_slots.c | 151 ++++++- mm/swapfile.c | 102 ++++- mm/vmscan.c | 36 +- 12 files changed, 767 insertions(+), 45 deletions(-) -- 2.25.1

1 7

[PATCH v2 OLK-5.10 0/7] Per-memcg swap control
by Liu Shixin 25 Jun '23

25 Jun '23

This series patches add swap control for memory cgroup. Patch[2] add page type in memory.reclaim interface to support reclaim anon pages. Patch[4] add memory.force_swapin interface to support swap back pages proactively. Patch[5] add memory.swap.max interface to limit usage of swap for memory cgroup. Patch[6-7] add memory.swapfile interface to limit available swap device for memory cgroup. v1->v2: Rebase on the latest version and fix merge conflicts. Liu Shixin (6): memcg: add page type to memory.reclaim interface memcg: introduce memcg swap qos feature memcg: introduce per-memcg swapin interface memcg: add restrict to swap to cgroup1 mm/swapfile: introduce per-memcg swapfile control mm: swap_slots: add per-type slot cache Yosry Ahmed (1): mm: vmpressure: don't count proactive reclaim in vmpressure .../admin-guide/cgroup-v1/memory.rst | 3 + Documentation/admin-guide/cgroup-v2.rst | 16 +- include/linux/memcontrol.h | 31 ++ include/linux/mm.h | 1 + include/linux/swap.h | 17 +- include/linux/swap_slots.h | 2 +- mm/Kconfig | 9 + mm/madvise.c | 19 + mm/memcontrol.c | 425 +++++++++++++++++- mm/swap_slots.c | 151 ++++++- mm/swapfile.c | 102 ++++- mm/vmscan.c | 36 +- 12 files changed, 767 insertions(+), 45 deletions(-) -- 2.25.1

2 8

[PATCH OLK-5.10] media: rkvdec: fix use after free bug in rkvdec_remove
by Zhang Xiaoxu 25 Jun '23

25 Jun '23

From: Zheng Wang <zyytlz.wz(a)163.com> stable inclusion from stable-v5.10.180 commit de19d02d734ef29f5dbd2c12fe810fa960ecd83f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7EDZ3 CVE: CVE-2023-35829 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3228cec23b8b29215e18090c6ba635840190993d ] In rkvdec_probe, rkvdec->watchdog_work is bound with rkvdec_watchdog_func. Then rkvdec_vp9_run may be called to start the work. If we remove the module which will call rkvdec_remove to make cleanup, there may be a unfinished work. The possible sequence is as follows, which will cause a typical UAF bug. Fix it by canceling the work before cleanup in rkvdec_remove. CPU0 CPU1 |rkvdec_watchdog_func rkvdec_remove | rkvdec_v4l2_cleanup| v4l2_m2m_release | kfree(m2m_dev); | | | v4l2_m2m_get_curr_priv | m2m_dev->curr_ctx //use Fixes: cd33c830448b ("media: rkvdec: Add the rkvdec driver") Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> --- drivers/staging/media/rkvdec/rkvdec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/staging/media/rkvdec/rkvdec.c b/drivers/staging/media/rkvdec/rkvdec.c index e384ea8d7280..f6a29a707862 100644 --- a/drivers/staging/media/rkvdec/rkvdec.c +++ b/drivers/staging/media/rkvdec/rkvdec.c @@ -1077,6 +1077,8 @@ static int rkvdec_remove(struct platform_device *pdev) { struct rkvdec_dev *rkvdec = platform_get_drvdata(pdev); + cancel_delayed_work_sync(&rkvdec->watchdog_work); + rkvdec_v4l2_cleanup(rkvdec); pm_runtime_disable(&pdev->dev); pm_runtime_dont_use_autosuspend(&pdev->dev); -- 2.31.1

2 1

2024

2023

2022

2021

2020

2019

Kernel