- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] NTB: fix possible name leak in ntb_register_device()
by Zeng Heng 11 May '24

11 May '24

From: Yang Yingliang <yangyingliang(a)huawei.com> mainline inclusion from mainline-v6.9-rc1 commit aebfdfe39b9327a3077d0df8db3beb3160c9bdd0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9IV CVE: CVE-2023-52652 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- If device_register() fails in ntb_register_device(), the device name allocated by dev_set_name() should be freed. As per the comment in device_register(), callers should use put_device() to give up the reference in the error path. So fix this by calling put_device() in the error path so that the name can be freed in kobject_cleanup(). As a result of this, put_device() in the error path of ntb_register_device() is removed and the actual error is returned. Fixes: a1bd3baeb2f1 ("NTB: Add NTB hardware abstraction layer") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Link: https://lore.kernel.org/r/20231201033057.1399131-1-yangyingliang@huaweiclou… [mani: reworded commit message] Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Conflicts: drivers/pci/endpoint/functions/pci-epf-vntb.c [The version does not include the pci-epf-vntb.c source file.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/ntb/core.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/ntb/core.c b/drivers/ntb/core.c index f8f75a504a58..c423c91a617e 100644 --- a/drivers/ntb/core.c +++ b/drivers/ntb/core.c @@ -100,6 +100,8 @@ EXPORT_SYMBOL(ntb_unregister_client); int ntb_register_device(struct ntb_dev *ntb) { + int ret; + if (!ntb) return -EINVAL; if (!ntb->pdev) @@ -120,7 +122,11 @@ int ntb_register_device(struct ntb_dev *ntb) ntb->ctx_ops = NULL; spin_lock_init(&ntb->ctx_lock); - return device_register(&ntb->dev); + ret = device_register(&ntb->dev); + if (ret) + put_device(&ntb->dev); + + return ret; } EXPORT_SYMBOL(ntb_register_device); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] NTB: fix possible name leak in ntb_register_device()
by Zeng Heng 11 May '24

11 May '24

From: Yang Yingliang <yangyingliang(a)huawei.com> mainline inclusion from mainline-v6.9-rc1 commit aebfdfe39b9327a3077d0df8db3beb3160c9bdd0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9IV CVE: CVE-2023-52652 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- If device_register() fails in ntb_register_device(), the device name allocated by dev_set_name() should be freed. As per the comment in device_register(), callers should use put_device() to give up the reference in the error path. So fix this by calling put_device() in the error path so that the name can be freed in kobject_cleanup(). As a result of this, put_device() in the error path of ntb_register_device() is removed and the actual error is returned. Fixes: a1bd3baeb2f1 ("NTB: Add NTB hardware abstraction layer") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Link: https://lore.kernel.org/r/20231201033057.1399131-1-yangyingliang@huaweiclou… [mani: reworded commit message] Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Conflicts: drivers/pci/endpoint/functions/pci-epf-vntb.c [The version does not include the pci-epf-vntb.c source file.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/ntb/ntb.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/ntb/ntb.c b/drivers/ntb/ntb.c index 2581ab724c34..3305a2fbea4e 100644 --- a/drivers/ntb/ntb.c +++ b/drivers/ntb/ntb.c @@ -100,6 +100,8 @@ EXPORT_SYMBOL(ntb_unregister_client); int ntb_register_device(struct ntb_dev *ntb) { + int ret; + if (!ntb) return -EINVAL; if (!ntb->pdev) @@ -120,7 +122,11 @@ int ntb_register_device(struct ntb_dev *ntb) ntb->ctx_ops = NULL; spin_lock_init(&ntb->ctx_lock); - return device_register(&ntb->dev); + ret = device_register(&ntb->dev); + if (ret) + put_device(&ntb->dev); + + return ret; } EXPORT_SYMBOL(ntb_register_device); -- 2.25.1

2 1

[rdma-core v3] libhns: Fix missing flag when creating qp by hnsdv_create_qp()
by Chengchang Tang 11 May '24

11 May '24

From: Juan Zhou <zhoujuan51(a)h-partners.com> driver inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/rdma-core/issues/I9NZME -------------------------------------------------------------------------- This flag will be used when the DCA mode is enabled. Without this flag, the QP fails to be created in DCA mode. Fixes: c7bf0dbf472d ("libhns: Introduce DCA for RC QP") Signed-off-by: Juan Zhou <zhoujuan51(a)h-partners.com> --- providers/hns/hns_roce_u_verbs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/providers/hns/hns_roce_u_verbs.c b/providers/hns/hns_roce_u_verbs.c index a680339..e30880c 100644 --- a/providers/hns/hns_roce_u_verbs.c +++ b/providers/hns/hns_roce_u_verbs.c @@ -1049,7 +1049,8 @@ int hns_roce_u_destroy_srq(struct ibv_srq *ibv_srq) } enum { - HNSDV_QP_SUP_COMP_MASK = HNSDV_QP_INIT_ATTR_MASK_QP_CONGEST_TYPE, + HNSDV_QP_SUP_COMP_MASK = HNSDV_QP_INIT_ATTR_MASK_QP_CREATE_FLAGS | + HNSDV_QP_INIT_ATTR_MASK_QP_CONGEST_TYPE, }; static int check_hnsdv_qp_attr(struct hns_roce_context *ctx, -- 2.33.0

1 0

[PATCH OLK-6.6 00/14] Backport some memory policy feature and bugfix in mm from mainline
by Ze Zuo 11 May '24

11 May '24

Backport feature(mm/mempolicy: weighted interleave mempolicy and sysfs extension) and some mempolicy bugfix and cleanup. Gregory Price (3): mm/mempolicy: refactor a read-once mechanism into a function for re-use mm/mempolicy: introduce MPOL_WEIGHTED_INTERLEAVE for weighted interleaving mm/mempolicy: protect task interleave functions with tsk->mems_allowed_seq Hugh Dickins (10): mempolicy: fix migrate_pages(2) syscall return nr_failed mempolicy trivia: delete those ancient pr_debug()s mempolicy trivia: slightly more consistent naming mempolicy trivia: use pgoff_t in shared mempolicy tree mempolicy: mpol_shared_policy_init() without pseudo-vma mempolicy: remove confusing MPOL_MF_LAZY dead code kernfs: drop shared NUMA mempolicy hooks mempolicy: alloc_pages_mpol() for NUMA policy without vma mempolicy: mmap_lock is not needed while migrating folios mempolicy: migration attempt to match interleave nodes Rakie Kim (1): mm/mempolicy: implement the sysfs-based weighted_interleave interface .../ABI/testing/sysfs-kernel-mm-mempolicy | 4 + ...fs-kernel-mm-mempolicy-weighted-interleave | 25 + .../admin-guide/mm/numa_memory_policy.rst | 9 + fs/kernfs/file.c | 49 - fs/proc/task_mmu.c | 5 +- include/linux/gfp.h | 10 +- include/linux/hugetlb.h | 9 - include/linux/mempolicy.h | 51 +- include/linux/mm.h | 2 +- include/linux/sched.h | 1 + include/uapi/linux/mempolicy.h | 3 +- ipc/shm.c | 21 +- mm/hugetlb.c | 38 +- mm/mempolicy.c | 1449 +++++++++++------ mm/shmem.c | 95 +- mm/swap.h | 9 +- mm/swap_state.c | 86 +- mm/zswap.c | 7 +- 18 files changed, 1137 insertions(+), 736 deletions(-) create mode 100644 Documentation/ABI/testing/sysfs-kernel-mm-mempolicy create mode 100644 Documentation/ABI/testing/sysfs-kernel-mm-mempolicy-weighted-interleave -- 2.25.1

2 15

[PATCH openEuler-1.0-LTS] s390/dasd: fix double module refcount decrement
by Chen Zhongjin 11 May '24

11 May '24

From: Miroslav Franc <mfranc(a)suse.cz> mainline inclusion from mainline-v6.9-rc1 commit c3116e62ddeff79cae342147753ce596f01fcf06 category: bugfix bugzilla: 189916 CVE: CVE-2024-27054 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Once the discipline is associated with the device, deleting the device takes care of decrementing the module's refcount. Doing it manually on this error path causes refcount to artificially decrease on each error while it should just stay the same. Fixes: c020d722b110 ("s390/dasd: fix panic during offline processing") Signed-off-by: Miroslav Franc <mfranc(a)suse.cz> Signed-off-by: Jan Höppner <hoeppner(a)linux.ibm.com> Signed-off-by: Stefan Haberland <sth(a)linux.ibm.com> Link: https://lore.kernel.org/r/20240209124522.3697827-3-sth@linux.ibm.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: drivers/s390/block/dasd.c [fix context conflicts] Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/s390/block/dasd.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c index a23e7d394a0ad..433651225fca6 100644 --- a/drivers/s390/block/dasd.c +++ b/drivers/s390/block/dasd.c @@ -3501,12 +3501,11 @@ int dasd_generic_set_online(struct ccw_device *cdev, dasd_delete_device(device); return -EINVAL; } + device->base_discipline = base_discipline; if (!try_module_get(discipline->owner)) { - module_put(base_discipline->owner); dasd_delete_device(device); return -EINVAL; } - device->base_discipline = base_discipline; device->discipline = discipline; /* check_device will allocate block device if necessary */ @@ -3514,8 +3513,6 @@ int dasd_generic_set_online(struct ccw_device *cdev, if (rc) { pr_warn("%s Setting the DASD online with discipline %s failed with rc=%i\n", dev_name(&cdev->dev), discipline->name, rc); - module_put(discipline->owner); - module_put(base_discipline->owner); dasd_delete_device(device); return rc; } -- 2.25.1

2 1

[PATCH OLK-6.6 v3] md: do not delete safemode_timer in mddev_suspend
by Li Nan 11 May '24

11 May '24

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9JMCR Reference: https://lore.kernel.org/all/20240508092053.1447930-1-linan666@huaweicloud.c… -------------------------------- The deletion of safemode_timer in mddev_suspend() is redundant and potentially harmful now. If timer is about to be woken up but gets deleted, 'in_sync' will remain 0 until the next write, causing array to stay in the 'active' state instead of transitioning to 'clean'. Commit 0d9f4f135eb6 ("MD: Add del_timer_sync to mddev_suspend (fix nasty panic))" introduced this deletion for dm, because if timer fired after dm is destroyed, the resource which the timer depends on might have been freed. However, commit 0dd84b319352 ("md: call __md_stop_writes in md_stop") added __md_stop_writes() to md_stop(), which is called before freeing resource. Timer is deleted in __md_stop_writes(), and the origin issue is resolved. Therefore, delete safemode_timer can be removed safely now. Fixes: 0dd84b319352 ("md: call __md_stop_writes in md_stop") Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/md/md.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 80cb0120394f..dee49543c2ca 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -490,7 +490,6 @@ int mddev_suspend(struct mddev *mddev, bool interruptible) */ WRITE_ONCE(mddev->suspended, mddev->suspended + 1); - del_timer_sync(&mddev->safemode_timer); /* restrict memory reclaim I/O during raid array is suspend */ mddev->noio_flag = memalloc_noio_save(); -- 2.39.2

2 1

[PATCH v2 OLK-6.6 0/3] mm: mglru: reuse some legacy trace
by Zhao Mengmeng 11 May '24

11 May '24

From: Zhao Mengmeng <zhaomengmeng(a)kylinos.cn> Backport upstream mglru patch to reuse some trace events, along with trace-vmscan-postprocess parsing and output fixes. Jaewon Kim (1): mm: multi-gen LRU: reuse some legacy trace events Vlastimil Babka (2): trace-vmscan-postprocess: sync with tracepoints updates mm, vmscan: remove ISOLATE_UNMAPPED .../postprocess/trace-vmscan-postprocess.pl | 42 ++++++++----------- include/linux/mmzone.h | 2 - include/trace/events/vmscan.h | 8 +--- mm/vmscan.c | 21 ++++++---- 4 files changed, 34 insertions(+), 39 deletions(-) -- 2.33.0

3 9

[PATCH OLK-6.6 v2] md: do not delete safemode_timer in mddev_suspend
by Li Nan 11 May '24

11 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9JMCR -------------------------------- The deletion of safemode_timer in mddev_suspend() is redundant and potentially harmful now. If timer is about to be woken up but gets deleted, 'in_sync' will remain 0 until the next write, causing array to stay in the 'active' state instead of transitioning to 'clean'. Commit 0d9f4f135eb6 ("MD: Add del_timer_sync to mddev_suspend (fix nasty panic))" introduced this deletion for dm, because if timer fired after dm is destroyed, the resource which the timer depends on might have been freed. However, commit 0dd84b319352 ("md: call __md_stop_writes in md_stop") added __md_stop_writes() to md_stop(), which is called before freeing resource. Timer is deleted in __md_stop_writes(), and the origin issue is resolved. Therefore, delete safemode_timer can be removed safely now. Fixes: 0dd84b319352 ("md: call __md_stop_writes in md_stop") Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/md/md.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 80cb0120394f..dee49543c2ca 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -490,7 +490,6 @@ int mddev_suspend(struct mddev *mddev, bool interruptible) */ WRITE_ONCE(mddev->suspended, mddev->suspended + 1); - del_timer_sync(&mddev->safemode_timer); /* restrict memory reclaim I/O during raid array is suspend */ mddev->noio_flag = memalloc_noio_save(); -- 2.39.2

2 1

[PATCH v3 OLK-6.6 0/3] mm: mglru: reuse some legacy trace
by Zhao Mengmeng 11 May '24

11 May '24

Backport upstream mglru patch to reuse some trace events, along with trace-vmscan-postprocess parsing and output fixes. Jaewon Kim (1): mm: multi-gen LRU: reuse some legacy trace events Vlastimil Babka (2): trace-vmscan-postprocess: sync with tracepoints updates mm, vmscan: remove ISOLATE_UNMAPPED .../postprocess/trace-vmscan-postprocess.pl | 42 ++++++++----------- include/linux/mmzone.h | 2 - include/trace/events/vmscan.h | 8 +--- mm/vmscan.c | 21 ++++++---- 4 files changed, 34 insertions(+), 39 deletions(-) -- 2.33.0

2 4

[openeuler:OLK-6.6 7640/9508] kernel/livepatch/core.c:216:13: warning: no previous prototype for 'arch_klp_skip_resolve'
by kernel test robot 11 May '24

11 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 0238904492b29dfc7715e7783eff8011b916ddac commit: b8f3220637be1736c165c289c634f27841ac4e01 [7640/9508] livepatch: add arch hook before doing klp_resolve_symbols config: x86_64-randconfig-013-20240511 (https://download.01.org/0day-ci/archive/20240511/202405111327.wFY69R0L-lkp@…) compiler: gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240511/202405111327.wFY69R0L-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405111327.wFY69R0L-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/livepatch/core.c:97:12: warning: no previous prototype for 'arch_klp_init_func' [-Wmissing-prototypes] 97 | int __weak arch_klp_init_func(struct klp_object *obj, struct klp_func *func) | ^~~~~~~~~~~~~~~~~~ >> kernel/livepatch/core.c:216:13: warning: no previous prototype for 'arch_klp_skip_resolve' [-Wmissing-prototypes] 216 | bool __weak arch_klp_skip_resolve(unsigned int type) | ^~~~~~~~~~~~~~~~~~~~~ kernel/livepatch/core.c:1767:12: warning: no previous prototype for 'arch_klp_check_activeness_func' [-Wmissing-prototypes] 1767 | int __weak arch_klp_check_activeness_func(struct klp_func *func, int enable, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/livepatch/core.c:2022:14: warning: no previous prototype for 'arch_klp_mem_alloc' [-Wmissing-prototypes] 2022 | void __weak *arch_klp_mem_alloc(size_t size) | ^~~~~~~~~~~~~~~~~~ kernel/livepatch/core.c:2027:13: warning: no previous prototype for 'arch_klp_mem_free' [-Wmissing-prototypes] 2027 | void __weak arch_klp_mem_free(void *mem) | ^~~~~~~~~~~~~~~~~ kernel/livepatch/core.c:2063:13: warning: no previous prototype for 'arch_klp_set_brk_func' [-Wmissing-prototypes] 2063 | void __weak arch_klp_set_brk_func(struct klp_func_node *func_node, void *new_func) | ^~~~~~~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for DRM_I915_DEBUG_GEM Depends on [n]: HAS_IOMEM [=y] && DRM_I915 [=m] && EXPERT [=y] && DRM_I915_WERROR [=n] Selected by [m]: - DRM_I915_DEBUG [=y] && HAS_IOMEM [=y] && DRM_I915 [=m] && EXPERT [=y] && !COMPILE_TEST [=n] vim +/arch_klp_skip_resolve +216 kernel/livepatch/core.c 96 > 97 int __weak arch_klp_init_func(struct klp_object *obj, struct klp_func *func) 98 { 99 return 0; 100 } 101 #endif /* CONFIG_LIVEPATCH_FTRACE */ 102 103 static bool klp_initialized(void) 104 { 105 return !!klp_root_kobj; 106 } 107 108 #ifdef CONFIG_LIVEPATCH_FTRACE 109 static struct klp_func *klp_find_func(struct klp_object *obj, 110 struct klp_func *old_func) 111 { 112 struct klp_func *func; 113 114 klp_for_each_func(obj, func) { 115 if ((strcmp(old_func->old_name, func->old_name) == 0) && 116 (old_func->old_sympos == func->old_sympos)) { 117 return func; 118 } 119 } 120 121 return NULL; 122 } 123 124 static struct klp_object *klp_find_object(struct klp_patch *patch, 125 struct klp_object *old_obj) 126 { 127 struct klp_object *obj; 128 129 klp_for_each_object(patch, obj) { 130 if (klp_is_module(old_obj)) { 131 if (klp_is_module(obj) && 132 strcmp(old_obj->name, obj->name) == 0) { 133 return obj; 134 } 135 } else if (!klp_is_module(obj)) { 136 return obj; 137 } 138 } 139 140 return NULL; 141 } 142 #endif /* CONFIG_LIVEPATCH_FTRACE */ 143 144 struct klp_find_arg { 145 const char *name; 146 unsigned long addr; 147 unsigned long count; 148 unsigned long pos; 149 }; 150 151 static int klp_match_callback(void *data, unsigned long addr) 152 { 153 struct klp_find_arg *args = data; 154 155 args->addr = addr; 156 args->count++; 157 158 /* 159 * Finish the search when the symbol is found for the desired position 160 * or the position is not defined for a non-unique symbol. 161 */ 162 if ((args->pos && (args->count == args->pos)) || 163 (!args->pos && (args->count > 1))) 164 return 1; 165 166 return 0; 167 } 168 169 static int klp_find_callback(void *data, const char *name, unsigned long addr) 170 { 171 struct klp_find_arg *args = data; 172 173 if (strcmp(args->name, name)) 174 return 0; 175 176 return klp_match_callback(data, addr); 177 } 178 179 static int klp_find_object_symbol(const char *objname, const char *name, 180 unsigned long sympos, unsigned long *addr) 181 { 182 struct klp_find_arg args = { 183 .name = name, 184 .addr = 0, 185 .count = 0, 186 .pos = sympos, 187 }; 188 189 if (objname) 190 module_kallsyms_on_each_symbol(objname, klp_find_callback, &args); 191 else 192 kallsyms_on_each_match_symbol(klp_match_callback, name, &args); 193 194 /* 195 * Ensure an address was found. If sympos is 0, ensure symbol is unique; 196 * otherwise ensure the symbol position count matches sympos. 197 */ 198 if (args.addr == 0) 199 pr_err("symbol '%s' not found in symbol table\n", name); 200 else if (args.count > 1 && sympos == 0) { 201 pr_err("unresolvable ambiguity for symbol '%s' in object '%s'\n", 202 name, objname); 203 } else if (sympos != args.count && sympos > 0) { 204 pr_err("symbol position %lu for symbol '%s' in object '%s' not found\n", 205 sympos, name, objname ? objname : "vmlinux"); 206 } else { 207 *addr = args.addr; 208 return 0; 209 } 210 211 *addr = 0; 212 return -EINVAL; 213 } 214 215 #ifdef CONFIG_LIVEPATCH_WO_FTRACE > 216 bool __weak arch_klp_skip_resolve(unsigned int type) 217 { 218 return false; 219 } 220 #endif 221 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0