- Kernel - mailweb.openeuler.org

[PATCH kernel-4.19] sharepool: Fix ASLR broken
by Yang Yingliang 20 Oct '21

20 Oct '21

From: Wang Wensheng <wangwensheng4(a)huawei.com> ascend inclusion category: bugfix bugzilla: NA CVE: NA --------------------------- To avoid mmap vspace reserved for sharepool, we currently change the high_limit to MMAP_SHARE_POOL_START in arch_get_unmapped_area() and arch_get_unmapped_area_topdown(). In mmap-topdown scene, this make the start address of mmap being always MMAP_SHARE_POOL_START. ASLR got broken. To fix this, this patch set the mm->mmap_base based on MMAP_SHARE_POOL_START instead of STACK_TOP in topdown scene. Fixes: 4bdd5c21793e ("ascend: memory: introduce do_mm_populate and hugetlb_insert_hugepage") Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Reviewed-by: Ding Tianhong <dingtianhong(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/arm64/mm/mmap.c | 6 +++++- include/linux/share_pool.h | 4 ++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/arch/arm64/mm/mmap.c b/arch/arm64/mm/mmap.c index 157f2caa13516..aca257158611f 100644 --- a/arch/arm64/mm/mmap.c +++ b/arch/arm64/mm/mmap.c @@ -28,6 +28,7 @@ #include <linux/io.h> #include <linux/personality.h> #include <linux/random.h> +#include <linux/share_pool.h> #include <asm/cputype.h> @@ -80,7 +81,10 @@ static unsigned long mmap_base(unsigned long rnd, struct rlimit *rlim_stack) else if (gap > MAX_GAP) gap = MAX_GAP; - return PAGE_ALIGN(STACK_TOP - gap - rnd); + if (sp_is_enabled()) + return ALIGN_DOWN(MMAP_SHARE_POOL_START - rnd, PAGE_SIZE); + else + return PAGE_ALIGN(STACK_TOP - gap - rnd); } /* diff --git a/include/linux/share_pool.h b/include/linux/share_pool.h index 9650f257b3ad7..9557a8be46677 100644 --- a/include/linux/share_pool.h +++ b/include/linux/share_pool.h @@ -130,8 +130,6 @@ struct sp_proc_stat { atomic64_t k2u_size; }; -#ifdef CONFIG_ASCEND_SHARE_POOL - #define MAP_SHARE_POOL 0x100000 #define MMAP_TOP_4G_SIZE 0x100000000UL @@ -148,6 +146,8 @@ struct sp_proc_stat { #define MMAP_SHARE_POOL_START (MMAP_SHARE_POOL_END - MMAP_SHARE_POOL_SIZE) #define MMAP_SHARE_POOL_16G_START (MMAP_SHARE_POOL_END - MMAP_SHARE_POOL_DVPP_SIZE) +#ifdef CONFIG_ASCEND_SHARE_POOL + static inline void sp_init_mm(struct mm_struct *mm) { mm->sp_group = NULL; -- 2.25.1

1 0

[PATCH kernel-4.19] numa/cdm: Introduce a hbm_per_part variable
by Yang Yingliang 20 Oct '21

20 Oct '21

From: Wang Wensheng <wangwensheng4(a)huawei.com> ascend inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4D63I CVE: NA ------------------------------------------------- Not all cdm nodes are hbm and we don't need to operate on the other nodes. So we should specify the hbm count per partion. Here we assume that all the hbm nodes appear at first of all the cdm nodes in one partion. Otherwise the management structure of the hbm nodes could not be moved, which is not worse than closing this feature. Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/arm64/mm/numa.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/arch/arm64/mm/numa.c b/arch/arm64/mm/numa.c index 82d53927554d8..c65a71de8d5fb 100644 --- a/arch/arm64/mm/numa.c +++ b/arch/arm64/mm/numa.c @@ -63,7 +63,9 @@ inline int arch_check_node_cdm(int nid) * |node2 HBM| | |node4 HBM| * |---------- | ----------| * |node3 HBM| | |node5 HBM| - * ----------- | ----------- + * |---------- | ----------| + * | ... | | | ... | + * |---------- | ----------| * * Return: * This function returns a ddr node which is of the same partion with the input @@ -76,6 +78,12 @@ int __init cdm_node_to_ddr_node(int nid) nodemask_t ddr_mask; int nr_ddr, cdm_per_part, fake_nid; int nr_cdm = nodes_weight(cdmmask); + /* + * Specify the count of hbm nodes whoes management structrue would be + * moved. Here number 2 is a magic and we should make it configable + * for extending + */ + int hbm_per_part = 2; if (!nr_cdm || nodes_empty(numa_nodes_parsed)) return nid; @@ -87,11 +95,12 @@ int __init cdm_node_to_ddr_node(int nid) nr_ddr = nodes_weight(ddr_mask); cdm_per_part = nr_cdm / nr_ddr; - if (cdm_per_part == 0 || nid < nr_ddr) + if (cdm_per_part == 0 || nid < nr_ddr || + nid >= (hbm_per_part + 1) * nr_ddr) /* our assumption has borken, just return the original nid. */ return nid; - fake_nid = (nid - nr_ddr) / cdm_per_part; + fake_nid = (nid - nr_ddr) / hbm_per_part; fake_nid = !node_isset(fake_nid, cdmmask) ? fake_nid : nid; pr_info("nid: %d, fake_nid: %d\n", nid, fake_nid); -- 2.25.1

1 0

[PATCH kernel-4.19] uacce: misc fixes
by Yang Yingliang 20 Oct '21

20 Oct '21

From: Yu'an Wang <wangyuan46(a)huawei.com> driver inclusion category: bugfix bugzilla: NA CVE: NA 1.add input para check of uacce_unregister api 2.change uacce_qfrt_str to internal interface, because it is used just in uacce.c Signed-off-by: Yu'an Wang <wangyuan46(a)huawei.com> Reviewed-by: Longfang Liu <liulongfang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/misc/uacce/uacce.c | 6 ++++-- include/linux/uacce.h | 1 - 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/misc/uacce/uacce.c b/drivers/misc/uacce/uacce.c index db7b3936aec6f..b0cdc244e882a 100644 --- a/drivers/misc/uacce/uacce.c +++ b/drivers/misc/uacce/uacce.c @@ -126,11 +126,10 @@ static void uacce_hw_err_destroy(struct uacce *uacce) } } -const char *uacce_qfrt_str(struct uacce_qfile_region *qfr) +static const char *uacce_qfrt_str(struct uacce_qfile_region *qfr) { return qfrt_str[qfr->type]; } -EXPORT_SYMBOL_GPL(uacce_qfrt_str); /** * uacce_wake_up - Wake up the process who is waiting this queue @@ -1302,6 +1301,9 @@ EXPORT_SYMBOL_GPL(uacce_register); */ int uacce_unregister(struct uacce *uacce) { + if (!uacce) + return -ENODEV; + if (atomic_read(&uacce->ref) > 0) { printk_ratelimited("Fail to unregister uacce, please close all uacce queues!\n"); return -EAGAIN; diff --git a/include/linux/uacce.h b/include/linux/uacce.h index 43737c3f7f525..b43b65abdce39 100644 --- a/include/linux/uacce.h +++ b/include/linux/uacce.h @@ -128,7 +128,6 @@ struct uacce { int uacce_register(struct uacce *uacce); int uacce_unregister(struct uacce *uacce); void uacce_wake_up(struct uacce_queue *q); -const char *uacce_qfrt_str(struct uacce_qfile_region *qfr); struct uacce *dev_to_uacce(struct device *dev); int uacce_hw_err_isolate(struct uacce *uacce); -- 2.25.1

1 0

[PATCH kernel-4.19 1/6] mm/page_alloc.c: memory hotplug: free pages as higher order
by Yang Yingliang 20 Oct '21

20 Oct '21

From: Arun KS <arunks(a)codeaurora.org> mainline inclusion from mainline-v5.1-rc1 commit a9cd410a3d296846a8125aa43d97a573a354c472 category: feature bugzilla: 182882 CVE: NA ----------------------------------------------- When freeing pages are done with higher order, time spent on coalescing pages by buddy allocator can be reduced. With section size of 256MB, hot add latency of a single section shows improvement from 50-60 ms to less than 1 ms, hence improving the hot add latency by 60 times. Modify external providers of online callback to align with the change. [arunks(a)codeaurora.org: v11] Link: http://lkml.kernel.org/r/1547792588-18032-1-git-send-email-arunks@codeauror… [akpm(a)linux-foundation.org: remove unused local, per Arun] [akpm(a)linux-foundation.org: avoid return of void-returning __free_pages_core(), per Oscar] [akpm(a)linux-foundation.org: fix it for mm-convert-totalram_pages-and-totalhigh_pages-variables-to-atomic.patch] [arunks(a)codeaurora.org: v8] Link: http://lkml.kernel.org/r/1547032395-24582-1-git-send-email-arunks@codeauror… [arunks(a)codeaurora.org: v9] Link: http://lkml.kernel.org/r/1547098543-26452-1-git-send-email-arunks@codeauror… Link: http://lkml.kernel.org/r/1538727006-5727-1-git-send-email-arunks@codeaurora… Signed-off-by: Arun KS <arunks(a)codeaurora.org> Reviewed-by: Andrew Morton <akpm(a)linux-foundation.org> Acked-by: Michal Hocko <mhocko(a)suse.com> Reviewed-by: Oscar Salvador <osalvador(a)suse.de> Reviewed-by: Alexander Duyck <alexander.h.duyck(a)linux.intel.com> Cc: K. Y. Srinivasan <kys(a)microsoft.com> Cc: Haiyang Zhang <haiyangz(a)microsoft.com> Cc: Stephen Hemminger <sthemmin(a)microsoft.com> Cc: Boris Ostrovsky <boris.ostrovsky(a)oracle.com> Cc: Juergen Gross <jgross(a)suse.com> Cc: Dan Williams <dan.j.williams(a)intel.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Joonsoo Kim <iamjoonsoo.kim(a)lge.com> Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Cc: Mathieu Malaterre <malat(a)debian.org> Cc: "Kirill A. Shutemov" <kirill.shutemov(a)linux.intel.com> Cc: Souptick Joarder <jrdr.linux(a)gmail.com> Cc: Mel Gorman <mgorman(a)techsingularity.net> Cc: Aaron Lu <aaron.lu(a)intel.com> Cc: Srivatsa Vaddagiri <vatsa(a)codeaurora.org> Cc: Vinayak Menon <vinmenon(a)codeaurora.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Conflicts: mm/page_alloc.c mm/memory_hotplug.c [Peng Liu: adjust context] Signed-off-by: Peng Liu <liupeng256(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/hv/hv_balloon.c | 7 ++++--- drivers/xen/balloon.c | 15 ++++++++++----- include/linux/memory_hotplug.h | 2 +- mm/internal.h | 1 + mm/memory_hotplug.c | 33 +++++++++++++++++++++------------ mm/page_alloc.c | 8 ++++---- 6 files changed, 41 insertions(+), 25 deletions(-) diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c index e5fc719a34e70..23d9156915271 100644 --- a/drivers/hv/hv_balloon.c +++ b/drivers/hv/hv_balloon.c @@ -771,7 +771,7 @@ static void hv_mem_hot_add(unsigned long start, unsigned long size, } } -static void hv_online_page(struct page *pg) +static void hv_online_page(struct page *pg, unsigned int order) { struct hv_hotadd_state *has; unsigned long flags; @@ -780,10 +780,11 @@ static void hv_online_page(struct page *pg) spin_lock_irqsave(&dm_device.ha_lock, flags); list_for_each_entry(has, &dm_device.ha_region_list, list) { /* The page belongs to a different HAS. */ - if ((pfn < has->start_pfn) || (pfn >= has->end_pfn)) + if ((pfn < has->start_pfn) || + (pfn + (1UL << order) > has->end_pfn)) continue; - hv_page_online_one(has, pg); + hv_bring_pgs_online(has, pfn, 1UL << order); break; } spin_unlock_irqrestore(&dm_device.ha_lock, flags); diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c index b23edf64c2b21..630fd49a7ce84 100644 --- a/drivers/xen/balloon.c +++ b/drivers/xen/balloon.c @@ -369,14 +369,19 @@ static enum bp_state reserve_additional_memory(void) return BP_ECANCELED; } -static void xen_online_page(struct page *page) +static void xen_online_page(struct page *page, unsigned int order) { - __online_page_set_limits(page); + unsigned long i, size = (1 << order); + unsigned long start_pfn = page_to_pfn(page); + struct page *p; + pr_debug("Online %lu pages starting at pfn 0x%lx\n", size, start_pfn); mutex_lock(&balloon_mutex); - - __balloon_append(page); - + for (i = 0; i < size; i++) { + p = pfn_to_page(start_pfn + i); + __online_page_set_limits(p); + __balloon_append(p); + } mutex_unlock(&balloon_mutex); } diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h index 5653178768227..8782f0e993704 100644 --- a/include/linux/memory_hotplug.h +++ b/include/linux/memory_hotplug.h @@ -89,7 +89,7 @@ extern int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn, unsigned long *valid_start, unsigned long *valid_end); extern void __offline_isolated_pages(unsigned long, unsigned long); -typedef void (*online_page_callback_t)(struct page *page); +typedef void (*online_page_callback_t)(struct page *page, unsigned int order); extern int set_online_page_callback(online_page_callback_t callback); extern int restore_online_page_callback(online_page_callback_t callback); diff --git a/mm/internal.h b/mm/internal.h index 3bb7ca86e84eb..415a6a326bb4d 100644 --- a/mm/internal.h +++ b/mm/internal.h @@ -163,6 +163,7 @@ static inline struct page *pageblock_pfn_to_page(unsigned long start_pfn, extern int __isolate_free_page(struct page *page, unsigned int order); extern void __free_pages_bootmem(struct page *page, unsigned long pfn, unsigned int order); +extern void __free_pages_core(struct page *page, unsigned int order); extern void prep_compound_page(struct page *page, unsigned int order); extern void post_alloc_hook(struct page *page, unsigned int order, gfp_t gfp_flags); diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c index 967adfc17dd26..64a3ec9365911 100644 --- a/mm/memory_hotplug.c +++ b/mm/memory_hotplug.c @@ -48,7 +48,7 @@ * and restore_online_page_callback() for generic callback restore. */ -static void generic_online_page(struct page *page); +static void generic_online_page(struct page *page, unsigned int order); static online_page_callback_t online_page_callback = generic_online_page; static DEFINE_MUTEX(online_page_callback_lock); @@ -580,26 +580,35 @@ void __online_page_free(struct page *page) } EXPORT_SYMBOL_GPL(__online_page_free); -static void generic_online_page(struct page *page) +static void generic_online_page(struct page *page, unsigned int order) { - __online_page_set_limits(page); - __online_page_increment_counters(page); - __online_page_free(page); + __free_pages_core(page, order); + adjust_managed_page_count(page, 1UL << order); +} + +static int online_pages_blocks(unsigned long start, unsigned long nr_pages) +{ + unsigned long end = start + nr_pages; + int order, onlined_pages = 0; + + while (start < end) { + order = min(MAX_ORDER - 1, + get_order(PFN_PHYS(end) - PFN_PHYS(start))); + (*online_page_callback)(pfn_to_page(start), order); + + onlined_pages += (1UL << order); + start += (1UL << order); + } + return onlined_pages; } static int online_pages_range(unsigned long start_pfn, unsigned long nr_pages, void *arg) { - unsigned long i; unsigned long onlined_pages = *(unsigned long *)arg; - struct page *page; if (PageReserved(pfn_to_page(start_pfn))) - for (i = 0; i < nr_pages; i++) { - page = pfn_to_page(start_pfn + i); - (*online_page_callback)(page); - onlined_pages++; - } + onlined_pages += online_pages_blocks(start_pfn, nr_pages); online_mem_sections(start_pfn, start_pfn + nr_pages); diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 12e0899f3b9c8..e0002e5c3d06d 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -1288,7 +1288,7 @@ static void __free_pages_ok(struct page *page, unsigned int order) local_irq_restore(flags); } -static void __init __free_pages_boot_core(struct page *page, unsigned int order) +void __free_pages_core(struct page *page, unsigned int order) { unsigned int nr_pages = 1 << order; struct page *p = page; @@ -1368,7 +1368,7 @@ void __init __free_pages_bootmem(struct page *page, unsigned long pfn, return; page_zone(page)->managed_pages += 1UL << order; - return __free_pages_boot_core(page, order); + return __free_pages_core(page, order); } /* @@ -1459,14 +1459,14 @@ static void __init deferred_free_range(unsigned long pfn, if (nr_pages == pageblock_nr_pages && (pfn & (pageblock_nr_pages - 1)) == 0) { set_pageblock_migratetype(page, MIGRATE_MOVABLE); - __free_pages_boot_core(page, pageblock_order); + __free_pages_core(page, pageblock_order); return; } for (i = 0; i < nr_pages; i++, page++, pfn++) { if ((pfn & (pageblock_nr_pages - 1)) == 0) set_pageblock_migratetype(page, MIGRATE_MOVABLE); - __free_pages_boot_core(page, 0); + __free_pages_core(page, 0); } } -- 2.25.1

1 5

[PATCH kernel-4.19] raid1: ensure write behind bio has less than BIO_MAX_VECS sectors
by Yang Yingliang 20 Oct '21

20 Oct '21

From: Guoqing Jiang <jiangguoqing(a)kylinos.cn> mainline inclusion from mainline-v5.15-rc1 commit 6607cd319b6b91bff94e90f798a61c031650b514 category: bugfix bugzilla: 182883, https://gitee.com/openeuler/kernel/issues/I4ENHY CVE: NA ------------------------------------------------- We can't split write behind bio with more than BIO_MAX_VECS sectors, otherwise the below call trace was triggered because we could allocate oversized write behind bio later. [ 8.097936] bvec_alloc+0x90/0xc0 [ 8.098934] bio_alloc_bioset+0x1b3/0x260 [ 8.099959] raid1_make_request+0x9ce/0xc50 [raid1] [ 8.100988] ? __bio_clone_fast+0xa8/0xe0 [ 8.102008] md_handle_request+0x158/0x1d0 [md_mod] [ 8.103050] md_submit_bio+0xcd/0x110 [md_mod] [ 8.104084] submit_bio_noacct+0x139/0x530 [ 8.105127] submit_bio+0x78/0x1d0 [ 8.106163] ext4_io_submit+0x48/0x60 [ext4] [ 8.107242] ext4_writepages+0x652/0x1170 [ext4] [ 8.108300] ? do_writepages+0x41/0x100 [ 8.109338] ? __ext4_mark_inode_dirty+0x240/0x240 [ext4] [ 8.110406] do_writepages+0x41/0x100 [ 8.111450] __filemap_fdatawrite_range+0xc5/0x100 [ 8.112513] file_write_and_wait_range+0x61/0xb0 [ 8.113564] ext4_sync_file+0x73/0x370 [ext4] [ 8.114607] __x64_sys_fsync+0x33/0x60 [ 8.115635] do_syscall_64+0x33/0x40 [ 8.116670] entry_SYSCALL_64_after_hwframe+0x44/0xae Thanks for the comment from Christoph. [1]. https://bugs.archlinux.org/task/70992 Cc: stable(a)vger.kernel.org # v5.12+ Reported-by: Jens Stutte <jens(a)chianterastutte.eu> Tested-by: Jens Stutte <jens(a)chianterastutte.eu> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Guoqing Jiang <jiangguoqing(a)kylinos.cn> Signed-off-by: Song Liu <songliubraving(a)fb.com> Conflict: drivers/md/raid1.c [ Mainline patch 6607cd319b6b ("raid1: ensure write behind bio has less than BIO_MAX_VECS sectors"), BIO_MAX_VECS is used directly, but the BIO_MAX_VECS was renamed previously and the corresponding patch a8affc03a9b37 ("block: rename BIO_MAX_PAGES to BIO_MAX_VECS") was not incorporated. So we modify BIO_MAX_VECS to the original BIO_MAX_PAGES.] Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/md/raid1.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index cfc23bf440f84..0c30a1fdb561c 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1318,6 +1318,7 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, struct raid1_plug_cb *plug = NULL; int first_clone; int max_sectors; + bool write_behind = false; if (mddev_is_clustered(mddev) && md_cluster_ops->area_resyncing(mddev, WRITE, @@ -1370,6 +1371,15 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, max_sectors = r1_bio->sectors; for (i = 0; i < disks; i++) { struct md_rdev *rdev = rcu_dereference(conf->mirrors[i].rdev); + + /* + * The write-behind io is only attempted on drives marked as + * write-mostly, which means we could allocate write behind + * bio later. + */ + if (rdev && test_bit(WriteMostly, &rdev->flags)) + write_behind = true; + if (rdev && unlikely(test_bit(Blocked, &rdev->flags))) { atomic_inc(&rdev->nr_pending); blocked_rdev = rdev; @@ -1444,6 +1454,15 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, goto retry_write; } + /* + * When using a bitmap, we may call alloc_behind_master_bio below. + * alloc_behind_master_bio allocates a copy of the data payload a page + * at a time and thus needs a new bio that can fit the whole payload + * this bio in page sized chunks. + */ + if (write_behind && bitmap) + max_sectors = min_t(int, max_sectors, + BIO_MAX_PAGES * (PAGE_SIZE >> 9)); if (max_sectors < bio_sectors(bio)) { struct bio *split = bio_split(bio, max_sectors, GFP_NOIO, &conf->bio_split); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] blk-wbt: fix IO hang due to negative inflight counter
by Yang Yingliang 20 Oct '21

20 Oct '21

From: Laibin Qiu <qiulaibin(a)huawei.com> hulk inclusion category: bugfix bugzilla: 182135, https://gitee.com/openeuler/kernel/issues/I4ENC8 CVE: NA -------------------------- Block test reported the following stack, Some req has been watting for wakeup in wbt_wait, and vmcore showed that wbt inflight counter is -1. So Request cannot be awakened. PID: 75416 TASK: ffff88836c098000 CPU: 2 COMMAND: "fsstress" [ffff8882e59a7608] __schedule at ffffffffb2d22a25 [ffff8882e59a7720] schedule at ffffffffb2d2358f [ffff8882e59a7738] io_schedule at ffffffffb2d23bdc [ffff8882e59a7750] rq_qos_wait at ffffffffb2400fde [ffff8882e59a7878] wbt_wait at ffffffffb243a051 [ffff8882e59a7910] __rq_qos_throttle at ffffffffb2400a20 [ffff8882e59a7930] blk_mq_make_request at ffffffffb23de038 [ffff8882e59a7a98] generic_make_request at ffffffffb23c393d [ffff8882e59a7b80] submit_bio at ffffffffb23c3db8 [ffff8882e59a7c48] submit_bio_wait at ffffffffb23b3a5d [ffff8882e59a7cf0] blkdev_issue_flush at ffffffffb23c8f4c [ffff8882e59a7d20] ext4_sync_fs at ffffffffc06dd708 [ext4] [ffff8882e59a7dd0] sync_filesystem at ffffffffb21e8335 [ffff8882e59a7df8] ovl_sync_fs at ffffffffc0fd853a [overlay] [ffff8882e59a7e10] sync_fs_one_sb at ffffffffb21e8221 [ffff8882e59a7e30] iterate_supers at ffffffffb218401e [ffff8882e59a7e70] ksys_sync at ffffffffb21e8588 [ffff8882e59a7f20] __x64_sys_sync at ffffffffb21e861f [ffff8882e59a7f28] do_syscall_64 at ffffffffb1c06bc8 [ffff8882e59a7f50] entry_SYSCALL_64_after_hwframe at ffffffffb2e000ad RIP: 00007f479ab13347 RSP: 00007ffd4dda9fe8 RFLAGS: 00000202 RAX: ffffffffffffffda RBX: 0000000000000068 RCX: 00007f479ab13347 RDX: 0000000000000000 RSI: 000000003e1b142d RDI: 0000000000000068 RBP: 0000000051eb851f R8: 00007f479abd4034 R9: 00007f479abd40a0 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000402c20 R13: 0000000000000001 R14: 0000000000000000 R15: 7fffffffffffffff The ->inflight counter may be negative (-1) if 1) blk-wbt was disabled when the IO was issued, which will add inflight count. 2) blk-wbt was enabled before this IO tracked. 3) the ->inflight counter is decreased from 0 to -1 in endio(). This fixes the problem by freezing the queue while enabling wbt, there is no inflight rq running. Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/blk-wbt.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/block/blk-wbt.c b/block/blk-wbt.c index 3d9f61633e688..ffd5c17f5a101 100644 --- a/block/blk-wbt.c +++ b/block/blk-wbt.c @@ -23,6 +23,9 @@ #include <linux/slab.h> #include <linux/backing-dev.h> #include <linux/swap.h> +#ifndef __GENKSYMS__ +#include <linux/blk-mq.h> +#endif #include "blk-wbt.h" #include "blk-rq-qos.h" @@ -824,9 +827,16 @@ int wbt_init(struct request_queue *q) rq_qos_add(q, &rwb->rqos); blk_stat_add_callback(q, rwb->cb); - rwb->min_lat_nsec = wbt_default_latency_nsec(q); + /* + * Ensure that the queue is idled by freezing the queue + * while enabling wbt, there is no inflight rq running. + */ + blk_mq_freeze_queue(q); + rwb->min_lat_nsec = wbt_default_latency_nsec(q); wbt_set_queue_depth(q, blk_queue_depth(q)); + + blk_mq_unfreeze_queue(q); wbt_set_write_cache(q, test_bit(QUEUE_FLAG_WC, &q->queue_flags)); return 0; -- 2.25.1

1 0

[PATCH OLK-5.10 v3 0/1] scsi: spfc: initial commit the spfc module
by Yanling Song 20 Oct '21

20 Oct '21

Ramaxel inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4DBD7 CVE: NA Initial commit the spfc module for ramaxel Super FC adapter Changes since v2: - 1. Change comments of default N to M in kconfig. - 2. Update MACRO to sync with file name. - 3. Remove new blank line at EOF. - 4. Remove unncessary initialization of local varaibles. Changes since v1: - Add UNF_PORT_CFG_SET_PORT_STATE state Yanling Song (1): scsi: spfc: initial commit the spfc module arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + drivers/scsi/Kconfig | 1 + drivers/scsi/Makefile | 1 + drivers/scsi/spfc/Kconfig | 16 + drivers/scsi/spfc/Makefile | 47 + drivers/scsi/spfc/common/unf_common.h | 1755 +++++++ drivers/scsi/spfc/common/unf_disc.c | 1276 +++++ drivers/scsi/spfc/common/unf_disc.h | 51 + drivers/scsi/spfc/common/unf_event.c | 517 ++ drivers/scsi/spfc/common/unf_event.h | 83 + drivers/scsi/spfc/common/unf_exchg.c | 2317 +++++++++ drivers/scsi/spfc/common/unf_exchg.h | 436 ++ drivers/scsi/spfc/common/unf_exchg_abort.c | 825 +++ drivers/scsi/spfc/common/unf_exchg_abort.h | 23 + drivers/scsi/spfc/common/unf_fcstruct.h | 459 ++ drivers/scsi/spfc/common/unf_gs.c | 2521 +++++++++ drivers/scsi/spfc/common/unf_gs.h | 58 + drivers/scsi/spfc/common/unf_init.c | 353 ++ drivers/scsi/spfc/common/unf_io.c | 1220 +++++ drivers/scsi/spfc/common/unf_io.h | 96 + drivers/scsi/spfc/common/unf_io_abnormal.c | 986 ++++ drivers/scsi/spfc/common/unf_io_abnormal.h | 19 + drivers/scsi/spfc/common/unf_log.h | 178 + drivers/scsi/spfc/common/unf_lport.c | 1008 ++++ drivers/scsi/spfc/common/unf_lport.h | 519 ++ drivers/scsi/spfc/common/unf_ls.c | 4883 ++++++++++++++++++ drivers/scsi/spfc/common/unf_ls.h | 61 + drivers/scsi/spfc/common/unf_npiv.c | 1005 ++++ drivers/scsi/spfc/common/unf_npiv.h | 47 + drivers/scsi/spfc/common/unf_npiv_portman.c | 360 ++ drivers/scsi/spfc/common/unf_npiv_portman.h | 17 + drivers/scsi/spfc/common/unf_portman.c | 2431 +++++++++ drivers/scsi/spfc/common/unf_portman.h | 96 + drivers/scsi/spfc/common/unf_rport.c | 2286 ++++++++ drivers/scsi/spfc/common/unf_rport.h | 301 ++ drivers/scsi/spfc/common/unf_scsi.c | 1462 ++++++ drivers/scsi/spfc/common/unf_scsi_common.h | 570 ++ drivers/scsi/spfc/common/unf_service.c | 1439 ++++++ drivers/scsi/spfc/common/unf_service.h | 66 + drivers/scsi/spfc/common/unf_type.h | 216 + drivers/scsi/spfc/hw/spfc_chipitf.c | 1105 ++++ drivers/scsi/spfc/hw/spfc_chipitf.h | 797 +++ drivers/scsi/spfc/hw/spfc_cqm_bat_cla.c | 1646 ++++++ drivers/scsi/spfc/hw/spfc_cqm_bat_cla.h | 215 + drivers/scsi/spfc/hw/spfc_cqm_bitmap_table.c | 891 ++++ drivers/scsi/spfc/hw/spfc_cqm_bitmap_table.h | 65 + drivers/scsi/spfc/hw/spfc_cqm_main.c | 1256 +++++ drivers/scsi/spfc/hw/spfc_cqm_main.h | 414 ++ drivers/scsi/spfc/hw/spfc_cqm_object.c | 958 ++++ drivers/scsi/spfc/hw/spfc_cqm_object.h | 279 + drivers/scsi/spfc/hw/spfc_hba.c | 1751 +++++++ drivers/scsi/spfc/hw/spfc_hba.h | 341 ++ drivers/scsi/spfc/hw/spfc_hw_wqe.h | 1645 ++++++ drivers/scsi/spfc/hw/spfc_io.c | 1193 +++++ drivers/scsi/spfc/hw/spfc_io.h | 138 + drivers/scsi/spfc/hw/spfc_lld.c | 997 ++++ drivers/scsi/spfc/hw/spfc_lld.h | 76 + drivers/scsi/spfc/hw/spfc_module.h | 297 ++ drivers/scsi/spfc/hw/spfc_parent_context.h | 269 + drivers/scsi/spfc/hw/spfc_queue.c | 4857 +++++++++++++++++ drivers/scsi/spfc/hw/spfc_queue.h | 711 +++ drivers/scsi/spfc/hw/spfc_service.c | 2168 ++++++++ drivers/scsi/spfc/hw/spfc_service.h | 282 + drivers/scsi/spfc/hw/spfc_utils.c | 102 + drivers/scsi/spfc/hw/spfc_utils.h | 202 + drivers/scsi/spfc/hw/spfc_wqe.c | 646 +++ drivers/scsi/spfc/hw/spfc_wqe.h | 239 + 68 files changed, 53547 insertions(+) create mode 100644 drivers/scsi/spfc/Kconfig create mode 100644 drivers/scsi/spfc/Makefile create mode 100644 drivers/scsi/spfc/common/unf_common.h create mode 100644 drivers/scsi/spfc/common/unf_disc.c create mode 100644 drivers/scsi/spfc/common/unf_disc.h create mode 100644 drivers/scsi/spfc/common/unf_event.c create mode 100644 drivers/scsi/spfc/common/unf_event.h create mode 100644 drivers/scsi/spfc/common/unf_exchg.c create mode 100644 drivers/scsi/spfc/common/unf_exchg.h create mode 100644 drivers/scsi/spfc/common/unf_exchg_abort.c create mode 100644 drivers/scsi/spfc/common/unf_exchg_abort.h create mode 100644 drivers/scsi/spfc/common/unf_fcstruct.h create mode 100644 drivers/scsi/spfc/common/unf_gs.c create mode 100644 drivers/scsi/spfc/common/unf_gs.h create mode 100644 drivers/scsi/spfc/common/unf_init.c create mode 100644 drivers/scsi/spfc/common/unf_io.c create mode 100644 drivers/scsi/spfc/common/unf_io.h create mode 100644 drivers/scsi/spfc/common/unf_io_abnormal.c create mode 100644 drivers/scsi/spfc/common/unf_io_abnormal.h create mode 100644 drivers/scsi/spfc/common/unf_log.h create mode 100644 drivers/scsi/spfc/common/unf_lport.c create mode 100644 drivers/scsi/spfc/common/unf_lport.h create mode 100644 drivers/scsi/spfc/common/unf_ls.c create mode 100644 drivers/scsi/spfc/common/unf_ls.h create mode 100644 drivers/scsi/spfc/common/unf_npiv.c create mode 100644 drivers/scsi/spfc/common/unf_npiv.h create mode 100644 drivers/scsi/spfc/common/unf_npiv_portman.c create mode 100644 drivers/scsi/spfc/common/unf_npiv_portman.h create mode 100644 drivers/scsi/spfc/common/unf_portman.c create mode 100644 drivers/scsi/spfc/common/unf_portman.h create mode 100644 drivers/scsi/spfc/common/unf_rport.c create mode 100644 drivers/scsi/spfc/common/unf_rport.h create mode 100644 drivers/scsi/spfc/common/unf_scsi.c create mode 100644 drivers/scsi/spfc/common/unf_scsi_common.h create mode 100644 drivers/scsi/spfc/common/unf_service.c create mode 100644 drivers/scsi/spfc/common/unf_service.h create mode 100644 drivers/scsi/spfc/common/unf_type.h create mode 100644 drivers/scsi/spfc/hw/spfc_chipitf.c create mode 100644 drivers/scsi/spfc/hw/spfc_chipitf.h create mode 100644 drivers/scsi/spfc/hw/spfc_cqm_bat_cla.c create mode 100644 drivers/scsi/spfc/hw/spfc_cqm_bat_cla.h create mode 100644 drivers/scsi/spfc/hw/spfc_cqm_bitmap_table.c create mode 100644 drivers/scsi/spfc/hw/spfc_cqm_bitmap_table.h create mode 100644 drivers/scsi/spfc/hw/spfc_cqm_main.c create mode 100644 drivers/scsi/spfc/hw/spfc_cqm_main.h create mode 100644 drivers/scsi/spfc/hw/spfc_cqm_object.c create mode 100644 drivers/scsi/spfc/hw/spfc_cqm_object.h create mode 100644 drivers/scsi/spfc/hw/spfc_hba.c create mode 100644 drivers/scsi/spfc/hw/spfc_hba.h create mode 100644 drivers/scsi/spfc/hw/spfc_hw_wqe.h create mode 100644 drivers/scsi/spfc/hw/spfc_io.c create mode 100644 drivers/scsi/spfc/hw/spfc_io.h create mode 100644 drivers/scsi/spfc/hw/spfc_lld.c create mode 100644 drivers/scsi/spfc/hw/spfc_lld.h create mode 100644 drivers/scsi/spfc/hw/spfc_module.h create mode 100644 drivers/scsi/spfc/hw/spfc_parent_context.h create mode 100644 drivers/scsi/spfc/hw/spfc_queue.c create mode 100644 drivers/scsi/spfc/hw/spfc_queue.h create mode 100644 drivers/scsi/spfc/hw/spfc_service.c create mode 100644 drivers/scsi/spfc/hw/spfc_service.h create mode 100644 drivers/scsi/spfc/hw/spfc_utils.c create mode 100644 drivers/scsi/spfc/hw/spfc_utils.h create mode 100644 drivers/scsi/spfc/hw/spfc_wqe.c create mode 100644 drivers/scsi/spfc/hw/spfc_wqe.h -- 2.30.0

2 2

[PATCH kernel-4.19 v6 00/23] support psi feature
by Liu Xinpeng 19 Oct '21

19 Oct '21

backport psi feature from upstream 5.4 bugzilla: https://gitee.com/openeuler/kernel/issues/I47QS2 Baruch Siach (1): psi: fix reference to kernel commandline enable Dan Schatzberg (1): kernel/sched/psi.c: expose pressure metrics on root cgroup Johannes Weiner (11): sched: loadavg: consolidate LOAD_INT, LOAD_FRAC, CALC_LOAD sched: loadavg: make calc_load_n() public sched: sched.h: make rq locking and clock functions available in stats.h sched: introduce this_rq_lock_irq() psi: pressure stall information for CPU, memory, and IO psi: cgroup support psi: make disabling/enabling easier for vendor kernels psi: fix aggregation idle shut-off psi: avoid divide-by-zero crash inside virtual machines fs: kernfs: add poll file operation sched/psi: Fix sampling error and rare div0 crashes with cgroups and high uptime Josef Bacik (1): blk-iolatency: use a percentile approache for ssd's Liu Xinpeng (2): psi:enable psi in config psi:avoid kabi change Olof Johansson (1): kernel/sched/psi.c: simplify cgroup_move_task() Suren Baghdasaryan (6): psi: introduce state_mask to represent stalled psi states psi: make psi_enable static psi: rename psi fields in preparation for psi trigger addition psi: split update_stats into parts psi: track changed states include/: refactor headers to allow kthread.h inclusion in psi_types.h Documentation/accounting/psi.txt | 73 +++ Documentation/admin-guide/cgroup-v2.rst | 18 + Documentation/admin-guide/kernel-parameters.txt | 4 + arch/arm64/configs/openeuler_defconfig | 2 + arch/powerpc/platforms/cell/cpufreq_spudemand.c | 2 +- arch/powerpc/platforms/cell/spufs/sched.c | 9 +- arch/s390/appldata/appldata_os.c | 4 - arch/x86/configs/openeuler_defconfig | 2 + block/blk-iolatency.c | 183 +++++- drivers/cpuidle/governors/menu.c | 4 - drivers/spi/spi-rockchip.c | 1 + fs/kernfs/file.c | 31 +- fs/proc/loadavg.c | 3 - include/linux/cgroup-defs.h | 12 + include/linux/cgroup.h | 17 + include/linux/kernfs.h | 8 + include/linux/kthread.h | 4 + include/linux/psi.h | 55 ++ include/linux/psi_types.h | 95 +++ include/linux/sched.h | 13 + include/linux/sched/loadavg.h | 24 +- init/Kconfig | 28 + kernel/cgroup/cgroup.c | 55 +- kernel/debug/kdb/kdb_main.c | 7 +- kernel/fork.c | 4 + kernel/kthread.c | 3 + kernel/sched/Makefile | 1 + kernel/sched/core.c | 16 +- kernel/sched/loadavg.c | 139 ++-- kernel/sched/psi.c | 823 ++++++++++++++++++++++++ kernel/sched/sched.h | 178 ++--- kernel/sched/stats.h | 86 +++ kernel/workqueue.c | 23 + kernel/workqueue_internal.h | 6 +- mm/compaction.c | 5 + mm/filemap.c | 11 + mm/page_alloc.c | 9 + mm/vmscan.c | 9 + 38 files changed, 1726 insertions(+), 241 deletions(-) create mode 100644 Documentation/accounting/psi.txt create mode 100644 include/linux/psi.h create mode 100644 include/linux/psi_types.h create mode 100644 kernel/sched/psi.c -- 1.8.3.1

1 22

[PATCH openEuler-5.10 0/4] Backport LTS 5.10.66
by Zheng Zengkai 19 Oct '21

19 Oct '21

Backport LTS 5.10.66 patches from upstream. Greg Kroah-Hartman (3): Revert "block: nbd: add sanity check for first_minor" Revert "posix-cpu-timers: Force next expiration recalc after itimer reset" Revert "time: Handle negative seconds correctly in timespec64_to_ns()" Sasha Levin (1): Revert "Bluetooth: Move shutdown callback before flushing tx and rx queue" drivers/block/nbd.c | 10 ---------- include/linux/time64.h | 9 ++------- kernel/time/posix-cpu-timers.c | 2 ++ net/bluetooth/hci_core.c | 8 -------- 4 files changed, 4 insertions(+), 25 deletions(-) -- 2.20.1

1 4

[PATCH openEuler-5.10 000/236] Backport LTS 5.10.65
by Zheng Zengkai 19 Oct '21

19 Oct '21

Backport LTS 5.10.65 patches from upstream. Abhishek Naik (1): iwlwifi: skip first element in the WTAS ACPI table Ahmad Fatoum (1): brcmfmac: pcie: fix oops on failure to resume and reprobe Alexander Gordeev (1): s390/kasan: fix large PMD pages address alignment check Amit Engel (1): nvmet: pass back cntlid on successful completion Anand Moon (3): ARM: dts: meson8b: odroidc1: Fix the pwm regulator supply properties ARM: dts: meson8b: mxq: Fix the pwm regulator supply properties ARM: dts: meson8b: ec100: Fix the pwm regulator supply properties Andrey Ignatov (1): bpf: Fix possible out of bound write in narrow load handling Andrii Nakryiko (1): libbpf: Re-build libbpf.so when libbpf.map changes Andy Duan (1): tty: serial: fsl_lpuart: fix the wrong mapbase value Andy Shevchenko (1): leds: lt3593: Put fwnode in any case during ->probe() Austin Kim (1): IMA: remove -Wmissing-prototypes warning Aya Levin (1): net/mlx5: Register to devlink ingress VLAN filter trap Babu Moger (1): x86/resctrl: Fix a maybe-uninitialized build warning treated as error Ben Hutchings (1): crypto: omap - Fix inconsistent locking of device lists Benjamin Coddington (1): lockd: Fix invalid lockowner cast after vfs_test_lock Biju Das (1): arm64: dts: renesas: hihope-rzg2-ex: Add EtherAVB internal rx delay Bjorn Andersson (1): soc: qcom: rpmhpd: Use corner in power_off Bob Peterson (1): gfs2: init system threads before freeze lock Borislav Petkov (1): x86/mce: Defer processing of early errors Brett Creeley (1): ice: Only lock to update netdev dev_addr Cezary Rojewski (3): ASoC: Intel: kbl_da7219_max98927: Fix format selection for max98373 ASoC: Intel: Skylake: Leave data as is when invoking TLV IPCs ASoC: Intel: Skylake: Fix module resource and format selection Chen-Yu Tsai (3): irqchip/gic-v3: Fix priority comparison when non-secure priorities are used regulator: vctrl: Use locked regulator_get_voltage in probe path regulator: vctrl: Avoid lockdep warning in enable/disable ops Chih-Kang Chang (1): mac80211: Fix insufficient headroom issue for AMSDU Christoph Hellwig (1): bcache: add proper error unwinding in bcache_device_init Christophe JAILLET (9): spi: coldfire-qspi: Use clk_disable_unprepare in the remove function media: cxd2880-spi: Fix an error handling path drm/msm/dsi: Fix some reference counted resource leaks firmware: raspberrypi: Fix a leak in 'rpi_firmware_get()' usb: bdc: Fix an error handling path in 'bdc_probe()' when no suitable DMA config is available usb: bdc: Fix a resource leak in the error handling path of 'bdc_probe()' ASoC: wcd9335: Fix a double irq free in the remove function ASoC: wcd9335: Fix a memory leak in the error handling path of the probe function ASoC: wcd9335: Disable irq on slave ports in the remove function Chunguang Xu (1): blk-throtl: optimize IOPS throttle for large IO scenarios Chunyan Zhang (1): spi: sprd: Fix the wrong WDG_LOAD_VAL Claudiu Beznea (1): ARM: dts: at91: add pinctrl-{names, 0} for all gpios Colin Ian King (4): gfs2: Fix memory leak of object lsi on error return path 6lowpan: iphc: Fix an off-by-one check of array index media: venus: venc: Fix potential null pointer dereference on pointer fmt Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow Curtis Malainey (1): ASoC: Intel: Fix platform ID matching Damien Le Moal (1): libata: fix ata_host_start() Dan Carpenter (5): media: rockchip/rga: fix error handling in probe Bluetooth: sco: prevent information leak in sco_conn_defer_accept() rsi: fix error code in rsi_load_9116_firmware() rsi: fix an error code in rsi_probe() ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point() Daniel Thompson (1): backlight: pwm_bl: Improve bootloader/kernel device handover David Heidelberg (2): drm/msm/mdp4: refactor HW revision detection into read_mdp_hw_revision drm/msm/mdp4: move HW revision detection to earlier phase Desmond Cheong Zhi Xi (2): fcntl: fix potential deadlock for &fasync_struct.fa_lock Bluetooth: fix repeated calls to sco_sock_kill Dietmar Eggemann (1): sched/deadline: Fix missing clock update in migrate_task_rq_dl() Dmitry Baryshkov (1): drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary LMs Dmitry Osipenko (2): regulator: tps65910: Silence deferred probe error power: supply: smb347-charger: Add missing pin control activation Dongliang Mu (4): media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init media: dvb-usb: fix uninit-value in vp702x_read_mac_addr media: dvb-usb: Fix error handling in dvb_usb_i2c_init media: em28xx-input: fix refcount bug in em28xx_usb_disconnect Douglas Anderson (2): ASoC: rt5682: Properly turn off regulators if wrong device ID ASoC: rt5682: Remove unused variable in rt5682_i2c_remove() Dylan Hung (1): ARM: dts: aspeed-g6: Fix HVI3C function-group in pinctrl dtsi Emmanuel Grumbach (1): iwlwifi: follow the new inclusive terminology Eric Biggers (1): blk-crypto: fix check for too-large dun_bytes Eric Dumazet (3): ipv6: make exception cache less predictible ipv4: make exception cache less predictible ipv4: fix endianness issue in inet_rtm_getroute_build_skb() Evgeny Novikov (1): usb: ehci-orion: Handle errors of clk_prepare_enable() in probe Frederic Weisbecker (1): posix-cpu-timers: Force next expiration recalc after itimer reset Geert Uytterhoeven (5): m68k: Fix invalid RMW_INSNS on CPUs that lack CAS soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally arm64: dts: renesas: r8a77995: draak: Remove bogus adv7511w properties arm64: dts: renesas: rzg2: Convert EtherAVB to explicit delay handling usb: gadget: udc: renesas_usb3: Fix soc_device_match() abuse Giovanni Cabiddu (4): crypto: qat - do not ignore errors from enable_vf2pf_comms() crypto: qat - handle both source of interrupt in VF ISR crypto: qat - do not export adf_iov_putmsg() crypto: qat - use proper type for vf_mask Haiyue Wang (1): gve: fix the wrong AdminQ buffer overflow check Halil Pasic (1): KVM: s390: index kvm->arch.idle_mask by vcpu_idx Hans de Goede (2): power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors leds: trigger: audio: Add an activate callback to ensure the initial brightness is set Harald Freudenberger (2): s390/zcrypt: fix wrong offset index for APKA master key valid state s390/ap: fix state machine hang after failure to enable irq Harshvardhan Jha (1): drm/gma500: Fix end of loop tests for list_for_each_entry He Fengqing (1): bpf: Fix potential memleak and UAF in the verifier. Hongbo Li (1): lib/mpi: use kcalloc in mpi_resize Huacai Chen (1): irqchip/loongson-pch-pic: Improve edge triggered interrupt support Ilya Leoshkevich (1): selftests/bpf: Fix test_core_autosize on big-endian machines J. Bruce Fields (1): nfsd4: Fix forced-expiry locking Jaegeuk Kim (1): f2fs: guarantee to write dirty data when enabling checkpoint back Jan Kara (1): udf: Check LVID earlier Jens Axboe (1): io_uring: IORING_OP_WRITE needs hash_reg_file set Jeongtae Park (1): regmap: fix the offset of register error log Jiapeng Chong (2): leds: is31fl32xx: Fix missing error code in is31fl32xx_parse_dt() net/mlx5: Fix missing return value in mlx5_devlink_eswitch_inline_mode_set() Jose Blanquicet (1): selftests/bpf: Fix bpf-iter-tcp4 test to print correctly the dest IP Juhee Kang (1): samples: pktgen: add missing IPv6 option to pktgen scripts Julia Lawall (1): drm/of: free the right object Justin M. Forbes (1): iwlwifi Add support for ax201 in Samsung Galaxy Book Flex2 Alpha Kai-Heng Feng (2): drm/amdgpu/acp: Make PM domain really work Bluetooth: Move shutdown callback before flushing tx and rx queue Kevin Mitchell (1): lkdtm: replace SCSI_DISPATCH_CMD with SCSI_QUEUE_RQ Kim Phillips (1): perf/x86/amd/ibs: Extend PERF_PMU_CAP_NO_EXCLUDE to IBS Op Krzysztof Hałasa (1): media: TDA1997x: enable EDID support Krzysztof Kozlowski (1): arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7 Kuniyuki Iwashima (1): bpf: Fix a typo of reuseport map in bpf.h. Len Baker (1): CIFS: Fix a potencially linear read overflow Leon Romanovsky (3): ionic: cleanly release devlink instance devlink: Break parameter notification sequence to be before/after unload/load driver devlink: Clear whole devlink_flash_notify struct Linus Walleij (1): clk: kirkwood: Fix a clocking boot regression Lukas Bulwahn (1): clk: staging: correct reference to config IOMEM to config HAS_IOMEM Lukas Hannen (1): time: Handle negative seconds correctly in timespec64_to_ns() Lukasz Luba (1): PM: EM: Increase energy calculation precision Marco Chiappero (2): crypto: qat - fix reuse of completion variable crypto: qat - fix naming for init/shutdown VF to PF notifications Marek Vasut (3): drm: mxsfb: Enable recovery on underflow drm: mxsfb: Increase number of outstanding requests on V4 and newer HW drm: mxsfb: Clear FIFO_CLEAR bit Martin Blumenstingl (1): ARM: dts: meson8: Use a higher default GPU clock frequency Martin KaFai Lau (1): tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos Martynas Pumputis (1): libbpf: Fix removal of inner map in bpf_object__create_map Matija Glavinic Pecotic (1): spi: davinci: invoke chipselect callback Matthew Cover (1): bpf, samples: Add missing mprog-disable to xdp_redirect_cpu's optstring Mauro Carvalho Chehab (1): media: rockchip/rga: use pm_runtime_resume_and_get() Maxim Levitsky (1): KVM: VMX: avoid running vmx_handle_exit_irqoff in case of emulation Maxim Mikityanskiy (2): net/mlx5e: Prohibit inner indir TIRs in IPoIB net/mlx5e: Block LRO if firmware asks for tunneled LRO Mika Penttilä (1): sched/numa: Fix is_core_idle() Miklos Szeredi (2): fuse: truncate pagecache on atomic_o_trunc fuse: flush extending writes Ming Lei (1): block: return ELEVATOR_DISCARD_MERGE if possible Nadezda Lutovinova (1): usb: gadget: mv_u3d: request_irq() after initializing UDC Nguyen Dinh Phi (1): tty: Fix data race between tiocsti() and flush_to_ldisc() Nicolas Saenz Julienne (1): firmware: raspberrypi: Keep count of all consumers Niklas Schnelle (1): s390/pci: fix misleading rc in clp_set_pci_fn() Pali Rohár (3): udf: Fix iocharset=utf8 mount option isofs: joliet: Fix iocharset=utf8 mount option arm64: dts: marvell: armada-37xx: Extend PCIe MEM space Parav Pandit (1): net/mlx5: Fix unpublish devlink parameters Paul E. McKenney (1): rcu: Add lockdep_assert_irqs_disabled() to rcu_sched_clock_irq() and callees Pavel Begunkov (1): bio: fix page leak bio_add_hw_page failure Pavel Skripkin (6): m68k: emu: Fix invalid free in nfeth_cleanup() block: nbd: add sanity check for first_minor media: go7007: fix memory leak in go7007_usb_probe media: go7007: remove redundant initialization net: cipso: fix warnings in netlbl_cipsov4_add_std Bluetooth: add timeout sanity check to hci_inquiry Peter Oberparleiter (2): s390/debug: keep debug data on resize s390/debug: fix debug area life cycle Peter Robinson (1): power: supply: cw2015: use dev_err_probe to allow deferred probe Peter Zijlstra (2): locking/mutex: Fix HANDOFF condition locking/lockdep: Mark local_lock_t Philipp Zabel (1): media: coda: fix frame_mem_ctrl for YUV420 and YVU420 formats Phong Hoang (1): clocksource/drivers/sh_cmt: Fix wrong setting if don't request IRQ for clock source channel Qiuxu Zhuo (1): EDAC/i10nm: Fix NVDIMM detection Quanyang Wang (1): spi: spi-zynq-qspi: use wait_for_completion_timeout to make zynq_qspi_exec_mem_op not interruptible Quentin Perret (2): sched/deadline: Fix reset_on_fork reporting of DL tasks sched: Fix UCLAMP_FLAG_IDLE setting Rafael J. Wysocki (2): PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently PCI: PM: Enable PME if it can be signaled from D3cold Ruozhu Li (2): nvme-tcp: don't update queue count when failing to set io queues nvme-rdma: don't update queue count when failing to set io queues Sean Anderson (1): crypto: mxs-dcp - Check for DMA mapping errors Sean Christopherson (2): Revert "KVM: x86: mmu: Add guest physical address check in translate_gpa()" KVM: nVMX: Unconditionally clear nested.pi_pending on nested VM-Enter Sebastian Krzyszkowiak (1): power: supply: max17042_battery: fix typo in MAx17042_TOFF Sergey Senozhatsky (1): rcu/tree: Handle VM stoppage in stall detection Sergey Shtylyov (15): i2c: highlander: add IRQ check usb: dwc3: meson-g12a: add IRQ check usb: dwc3: qcom: add IRQ check usb: gadget: udc: at91: add IRQ check usb: gadget: udc: s3c2410: add IRQ check usb: phy: fsl-usb: add IRQ check usb: phy: twl6030: add IRQ checks usb: host: ohci-tmio: add IRQ check usb: phy: tahvo: add IRQ check i2c: synquacer: fix deferred probing i2c: iop3xx: fix deferred probing i2c: s3c2410: fix IRQ check i2c: hix5hd2: fix IRQ check i2c: mt65xx: fix IRQ check i2c: xlp9xx: fix main IRQ check Shuyi Cheng (1): libbpf: Fix the possible memory leak on error Smita Koralahalli (1): EDAC/mce_amd: Do not load edac_mce_amd module on guests Stefan Assmann (1): i40e: improve locking of mac_filter_hash Stefan Berger (2): certs: Trigger creation of RSA module signing key if it's not an RSA key tpm: ibmvtpm: Avoid error message when process gets signal while waiting Stefan Wahren (1): net: qualcomm: fix QCA7000 checksum handling Stephan Gerhold (1): soc: qcom: smsm: Fix missed interrupts if state changes while masked Stephen Boyd (1): ASoC: rt5682: Implement remove callback Steven Price (1): drm/of: free the iterator object on failure Stian Skjelstad (1): udf_get_extendedattr() had no boundary checks. Subbaraya Sundeep (2): octeontx2-af: Fix loop in free and unmap counter octeontx2-af: Fix static code analyzer reported issues Sudarsana Reddy Kalluru (1): atlantic: Fix driver resume flow. Sunil Goutham (1): octeontx2-af: Set proper errorcode for IPv4 checksum errors Sven Eckelmann (1): debugfs: Return error during {full/open}_proxy_open() on rmmod THOBY Simon (1): IMA: remove the dependency on CRYPTO_MD5 Tedd Ho-Jeong An (1): Bluetooth: mgmt: Fix wrong opcode in the response for add_adv cmd Tetsuo Handa (1): fbmem: don't allow too huge resolutions Thomas Gleixner (3): hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns() hrtimer: Ensure timerfd notification for HIGHRES=n locking/local_lock: Add missing owner initialization Tian Tao (1): i2c: fix platform_get_irq.cocci warnings Tony Lindgren (6): crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop() spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config spi: spi-pic32: Fix issue with uninitialized dma_slave_config mmc: sdhci: Fix issue with uninitialized dma_slave_config mmc: dw_mmc: Fix issue with uninitialized dma_slave_config mmc: moxart: Fix issue with uninitialized dma_slave_config Valentin Schneider (1): PM: cpu: Make notifier chain use a raw_spinlock_t Vineeth Vijayan (1): s390/cio: add dev_busid sysfs entry for each subchannel Waiman Long (3): cgroup/cpuset: Fix a partition bug with hotplug cgroup/cpuset: Miscellaneous code cleanup cgroup/cpuset: Fix violation of cpuset locking rule Wei Yongjun (1): drm/panfrost: Fix missing clk_disable_unprepare() on error in panfrost_clk_init() William Breathitt Gray (1): counter: 104-quad-8: Return error when invalid mode during ceiling_write Xiyu Yang (1): net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed Xu Yu (1): mm/swap: consider max pages in iomap_swapfile_add_extent Yanfei Xu (2): rcu: Fix to include first blocked task in stall warning rcu: Fix stall-warning deadlock due to non-release of rcu_node ->lock Yizhuo (1): media: atomisp: fix the uninitialized use and rename "retvalue" Zelin Deng (1): KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is adjusted Zenghui Yu (1): bcma: Fix memory leak for internally-handled cores Zhang Qilong (1): ASoC: mediatek: mt8183: Fix Unbalanced pm_runtime_enable in mt8183_afe_pcm_dev_probe Zhen Lei (3): genirq/timings: Fix error return code in irq_timings_test_irqs() firmware: fix theoretical UAF race with firmware cache and resume driver core: Fix error return code in really_probe() .../fault-injection/provoke-crashes.rst | 2 +- arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi | 4 +- arch/arm/boot/dts/at91-sam9x60ek.dts | 16 +- arch/arm/boot/dts/at91-sama5d3_xplained.dts | 29 +++ arch/arm/boot/dts/at91-sama5d4_xplained.dts | 19 ++ arch/arm/boot/dts/meson8.dtsi | 5 + arch/arm/boot/dts/meson8b-ec100.dts | 4 +- arch/arm/boot/dts/meson8b-mxq.dts | 4 +- arch/arm/boot/dts/meson8b-odroidc1.dts | 4 +- arch/arm64/boot/dts/exynos/exynos7.dtsi | 2 +- .../dts/marvell/armada-3720-turris-mox.dts | 17 ++ arch/arm64/boot/dts/marvell/armada-37xx.dtsi | 11 +- .../boot/dts/renesas/beacon-renesom-som.dtsi | 3 +- .../boot/dts/renesas/hihope-rzg2-ex.dtsi | 3 +- arch/arm64/boot/dts/renesas/r8a774a1.dtsi | 2 + arch/arm64/boot/dts/renesas/r8a774b1.dtsi | 2 + arch/arm64/boot/dts/renesas/r8a774c0.dtsi | 1 + arch/arm64/boot/dts/renesas/r8a774e1.dtsi | 2 + .../arm64/boot/dts/renesas/r8a77995-draak.dts | 4 - arch/m68k/Kconfig.cpu | 8 +- arch/m68k/emu/nfeth.c | 4 +- arch/s390/include/asm/kvm_host.h | 1 + arch/s390/kernel/debug.c | 176 +++++++++++------- arch/s390/kvm/interrupt.c | 12 +- arch/s390/kvm/kvm-s390.c | 2 +- arch/s390/kvm/kvm-s390.h | 2 +- arch/s390/mm/kasan_init.c | 41 ++-- arch/s390/pci/pci.c | 7 +- arch/s390/pci/pci_clp.c | 33 ++-- arch/x86/events/amd/ibs.c | 1 + arch/x86/include/asm/mce.h | 1 + arch/x86/kernel/cpu/mce/core.c | 11 +- arch/x86/kernel/cpu/resctrl/monitor.c | 6 + arch/x86/kvm/mmu/mmu.c | 6 - arch/x86/kvm/vmx/nested.c | 7 +- arch/x86/kvm/vmx/vmx.c | 3 + arch/x86/kvm/x86.c | 4 + block/bfq-iosched.c | 3 + block/bio.c | 15 +- block/blk-crypto.c | 2 +- block/blk-merge.c | 18 +- block/blk-throttle.c | 32 ++++ block/blk.h | 2 + block/elevator.c | 3 + block/mq-deadline.c | 2 + certs/Makefile | 8 + drivers/ata/libata-core.c | 2 +- drivers/base/dd.c | 16 +- drivers/base/firmware_loader/main.c | 20 +- drivers/base/regmap/regmap.c | 2 +- drivers/bcma/main.c | 6 +- drivers/block/nbd.c | 10 + drivers/char/tpm/tpm_ibmvtpm.c | 26 +-- drivers/char/tpm/tpm_ibmvtpm.h | 2 +- drivers/clk/mvebu/kirkwood.c | 1 + drivers/clocksource/sh_cmt.c | 30 +-- drivers/counter/104-quad-8.c | 5 +- drivers/crypto/mxs-dcp.c | 45 ++++- drivers/crypto/omap-aes.c | 8 +- drivers/crypto/omap-des.c | 8 +- drivers/crypto/omap-sham.c | 14 +- .../qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c | 4 +- .../qat/qat_c62xvf/adf_c62xvf_hw_data.c | 4 +- .../crypto/qat/qat_common/adf_common_drv.h | 8 +- drivers/crypto/qat/qat_common/adf_init.c | 5 +- drivers/crypto/qat/qat_common/adf_isr.c | 7 +- drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 3 +- drivers/crypto/qat/qat_common/adf_vf2pf_msg.c | 12 +- drivers/crypto/qat/qat_common/adf_vf_isr.c | 7 +- .../qat_dh895xccvf/adf_dh895xccvf_hw_data.c | 4 +- drivers/edac/i10nm_base.c | 6 +- drivers/edac/mce_amd.c | 3 + drivers/firmware/raspberrypi.c | 46 ++++- drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 54 +++--- drivers/gpu/drm/drm_of.c | 6 +- drivers/gpu/drm/gma500/oaktrail_lvds.c | 2 +- drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c | 10 +- drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c | 68 ++++--- drivers/gpu/drm/msm/dsi/dsi.c | 6 +- drivers/gpu/drm/mxsfb/mxsfb_drv.c | 3 + drivers/gpu/drm/mxsfb/mxsfb_drv.h | 1 + drivers/gpu/drm/mxsfb/mxsfb_kms.c | 40 ++++ drivers/gpu/drm/mxsfb/mxsfb_regs.h | 9 + drivers/gpu/drm/panfrost/panfrost_device.c | 3 +- drivers/i2c/busses/i2c-highlander.c | 2 +- drivers/i2c/busses/i2c-hix5hd2.c | 4 +- drivers/i2c/busses/i2c-iop3xx.c | 6 +- drivers/i2c/busses/i2c-mt65xx.c | 2 +- drivers/i2c/busses/i2c-s3c2410.c | 2 +- drivers/i2c/busses/i2c-synquacer.c | 2 +- drivers/i2c/busses/i2c-xlp9xx.c | 2 +- drivers/irqchip/irq-gic-v3.c | 23 ++- drivers/irqchip/irq-loongson-pch-pic.c | 19 +- drivers/leds/leds-is31fl32xx.c | 1 + drivers/leds/leds-lt3593.c | 5 +- drivers/leds/trigger/ledtrig-audio.c | 37 +++- drivers/md/bcache/super.c | 16 +- drivers/media/i2c/tda1997x.c | 1 + drivers/media/platform/coda/coda-bit.c | 18 +- drivers/media/platform/qcom/venus/venc.c | 2 + drivers/media/platform/rockchip/rga/rga-buf.c | 3 +- drivers/media/platform/rockchip/rga/rga.c | 29 ++- drivers/media/spi/cxd2880-spi.c | 7 +- drivers/media/usb/dvb-usb/dvb-usb-i2c.c | 9 +- drivers/media/usb/dvb-usb/dvb-usb-init.c | 2 +- drivers/media/usb/dvb-usb/nova-t-usb2.c | 6 +- drivers/media/usb/dvb-usb/vp702x.c | 12 +- drivers/media/usb/em28xx/em28xx-input.c | 1 - drivers/media/usb/go7007/go7007-driver.c | 26 --- drivers/media/usb/go7007/go7007-usb.c | 2 +- drivers/misc/lkdtm/core.c | 2 +- drivers/mmc/host/dw_mmc.c | 1 + drivers/mmc/host/moxart-mmc.c | 1 + drivers/mmc/host/sdhci.c | 1 + .../ethernet/aquantia/atlantic/aq_pci_func.c | 3 + drivers/net/ethernet/google/gve/gve_adminq.c | 6 +- .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 23 ++- drivers/net/ethernet/intel/ice/ice_main.c | 13 +- .../ethernet/marvell/octeontx2/af/rvu_npc.c | 16 +- .../net/ethernet/mellanox/mlx5/core/devlink.c | 52 ++++++ .../net/ethernet/mellanox/mlx5/core/en/fs.h | 6 - .../net/ethernet/mellanox/mlx5/core/en_fs.c | 10 +- .../net/ethernet/mellanox/mlx5/core/en_main.c | 15 ++ .../mellanox/mlx5/core/eswitch_offloads.c | 5 +- .../ethernet/mellanox/mlx5/core/ipoib/ipoib.c | 18 +- .../ethernet/pensando/ionic/ionic_devlink.c | 14 +- drivers/net/ethernet/qualcomm/qca_spi.c | 2 +- drivers/net/ethernet/qualcomm/qca_uart.c | 2 +- drivers/net/wireless/ath/ath6kl/wmi.c | 4 +- .../broadcom/brcm80211/brcmfmac/pcie.c | 2 +- drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 32 ++-- drivers/net/wireless/intel/iwlwifi/fw/acpi.h | 10 +- .../wireless/intel/iwlwifi/fw/api/commands.h | 2 +- .../wireless/intel/iwlwifi/fw/api/nvm-reg.h | 8 +- .../net/wireless/intel/iwlwifi/fw/api/scan.h | 12 +- drivers/net/wireless/intel/iwlwifi/fw/file.h | 2 +- .../net/wireless/intel/iwlwifi/iwl-config.h | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 6 +- .../net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | 10 +- .../net/wireless/intel/iwlwifi/mvm/mac80211.c | 13 +- drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 24 +-- drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 1 + drivers/net/wireless/rsi/rsi_91x_hal.c | 4 +- drivers/net/wireless/rsi/rsi_91x_usb.c | 1 + drivers/nvme/host/rdma.c | 4 +- drivers/nvme/host/tcp.c | 4 +- drivers/nvme/target/fabrics-cmd.c | 9 +- drivers/pci/pci.c | 25 ++- drivers/power/supply/axp288_fuel_gauge.c | 4 +- drivers/power/supply/cw2015_battery.c | 4 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/power/supply/smb347-charger.c | 10 + drivers/regulator/tps65910-regulator.c | 10 +- drivers/regulator/vctrl-regulator.c | 73 +++++--- drivers/s390/cio/css.c | 17 ++ drivers/s390/crypto/ap_bus.c | 25 +-- drivers/s390/crypto/ap_bus.h | 10 +- drivers/s390/crypto/ap_queue.c | 20 +- drivers/s390/crypto/zcrypt_ccamisc.c | 8 +- drivers/soc/qcom/rpmhpd.c | 5 +- drivers/soc/qcom/smsm.c | 11 +- drivers/soc/rockchip/Kconfig | 4 +- drivers/spi/spi-coldfire-qspi.c | 2 +- drivers/spi/spi-davinci.c | 8 +- drivers/spi/spi-fsl-dspi.c | 1 + drivers/spi/spi-pic32.c | 1 + drivers/spi/spi-sprd-adi.c | 2 +- drivers/spi/spi-zynq-qspi.c | 8 +- drivers/staging/clocking-wizard/Kconfig | 2 +- .../media/atomisp/i2c/atomisp-mt9m114.c | 11 +- drivers/tty/serial/fsl_lpuart.c | 2 +- drivers/tty/tty_io.c | 4 +- drivers/usb/dwc3/dwc3-meson-g12a.c | 2 + drivers/usb/dwc3/dwc3-qcom.c | 4 + drivers/usb/gadget/udc/at91_udc.c | 4 +- drivers/usb/gadget/udc/bdc/bdc_core.c | 30 +-- drivers/usb/gadget/udc/mv_u3d_core.c | 19 +- drivers/usb/gadget/udc/renesas_usb3.c | 17 +- drivers/usb/gadget/udc/s3c2410_udc.c | 4 + drivers/usb/host/ehci-orion.c | 8 +- drivers/usb/host/ohci-tmio.c | 3 + drivers/usb/phy/phy-fsl-usb.c | 2 + drivers/usb/phy/phy-tahvo.c | 4 +- drivers/usb/phy/phy-twl6030-usb.c | 5 + drivers/video/backlight/pwm_bl.c | 54 +++--- drivers/video/fbdev/core/fbmem.c | 6 + fs/cifs/cifs_unicode.c | 9 +- fs/debugfs/file.c | 8 +- fs/f2fs/file.c | 5 +- fs/f2fs/super.c | 11 +- fs/fcntl.c | 5 +- fs/fuse/file.c | 9 +- fs/gfs2/ops_fstype.c | 43 +++++ fs/gfs2/super.c | 61 +----- fs/io_uring.c | 1 + fs/iomap/swapfile.c | 6 + fs/isofs/inode.c | 27 ++- fs/isofs/isofs.h | 1 - fs/isofs/joliet.c | 4 +- fs/lockd/svclock.c | 2 +- fs/nfsd/nfs4state.c | 4 +- fs/udf/misc.c | 13 +- fs/udf/super.c | 75 ++++---- fs/udf/udf_sb.h | 2 - fs/udf/unicode.c | 4 +- include/linux/blkdev.h | 16 ++ include/linux/energy_model.h | 16 ++ include/linux/hrtimer.h | 5 - include/linux/local_lock_internal.h | 39 ++-- include/linux/lockdep.h | 15 +- include/linux/lockdep_types.h | 18 +- include/linux/mlx5/mlx5_ifc.h | 3 +- include/linux/power/max17042_battery.h | 2 +- include/linux/time64.h | 9 +- include/soc/bcm2835/raspberrypi-firmware.h | 2 + include/uapi/linux/bpf.h | 2 +- kernel/bpf/verifier.c | 31 +-- kernel/cgroup/cpuset.c | 95 ++++++---- kernel/cpu_pm.c | 50 +++-- kernel/irq/timings.c | 2 + kernel/locking/lockdep.c | 16 +- kernel/locking/mutex.c | 15 +- kernel/power/energy_model.c | 4 +- kernel/rcu/tree.c | 4 + kernel/rcu/tree_plugin.h | 1 + kernel/rcu/tree_stall.h | 34 +++- kernel/sched/core.c | 25 ++- kernel/sched/deadline.c | 8 +- kernel/sched/fair.c | 2 +- kernel/sched/sched.h | 2 + kernel/time/hrtimer.c | 92 ++++++--- kernel/time/posix-cpu-timers.c | 2 - kernel/time/tick-internal.h | 3 + lib/mpi/mpiutil.c | 2 +- net/6lowpan/debugfs.c | 3 +- net/bluetooth/cmtp/cmtp.h | 2 +- net/bluetooth/hci_core.c | 14 ++ net/bluetooth/mgmt.c | 2 +- net/bluetooth/sco.c | 11 +- net/core/devlink.c | 36 ++-- net/ipv4/route.c | 48 +++-- net/ipv4/tcp_ipv4.c | 5 +- net/ipv6/route.c | 5 +- net/mac80211/tx.c | 4 +- net/netlabel/netlabel_cipso_v4.c | 8 +- net/sched/sch_cbq.c | 2 +- samples/bpf/xdp_redirect_cpu_user.c | 2 +- samples/pktgen/pktgen_sample04_many_flows.sh | 12 +- .../pktgen/pktgen_sample05_flow_per_thread.sh | 12 +- security/integrity/ima/Kconfig | 1 - security/integrity/ima/ima_mok.c | 2 +- sound/soc/codecs/rt5682-i2c.c | 20 ++ sound/soc/codecs/wcd9335.c | 23 ++- sound/soc/intel/boards/kbl_da7219_max98927.c | 55 +----- .../intel/common/soc-acpi-intel-cml-match.c | 2 +- .../intel/common/soc-acpi-intel-kbl-match.c | 2 +- sound/soc/intel/skylake/skl-topology.c | 25 +-- sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 43 +++-- tools/include/uapi/linux/bpf.h | 2 +- tools/lib/bpf/Makefile | 10 +- tools/lib/bpf/libbpf.c | 16 +- .../selftests/bpf/progs/bpf_iter_tcp4.c | 2 +- .../selftests/bpf/progs/test_core_autosize.c | 20 +- 263 files changed, 2072 insertions(+), 1182 deletions(-) -- 2.20.1

1 236

[PATCH openEuler-5.10 00/23] Backport LTS 5.10.64
by Zheng Zengkai 19 Oct '21

19 Oct '21

Backport LTS 5.10.64 patches from upstream. Alexander Tsoy (1): ALSA: usb-audio: Add registration quirk for JBL Quantum 800 Chunfeng Yun (4): usb: gadget: tegra-xudc: fix the wrong mult value for HS isoc or intr usb: mtu3: restore HS function when set SS/SSP usb: mtu3: use @mult for HS isoc or intr usb: mtu3: fix the wrong HS mult value Esben Haabendal (1): net: ll_temac: Remove left-over debug message Hayes Wang (1): Revert "r8169: avoid link-up interrupt issue on RTL8106e if user enables ASPM" Jiri Slaby (1): tty: drop termiox user definitions Marek Behún (1): PCI: Call Max Payload Size-related fixup quirks early Mathias Nyman (2): xhci: fix even more unsafe memory usage in xhci tracing xhci: fix unsafe memory usage in xhci tracing Ming Lei (3): blk-mq: fix kernel panic during iterating over flush request blk-mq: fix is_flush_rq blk-mq: clearing flush request reference in tags->rqs[] Pablo Neira Ayuso (2): netfilter: nf_tables: initialize set before expression setup netfilter: nftables: clone set element expression template Paul Gortmaker (1): x86/reboot: Limit Dell Optiplex 990 quirk to early BIOS versions Randy Dunlap (2): net: kcov: don't select SKB_EXTENSIONS when there is no NET net: linux/skbuff.h: combine SKB_EXTENSIONS + KCOV handling Suravee Suthikulpanit (1): x86/events/amd/iommu: Fix invalid Perf result due to IOMMU PMC power-gating Tom Rix (1): USB: serial: mos7720: improve OOM-handling in read_mos_reg() Vignesh Raghavendra (1): serial: 8250: 8250_omap: Fix unused variable warning Yoshihiro Shimoda (1): usb: host: xhci-rcar: Don't reload firmware after the completion arch/x86/events/amd/iommu.c | 47 ++++++------ arch/x86/kernel/reboot.c | 3 +- block/blk-core.c | 1 - block/blk-flush.c | 13 ++++ block/blk-mq.c | 37 +++++++++- block/blk.h | 6 +- drivers/net/ethernet/realtek/r8169_main.c | 1 + drivers/net/ethernet/xilinx/ll_temac_main.c | 4 +- drivers/pci/quirks.c | 12 +-- drivers/tty/serial/8250/8250_omap.c | 26 +++---- drivers/usb/gadget/udc/tegra-xudc.c | 4 +- drivers/usb/host/xhci-debugfs.c | 14 +++- drivers/usb/host/xhci-rcar.c | 7 ++ drivers/usb/host/xhci-ring.c | 3 +- drivers/usb/host/xhci-trace.h | 26 ++++--- drivers/usb/host/xhci.h | 73 +++++++++--------- drivers/usb/mtu3/mtu3_core.c | 4 +- drivers/usb/mtu3/mtu3_gadget.c | 6 +- drivers/usb/serial/mos7720.c | 4 +- include/linux/skbuff.h | 4 +- include/uapi/linux/termios.h | 15 ---- lib/Kconfig.debug | 2 +- net/netfilter/nf_tables_api.c | 82 +++++++++++++-------- sound/usb/quirks.c | 1 + 24 files changed, 234 insertions(+), 161 deletions(-) -- 2.20.1

1 23

[PATCH openEuler-5.10 0/2] livepatch: Add klp_{register,unregister}
by Zheng Zengkai 19 Oct '21

19 Oct '21

livepatch: Add klp_{register,unregister}_patch for stop_machine model. Yang Jihong (2): livepatch: Add klp_{register,unregister}_patch for stop_machine model livepatch: Adapt livepatch-sample for stop_machine model include/linux/livepatch.h | 15 +- kernel/livepatch/core.c | 257 ++++++++++++++++++++------- samples/livepatch/livepatch-sample.c | 37 ++++ 3 files changed, 239 insertions(+), 70 deletions(-) -- 2.20.1

1 2

[PATCH openEuler-5.10 00/27] Backport LTS 5.10.63
by Zheng Zengkai 19 Oct '21

19 Oct '21

Backport LTS 5.10.63 patches from upstream. Al Viro (1): new helper: inode_wrong_type() Amir Goldstein (1): fuse: fix illegal access to inode with reused nodeid Andy Shevchenko (1): spi: Switch to signed types for *_native_cs SPI controller fields Christoph Hellwig (1): cryptoloop: add a deprecation warning Eric Biggers (4): fscrypt: add fscrypt_symlink_getattr() for computing st_size ext4: report correct st_size for encrypted symlinks f2fs: report correct st_size for encrypted symlinks ubifs: report correct st_size for encrypted symlinks Greg Kroah-Hartman (3): Revert "ucounts: Increase ucounts reference counter before the security hook" Revert "cred: add missing return error code when set_cred_ucounts() failed" Revert "Add a reference to ucounts for each cred" Harini Katakam (1): net: macb: Add a NULL check on desc_ptp Johnathon Clark (1): ALSA: hda/realtek: Quirk for HP Spectre x360 14 amp setup Kim Phillips (2): perf/x86/amd/ibs: Work around erratum #1197 perf/x86/amd/power: Assign pmu.module Krzysztof Hałasa (1): gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for (semi)planar U/V formats Maciej Falkowski (1): ARM: OMAP1: ams-delta: remove unused function ams_delta_camera_power Matthieu Baerts (1): static_call: Fix unused variable warn w/o MODULE Pavel Skripkin (1): media: stkwebcam: fix memory leak in stk_camera_probe Randy Dunlap (1): xtensa: fix kconfig unmet dependency warning for HAVE_FUTEX_CMPXCHG Sai Krishna Potthuri (1): reset: reset-zynqmp: Fixed the argument data type Shai Malin (2): qed: Fix the VF msix vectors flow qede: Fix memset corruption Takashi Iwai (1): ALSA: hda/realtek: Workaround for conflicting SSID on ASUS ROG Strix G17 Tuo Li (1): ceph: fix possible null-pointer dereference in ceph_mdsmap_decode() Xiaoyao Li (1): perf/x86/intel/pt: Fix mask of num_address_ranges Zubin Mithra (1): ALSA: pcm: fix divide error in snd_pcm_lib_ioctl arch/arm/mach-omap1/board-ams-delta.c | 14 ------- arch/x86/events/amd/ibs.c | 8 ++++ arch/x86/events/amd/power.c | 1 + arch/x86/events/intel/pt.c | 2 +- arch/xtensa/Kconfig | 2 +- drivers/block/Kconfig | 4 +- drivers/block/cryptoloop.c | 2 + drivers/gpu/ipu-v3/ipu-cpmem.c | 30 ++++++------- drivers/media/usb/stkwebcam/stk-webcam.c | 6 ++- drivers/net/ethernet/cadence/macb_ptp.c | 11 ++++- drivers/net/ethernet/qlogic/qed/qed_main.c | 7 +++- drivers/net/ethernet/qlogic/qede/qede_main.c | 2 +- drivers/reset/reset-zynqmp.c | 3 +- fs/9p/vfs_inode.c | 4 +- fs/9p/vfs_inode_dotl.c | 4 +- fs/ceph/mdsmap.c | 8 ++-- fs/cifs/inode.c | 5 +-- fs/crypto/hooks.c | 44 ++++++++++++++++++++ fs/exec.c | 4 -- fs/ext4/symlink.c | 11 ++++- fs/f2fs/namei.c | 11 ++++- fs/fuse/dir.c | 6 +-- fs/fuse/fuse_i.h | 7 ++++ fs/fuse/inode.c | 4 +- fs/fuse/readdir.c | 7 +++- fs/nfs/inode.c | 6 +-- fs/nfsd/nfsproc.c | 2 +- fs/overlayfs/namei.c | 4 +- fs/ubifs/file.c | 12 +++++- include/linux/cred.h | 2 - include/linux/fs.h | 5 +++ include/linux/fscrypt.h | 7 ++++ include/linux/spi/spi.h | 4 +- include/linux/user_namespace.h | 4 -- kernel/cred.c | 41 ------------------ kernel/fork.c | 6 --- kernel/static_call.c | 4 +- kernel/sys.c | 12 ------ kernel/ucount.c | 40 ++---------------- kernel/user_namespace.c | 3 -- sound/core/pcm_lib.c | 2 +- sound/pci/hda/patch_realtek.c | 11 +++++ 42 files changed, 193 insertions(+), 179 deletions(-) -- 2.20.1

1 27

[PATCH openEuler-5.10 00/89] Backport LTS 5.10.62
by Zheng Zengkai 19 Oct '21

19 Oct '21

Backport LTS 5.10.62 patches from upstream. Aaron Ma (1): igc: fix page fault when thunderbolt is unplugged Adam Ford (1): clk: renesas: rcar-usb2-clock-sel: Fix kernel NULL pointer dereference Alexey Gladkov (1): ucounts: Increase ucounts reference counter before the security hook Andrey Ignatov (1): rtnetlink: Return correct error on changing device netns Ben Skeggs (2): drm/nouveau/disp: power down unused DP links during init drm/nouveau/kms/nv50: workaround EFI GOP window channel format differences Benjamin Berg (2): usb: typec: ucsi: acpi: Always decode connector change information usb: typec: ucsi: Work around PPM losing change information Bjorn Andersson (1): usb: typec: ucsi: Clear pending after acking connector change Christophe JAILLET (1): xgene-v2: Fix a resource leak in the error handling path of 'xge_probe()' Colin Ian King (1): perf/x86/intel/uncore: Fix integer overflow on 23 bit left shift of a u32 DENG Qingfang (1): net: dsa: mt7530: fix VLAN traffic leaks again Daniel Borkmann (1): bpf: Fix ringbuf helper function compatibility Davide Caratti (1): net/sched: ets: fix crash when flipping from 'strict' to 'quantum' Denis Efremov (1): Revert "floppy: reintroduce O_NDELAY fix" Derek Fang (1): ASoC: rt5682: Adjust headset volume button threshold Dinghao Liu (1): RDMA/bnxt_re: Remove unpaired rtnl unlock in bnxt_re_dev_init() Eric Dumazet (2): ipv6: use siphash in rt6_exception_hash() ipv4: use siphash instead of Jenkins in fnhe_hashfun() Filipe Manana (1): btrfs: fix race between marking inode needs to be logged and log syncing Florian Westphal (1): netfilter: conntrack: collect all entries in one cycle Frieder Schrempf (1): mtd: spinand: Fix incorrect parameters for on-die ECC Gal Pressman (1): RDMA/efa: Free IRQ vectors on error flow Gerd Rausch (1): net/rds: dma_map_sg is entitled to merge entries Guenter Roeck (1): ARC: Fix CONFIG_STACKDEPOT Guo Ren (2): riscv: Fixup wrong ftrace remove cflag riscv: Fixup patch_text panic in ftrace Helge Deller (1): Revert "parisc: Add assembly implementations for memset, strlen, strcpy, strncpy and strcat" Jacob Keller (1): ice: do not abort devlink info if board identifier can't be found Jerome Brunet (1): usb: gadget: u_audio: fix race condition on endpoint stop Johan Hovold (1): Revert "USB: serial: ch341: fix character loss at high transfer rates" Johannes Berg (1): iwlwifi: pnvm: accept multiple HW-type TLVs Kees Cook (1): lkdtm: Enable DOUBLE_FAULT on all architectures Kenneth Feng (2): Revert "drm/amd/pm: fix workload mismatch on vega10" drm/amd/pm: change the workload type for some cards Li Jinlin (1): scsi: core: Fix hang of freezing queue between blocking and running device Linus Torvalds (2): pipe: avoid unnecessary EPOLLET wakeups under normal loads pipe: do FASYNC notifications for every pipe IO, not just state changes Mark Brown (2): ASoC: component: Remove misplaced prefix handling in pin control functions net: mscc: Fix non-GPL export of regmap APIs Mark Yacoub (1): drm: Copy drm_wait_vblank to user before returning Mathieu Desnoyers (1): tracepoint: Use rcu get state and cond sync for static call updates Matthew Brost (1): drm/i915: Fix syncmap memory leak Maxim Kiselev (1): net: marvell: fix MVNETA_TX_IN_PRGRS bit number Michael S. Tsirkin (1): tools/virtio: fix build Michał Mirosław (1): opp: remove WARN when no valid OPPs remain Michel Dänzer (1): drm/amdgpu: Cancel delayed work when GFXOFF is disabled Miklos Szeredi (1): ovl: fix uninitialized pointer read in ovl_lookup_real_one() Ming Lei (2): blk-iocost: fix lockdep warning on blkcg->lock blk-mq: don't grab rq's refcount in blk_mq_check_expired() Naresh Kumar PBS (1): RDMA/bnxt_re: Add missing spin lock initialization Neeraj Upadhyay (1): vringh: Use wiov->used to check for read/write desc order Parav Pandit (2): virtio: Improve vq->broken access to avoid any compiler optimization virtio_pci: Support surprise removal of virtio pci device Paul E. McKenney (5): srcu: Provide internal interface to start a Tree SRCU grace period srcu: Provide polling interfaces for Tree SRCU grace periods srcu: Provide internal interface to start a Tiny SRCU grace period srcu: Make Tiny SRCU use multi-bit grace-period counter srcu: Provide polling interfaces for Tiny SRCU grace periods Pauli Virtanen (1): Bluetooth: btusb: check conditions before enabling USB ALT 3 for WBS Peter Collingbourne (1): net: don't unconditionally copy_from_user a struct ifreq for socket ioctls Petko Manolov (1): net: usb: pegasus: fixes of set_register(s) return value evaluation; Petr Vorel (1): arm64: dts: qcom: msm8994-angler: Fix gpio-reserved-ranges 85-88 Qu Wenruo (1): Revert "btrfs: compression: don't try to compress if we don't have enough pages" Rahul Lakkireddy (1): cxgb4: dont touch blocked freelist bitmap after free Richard Guy Briggs (1): audit: move put_tree() to avoid trim_trees refcount underflow and UAF Rob Herring (1): dt-bindings: sifive-l2-cache: Fix 'select' matching Sasha Neftin (2): e1000e: Fix the max snoop/no-snoop latency for 10M e1000e: Do not take care about recovery NVM checksum Shai Malin (2): qed: qed ll2 race condition fixes qed: Fix null-pointer dereference in qed_rdma_create_qp() Shreyansh Chouhan (1): ip_gre: add validation for csum_start Stefan Mätje (1): can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX and TX error counters Takashi Iwai (1): usb: renesas-xhci: Prefer firmware loading on unknown ROM state Thara Gopinath (1): cpufreq: blocklist Qualcomm sm8150 in cpufreq-dt-platdev Thinh Nguyen (1): usb: dwc3: gadget: Fix dwc3_calc_trbs_left() Toshiki Nishioka (1): igc: Use num_tx_queues when iterating over tx_ring queue Tuo Li (1): IB/hfi1: Fix possible null-pointer dereference in _extend_sdma_tx_descs() Ulf Hansson (1): Revert "mmc: sdhci-iproc: Set SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN on BCM2711" Vincent Chen (1): riscv: Ensure the value of FP registers in the core dump file is up to date Vincent Whitchurch (1): virtio_vdpa: reject invalid vq indices Wesley Cheng (1): usb: dwc3: gadget: Stop EP0 transfers during pullup disable Wong Vee Khee (1): net: stmmac: fix kernel panic due to NULL pointer dereference of plat->est Xiaoliang Yang (1): net: stmmac: add mutex lock to protect est parameters Xin Long (1): tipc: call tipc_wait_for_connect only when dlen is not 0 Xiubo Li (1): ceph: correctly handle releasing an embedded cap flush Yonghong Song (2): bpf: Fix NULL pointer dereference in bpf_get_local_storage() helper bpf: Fix potentially incorrect results with bpf_get_local_storage() Zhengjun Zhang (1): USB: serial: option: add new VID/PID to support Fibocom FG150 .../bindings/riscv/sifive-l2-cache.yaml | 6 +- arch/arc/kernel/vmlinux.lds.S | 2 + .../boot/dts/qcom/msm8994-angler-rev-101.dts | 4 + arch/parisc/include/asm/string.h | 15 -- arch/parisc/kernel/parisc_ksyms.c | 4 - arch/parisc/lib/Makefile | 4 +- arch/parisc/lib/memset.c | 72 ++++++++++ arch/parisc/lib/string.S | 136 ------------------ arch/riscv/kernel/Makefile | 5 +- arch/riscv/kernel/ptrace.c | 4 + arch/riscv/mm/Makefile | 3 +- arch/x86/events/intel/uncore_snbep.c | 2 +- block/blk-iocost.c | 8 +- block/blk-mq.c | 30 +--- drivers/block/floppy.c | 30 ++-- drivers/bluetooth/btusb.c | 22 +-- drivers/clk/renesas/rcar-usb2-clock-sel.c | 2 +- drivers/cpufreq/cpufreq-dt-platdev.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 36 +++-- .../drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 15 +- drivers/gpu/drm/drm_ioc32.c | 4 +- drivers/gpu/drm/i915/gt/intel_timeline.c | 8 ++ drivers/gpu/drm/nouveau/dispnv50/disp.c | 27 ++++ drivers/gpu/drm/nouveau/dispnv50/head.c | 13 +- drivers/gpu/drm/nouveau/dispnv50/head.h | 1 + drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.h | 1 + .../gpu/drm/nouveau/nvkm/engine/disp/outp.c | 9 ++ drivers/infiniband/hw/bnxt_re/ib_verbs.c | 1 + drivers/infiniband/hw/bnxt_re/main.c | 1 - drivers/infiniband/hw/efa/efa_main.c | 1 + drivers/infiniband/hw/hfi1/sdma.c | 9 +- drivers/misc/lkdtm/core.c | 2 - drivers/mmc/host/sdhci-iproc.c | 3 +- drivers/mtd/nand/spi/core.c | 6 +- drivers/mtd/nand/spi/macronix.c | 6 +- drivers/mtd/nand/spi/toshiba.c | 6 +- drivers/net/can/usb/esd_usb2.c | 4 +- drivers/net/dsa/mt7530.c | 5 +- drivers/net/ethernet/apm/xgene-v2/main.c | 4 +- .../net/ethernet/chelsio/cxgb4/cxgb4_main.c | 7 +- drivers/net/ethernet/intel/e1000e/ich8lan.c | 32 +++-- drivers/net/ethernet/intel/e1000e/ich8lan.h | 3 + drivers/net/ethernet/intel/ice/ice_devlink.c | 4 +- drivers/net/ethernet/intel/igc/igc_main.c | 36 +++-- drivers/net/ethernet/intel/igc/igc_ptp.c | 3 +- drivers/net/ethernet/marvell/mvneta.c | 2 +- drivers/net/ethernet/mscc/ocelot_io.c | 16 +-- drivers/net/ethernet/qlogic/qed/qed_ll2.c | 20 +++ drivers/net/ethernet/qlogic/qed/qed_rdma.c | 3 +- .../net/ethernet/stmicro/stmmac/stmmac_tc.c | 22 ++- drivers/net/usb/pegasus.c | 4 +- drivers/net/wireless/intel/iwlwifi/fw/pnvm.c | 25 ++-- drivers/opp/of.c | 5 +- drivers/scsi/scsi_sysfs.c | 9 +- drivers/usb/dwc3/gadget.c | 23 ++- drivers/usb/gadget/function/u_audio.c | 5 +- drivers/usb/host/xhci-pci-renesas.c | 35 +++-- drivers/usb/serial/ch341.c | 1 - drivers/usb/serial/option.c | 2 + drivers/usb/typec/ucsi/ucsi.c | 125 +++++++++++++--- drivers/usb/typec/ucsi/ucsi.h | 2 + drivers/usb/typec/ucsi/ucsi_acpi.c | 5 +- drivers/vhost/vringh.c | 2 +- drivers/virtio/virtio_pci_common.c | 7 + drivers/virtio/virtio_ring.c | 6 +- drivers/virtio/virtio_vdpa.c | 3 + fs/btrfs/btrfs_inode.h | 15 ++ fs/btrfs/file.c | 11 +- fs/btrfs/inode.c | 6 +- fs/btrfs/transaction.h | 2 +- fs/ceph/caps.c | 21 +-- fs/ceph/mds_client.c | 7 +- fs/ceph/snap.c | 3 + fs/ceph/super.h | 3 +- fs/overlayfs/export.c | 2 +- fs/pipe.c | 33 +++-- include/linux/bpf-cgroup.h | 4 +- include/linux/bpf.h | 4 +- include/linux/netdevice.h | 4 + include/linux/pipe_fs_i.h | 2 + include/linux/rcupdate.h | 2 + include/linux/srcu.h | 3 + include/linux/srcutiny.h | 7 +- include/linux/stmmac.h | 1 + kernel/audit_tree.c | 2 +- kernel/bpf/helpers.c | 4 +- kernel/bpf/verifier.c | 8 +- kernel/cred.c | 12 +- kernel/rcu/srcutiny.c | 77 ++++++++-- kernel/rcu/srcutree.c | 127 ++++++++++++---- kernel/tracepoint.c | 81 +++++++++-- net/core/rtnetlink.c | 3 +- net/ipv4/ip_gre.c | 2 + net/ipv4/route.c | 12 +- net/ipv6/route.c | 20 ++- net/netfilter/nf_conntrack_core.c | 71 +++------ net/rds/ib_frmr.c | 4 +- net/sched/sch_ets.c | 7 + net/socket.c | 6 +- net/tipc/socket.c | 2 +- sound/soc/codecs/rt5682.c | 1 + sound/soc/soc-component.c | 63 ++++---- tools/virtio/Makefile | 3 +- tools/virtio/linux/spinlock.h | 56 ++++++++ tools/virtio/linux/virtio.h | 2 + 107 files changed, 1025 insertions(+), 600 deletions(-) create mode 100644 arch/parisc/lib/memset.c delete mode 100644 arch/parisc/lib/string.S create mode 100644 tools/virtio/linux/spinlock.h -- 2.20.1

1 89

[PATCH openEuler-5.10] ARM: spectre-v2: turn off the mitigation via boot cmdline param
by Zheng Zengkai 19 Oct '21

19 Oct '21

From: "GONG, Ruiqi" <gongruiqi1(a)huawei.com> hulk inclusion category: feature feature: switch of spectre mitigation bugzilla: 180851 https://gitee.com/openeuler/kernel/issues/I4EF1O ------------------------------------------------- We enable spectre mitigation by default for ARM32, which may cause performance regression. To offer an option to turn off this feature, implement a cmdline parameter 'nospectre_v2' compatible with mainline, which sets up a switch to skip invalidating BTB/icache for A9/A15 in context switching and user abort. Signed-off-by: GONG, Ruiqi <gongruiqi1(a)huawei.com> Cc: Hanjun Guo <guohanjun(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> --- arch/arm/include/asm/system_misc.h | 1 + arch/arm/mm/proc-v7-bugs.c | 18 ++++++++++++++++++ arch/arm/mm/proc-v7.S | 15 +++++++++++++++ 3 files changed, 34 insertions(+) diff --git a/arch/arm/include/asm/system_misc.h b/arch/arm/include/asm/system_misc.h index 66f6a3ae68d2..a7ac0c9f38e5 100644 --- a/arch/arm/include/asm/system_misc.h +++ b/arch/arm/include/asm/system_misc.h @@ -37,6 +37,7 @@ static inline void harden_branch_predictor(void) #define UDBG_BUS (1 << 4) extern unsigned int user_debug; +extern int nospectre_v2; #endif /* !__ASSEMBLY__ */ diff --git a/arch/arm/mm/proc-v7-bugs.c b/arch/arm/mm/proc-v7-bugs.c index 114c05ab4dd9..d7750cddc334 100644 --- a/arch/arm/mm/proc-v7-bugs.c +++ b/arch/arm/mm/proc-v7-bugs.c @@ -8,6 +8,19 @@ #include <asm/proc-fns.h> #include <asm/system_misc.h> +/* + * 32-bit ARM spectre hardening, enabled by default, can be disabled via boot + * cmdline param 'nospectre_v2' to avoid performance regression. + */ +int nospectre_v2 __read_mostly; + +static int __init nospectre_v2_setup(char *str) +{ + nospectre_v2 = 1; + return 0; +} +early_param("nospectre_v2", nospectre_v2_setup); + #ifdef CONFIG_HARDEN_BRANCH_PREDICTOR DEFINE_PER_CPU(harden_branch_predictor_fn_t, harden_branch_predictor_fn); @@ -41,6 +54,11 @@ static void cpu_v7_spectre_init(void) const char *spectre_v2_method = NULL; int cpu = smp_processor_id(); + if (nospectre_v2) { + pr_info_once("Spectre v2: hardening is disabled\n"); + return; + } + if (per_cpu(harden_branch_predictor_fn, cpu)) return; diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S index 28c9d32fa99a..a59ddfd7a179 100644 --- a/arch/arm/mm/proc-v7.S +++ b/arch/arm/mm/proc-v7.S @@ -111,17 +111,32 @@ ENTRY(cpu_v7_hvc_switch_mm) b cpu_v7_switch_mm ENDPROC(cpu_v7_hvc_switch_mm) #endif + +.globl nospectre_v2 ENTRY(cpu_v7_iciallu_switch_mm) + adr r3, 3f + ldr r3, [r3] + cmp r3, #1 + beq 1f mov r3, #0 mcr p15, 0, r3, c7, c5, 0 @ ICIALLU +1: b cpu_v7_switch_mm ENDPROC(cpu_v7_iciallu_switch_mm) ENTRY(cpu_v7_bpiall_switch_mm) + adr r3, 3f + ldr r3, [r3] + cmp r3, #1 + beq 1f mov r3, #0 mcr p15, 0, r3, c7, c5, 6 @ flush BTAC/BTB +1: b cpu_v7_switch_mm ENDPROC(cpu_v7_bpiall_switch_mm) + .align +3: .long nospectre_v2 + string cpu_v7_name, "ARMv7 Processor" .align -- 2.20.1

1 0

[PATCH openEuler-5.10 00/38] bugfix and enhancement for mm/fs/livepatch
by Zheng Zengkai 19 Oct '21

19 Oct '21

Backport bugfix and enhancement patches for mm/fs/livepatch/sched. Al Viro (2): switch file_open_root() to struct path take LOOKUP_{ROOT,ROOT_GRABBED,JUMPED} out of LOOKUP_... space Chen Jun (1): mm: Fix the uninitialized use in overcommit_policy_handler Guoqing Jiang (1): md: revert io stats accounting Kefeng Wang (1): once: Fix panic when module unload Leah Rumancik (1): ext4: wipe ext4_dir_entry2 upon file deletion Li Hua (2): sched/idle: Optimize the loop time algorithm to reduce multicore disturb sched/idle: Reported an error when an illegal negative value is passed Vasily Averin (7): memcg: enable accounting for pids in nested pid namespaces memcg: enable accounting for mnt_cache entries memcg: enable accounting for fasync_cache memcg: enable accounting for new namesapces and struct nsproxy memcg: enable accounting for signals memcg: enable accounting for posix_timers_cache slab memcg: enable accounting for ldt_struct objects Vignesh Raghavendra (1): serial: 8250: 8250_omap: Fix possible array out of bounds access Yang Jihong (1): perf annotate: Add itrace options support Yang Yang (1): kyber: introduce kyber_depth_updated() Ye Bin (1): ext4: fix potential uninitialized access to retval in kmmpd Ye Weihua (9): livepatch: Add state describe for force livepatch: checks only if the replaced instruction is on the stack livepatch/arm64: only check stack top livepatch/arm: only check stack top livepatch/ppc32: only check stack top livepatch/ppc64: only check stack top livepatch/x86: only check stack top livepatch: move arch_klp_mem_recycle after the return value judgment livepatch: Fix compile warnning Yu Jiahua (1): sched: Aware multi-core system for optimize loadtracking Yu Kuai (2): blk-mq: clear active_queues before clearing BLK_MQ_F_TAG_QUEUE_SHARED blk-mq: fix divide by zero crash in tg_may_dispatch() Yutian Yang (1): memcg: charge fs_context and legacy_fs_context Zhang Yi (5): ext4: move inode eio simulation behind io completeion ext4: make the updating inode data procedure atomic ext4: factor out ext4_fill_raw_inode() ext4: move ext4_fill_raw_inode() related functions ext4: prevent getting empty inode buffer Zheng Zucheng (1): sysctl: Refactor IAS framework Documentation/filesystems/path-lookup.rst | 6 +- Documentation/filesystems/porting.rst | 9 + arch/arm/kernel/livepatch.c | 221 +++++++++++-- arch/arm64/kernel/livepatch.c | 209 +++++++++++-- arch/powerpc/kernel/livepatch_32.c | 209 +++++++++++-- arch/powerpc/kernel/livepatch_64.c | 227 ++++++++++---- arch/um/drivers/mconsole_kern.c | 2 +- arch/x86/kernel/ldt.c | 6 +- arch/x86/kernel/livepatch.c | 347 +++++++++++++++------ block/blk-mq.c | 6 +- block/blk-sysfs.c | 7 + block/blk-throttle.c | 37 ++- block/kyber-iosched.c | 29 +- drivers/md/md.c | 45 --- drivers/md/md.h | 1 - drivers/tty/serial/8250/8250_omap.c | 1 + fs/coredump.c | 4 +- fs/ext4/inode.c | 332 +++++++++++--------- fs/ext4/mmp.c | 2 +- fs/ext4/namei.c | 24 +- fs/fcntl.c | 3 +- fs/fhandle.c | 2 +- fs/fs_context.c | 4 +- fs/internal.h | 2 +- fs/kernel_read_file.c | 2 +- fs/namei.c | 60 ++-- fs/namespace.c | 7 +- fs/nfs/nfstrace.h | 4 - fs/open.c | 4 +- fs/proc/proc_sysctl.c | 2 +- include/linux/blkdev.h | 1 + include/linux/fs.h | 9 +- include/linux/kernel.h | 4 +- include/linux/livepatch.h | 4 + include/linux/namei.h | 3 - include/linux/once.h | 4 +- include/linux/sched/sysctl.h | 8 +- init/Kconfig | 36 ++- ipc/namespace.c | 2 +- kernel/cgroup/namespace.c | 2 +- kernel/livepatch/core.c | 2 +- kernel/nsproxy.c | 2 +- kernel/pid_namespace.c | 5 +- kernel/sched/fair.c | 86 ++--- kernel/sched/idle.c | 48 ++- kernel/signal.c | 2 +- kernel/sysctl.c | 84 ++--- kernel/time/namespace.c | 4 +- kernel/time/posix-timers.c | 4 +- kernel/user_namespace.c | 2 +- kernel/usermode_driver.c | 2 +- lib/once.c | 11 +- mm/util.c | 4 +- security/integrity/ima/ima_digest_list.c | 2 +- tools/perf/Documentation/perf-annotate.txt | 7 + tools/perf/builtin-annotate.c | 11 + 56 files changed, 1494 insertions(+), 669 deletions(-) -- 2.20.1

1 38

[PATCH openEuler-5.10 01/12] hfs: fix null-ptr-deref in hfs_find_init()
by Zheng Zengkai 19 Oct '21

19 Oct '21

From: Yang Yingliang <yangyingliang(a)huawei.com> hulk inclusion category: bugfix bugzilla: 179898 https://gitee.com/openeuler/kernel/issues/I4DDEL CVE: CVE-2018-12928 --------------------------- It will cause a null-ptr-deref in hfs_find_init() in fuzz test. [ 107.092729] hfs: continuing without an alternate MDB [ 107.097632] general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI [ 107.104679] KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] [ 107.109100] CPU: 0 PID: 379 Comm: hfs_inject Not tainted 5.7.0-rc7-00001-g24627f5f2973 #897 [ 107.114142] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 107.121095] RIP: 0010:hfs_find_init+0x72/0x170 [ 107.123609] Code: c1 ea 03 80 3c 02 00 0f 85 e6 00 00 00 4c 8d 65 40 48 c7 43 18 00 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e a5 00 00 00 8b 45 40 be c0 0c [ 107.134660] RSP: 0018:ffff88810291f3f8 EFLAGS: 00010202 [ 107.137897] RAX: dffffc0000000000 RBX: ffff88810291f468 RCX: 1ffff110175cdf05 [ 107.141874] RDX: 0000000000000008 RSI: ffff88810291f468 RDI: ffff88810291f480 [ 107.145844] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffed1020381013 [ 107.149431] R10: ffff88810291f500 R11: ffffed1020381012 R12: 0000000000000040 [ 107.152315] R13: 0000000000000000 R14: ffff888101c0814a R15: ffff88810291f468 [ 107.155464] FS: 00000000009ea880(0000) GS:ffff88810c600000(0000) knlGS:0000000000000000 [ 107.159795] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 107.162987] CR2: 00005605a19dd284 CR3: 0000000103a0c006 CR4: 0000000000020ef0 [ 107.166665] Call Trace: [ 107.167969] ? find_held_lock+0x33/0x1c0 [ 107.169972] hfs_ext_read_extent+0x16b/0xb00 [ 107.172092] ? create_page_buffers+0x14e/0x1b0 [ 107.174303] ? hfs_free_extents+0x280/0x280 [ 107.176437] ? lock_downgrade+0x730/0x730 [ 107.178272] hfs_get_block+0x496/0x8a0 [ 107.179972] block_read_full_page+0x241/0x8d0 [ 107.181971] ? hfs_extend_file+0xae0/0xae0 [ 107.183814] ? end_buffer_async_read_io+0x10/0x10 [ 107.185954] ? add_to_page_cache_lru+0x13f/0x1f0 [ 107.188006] ? add_to_page_cache_locked+0x10/0x10 [ 107.190175] do_read_cache_page+0xc6a/0x1180 [ 107.192096] ? generic_file_read_iter+0x4c0/0x4c0 [ 107.194234] ? hfs_btree_open+0x408/0x1000 [ 107.196068] ? lock_downgrade+0x730/0x730 [ 107.197926] ? wake_bit_function+0x180/0x180 [ 107.199845] ? lockdep_init_map_waits+0x267/0x7c0 [ 107.201895] hfs_btree_open+0x455/0x1000 [ 107.203479] hfs_mdb_get+0x122c/0x1ae8 [ 107.205065] ? hfs_mdb_put+0x350/0x350 [ 107.206590] ? queue_work_node+0x260/0x260 [ 107.208309] ? rcu_read_lock_sched_held+0xa1/0xd0 [ 107.210227] ? lockdep_init_map_waits+0x267/0x7c0 [ 107.212144] ? lockdep_init_map_waits+0x267/0x7c0 [ 107.213979] hfs_fill_super+0x9ba/0x1280 [ 107.215444] ? bdev_name.isra.9+0xf1/0x2b0 [ 107.217028] ? hfs_remount+0x190/0x190 [ 107.218428] ? pointer+0x5da/0x710 [ 107.219745] ? file_dentry_name+0xf0/0xf0 [ 107.221262] ? mount_bdev+0xd1/0x330 [ 107.222592] ? vsnprintf+0x7bd/0x1250 [ 107.224007] ? pointer+0x710/0x710 [ 107.225332] ? down_write+0xe5/0x160 [ 107.226698] ? hfs_remount+0x190/0x190 [ 107.228120] ? snprintf+0x91/0xc0 [ 107.229388] ? vsprintf+0x10/0x10 [ 107.230628] ? sget+0x3af/0x4a0 [ 107.231848] ? hfs_remount+0x190/0x190 [ 107.233300] mount_bdev+0x26e/0x330 [ 107.234611] ? hfs_statfs+0x540/0x540 [ 107.236015] legacy_get_tree+0x101/0x1f0 [ 107.237431] ? security_capable+0x58/0x90 [ 107.238832] vfs_get_tree+0x89/0x2d0 [ 107.240082] ? ns_capable_common+0x5c/0xd0 [ 107.241521] do_mount+0xd8a/0x1720 [ 107.242727] ? lock_downgrade+0x730/0x730 [ 107.244116] ? copy_mount_string+0x20/0x20 [ 107.245557] ? _copy_from_user+0xbe/0x100 [ 107.246967] ? memdup_user+0x47/0x70 [ 107.248212] __x64_sys_mount+0x162/0x1b0 [ 107.249537] do_syscall_64+0xa5/0x4f0 [ 107.250742] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 107.252369] RIP: 0033:0x44e8ea [ 107.253360] Code: 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 107.259240] RSP: 002b:00007ffd910e4c28 EFLAGS: 00000207 ORIG_RAX: 00000000000000a5 [ 107.261668] RAX: ffffffffffffffda RBX: 0000000000400400 RCX: 000000000044e8ea [ 107.263920] RDX: 000000000049321e RSI: 0000000000493222 RDI: 00007ffd910e4d00 [ 107.266177] RBP: 00007ffd910e5d10 R08: 0000000000000000 R09: 000000000000000a [ 107.268451] R10: 0000000000000001 R11: 0000000000000207 R12: 0000000000401c40 [ 107.270721] R13: 0000000000000000 R14: 00000000006ba018 R15: 0000000000000000 [ 107.273025] Modules linked in: [ 107.274029] Dumping ftrace buffer: [ 107.275121] (ftrace buffer empty) [ 107.276370] ---[ end trace c5e0b9d684f3570e ]--- We need check tree in hfs_find_init(). https://lore.kernel.org/linux-fsdevel/20180419024358.GA5215@bombadil.infrad… https://marc.info/?l=linux-fsdevel&m=152406881024567&w=2 References: CVE-2018-12928 Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> --- fs/hfs/bfind.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/hfs/bfind.c b/fs/hfs/bfind.c index ef9498a6e88a..ae44c8fa86ec 100644 --- a/fs/hfs/bfind.c +++ b/fs/hfs/bfind.c @@ -16,6 +16,8 @@ int hfs_find_init(struct hfs_btree *tree, struct hfs_find_data *fd) { void *ptr; + if (!tree) + return -EINVAL; fd->tree = tree; fd->bnode = NULL; ptr = kmalloc(tree->max_key_len * 2 + 4, GFP_KERNEL); -- 2.20.1

1 11

[PATCH openEuler-5.10 00/94] Backport LTS 5.10.61
by Zheng Zengkai 19 Oct '21

19 Oct '21

Backport LTS 5.10.61 patches from upstream. Adrian Larumbe (1): dmaengine: xilinx_dma: Fix read-after-free bug when terminating transfers Alan Stern (2): USB: core: Avoid WARNings for 0-length descriptor requests USB: core: Fix incorrect pipe calculation in do_proc_control() Andreas Persson (1): mtd: cfi_cmdset_0002: fix crash when erasing/writing AMD cards Andy Shevchenko (1): ptp_pch: Restore dependency on PCI Arkadiusz Kubalewski (1): i40e: Fix ATR queue selection Bing Guo (1): drm/amd/display: Fix Dynamic bpp issue with 8K30 with Navi 1X Bjorn Andersson (1): clk: qcom: gdsc: Ensure regulator init state matches GDSC state Christophe Kerello (1): mmc: mmci: stm32: Check when the voltage switch procedure should be done Dan Carpenter (1): media: zr364xx: fix memory leaks in probe() Dave Gerlach (1): ARM: dts: am43x-epos-evm: Reduce i2c0 bus speed for tps65218 Dinghao Liu (1): net: qlcnic: add missed unlock in qlcnic_83xx_flash_read32 Dong Aisheng (1): clk: imx6q: fix uart earlycon unwork Dongliang Mu (2): ipack: tpci200: fix many double free issues in tpci200_pci_probe ipack: tpci200: fix memory leak in the tpci200_register Eli Cohen (1): vdpa/mlx5: Avoid destroying MR on empty iotlb Evgeny Novikov (1): media: zr364xx: propagate errors from zr364xx_start_readpipe() Frank Wunderlich (1): iommu: Check if group is NULL before remove device Harshvardhan Jha (2): net: xfrm: Fix end of loop tests for list_for_each_entry scsi: megaraid_mm: Fix end of loop tests for list_for_each_entry() Hayes Wang (1): r8152: fix writing USB_BP2_EN Ido Schimmel (1): Revert "flow_offload: action should not be NULL when it is referenced" Igor Pylypiv (1): scsi: pm80xx: Fix TMF task completion race condition Ilya Leoshkevich (1): bpf: Clear zext_dst of dead insns Ivan T. Ivanov (1): net: usb: lan78xx: don't modify phy_device state concurrently Jakub Kicinski (4): bnxt: don't lock the tx queue from napi poll bnxt: disable napi before canceling DIM bnxt: make sure xmit_more + errors does not miss doorbells bnxt: count Tx drops Jaroslav Kysela (1): ALSA: hda - fix the 'Capture Switch' value change notifications Jason Wang (1): virtio-net: use NETIF_F_GRO_HW instead of NETIF_F_LRO Jeff Layton (1): fs: warn about impending deprecation of mandatory locks Jens Axboe (2): io_uring: fix xa_alloc_cycle() error return value check io_uring: only assign io_uring_enter() SQPOLL error in actual error case Johannes Weiner (1): mm: memcontrol: fix occasional OOMs due to proportional memory.low reclaim Jouni Malinen (5): ath: Use safer key clearing with key cache entries ath9k: Clear key cache explicitly on disabling hardware ath: Export ath_hw_keysetmac() ath: Modify ath_key_delete() to not need full key entry ath9k: Postpone key cache entry deletion for TXQ frames reference it Kai-Heng Feng (1): ALSA: hda/realtek: Limit mic boost on HP ProBook 445 G8 Kristin Paget (1): ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9510 laptop Lahav Schlesinger (1): vrf: Reset skb conntrack connection on VRF rcv Liu Yi L (1): iommu/vt-d: Fix incomplete cache flush in intel_pasid_tear_down_entry() Lu Baolu (1): iommu/vt-d: Consolidate duplicate cache invaliation code Marcin Bachry (1): PCI: Increase D3 delay for AMD Renoir/Cezanne XHCI Marek Behún (1): cpufreq: armada-37xx: forbid cpufreq for 1.2 GHz variant Michael Chan (2): bnxt_en: Disable aRFS if running on 212 firmware bnxt_en: Add missing DMA memory barriers NeilBrown (1): btrfs: prevent rename2 from exchanging a subvol with a directory from different parents Nicolas Saenz Julienne (2): mmc: sdhci-iproc: Cap min clock frequency on BCM2711 mmc: sdhci-iproc: Set SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN on BCM2711 Niklas Schnelle (1): s390/pci: fix use after free of zpci_dev Ole Bjørn Midtbø (1): Bluetooth: hidp: use correct wait queue when removing ctrl_wait Parav Pandit (1): virtio: Protect vqs list access Pavel Skripkin (2): media: drivers/media/usb: fix memory leak in zr364xx_probe net: 6pack: fix slab-out-of-bounds in decode_data Peter Ujfalusi (1): dmaengine: of-dma: router_xlate to return -EPROBE_DEFER if controller is not yet available Petko Manolov (1): net: usb: pegasus: Check the return value of get_geristers() and friends; Petr Vorel (1): arm64: dts: qcom: msm8992-bullhead: Remove PSCI Prabhakar Kushwaha (1): qede: fix crash in rmmod qede while automatic debug collection Qingqing Zhuo (1): drm/amd/display: workaround for hard hang on HPD on native DP Randy Dunlap (1): dccp: add do-while-0 stubs for dccp_pr_debug macros Saravana Kannan (2): net: mdio-mux: Don't ignore memory allocation errors net: mdio-mux: Handle -EPROBE_DEFER correctly Shaik Sajida Bhanu (1): mmc: sdhci-msm: Update the software timeout value for sdhc Sreekanth Reddy (1): scsi: core: Avoid printing an error if target_alloc() returns -ENXIO Srinivas Kandagatla (4): arm64: dts: qcom: c630: fix correct powerdown pin for WSA881x slimbus: messaging: start transaction ids from 1 instead of zero slimbus: messaging: check for valid transaction id slimbus: ngd: reset dma setup during runtime pm Steven Rostedt (VMware) (1): tracing / histogram: Fix NULL pointer dereference on strcmp() on NULL event name Sudeep Holla (1): ARM: dts: nomadik: Fix up interrupt controller node names Sylwester Dziedziuch (1): iavf: Fix ping is lost after untrusted VF had tried to change MAC Takashi Iwai (2): ALSA: hda/via: Apply runtime PM workaround for ASUS B23E ASoC: intel: atom: Fix breakage for PCM buffer address setup Toke Høiland-Jørgensen (1): sch_cake: fix srchost/dsthost hashing mode Tony Lindgren (1): bus: ti-sysc: Fix error handling for sysc_check_active_timer() Uwe Kleine-König (1): spi: spi-mux: Add module info needed for autoloading Vincent Whitchurch (1): mmc: dw_mmc: Fix hang on data CRC error Wang Hai (1): ixgbe, xsk: clean up the resources in ixgbe_xsk_pool_enable error path Wanpeng Li (1): KVM: X86: Fix warning caused by stale emulation context Wei Huang (1): KVM: x86: Factor out x86 instruction emulation with decoding Xie Yongji (2): vhost-vdpa: Fix integer overflow in vhost_vdpa_process_iotlb_update() vhost: Fix the calculation in vhost_overflow() Xuan Zhuo (1): virtio-net: support XDP when not more queues Ye Bin (1): scsi: scsi_dh_rdac: Avoid crash during rdac_bus_attach() Yifan Zhang (1): drm/amdgpu: fix the doorbell missing when in CGPG issue for renoir. Yongqiang Niu (2): soc / drm: mediatek: Move DDP component defines into mtk-mmsys.h drm/mediatek: Fix aal size config Yu Kuai (1): dmaengine: usb-dmac: Fix PM reference leak in usb_dmac_probe() jason-jh.lin (1): drm/mediatek: Add AAL output size configuration kaixi.fan (1): ovs: clear skb->tstamp in forwarding path lijinlin (1): scsi: core: Fix capacity set to zero after offlinining device arch/arm/boot/dts/am43x-epos-evm.dts | 2 +- arch/arm/boot/dts/ste-nomadik-stn8815.dtsi | 4 +- .../dts/qcom/msm8992-bullhead-rev-101.dts | 4 + .../boot/dts/qcom/sdm850-lenovo-yoga-c630.dts | 4 +- arch/s390/pci/pci.c | 6 + arch/s390/pci/pci_bus.h | 5 + arch/x86/kvm/x86.c | 62 ++++++---- arch/x86/kvm/x86.h | 2 + drivers/bus/ti-sysc.c | 4 +- drivers/clk/imx/clk-imx6q.c | 2 +- drivers/clk/qcom/gdsc.c | 54 ++++++--- drivers/cpufreq/armada-37xx-cpufreq.c | 6 +- drivers/dma/of-dma.c | 9 +- drivers/dma/sh/usb-dmac.c | 2 +- drivers/dma/xilinx/xilinx_dma.c | 12 ++ drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 21 +++- .../amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c | 4 +- .../gpu/drm/amd/display/dc/dcn20/dcn20_optc.c | 2 +- drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c | 4 +- drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h | 34 +----- drivers/iommu/intel/pasid.c | 26 ++-- drivers/iommu/intel/pasid.h | 6 + drivers/iommu/intel/svm.c | 55 ++------- drivers/iommu/iommu.c | 3 + drivers/ipack/carriers/tpci200.c | 60 +++++----- drivers/media/usb/zr364xx/zr364xx.c | 77 ++++++++---- drivers/mmc/host/dw_mmc.c | 6 +- drivers/mmc/host/mmci_stm32_sdmmc.c | 7 +- drivers/mmc/host/sdhci-iproc.c | 21 +++- drivers/mmc/host/sdhci-msm.c | 18 +++ drivers/mtd/chips/cfi_cmdset_0002.c | 2 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 113 ++++++++++++------ drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + drivers/net/ethernet/intel/i40e/i40e_txrx.c | 3 +- drivers/net/ethernet/intel/iavf/iavf.h | 1 + drivers/net/ethernet/intel/iavf/iavf_main.c | 1 + .../net/ethernet/intel/iavf/iavf_virtchnl.c | 47 +++++++- drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c | 5 +- drivers/net/ethernet/qlogic/qede/qede.h | 1 + drivers/net/ethernet/qlogic/qede/qede_main.c | 8 ++ .../ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | 4 +- drivers/net/hamradio/6pack.c | 6 + drivers/net/mdio/mdio-mux.c | 36 ++++-- drivers/net/usb/lan78xx.c | 16 ++- drivers/net/usb/pegasus.c | 108 ++++++++++++----- drivers/net/usb/r8152.c | 2 +- drivers/net/virtio_net.c | 76 ++++++++---- drivers/net/vrf.c | 4 + drivers/net/wireless/ath/ath.h | 3 +- drivers/net/wireless/ath/ath5k/mac80211-ops.c | 2 +- drivers/net/wireless/ath/ath9k/htc_drv_main.c | 2 +- drivers/net/wireless/ath/ath9k/hw.h | 1 + drivers/net/wireless/ath/ath9k/main.c | 95 ++++++++++++++- drivers/net/wireless/ath/key.c | 41 ++++--- drivers/pci/quirks.c | 1 + drivers/ptp/Kconfig | 3 +- drivers/scsi/device_handler/scsi_dh_rdac.c | 4 +- drivers/scsi/megaraid/megaraid_mm.c | 21 +++- drivers/scsi/pm8001/pm8001_sas.c | 32 +++-- drivers/scsi/scsi_scan.c | 3 +- drivers/scsi/scsi_sysfs.c | 9 +- drivers/slimbus/messaging.c | 7 +- drivers/slimbus/qcom-ngd-ctrl.c | 5 +- drivers/soc/mediatek/mtk-mmsys.c | 4 +- drivers/spi/spi-mux.c | 8 ++ drivers/usb/core/devio.c | 2 +- drivers/usb/core/message.c | 6 + drivers/vdpa/mlx5/core/mr.c | 9 -- drivers/vhost/vdpa.c | 3 +- drivers/vhost/vhost.c | 10 +- drivers/virtio/virtio.c | 1 + drivers/virtio/virtio_ring.c | 8 ++ fs/btrfs/inode.c | 10 +- fs/io_uring.c | 16 +-- fs/namespace.c | 6 +- include/linux/memcontrol.h | 29 ++--- include/linux/soc/mediatek/mtk-mmsys.h | 33 +++++ include/linux/virtio.h | 1 + include/net/flow_offload.h | 12 +- kernel/bpf/verifier.c | 1 + kernel/trace/trace_events_hist.c | 2 + mm/vmscan.c | 27 +++-- net/bluetooth/hidp/core.c | 2 +- net/dccp/dccp.h | 6 +- net/openvswitch/vport.c | 1 + net/sched/sch_cake.c | 2 +- net/xfrm/xfrm_ipcomp.c | 2 +- sound/pci/hda/hda_generic.c | 10 +- sound/pci/hda/patch_realtek.c | 12 +- sound/pci/hda/patch_via.c | 1 + sound/soc/intel/atom/sst-mfld-platform-pcm.c | 2 +- 91 files changed, 964 insertions(+), 447 deletions(-) -- 2.20.1

1 94

[PATCH openEuler-5.10 000/101] Backport LTS 5.10.60
by Zheng Zengkai 19 Oct '21

19 Oct '21

Backport LTS 5.10.60 patches from upstream. Alex Deucher (1): drm/amdgpu: don't enable baco on boco platforms in runpm Andy Shevchenko (1): pinctrl: tigerlake: Fix GPIO mapping for newer version of software Anirudh Venkataramanan (1): ice: Prevent probing virtual functions Anson Jacob (1): drm/amd/display: use GFP_ATOMIC in amdgpu_dm_irq_schedule_work Antti Keränen (1): iio: adis: set GPIO reset pin direction Ard Biesheuvel (3): efi/libstub: arm64: Force Image reallocation if BSS was not reserved efi/libstub: arm64: Relax 2M alignment again for relocatable kernels efi/libstub: arm64: Double check image alignment at entry Aya Levin (1): net/mlx5: Fix return value from tracer initialization Babu Moger (1): x86/resctrl: Fix default monitoring groups reporting Ben Dai (1): genirq/timings: Prevent potential array overflow in __irq_timings_store() Ben Hutchings (8): net: phy: micrel: Fix link detection on ksz87xx switch" net: dsa: microchip: Fix ksz_read64() net: dsa: microchip: ksz8795: Fix VLAN filtering net: dsa: microchip: Fix probing KSZ87xx switch with DT node for host port net: dsa: microchip: ksz8795: Fix PVID tag insertion net: dsa: microchip: ksz8795: Reject unsupported VLAN configuration net: dsa: microchip: ksz8795: Fix VLAN untagged flag change on deletion net: dsa: microchip: ksz8795: Use software untagging on CPU port Benjamin Herrenschmidt (1): arm64: efi: kaslr: Fix occasional random alloc (and boot) failure Bixuan Cui (1): genirq/msi: Ensure deactivation on teardown Brett Creeley (1): ice: don't remove netdev->dev_addr from uc sync list Chris Lesiak (1): iio: humidity: hdc100x: Add margin to the conversion time Christian Hewitt (1): drm/meson: fix colour distortion from HDR set during vendor u-boot Christophe Leroy (1): powerpc/smp: Fix OOPS in topology_init() Colin Ian King (1): iio: adc: Fix incorrect exit of for-loop DENG Qingfang (1): net: dsa: mt7530: add the missing RxUnicast MIB counter Dan Williams (2): ACPI: NFIT: Fix support for virtual SPA ranges libnvdimm/region: Fix label activation vs errors Dongliang Mu (2): ieee802154: hwsim: fix GPF in hwsim_set_edge_lqi ieee802154: hwsim: fix GPF in hwsim_new_edge_nl Eric Bernstein (1): drm/amd/display: Remove invalid assert for ODM + MPC case Eric Dumazet (2): net: igmp: fix data-race in igmp_ifc_timer_expire() net: igmp: increase size of mr_ifc_count Ewan D. Milne (1): scsi: lpfc: Move initialization of phba->poll_list earlier to avoid crash Greg Kroah-Hartman (1): i2c: dev: zero out array used for i2c reads from userspace Grygorii Strashko (1): net: ethernet: ti: cpsw: fix min eth packet size for non-switch use-cases Guennadi Liakhovetski (1): ASoC: SOF: Intel: hda-ipc: fix reply size checking Guillaume Nault (1): bareudp: Fix invalid read beyond skb's linear data Hangbin Liu (1): net: sched: act_mirred: Reset ct info when mirror/redirect skb Hans de Goede (3): platform/x86: pcengines-apuv2: Add missing terminating entries to gpio-lookup tables vboxsf: Add vboxsf_[create|release]_sf_handle() helpers vboxsf: Add support for the atomic_open directory-inode op Hsin-Yi Wang (1): pinctrl: mediatek: Fix fallback behavior for bias_set_combo Hsuan-Chi Kuo (1): seccomp: Fix setting loaded filter count during TSYNC Jeff Layton (3): ceph: add some lockdep assertions around snaprealm handling ceph: clean up locking annotation for ceph_get_snap_realm and __lookup_snap_realm ceph: take snap_empty_lock atomically with snaprealm refcount change John Hubbard (1): net: mvvp2: fix short frame size on s390 Karsten Graul (1): net/smc: fix wait on already cleared link Longpeng(Mike) (1): vsock/virtio: avoid potential deadlock when vsock device remove Luis Henriques (1): ceph: reduce contention in ceph_check_delayed_caps() Mark Brown (1): ASoC: tlv320aic31xx: Fix jack detection after suspend Matt Roper (1): drm/i915: Only access SFC_DONE when media domain is not fused off Maxim Levitsky (2): KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653) KVM: nSVM: always intercept VMLOAD/VMSAVE when nested (CVE-2021-3656) Maximilian Heyne (1): xen/events: Fix race in set_evtchn_to_irq Md Fahad Iqbal Polash (1): iavf: Set RSS LUT and key in reset handle path Nathan Chancellor (1): vmlinux.lds.h: Handle clang's module.{c,d}tor sections Neal Cardwell (1): tcp_bbr: fix u32 wrap bug in round logic if bbr_init() called after 2B packets Nikolay Aleksandrov (1): net: bridge: fix flags interpretation for extern learn fdb entries Pali Rohár (1): ppp: Fix generating ifname when empty IFLA_IFNAME is specified Randy Dunlap (1): x86/tools: Fix objdump version check again Richard Fitzgerald (5): ASoC: cs42l42: Correct definition of ADC Volume control ASoC: cs42l42: Don't allow SND_SOC_DAIFMT_LEFT_J ASoC: cs42l42: Fix inversion of ADC Notch Switch control ASoC: cs42l42: Remove duplicate control for WNF filter frequency ASoC: cs42l42: Fix LRCLK frame start edge Robin Gögge (1): libbpf: Fix probe for BPF_PROG_TYPE_CGROUP_SOCKOPT Roi Dayan (1): psample: Add a fwd declaration for skbuff Sean Christopherson (2): KVM: VMX: Use current VMCS to query WAITPKG support for MSR emulation KVM: nVMX: Use vmx_need_pf_intercept() when deciding if L0 wants a #PF Shay Drory (1): net/mlx5: Synchronize correct IRQ when destroying CQ Shyam Prasad N (1): cifs: create sd context must be a multiple of 8 Takashi Iwai (4): ASoC: amd: Fix reference to PCM buffer address ASoC: xilinx: Fix reference to PCM buffer address ASoC: uniphier: Fix reference to PCM buffer address ASoC: intel: atom: Fix reference to PCM buffer address Takeshi Misawa (1): net: Fix memory leak in ieee802154_raw_deliver Tatsuhiko Yasumatsu (1): bpf: Fix integer overflow involving bucket_size Thomas Gleixner (11): genirq: Provide IRQCHIP_AFFINITY_PRE_STARTUP x86/msi: Force affinity setup before startup x86/ioapic: Force affinity setup before startup PCI/MSI: Enable and mask MSI-X early PCI/MSI: Mask all unused MSI-X entries PCI/MSI: Enforce that MSI-X table entry is masked for update PCI/MSI: Enforce MSI[X] entry updates to be visible PCI/MSI: Do not set invalid bits in MSI mask PCI/MSI: Correct misleading comments PCI/MSI: Use msi_mask_irq() in pci_msi_shutdown() PCI/MSI: Protect msi_desc::masked for multi-MSI Uwe Kleine-König (1): iio: adc: ti-ads7950: Ensure CS is deasserted after reading channels Vineet Gupta (1): ARC: fp: set FPU_STATUS.FWE to enable FPU_STATUS update on context switch Vladimir Oltean (4): net: dsa: lan9303: fix broken backpressure in .port_fdb_dump net: dsa: lantiq: fix broken backpressure in .port_fdb_dump net: dsa: sja1105: fix broken backpressure in .port_fdb_dump net: bridge: validate the NUD_PERMANENT bit when adding an extern_learn FDB entry Willy Tarreau (1): net: linkwatch: fix failure to restore device state across suspend/resume Xie Yongji (1): nbd: Aovid double completion of a request Yajun Deng (1): netfilter: nf_conntrack_bridge: Fix memory leak when error Yang Yingliang (1): net: bridge: fix memleak in br_add_if() arch/arc/kernel/fpu.c | 9 +- arch/powerpc/kernel/sysfs.c | 2 +- arch/x86/include/asm/svm.h | 2 + arch/x86/kernel/apic/io_apic.c | 6 +- arch/x86/kernel/apic/msi.c | 13 +- arch/x86/kernel/cpu/resctrl/monitor.c | 27 ++-- arch/x86/kvm/svm/nested.c | 14 +- arch/x86/kvm/svm/svm.c | 8 +- arch/x86/kvm/vmx/nested.c | 3 +- arch/x86/kvm/vmx/vmx.h | 2 +- arch/x86/tools/chkobjdump.awk | 1 + drivers/acpi/nfit/core.c | 3 + drivers/base/core.c | 1 + drivers/block/nbd.c | 14 +- drivers/firmware/efi/libstub/arm64-stub.c | 69 ++++++++-- drivers/firmware/efi/libstub/randomalloc.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 2 + .../drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c | 2 +- .../drm/amd/display/dc/dcn30/dcn30_resource.c | 1 - drivers/gpu/drm/i915/i915_gpu_error.c | 19 ++- drivers/gpu/drm/meson/meson_registers.h | 5 + drivers/gpu/drm/meson/meson_viu.c | 7 +- drivers/i2c/i2c-dev.c | 5 +- drivers/iio/adc/palmas_gpadc.c | 4 +- drivers/iio/adc/ti-ads7950.c | 1 - drivers/iio/humidity/hdc100x.c | 6 +- drivers/iio/imu/adis.c | 3 +- drivers/infiniband/hw/mlx5/cq.c | 4 +- drivers/infiniband/hw/mlx5/devx.c | 3 +- drivers/net/bareudp.c | 16 ++- drivers/net/dsa/lan9303-core.c | 34 ++--- drivers/net/dsa/lantiq_gswip.c | 14 +- drivers/net/dsa/microchip/ksz8795.c | 91 +++++++++++-- drivers/net/dsa/microchip/ksz_common.c | 2 +- drivers/net/dsa/microchip/ksz_common.h | 9 +- drivers/net/dsa/mt7530.c | 1 + drivers/net/dsa/sja1105/sja1105_main.c | 4 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 13 +- drivers/net/ethernet/intel/ice/ice_main.c | 28 ++-- drivers/net/ethernet/marvell/mvpp2/mvpp2.h | 2 +- drivers/net/ethernet/mellanox/mlx5/core/cq.c | 1 + .../mellanox/mlx5/core/diag/fw_tracer.c | 11 +- .../net/ethernet/mellanox/mlx5/core/en_main.c | 13 +- drivers/net/ethernet/mellanox/mlx5/core/eq.c | 20 ++- .../ethernet/mellanox/mlx5/core/fpga/conn.c | 4 +- .../net/ethernet/mellanox/mlx5/core/lib/eq.h | 2 + .../mellanox/mlx5/core/steering/dr_send.c | 4 +- drivers/net/ethernet/ti/cpsw_new.c | 7 +- drivers/net/ethernet/ti/cpsw_priv.h | 4 +- drivers/net/ieee802154/mac802154_hwsim.c | 6 +- drivers/net/phy/micrel.c | 2 - drivers/net/ppp/ppp_generic.c | 2 +- drivers/nvdimm/namespace_devs.c | 17 ++- drivers/pci/msi.c | 125 +++++++++++------- drivers/pinctrl/intel/pinctrl-tigerlake.c | 26 ++-- .../pinctrl/mediatek/pinctrl-mtk-common-v2.c | 8 +- drivers/platform/x86/pcengines-apuv2.c | 2 + drivers/scsi/lpfc/lpfc_init.c | 3 +- drivers/vdpa/mlx5/net/mlx5_vnet.c | 3 +- drivers/xen/events/events_base.c | 20 ++- fs/ceph/caps.c | 17 ++- fs/ceph/mds_client.c | 25 ++-- fs/ceph/snap.c | 54 +++++--- fs/ceph/super.h | 2 +- fs/cifs/smb2pdu.c | 2 +- fs/vboxsf/dir.c | 48 +++++++ fs/vboxsf/file.c | 71 ++++++---- fs/vboxsf/vfsmod.h | 7 + include/asm-generic/vmlinux.lds.h | 1 + include/linux/device.h | 1 + include/linux/inetdevice.h | 2 +- include/linux/irq.h | 2 + include/linux/mlx5/driver.h | 3 +- include/linux/msi.h | 2 +- include/net/psample.h | 2 + include/uapi/linux/neighbour.h | 7 +- kernel/bpf/hashtab.c | 4 +- kernel/irq/chip.c | 5 +- kernel/irq/msi.c | 13 +- kernel/irq/timings.c | 5 + kernel/seccomp.c | 2 +- net/bridge/br_fdb.c | 23 +++- net/bridge/br_if.c | 2 + net/bridge/netfilter/nf_conntrack_bridge.c | 6 + net/core/link_watch.c | 5 +- net/ieee802154/socket.c | 7 +- net/ipv4/igmp.c | 21 ++- net/ipv4/tcp_bbr.c | 2 +- net/sched/act_mirred.c | 3 + net/smc/smc_core.h | 2 + net/smc/smc_llc.c | 10 +- net/smc/smc_tx.c | 18 ++- net/smc/smc_wr.c | 10 ++ net/vmw_vsock/virtio_transport.c | 7 +- sound/soc/amd/acp-pcm-dma.c | 2 +- sound/soc/amd/raven/acp3x-pcm-dma.c | 2 +- sound/soc/amd/renoir/acp3x-pdm-dma.c | 2 +- sound/soc/codecs/cs42l42.c | 39 +++--- sound/soc/codecs/tlv320aic31xx.c | 10 ++ sound/soc/intel/atom/sst-mfld-platform-pcm.c | 3 +- sound/soc/sof/intel/hda-ipc.c | 4 +- sound/soc/uniphier/aio-dma.c | 2 +- sound/soc/xilinx/xlnx_formatter_pcm.c | 4 +- tools/lib/bpf/libbpf_probes.c | 4 +- 104 files changed, 829 insertions(+), 366 deletions(-) -- 2.20.1

1 101

[PATCH openEuler-5.10 00/18] Backport LTS 5.10.59
by Zheng Zengkai 19 Oct '21

19 Oct '21

Backport LTS 5.10.59 patches from upstream. Adam Ford (3): arm64: dts: renesas: rzg2: Add usb2_clksel to RZ/G2 M/N/H arm64: dts: renesas: beacon: Fix USB extal reference arm64: dts: renesas: beacon: Fix USB ref clock references Allen Pais (1): firmware: tee_bnxt: Release TEE shm, session, and context during kexec Daniel Borkmann (1): bpf: Add lockdown check for probe_write_user helper Hans de Goede (2): vboxsf: Honor excl flag to the dir-inode create op vboxsf: Make vboxsf_dir_create() return the handle for the created file Jeremy Szu (1): ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 650 G8 Notebook PC Longfang Liu (1): USB:ehci:fix Kunpeng920 ehci hardware problem Luke D Jones (1): ALSA: hda: Add quirk for ASUS Flow x13 Mike Rapoport (1): mm: make zone_to_nid() and zone_set_nid() available for DISCONTIGMEM Miklos Szeredi (1): ovl: prevent private clone if bind mount is not allowed Pali Rohár (1): ppp: Fix generating ppp unit id when ifname is not specified Reinette Chatre (1): Revert "selftests/resctrl: Use resctrl/info for feature detection" Sean Christopherson (1): KVM: SVM: Fix off-by-one indexing when nullifying last used SEV VMCB Sumit Garg (1): tee: Correct inappropriate usage of TEE_SHM_DMA_BUF flag Takashi Iwai (1): ALSA: pcm: Fix mmap breakage without explicit buffer setup YueHaibing (1): net: xilinx_emaclite: Do not print real IOMEM pointer .../dts/renesas/beacon-renesom-baseboard.dtsi | 4 +- .../boot/dts/renesas/beacon-renesom-som.dtsi | 6 ++- arch/arm64/boot/dts/renesas/r8a774a1.dtsi | 15 ++++++ arch/arm64/boot/dts/renesas/r8a774b1.dtsi | 15 ++++++ arch/arm64/boot/dts/renesas/r8a774e1.dtsi | 15 ++++++ arch/x86/kvm/svm/sev.c | 2 +- drivers/firmware/broadcom/tee_bnxt_fw.c | 14 +++-- drivers/net/ethernet/xilinx/xilinx_emaclite.c | 5 +- drivers/net/ppp/ppp_generic.c | 19 +++++-- drivers/tee/optee/call.c | 2 +- drivers/tee/optee/core.c | 3 +- drivers/tee/optee/rpc.c | 5 +- drivers/tee/optee/shm_pool.c | 8 ++- drivers/tee/tee_shm.c | 4 +- drivers/usb/host/ehci-pci.c | 3 ++ fs/namespace.c | 42 ++++++++++----- fs/vboxsf/dir.c | 28 ++++++---- include/linux/mmzone.h | 4 +- include/linux/security.h | 1 + include/linux/tee_drv.h | 1 + kernel/trace/bpf_trace.c | 5 +- security/security.c | 1 + sound/core/pcm_native.c | 5 +- sound/pci/hda/patch_realtek.c | 2 + tools/testing/selftests/resctrl/resctrl.h | 6 +-- tools/testing/selftests/resctrl/resctrlfs.c | 52 ++++--------------- 26 files changed, 168 insertions(+), 99 deletions(-) -- 2.20.1

1 18

[PATCH openEuler-5.10 1/2] sched/rt: Fix double enqueue caused by rt_effective_prio
by Zheng Zengkai 19 Oct '21

19 Oct '21

From: Peter Zijlstra <peterz(a)infradead.org> stable inclusion from stable-5.10.58 commit a3e6bd0c71bb5e4821aff9ab8f221bfc08039d73 bugzilla: 176984 https://gitee.com/openeuler/kernel/issues/I4E2P4 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f558c2b834ec27e75d37b1c860c139e7b7c3a8e4 upstream. Double enqueues in rt runqueues (list) have been reported while running a simple test that spawns a number of threads doing a short sleep/run pattern while being concurrently setscheduled between rt and fair class. WARNING: CPU: 3 PID: 2825 at kernel/sched/rt.c:1294 enqueue_task_rt+0x355/0x360 CPU: 3 PID: 2825 Comm: setsched__13 RIP: 0010:enqueue_task_rt+0x355/0x360 Call Trace: __sched_setscheduler+0x581/0x9d0 _sched_setscheduler+0x63/0xa0 do_sched_setscheduler+0xa0/0x150 __x64_sys_sched_setscheduler+0x1a/0x30 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xae list_add double add: new=ffff9867cb629b40, prev=ffff9867cb629b40, next=ffff98679fc67ca0. kernel BUG at lib/list_debug.c:31! invalid opcode: 0000 [#1] PREEMPT_RT SMP PTI CPU: 3 PID: 2825 Comm: setsched__13 RIP: 0010:__list_add_valid+0x41/0x50 Call Trace: enqueue_task_rt+0x291/0x360 __sched_setscheduler+0x581/0x9d0 _sched_setscheduler+0x63/0xa0 do_sched_setscheduler+0xa0/0x150 __x64_sys_sched_setscheduler+0x1a/0x30 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xae __sched_setscheduler() uses rt_effective_prio() to handle proper queuing of priority boosted tasks that are setscheduled while being boosted. rt_effective_prio() is however called twice per each __sched_setscheduler() call: first directly by __sched_setscheduler() before dequeuing the task and then by __setscheduler() to actually do the priority change. If the priority of the pi_top_task is concurrently being changed however, it might happen that the two calls return different results. If, for example, the first call returned the same rt priority the task was running at and the second one a fair priority, the task won't be removed by the rt list (on_list still set) and then enqueued in the fair runqueue. When eventually setscheduled back to rt it will be seen as enqueued already and the WARNING/BUG be issued. Fix this by calling rt_effective_prio() only once and then reusing the return value. While at it refactor code as well for clarity. Concurrent priority inheritance handling is still safe and will eventually converge to a new state by following the inheritance chain(s). Fixes: 0782e63bc6fe ("sched: Handle priority boosted tasks proper in setscheduler()") [squashed Peterz changes; added changelog] Reported-by: Mark Simmons <msimmons(a)redhat.com> Signed-off-by: Juri Lelli <juri.lelli(a)redhat.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Link: https://lkml.kernel.org/r/20210803104501.38333-1-juri.lelli@redhat.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Acked-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- kernel/sched/core.c | 95 ++++++++++++++++++--------------------------- 1 file changed, 37 insertions(+), 58 deletions(-) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index cb5c2f9be849..d5434cc99934 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -1590,12 +1590,18 @@ void deactivate_task(struct rq *rq, struct task_struct *p, int flags) dequeue_task(rq, p, flags); } -/* - * __normal_prio - return the priority that is based on the static prio - */ -static inline int __normal_prio(struct task_struct *p) +static inline int __normal_prio(int policy, int rt_prio, int nice) { - return p->static_prio; + int prio; + + if (dl_policy(policy)) + prio = MAX_DL_PRIO - 1; + else if (rt_policy(policy)) + prio = MAX_RT_PRIO - 1 - rt_prio; + else + prio = NICE_TO_PRIO(nice); + + return prio; } /* @@ -1607,15 +1613,7 @@ static inline int __normal_prio(struct task_struct *p) */ static inline int normal_prio(struct task_struct *p) { - int prio; - - if (task_has_dl_policy(p)) - prio = MAX_DL_PRIO-1; - else if (task_has_rt_policy(p)) - prio = MAX_RT_PRIO-1 - p->rt_priority; - else - prio = __normal_prio(p); - return prio; + return __normal_prio(p->policy, p->rt_priority, PRIO_TO_NICE(p->static_prio)); } /* @@ -3240,7 +3238,7 @@ int sched_fork(unsigned long clone_flags, struct task_struct *p) } else if (PRIO_TO_NICE(p->static_prio) < 0) p->static_prio = NICE_TO_PRIO(0); - p->prio = p->normal_prio = __normal_prio(p); + p->prio = p->normal_prio = p->static_prio; set_load_weight(p, false); /* @@ -4986,6 +4984,18 @@ int default_wake_function(wait_queue_entry_t *curr, unsigned mode, int wake_flag } EXPORT_SYMBOL(default_wake_function); +static void __setscheduler_prio(struct task_struct *p, int prio) +{ + if (dl_prio(prio)) + p->sched_class = &dl_sched_class; + else if (rt_prio(prio)) + p->sched_class = &rt_sched_class; + else + p->sched_class = &fair_sched_class; + + p->prio = prio; +} + #ifdef CONFIG_RT_MUTEXES static inline int __rt_effective_prio(struct task_struct *pi_task, int prio) @@ -5101,22 +5111,19 @@ void rt_mutex_setprio(struct task_struct *p, struct task_struct *pi_task) } else { p->dl.pi_se = &p->dl; } - p->sched_class = &dl_sched_class; } else if (rt_prio(prio)) { if (dl_prio(oldprio)) p->dl.pi_se = &p->dl; if (oldprio < prio) queue_flag |= ENQUEUE_HEAD; - p->sched_class = &rt_sched_class; } else { if (dl_prio(oldprio)) p->dl.pi_se = &p->dl; if (rt_prio(oldprio)) p->rt.timeout = 0; - p->sched_class = &fair_sched_class; } - p->prio = prio; + __setscheduler_prio(p, prio); if (queued) enqueue_task(rq, p, queue_flag); @@ -5349,35 +5356,6 @@ static void __setscheduler_params(struct task_struct *p, set_load_weight(p, true); } -/* Actually do priority change: must hold pi & rq lock. */ -static void __setscheduler(struct rq *rq, struct task_struct *p, - const struct sched_attr *attr, bool keep_boost) -{ - /* - * If params can't change scheduling class changes aren't allowed - * either. - */ - if (attr->sched_flags & SCHED_FLAG_KEEP_PARAMS) - return; - - __setscheduler_params(p, attr); - - /* - * Keep a potential priority boosting if called from - * sched_setscheduler(). - */ - p->prio = normal_prio(p); - if (keep_boost) - p->prio = rt_effective_prio(p, p->prio); - - if (dl_prio(p->prio)) - p->sched_class = &dl_sched_class; - else if (rt_prio(p->prio)) - p->sched_class = &rt_sched_class; - else - p->sched_class = &fair_sched_class; -} - /* * Check the target process has a UID that matches the current process's: */ @@ -5398,10 +5376,8 @@ static int __sched_setscheduler(struct task_struct *p, const struct sched_attr *attr, bool user, bool pi) { - int newprio = dl_policy(attr->sched_policy) ? MAX_DL_PRIO - 1 : - MAX_RT_PRIO - 1 - attr->sched_priority; - int retval, oldprio, oldpolicy = -1, queued, running; - int new_effective_prio, policy = attr->sched_policy; + int oldpolicy = -1, policy = attr->sched_policy; + int retval, oldprio, newprio, queued, running; const struct sched_class *prev_class; struct rq_flags rf; int reset_on_fork; @@ -5611,6 +5587,7 @@ static int __sched_setscheduler(struct task_struct *p, p->sched_reset_on_fork = reset_on_fork; oldprio = p->prio; + newprio = __normal_prio(policy, attr->sched_priority, attr->sched_nice); if (pi) { /* * Take priority boosted tasks into account. If the new @@ -5619,8 +5596,8 @@ static int __sched_setscheduler(struct task_struct *p, * the runqueue. This will be done when the task deboost * itself. */ - new_effective_prio = rt_effective_prio(p, newprio); - if (new_effective_prio == oldprio) + newprio = rt_effective_prio(p, newprio); + if (newprio == oldprio) queue_flags &= ~DEQUEUE_MOVE; } @@ -5633,7 +5610,10 @@ static int __sched_setscheduler(struct task_struct *p, prev_class = p->sched_class; - __setscheduler(rq, p, attr, pi); + if (!(attr->sched_flags & SCHED_FLAG_KEEP_PARAMS)) { + __setscheduler_params(p, attr); + __setscheduler_prio(p, newprio); + } __setscheduler_uclamp(p, attr); if (queued) { @@ -7640,7 +7620,6 @@ static inline int alloc_qos_sched_group(struct task_group *tg, static void sched_change_qos_group(struct task_struct *tsk, struct task_group *tg) { struct sched_attr attr; - struct rq *rq = task_rq(tsk); /* * No need to re-setcheduler when a task is exiting or the task @@ -7651,8 +7630,8 @@ static void sched_change_qos_group(struct task_struct *tsk, struct task_group *t (tg->qos_level == -1)) { attr.sched_priority = 0; attr.sched_policy = SCHED_IDLE; - attr.sched_nice = PRIO_TO_NICE(tsk->static_prio); - __setscheduler(rq, tsk, &attr, 0); + __setscheduler_params(tsk, &attr); + __setscheduler_prio(tsk, tsk->static_prio); } } -- 2.20.1

1 1

[PATCH openEuler-1.0-LTS 1/4] ovl: fix out of date comment and unreachable code
by Yang Yingliang 19 Oct '21

19 Oct '21

From: Amir Goldstein <amir73il(a)gmail.com> mainline inclusion from mainline-v5.7-rc1 commit 735c907d7b7df501e951ba07134b9f6f989a94e4 category: bugfix bugzilla: NA CVE: NA ------------------------------------------------- ovl_inode_update() is no longer called from create object code path. Fixes: 01b39dcc9568 ("ovl: use inode_insert5() to hash a newly...") Signed-off-by: Amir Goldstein <amir73il(a)gmail.com> Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Signed-off-by: Zheng Liang <zhengliang6(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/overlayfs/inode.c | 8 +++++--- fs/overlayfs/util.c | 2 -- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c index d1e9d926150b1..b016343a7209b 100644 --- a/fs/overlayfs/inode.c +++ b/fs/overlayfs/inode.c @@ -555,9 +555,11 @@ static void ovl_fill_inode(struct inode *inode, umode_t mode, dev_t rdev, * bits to encode layer), set the same value used for st_ino to i_ino, * so inode number exposed via /proc/locks and a like will be * consistent with d_ino and st_ino values. An i_ino value inconsistent - * with d_ino also causes nfsd readdirplus to fail. When called from - * ovl_new_inode(), ino arg is 0, so i_ino will be updated to real - * upper inode i_ino on ovl_inode_init() or ovl_inode_update(). + * with d_ino also causes nfsd readdirplus to fail. + * + * When called from ovl_create_object() => ovl_new_inode(), with + * ino = 0, i_ino will be updated to consistent value later on in + * ovl_get_inode() => ovl_fill_inode(). */ if (ovl_same_dev(inode->i_sb)) { inode->i_ino = ino; diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c index eb9411461b695..b83955f31ded0 100644 --- a/fs/overlayfs/util.c +++ b/fs/overlayfs/util.c @@ -419,8 +419,6 @@ void ovl_inode_update(struct inode *inode, struct dentry *upperdentry) smp_wmb(); OVL_I(inode)->__upperdentry = upperdentry; if (inode_unhashed(inode)) { - if (!inode->i_ino) - inode->i_ino = upperinode->i_ino; inode->i_private = upperinode; __insert_inode_hash(inode, (unsigned long) upperinode); } -- 2.25.1

1 3

[PATCH kernel-4.19 1/4] ovl: fix out of date comment and unreachable code
by Yang Yingliang 19 Oct '21

19 Oct '21

From: Amir Goldstein <amir73il(a)gmail.com> mainline inclusion from mainline-v5.7-rc1 commit 735c907d7b7df501e951ba07134b9f6f989a94e4 category: bugfix bugzilla: NA CVE: NA ------------------------------------------------- ovl_inode_update() is no longer called from create object code path. Fixes: 01b39dcc9568 ("ovl: use inode_insert5() to hash a newly...") Signed-off-by: Amir Goldstein <amir73il(a)gmail.com> Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Signed-off-by: Zheng Liang <zhengliang6(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/overlayfs/inode.c | 8 +++++--- fs/overlayfs/util.c | 2 -- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c index d1e9d926150b1..b016343a7209b 100644 --- a/fs/overlayfs/inode.c +++ b/fs/overlayfs/inode.c @@ -555,9 +555,11 @@ static void ovl_fill_inode(struct inode *inode, umode_t mode, dev_t rdev, * bits to encode layer), set the same value used for st_ino to i_ino, * so inode number exposed via /proc/locks and a like will be * consistent with d_ino and st_ino values. An i_ino value inconsistent - * with d_ino also causes nfsd readdirplus to fail. When called from - * ovl_new_inode(), ino arg is 0, so i_ino will be updated to real - * upper inode i_ino on ovl_inode_init() or ovl_inode_update(). + * with d_ino also causes nfsd readdirplus to fail. + * + * When called from ovl_create_object() => ovl_new_inode(), with + * ino = 0, i_ino will be updated to consistent value later on in + * ovl_get_inode() => ovl_fill_inode(). */ if (ovl_same_dev(inode->i_sb)) { inode->i_ino = ino; diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c index eb9411461b695..b83955f31ded0 100644 --- a/fs/overlayfs/util.c +++ b/fs/overlayfs/util.c @@ -419,8 +419,6 @@ void ovl_inode_update(struct inode *inode, struct dentry *upperdentry) smp_wmb(); OVL_I(inode)->__upperdentry = upperdentry; if (inode_unhashed(inode)) { - if (!inode->i_ino) - inode->i_ino = upperinode->i_ino; inode->i_private = upperinode; __insert_inode_hash(inode, (unsigned long) upperinode); } -- 2.25.1

1 3

Re: [PATCH openEuler-1.0-LTS V2 5/5] drm/hisilicon: Features to support reading resolutions from EDID
by QiuLaibin 19 Oct '21

19 Oct '21

hi gouhao: 这个补丁删除了hibmc_connector_init使用点，导致hibmc_connector_init函数申明但无使用点告警。同时注意到本patch部分代码在主线通过 be8c8403f63cf ("drm/hisilicon: Code refactoring for hibmc_drv_vdac") 合入，因此希望能够直接将该patch作为本patch的前向补丁一起合入。 best regard >>>>>>>>>>>>>>>>>>>>>>>>>> [WARNING] build_arm64_kabi <<<<<<<<<<<<<<<<<<<<<<<<<< make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- defconfig && make -j8 ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c:125:1: warning: ‘hibmc_connector_init’ defined but not used [-Wunused-function] hibmc_connector_init(struct hibmc_drm_private *priv) ^~~~~~~~~~~~~~~~~~~~ ==================================END================================== On 2021/9/18 11:11, Gou Hao wrote: > From: Tian Tao <tiantao6(a)hisilicon.com> mainline inclusion from > mainline-v5.14.0-rc7 commit a0d078d06e516184e2f575f3803935697b5e3ac6 > category: bugfix bugzilla: > https://gitee.com/openeuler/kernel/issues/I469VQCVE: NA The > modification of hibmc_vdac_init in the original patch cannot be > incorporated. In this patch, the hibmc_vdac_init is backport from the > mainline code. --------------------------------------- Use > drm_get_edid to get the resolution, if that fails, set it to a fixed > resolution. Rewrite the desrtoy callback function to release > resources. Signed-off-by: Tian Tao <tiantao6(a)hisilicon.com> > Reviewed-by: Thomas Zimmermann <tzimmermann(a)suse.de> Link: > https://patchwork.freedesktop.org/patch/msgid/1600778670-60370-3-git-send... > <https://patchwork.freedesktop.org/patch/msgid/1600778670-60370-3-git-send-e…>Signed-off-by: > gouhao <gouhao(a)uniontech.com> --- > .../gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c | 55 ++++++++++++++----- > 1 file changed, 41 insertions(+), 14 deletions(-) diff --git > a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c > b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c index > 90319a902..762e3404e 100644 --- > a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c +++ > b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c @@ -59,11 +59,23 @@ > static int hibmc_valid_mode(int w, int h) static int > hibmc_connector_get_modes(struct drm_connector *connector) { int > count; + void *edid; + struct hibmc_connector *hibmc_connector = > to_hibmc_connector(connector); + + edid = drm_get_edid(connector, > &hibmc_connector->adapter); + if (edid) { + > drm_connector_update_edid_property(connector, edid); + count = > drm_add_edid_modes(connector, edid); + if (count) + goto out; + } > drm_connector_update_edid_property(connector, NULL); count = > drm_add_modes_noedid(connector, 1920, 1200); > drm_set_preferred_mode(connector, 1024, 768); +out: + kfree(edid); > return count; } @@ -86,6 +98,14 @@ hibmc_connector_best_encoder(struct > drm_connector *connector) return drm_encoder_find(connector->dev, > NULL, connector->encoder_ids[0]); } +static void > hibmc_connector_destroy(struct drm_connector *connector) +{ + struct > hibmc_connector *hibmc_connector = to_hibmc_connector(connector); + + > i2c_del_adapter(&hibmc_connector->adapter); + > drm_connector_cleanup(connector); +} + static const struct > drm_connector_helper_funcs hibmc_connector_helper_funcs = { .get_modes > = hibmc_connector_get_modes, @@ -95,7 +115,7 @@ static const struct > drm_connector_helper_funcs static const struct drm_connector_funcs > hibmc_connector_funcs = { .fill_modes = > drm_helper_probe_single_connector_modes, - .destroy = > drm_connector_cleanup, + .destroy = hibmc_connector_destroy, .reset = > drm_atomic_helper_connector_reset, .atomic_duplicate_state = > drm_atomic_helper_connector_duplicate_state, .atomic_destroy_state = > drm_atomic_helper_connector_destroy_state, @@ -155,21 +175,16 @@ > static const struct drm_encoder_funcs hibmc_encoder_funcs = { int > hibmc_vdac_init(struct hibmc_drm_private *priv) { struct drm_device > *dev = priv->dev; - struct drm_encoder *encoder; - struct > drm_connector *connector; + struct hibmc_connector *hibmc_connector = > &priv->connector; + struct drm_encoder *encoder = &priv->encoder; + > struct drm_connector *connector = &hibmc_connector->base; int ret; - > connector = hibmc_connector_init(priv); > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 删除后导致hibmc_connector_init函数申明但无使用点告警。 > - if (IS_ERR(connector)) { - DRM_ERROR("failed to create connector: > %ld\n", - PTR_ERR(connector)); - return PTR_ERR(connector); - } - - > encoder = devm_kzalloc(dev->dev, sizeof(*encoder), GFP_KERNEL); - if > (!encoder) { - DRM_ERROR("failed to alloc memory when init > encoder\n"); - return -ENOMEM; + + ret = hibmc_ddc_create(dev, > hibmc_connector); + if (ret) { + DRM_ERROR("failed to create ddc: > %d\n", ret); + return ret; } encoder->possible_crtcs = 0x1; @@ -181,6 > +196,18 @@ int hibmc_vdac_init(struct hibmc_drm_private *priv) } > drm_encoder_helper_add(encoder, &hibmc_encoder_helper_funcs); + + ret > = drm_connector_init_with_ddc(dev, connector, + > &hibmc_connector_funcs, + DRM_MODE_CONNECTOR_VGA, + > &hibmc_connector->adapter); + if (ret) { + DRM_ERROR("failed to init > connector: %d\n", ret); + return ret; + } + + > drm_connector_helper_add(connector, &hibmc_connector_helper_funcs); + > drm_connector_attach_encoder(connector, encoder); return 0; -- 2.20.1 >

1 0

[PATCH openEuler-1.0-LTS V2 0/5] drm/hisilicon: Fix hibmc did not get edid
by Gou Hao 19 Oct '21

19 Oct '21

From: gouhao <gouhao(a)uniontech.com> Fix hibmc did not get edid. issue: https://gitee.com/openeuler/kernel/issues/I469VQ gouhao (5): drm-Split-out-drm_probe_helper.h drm-Add-ddc-link-in-sysfs-created-by-drm_connector drm-Add-drm_connector_init-variant-with-ddc drm/hisilicon: Support i2c driver algorithms for bit-shift adapters drm/hisilicon: Features to support reading resolutions from EDID drivers/gpu/drm/drm_connector.c | 35 +++++++ drivers/gpu/drm/drm_sysfs.c | 8 ++ drivers/gpu/drm/hisilicon/hibmc/Makefile | 3 +- .../gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h | 26 +++++ .../gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c | 99 +++++++++++++++++++ .../gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c | 55 ++++++++--- include/drm/drm_connector.h | 18 ++++ include/drm/drm_probe_helper.h | 27 +++++ 8 files changed, 256 insertions(+), 15 deletions(-) create mode 100644 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c create mode 100644 include/drm/drm_probe_helper.h -- 2.20.1

4 8

[PATCH openEuler-21.03 00/10] openEuler patches
by Wang ShaoBo 18 Oct '21

18 Oct '21

openEuler patches Andi Kleen (1): perf stat: Add a new --quiet option to 'perf stat' Chris Packham (1): i2c: mpc: Make use of i2c_recover_bus() Desmond Cheong Zhi Xi (1): drm: Lock pointer access in drm_master_release() Jiri Olsa (1): bpf: Forbid trampoline attach for functions with variable arguments Kees Cook (1): proc: Track /proc/$pid/attr/ opener mm_struct Liangyan (1): tracing: Correct the length check which causes memory corruption Steven Rostedt (VMware) (1): ftrace: Do not blindly read the ip address in ftrace_bug() mpiglet (1): arm64/mpam: add return value check for acpi_get_table() wenzhiwei11 (1): arm64/mpam: fix the problem that the ret variable is not initialized yin-xiujiang (1): arm64/mpam: fix device_errcode out of bounds arch/arm64/kernel/mpam/mpam_ctrlmon.c | 2 +- arch/arm64/kernel/mpam/mpam_device.c | 2 +- drivers/acpi/arm64/mpam.c | 2 +- drivers/gpu/drm/drm_auth.c | 3 ++- drivers/i2c/busses/i2c-mpc.c | 18 ++++++++++++++++-- fs/proc/base.c | 9 ++++++++- kernel/bpf/btf.c | 12 ++++++++++++ kernel/trace/ftrace.c | 8 +++++++- kernel/trace/trace.c | 2 +- tools/perf/Documentation/perf-stat.txt | 4 ++++ tools/perf/builtin-stat.c | 6 +++++- tools/perf/util/stat.h | 1 + 12 files changed, 59 insertions(+), 10 deletions(-) -- 2.25.1

1 10

[PATCH openEuler-1.0-LTS] soc: aspeed: lpc-ctrl: Fix boundary check for mmap
by Yang Yingliang 18 Oct '21

18 Oct '21

From: Iwona Winiarska <iwona.winiarska(a)intel.com> stable inclusion from linux-4.19.207 commit 9c8891b638319ddba9cfa330247922cd960c95b0 CVE: CVE-2021-42252 -------------------------------- commit b49a0e69a7b1a68c8d3f64097d06dabb770fec96 upstream. The check mixes pages (vm_pgoff) with bytes (vm_start, vm_end) on one side of the comparison, and uses resource address (rather than just the resource size) on the other side of the comparison. This can allow malicious userspace to easily bypass the boundary check and map pages that are located outside memory-region reserved by the driver. Fixes: 6c4e97678501 ("drivers/misc: Add Aspeed LPC control driver") Cc: stable(a)vger.kernel.org Signed-off-by: Iwona Winiarska <iwona.winiarska(a)intel.com> Reviewed-by: Andrew Jeffery <andrew(a)aj.id.au> Tested-by: Andrew Jeffery <andrew(a)aj.id.au> Reviewed-by: Joel Stanley <joel(a)aj.id.au> Signed-off-by: Joel Stanley <joel(a)jms.id.au> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/misc/aspeed-lpc-ctrl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/misc/aspeed-lpc-ctrl.c b/drivers/misc/aspeed-lpc-ctrl.c index a024f8042259a..870ab0dfcde06 100644 --- a/drivers/misc/aspeed-lpc-ctrl.c +++ b/drivers/misc/aspeed-lpc-ctrl.c @@ -50,7 +50,7 @@ static int aspeed_lpc_ctrl_mmap(struct file *file, struct vm_area_struct *vma) unsigned long vsize = vma->vm_end - vma->vm_start; pgprot_t prot = vma->vm_page_prot; - if (vma->vm_pgoff + vsize > lpc_ctrl->mem_base + lpc_ctrl->mem_size) + if (vma->vm_pgoff + vma_pages(vma) > lpc_ctrl->mem_size >> PAGE_SHIFT) return -EINVAL; /* ast2400/2500 AHB accesses are not cache coherent */ -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/2] mmap: userswap: fix memory leak in do_mmap
by Yang Yingliang 18 Oct '21

18 Oct '21

From: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4AHP2 CVE: NA ------------------------------------------------- When userswap is enabled, the memory pointed by 'pages' is not freed in abnormal branch in do_mmap(). To fix the issue and keep do_mmap() mostly unchanged, we rename do_mmap() to __do_mmap() and extract the memory alloc and free code out of __do_mmap(). When __do_mmap() returns a error value, we goto the error label to free the memory. Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- mm/mmap.c | 406 ++++++++++++++++++++++++++++-------------------------- 1 file changed, 211 insertions(+), 195 deletions(-) diff --git a/mm/mmap.c b/mm/mmap.c index 90cff771af771..074fbc0c559a7 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1373,173 +1373,8 @@ int unregister_mmap_notifier(struct notifier_block *nb) EXPORT_SYMBOL_GPL(unregister_mmap_notifier); #endif -#ifdef CONFIG_USERSWAP -/* - * Check if pages between 'addr ~ addr+len' can be user swapped. If so, get - * the reference of the pages and return the pages through input parameters - * 'ppages'. - */ -int pages_can_be_swapped(struct mm_struct *mm, unsigned long addr, - unsigned long len, struct page ***ppages) -{ - struct vm_area_struct *vma; - struct page *page = NULL; - struct page **pages = NULL; - unsigned long addr_start, addr_end; - unsigned long ret; - int i, page_num = 0; - - pages = kmalloc(sizeof(struct page *) * (len / PAGE_SIZE), GFP_KERNEL); - if (!pages) - return -ENOMEM; - - addr_start = addr; - addr_end = addr + len; - while (addr < addr_end) { - vma = find_vma(mm, addr); - if (!vma || !vma_is_anonymous(vma) || - (vma->vm_flags & VM_LOCKED) || vma->vm_file - || (vma->vm_flags & VM_STACK) || (vma->vm_flags & (VM_IO | VM_PFNMAP))) { - ret = -EINVAL; - goto out; - } - if (!(vma->vm_flags & VM_UFFD_MISSING)) { - ret = -EAGAIN; - goto out; - } -get_again: - /* follow_page will inc page ref, dec the ref after we remap the page */ - page = follow_page(vma, addr, FOLL_GET); - if (IS_ERR_OR_NULL(page)) { - ret = -ENODEV; - goto out; - } - pages[page_num] = page; - page_num++; - if (!PageAnon(page) || !PageSwapBacked(page) || PageHuge(page) || PageSwapCache(page)) { - ret = -EINVAL; - goto out; - } else if (PageTransCompound(page)) { - if (trylock_page(page)) { - if (!split_huge_page(page)) { - put_page(page); - page_num--; - unlock_page(page); - goto get_again; - } else { - unlock_page(page); - ret = -EINVAL; - goto out; - } - } else { - ret = -EINVAL; - goto out; - } - } - if (page_mapcount(page) > 1 || page_mapcount(page) + 1 != page_count(page)) { - ret = -EBUSY; - goto out; - } - addr += PAGE_SIZE; - } - - *ppages = pages; - return 0; - -out: - for (i = 0; i < page_num; i++) - put_page(pages[i]); - if (pages) - kfree(pages); - *ppages = NULL; - return ret; -} - -/* - * In uswap situation, we use the bit 0 of the returned address to indicate - * whether the pages are dirty. - */ -#define USWAP_PAGES_DIRTY 1 - -/* unmap the pages between 'addr ~ addr+len' and remap them to a new address */ -unsigned long do_user_swap(struct mm_struct *mm, unsigned long addr_start, - unsigned long len, struct page **pages, unsigned long new_addr) -{ - struct vm_area_struct *vma; - struct page *page; - pmd_t *pmd; - pte_t *pte, old_pte; - spinlock_t *ptl; - unsigned long addr, addr_end; - bool pages_dirty = false; - int i, err; - - addr_end = addr_start + len; - lru_add_drain(); - mmu_notifier_invalidate_range_start(mm, addr_start, addr_end); - addr = addr_start; - i = 0; - while (addr < addr_end) { - page = pages[i]; - vma = find_vma(mm, addr); - if (!vma) { - mmu_notifier_invalidate_range_end(mm, addr_start, addr_end); - WARN_ON("find_vma failed\n"); - return -EINVAL; - } - pmd = mm_find_pmd(mm, addr); - if (!pmd) { - mmu_notifier_invalidate_range_end(mm, addr_start, addr_end); - WARN_ON("mm_find_pmd failed, addr:%llx\n"); - return -ENXIO; - } - pte = pte_offset_map_lock(mm, pmd, addr, &ptl); - flush_cache_page(vma, addr, pte_pfn(*pte)); - old_pte = ptep_clear_flush(vma, addr, pte); - if (pte_dirty(old_pte) || PageDirty(page)) - pages_dirty = true; - set_pte(pte, swp_entry_to_pte(swp_entry(SWP_USERSWAP_ENTRY, page_to_pfn(page)))); - dec_mm_counter(mm, MM_ANONPAGES); - page_remove_rmap(page, false); - put_page(page); - - pte_unmap_unlock(pte, ptl); - vma->vm_flags |= VM_USWAP; - page->mapping = NULL; - addr += PAGE_SIZE; - i++; - } - mmu_notifier_invalidate_range_end(mm, addr_start, addr_end); - - addr_start = new_addr; - addr_end = new_addr + len; - addr = addr_start; - vma = find_vma(mm, addr); - i = 0; - while (addr < addr_end) { - page = pages[i]; - if (addr > vma->vm_end - 1) - vma = find_vma(mm, addr); - err = vm_insert_page(vma, addr, page); - if (err) { - pr_err("vm_insert_page failed:%d\n", err); - } - i++; - addr += PAGE_SIZE; - } - vma->vm_flags |= VM_USWAP; - - if (pages_dirty) - new_addr = new_addr | USWAP_PAGES_DIRTY; - - return new_addr; -} -#endif - -/* - * The caller must hold down_write(&current->mm->mmap_sem). - */ -unsigned long do_mmap(struct file *file, unsigned long addr, +static inline +unsigned long __do_mmap(struct file *file, unsigned long addr, unsigned long len, unsigned long prot, unsigned long flags, vm_flags_t vm_flags, unsigned long pgoff, unsigned long *populate, @@ -1547,12 +1382,6 @@ unsigned long do_mmap(struct file *file, unsigned long addr, { struct mm_struct *mm = current->mm; int pkey = 0; -#ifdef CONFIG_USERSWAP - struct page **pages = NULL; - unsigned long addr_start = addr; - int i, page_num = 0; - unsigned long ret; -#endif *populate = 0; @@ -1569,17 +1398,6 @@ unsigned long do_mmap(struct file *file, unsigned long addr, if (!(file && path_noexec(&file->f_path))) prot |= PROT_EXEC; -#ifdef CONFIG_USERSWAP - if (enable_userswap && (flags & MAP_REPLACE)) { - if (offset_in_page(addr) || (len % PAGE_SIZE)) - return -EINVAL; - page_num = len / PAGE_SIZE; - ret = pages_can_be_swapped(mm, addr, len, &pages); - if (ret) - return ret; - } -#endif - /* force arch specific MAP_FIXED handling in get_unmapped_area */ if (flags & MAP_FIXED_NOREPLACE) flags |= MAP_FIXED; @@ -1752,25 +1570,203 @@ unsigned long do_mmap(struct file *file, unsigned long addr, if (flags & MAP_CHECKNODE) set_vm_checknode(&vm_flags, flags); -#ifdef CONFIG_USERSWAP - /* mark the vma as special to avoid merging with other vmas */ - if (enable_userswap && (flags & MAP_REPLACE)) - vm_flags |= VM_SPECIAL; -#endif - addr = mmap_region(file, addr, len, vm_flags, pgoff, uf); if (!IS_ERR_VALUE(addr) && ((vm_flags & VM_LOCKED) || (flags & (MAP_POPULATE | MAP_NONBLOCK)) == MAP_POPULATE)) *populate = len; -#ifndef CONFIG_USERSWAP return addr; -#else - if (!enable_userswap || !(flags & MAP_REPLACE)) - return addr; +} + +#ifdef CONFIG_USERSWAP +/* + * Check if pages between 'addr ~ addr+len' can be user swapped. If so, get + * the reference of the pages and return the pages through input parameters + * 'ppages'. + */ +int pages_can_be_swapped(struct mm_struct *mm, unsigned long addr, + unsigned long len, struct page ***ppages) +{ + struct vm_area_struct *vma; + struct page *page = NULL; + struct page **pages = NULL; + unsigned long addr_start, addr_end; + unsigned long ret; + int i, page_num = 0; + + pages = kmalloc(sizeof(struct page *) * (len / PAGE_SIZE), GFP_KERNEL); + if (!pages) + return -ENOMEM; + + addr_start = addr; + addr_end = addr + len; + while (addr < addr_end) { + vma = find_vma(mm, addr); + if (!vma || !vma_is_anonymous(vma) || + (vma->vm_flags & VM_LOCKED) || vma->vm_file + || (vma->vm_flags & VM_STACK) || (vma->vm_flags & (VM_IO | VM_PFNMAP))) { + ret = -EINVAL; + goto out; + } + if (!(vma->vm_flags & VM_UFFD_MISSING)) { + ret = -EAGAIN; + goto out; + } +get_again: + /* follow_page will inc page ref, dec the ref after we remap the page */ + page = follow_page(vma, addr, FOLL_GET); + if (IS_ERR_OR_NULL(page)) { + ret = -ENODEV; + goto out; + } + pages[page_num] = page; + page_num++; + if (!PageAnon(page) || !PageSwapBacked(page) || PageHuge(page) || PageSwapCache(page)) { + ret = -EINVAL; + goto out; + } else if (PageTransCompound(page)) { + if (trylock_page(page)) { + if (!split_huge_page(page)) { + put_page(page); + page_num--; + unlock_page(page); + goto get_again; + } else { + unlock_page(page); + ret = -EINVAL; + goto out; + } + } else { + ret = -EINVAL; + goto out; + } + } + if (page_mapcount(page) > 1 || page_mapcount(page) + 1 != page_count(page)) { + ret = -EBUSY; + goto out; + } + addr += PAGE_SIZE; + } + + *ppages = pages; + return 0; + +out: + for (i = 0; i < page_num; i++) + put_page(pages[i]); + if (pages) + kfree(pages); + *ppages = NULL; + return ret; +} + +/* + * In uswap situation, we use the bit 0 of the returned address to indicate + * whether the pages are dirty. + */ +#define USWAP_PAGES_DIRTY 1 + +/* unmap the pages between 'addr ~ addr+len' and remap them to a new address */ +unsigned long do_user_swap(struct mm_struct *mm, unsigned long addr_start, + unsigned long len, struct page **pages, unsigned long new_addr) +{ + struct vm_area_struct *vma; + struct page *page; + pmd_t *pmd; + pte_t *pte, old_pte; + spinlock_t *ptl; + unsigned long addr, addr_end; + bool pages_dirty = false; + int i, err; + addr_end = addr_start + len; + lru_add_drain(); + mmu_notifier_invalidate_range_start(mm, addr_start, addr_end); + addr = addr_start; + i = 0; + while (addr < addr_end) { + page = pages[i]; + vma = find_vma(mm, addr); + if (!vma) { + mmu_notifier_invalidate_range_end(mm, addr_start, addr_end); + WARN_ON("find_vma failed\n"); + return -EINVAL; + } + pmd = mm_find_pmd(mm, addr); + if (!pmd) { + mmu_notifier_invalidate_range_end(mm, addr_start, addr_end); + WARN_ON("mm_find_pmd failed, addr:%llx\n"); + return -ENXIO; + } + pte = pte_offset_map_lock(mm, pmd, addr, &ptl); + flush_cache_page(vma, addr, pte_pfn(*pte)); + old_pte = ptep_clear_flush(vma, addr, pte); + if (pte_dirty(old_pte) || PageDirty(page)) + pages_dirty = true; + set_pte(pte, swp_entry_to_pte(swp_entry(SWP_USERSWAP_ENTRY, page_to_pfn(page)))); + dec_mm_counter(mm, MM_ANONPAGES); + page_remove_rmap(page, false); + put_page(page); + + pte_unmap_unlock(pte, ptl); + vma->vm_flags |= VM_USWAP; + page->mapping = NULL; + addr += PAGE_SIZE; + i++; + } + mmu_notifier_invalidate_range_end(mm, addr_start, addr_end); + + addr_start = new_addr; + addr_end = new_addr + len; + addr = addr_start; + vma = find_vma(mm, addr); + i = 0; + while (addr < addr_end) { + page = pages[i]; + if (addr > vma->vm_end - 1) + vma = find_vma(mm, addr); + err = vm_insert_page(vma, addr, page); + if (err) { + pr_err("vm_insert_page failed:%d\n", err); + } + i++; + addr += PAGE_SIZE; + } + vma->vm_flags |= VM_USWAP; + + if (pages_dirty) + new_addr = new_addr | USWAP_PAGES_DIRTY; + + return new_addr; +} + +static inline +unsigned long do_uswap_mmap(struct file *file, unsigned long addr, + unsigned long len, unsigned long prot, + unsigned long flags, vm_flags_t vm_flags, + unsigned long pgoff, unsigned long *populate, + struct list_head *uf) +{ + struct mm_struct *mm = current->mm; + unsigned long addr_start = addr; + struct page **pages = NULL; + unsigned long ret; + int i, page_num = 0; + + if (!len || offset_in_page(addr) || (len % PAGE_SIZE)) + return -EINVAL; + + page_num = len / PAGE_SIZE; + ret = pages_can_be_swapped(mm, addr, len, &pages); + if (ret) + return ret; + + /* mark the vma as special to avoid merging with other vmas */ + vm_flags |= VM_SPECIAL; + + addr = __do_mmap(file, addr, len, prot, flags, vm_flags, pgoff, + populate, uf); if (IS_ERR_VALUE(addr)) { - pr_info("mmap_region failed, return addr:%lx\n", addr); ret = addr; goto out; } @@ -1780,10 +1776,30 @@ unsigned long do_mmap(struct file *file, unsigned long addr, /* follow_page() above increased the reference*/ for (i = 0; i < page_num; i++) put_page(pages[i]); + if (pages) kfree(pages); + return ret; +} +#endif + +/* + * The caller must hold down_write(&current->mm->mmap_sem). + */ +unsigned long do_mmap(struct file *file, unsigned long addr, + unsigned long len, unsigned long prot, + unsigned long flags, vm_flags_t vm_flags, + unsigned long pgoff, unsigned long *populate, + struct list_head *uf) +{ +#ifdef CONFIG_USERSWAP + if (enable_userswap && (flags & MAP_REPLACE)) + return do_uswap_mmap(file, addr, len, prot, flags, vm_flags, + pgoff, populate, uf); #endif + return __do_mmap(file, addr, len, prot, flags, vm_flags, + pgoff, populate, uf); } unsigned long ksys_mmap_pgoff(unsigned long addr, unsigned long len, -- 2.25.1

1 1

Re: [PATCH openEuler-21.03] MIPS: Fix kernel hang under FUNCTION_GRAPH_TRACER and PREEMPT_TRACER
by chengjian (D) 18 Oct '21

18 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/16 23:06, jack 写道: > From: Tiezhu Yang <yangtiezhu(a)loongson.cn> > > stable inclusion > from stable-v5.10.44 > commit 7519ece673e300b0362572edbde7e030552705ec > bugzilla:https://bugzilla.openeuler.org/show_bug.cgi?id=417 > CVE: NA > > ------------------------------------------------- > > [ Upstream commit 78cf0eb926cb1abeff2106bae67752e032fe5f3e ] > > When update the latest mainline kernel with the following three configs, > the kernel hangs during startup: > > (1) CONFIG_FUNCTION_GRAPH_TRACER=y > (2) CONFIG_PREEMPT_TRACER=y > (3) CONFIG_FTRACE_STARTUP_TEST=y > > When update the latest mainline kernel with the above two configs (1) > and (2), the kernel starts normally, but it still hangs when execute > the following command: > > echo "function_graph" > /sys/kernel/debug/tracing/current_tracer > > Without CONFIG_PREEMPT_TRACER=y, the above two kinds of kernel hangs > disappeared, so it seems that CONFIG_PREEMPT_TRACER has some influences > with function_graph tracer at the first glance. > > I use ejtag to find out the epc address is related with preempt_enable() > in the file arch/mips/lib/mips-atomic.c, because function tracing can > trace the preempt_{enable,disable} calls that are traced, replace them > with preempt_{enable,disable}_notrace to prevent function tracing from > going into an infinite loop, and then it can fix the kernel hang issue. > > By the way, it seems that this commit is a complement and improvement of > commit f93a1a00f2bd ("MIPS: Fix crash that occurs when function tracing > is enabled"). > > Signed-off-by: Tiezhu Yang <yangtiezhu(a)loongson.cn> > Cc: Steven Rostedt <rostedt(a)goodmis.org> > Signed-off-by: Thomas Bogendoerfer <tsbogend(a)alpha.franken.de> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > Signed-off-by: jack <18380124974(a)163.com> > --- > arch/mips/lib/mips-atomic.c | 12 ++++++------ > 1 file changed, 6 insertions(+), 6 deletions(-) > > diff --git a/arch/mips/lib/mips-atomic.c b/arch/mips/lib/mips-atomic.c > index de03838b343b..a9b72eacfc0b 100644 > --- a/arch/mips/lib/mips-atomic.c > +++ b/arch/mips/lib/mips-atomic.c > @@ -37,7 +37,7 @@ > */ > notrace void arch_local_irq_disable(void) > { > - preempt_disable(); > + preempt_disable_notrace(); > > __asm__ __volatile__( > " .set push \n" > @@ -53,7 +53,7 @@ notrace void arch_local_irq_disable(void) > : /* no inputs */ > : "memory"); > > - preempt_enable(); > + preempt_enable_notrace(); > } > EXPORT_SYMBOL(arch_local_irq_disable); > > @@ -61,7 +61,7 @@ notrace unsigned long arch_local_irq_save(void) > { > unsigned long flags; > > - preempt_disable(); > + preempt_disable_notrace(); > > __asm__ __volatile__( > " .set push \n" > @@ -78,7 +78,7 @@ notrace unsigned long arch_local_irq_save(void) > : /* no inputs */ > : "memory"); > > - preempt_enable(); > + preempt_enable_notrace(); > > return flags; > } > @@ -88,7 +88,7 @@ notrace void arch_local_irq_restore(unsigned long flags) > { > unsigned long __tmp1; > > - preempt_disable(); > + preempt_disable_notrace(); > > __asm__ __volatile__( > " .set push \n" > @@ -106,7 +106,7 @@ notrace void arch_local_irq_restore(unsigned long flags) > : "0" (flags) > : "memory"); > > - preempt_enable(); > + preempt_enable_notrace(); > } > EXPORT_SYMBOL(arch_local_irq_restore); >

1 0

[PATCH kernel-4.19] arm64/mpam: fix the problem that the ret variable is not initialized
by Yang Yingliang 18 Oct '21

18 Oct '21

From: wenzhiwei11 <wenzhiwei(a)kylinos.cn> kylin inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4AHUL CVE: NA --------------------------------------------------- initialize the value "ret" in "schemata_list_init()" Signed-off-by: wenzhiwei11 <wenzhiwei(a)kylinos.cn> # openEuler_contributor Reviewed-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Cheng Jian <cj.chengjian(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_ctrlmon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/kernel/mpam/mpam_ctrlmon.c b/arch/arm64/kernel/mpam/mpam_ctrlmon.c index b1d32d432556c..b7508ad8c5314 100644 --- a/arch/arm64/kernel/mpam/mpam_ctrlmon.c +++ b/arch/arm64/kernel/mpam/mpam_ctrlmon.c @@ -127,7 +127,7 @@ static int add_schema(enum resctrl_conf_type t, struct resctrl_resource *r) int schemata_list_init(void) { - int ret; + int ret = 0; struct mpam_resctrl_res *res; struct resctrl_resource *r; -- 2.25.1

1 0

[PATCH openEuler-21.03] drm: Lock pointer access in drm_master_release()
by holmes 18 Oct '21

18 Oct '21

From: Desmond Cheong Zhi Xi <desmondcheongzx(a)gmail.com> stable inclusion from stable-v5.10.44 commit aa8591a58cbd2986090709e4202881f18e8ae30e bugzilla:https://bugzilla.openeuler.org/show_bug.cgi?id=435 CVE: NA ------------------------------------------------- commit c336a5ee984708db4826ef9e47d184e638e29717 upstream. This patch eliminates the following smatch warning: drivers/gpu/drm/drm_auth.c:320 drm_master_release() warn: unlocked access 'master' (line 318) expected lock '&dev->master_mutex' The 'file_priv->master' field should be protected by the mutex lock to '&dev->master_mutex'. This is because other processes can concurrently modify this field and free the current 'file_priv->master' pointer. This could result in a use-after-free error when 'master' is dereferenced in subsequent function calls to 'drm_legacy_lock_master_cleanup()' or to 'drm_lease_revoke()'. An example of a scenario that would produce this error can be seen from a similar bug in 'drm_getunique()' that was reported by Syzbot: https://syzkaller.appspot.com/bug?id=148d2f1dfac64af52ffd27b661981a540724f8… In the Syzbot report, another process concurrently acquired the device's master mutex in 'drm_setmaster_ioctl()', then overwrote 'fpriv->master' in 'drm_new_set_master()'. The old value of 'fpriv->master' was subsequently freed before the mutex was unlocked. Reported-by: Dan Carpenter <dan.carpenter(a)oracle.com> Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx(a)gmail.com> Cc: stable(a)vger.kernel.org Signed-off-by: Daniel Vetter <daniel.vetter(a)ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/20210609092119.173590-1-desmo… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: holmes <holmes(a)my.swjtu.edu.cn> --- drivers/gpu/drm/drm_auth.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c index f2d46b7ac6f9..232abbba3686 100644 --- a/drivers/gpu/drm/drm_auth.c +++ b/drivers/gpu/drm/drm_auth.c @@ -314,9 +314,10 @@ int drm_master_open(struct drm_file *file_priv) void drm_master_release(struct drm_file *file_priv) { struct drm_device *dev = file_priv->minor->dev; - struct drm_master *master = file_priv->master; + struct drm_master *master; mutex_lock(&dev->master_mutex); + master = file_priv->master; if (file_priv->magic) idr_remove(&file_priv->master->magic_map, file_priv->magic); -- 2.23.0

3 4

[PATCH kernel-4.19 1/3] NFS: Add a helper nfs_client_for_each_server()
by Yang Yingliang 18 Oct '21

18 Oct '21

From: Trond Myklebust <trond.myklebust(a)hammerspace.com> mainline inclusion from mainline-v5.7-rc1 commit 3c9e502b59fbd243cfac7cc6c875e432d285102a category: bugfix bugzilla: 182252 CVE: NA ----------------------------------------------- Add a helper nfs_client_for_each_server() to iterate through all the filesystems that are attached to a struct nfs_client, and apply a function to all the active ones. Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: ChenXiaoSong <chenxiaosong2(a)huawei.com> Reviewed-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/nfs/internal.h | 4 +++- fs/nfs/super.c | 35 +++++++++++++++++++++++++++++++++++ 2 files changed, 38 insertions(+), 1 deletion(-) diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h index cc07189a501fa..c3c0b40f163f1 100644 --- a/fs/nfs/internal.h +++ b/fs/nfs/internal.h @@ -417,7 +417,9 @@ extern int __init register_nfs_fs(void); extern void __exit unregister_nfs_fs(void); extern bool nfs_sb_active(struct super_block *sb); extern void nfs_sb_deactive(struct super_block *sb); - +extern int nfs_client_for_each_server(struct nfs_client *clp, + int (*fn)(struct nfs_server *, void *), + void *data); /* io.c */ extern void nfs_start_io_read(struct inode *inode); extern void nfs_end_io_read(struct inode *inode); diff --git a/fs/nfs/super.c b/fs/nfs/super.c index fe107348aabe6..48bcdcf4d039e 100644 --- a/fs/nfs/super.c +++ b/fs/nfs/super.c @@ -429,6 +429,41 @@ void nfs_sb_deactive(struct super_block *sb) } EXPORT_SYMBOL_GPL(nfs_sb_deactive); +static int __nfs_list_for_each_server(struct list_head *head, + int (*fn)(struct nfs_server *, void *), + void *data) +{ + struct nfs_server *server, *last = NULL; + int ret = 0; + + rcu_read_lock(); + list_for_each_entry_rcu(server, head, client_link) { + if (!nfs_sb_active(server->super)) + continue; + rcu_read_unlock(); + if (last) + nfs_sb_deactive(last->super); + last = server; + ret = fn(server, data); + if (ret) + goto out; + rcu_read_lock(); + } + rcu_read_unlock(); +out: + if (last) + nfs_sb_deactive(last->super); + return ret; +} + +int nfs_client_for_each_server(struct nfs_client *clp, + int (*fn)(struct nfs_server *, void *), + void *data) +{ + return __nfs_list_for_each_server(&clp->cl_superblocks, fn, data); +} +EXPORT_SYMBOL_GPL(nfs_client_for_each_server); + /* * Deliver file system statistics to userspace */ -- 2.25.1

1 2

[PATCH kernel-4.19 1/2] mmap: userswap: fix memory leak in do_mmap
by Yang Yingliang 18 Oct '21

18 Oct '21

From: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4AHP2 CVE: NA ------------------------------------------------- When userswap is enabled, the memory pointed by 'pages' is not freed in abnormal branch in do_mmap(). To fix the issue and keep do_mmap() mostly unchanged, we rename do_mmap() to __do_mmap() and extract the memory alloc and free code out of __do_mmap(). When __do_mmap() returns a error value, we goto the error label to free the memory. Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- mm/mmap.c | 404 +++++++++++++++++++++++++++--------------------------- 1 file changed, 204 insertions(+), 200 deletions(-) diff --git a/mm/mmap.c b/mm/mmap.c index 378e1869ac7a0..69848726063c7 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1384,172 +1384,6 @@ static unsigned long __mmap_region(struct mm_struct *mm, unsigned long len, vm_flags_t vm_flags, unsigned long pgoff, struct list_head *uf); -#ifdef CONFIG_USERSWAP -/* - * Check if pages between 'addr ~ addr+len' can be user swapped. If so, get - * the reference of the pages and return the pages through input parameters - * 'ppages'. - */ -int pages_can_be_swapped(struct mm_struct *mm, unsigned long addr, - unsigned long len, struct page ***ppages) -{ - struct vm_area_struct *vma; - struct page *page = NULL; - struct page **pages = NULL; - unsigned long addr_start, addr_end; - unsigned long ret; - int i, page_num = 0; - - pages = kmalloc(sizeof(struct page *) * (len / PAGE_SIZE), GFP_KERNEL); - if (!pages) - return -ENOMEM; - - addr_start = addr; - addr_end = addr + len; - while (addr < addr_end) { - vma = find_vma(mm, addr); - if (!vma || !vma_is_anonymous(vma) || - (vma->vm_flags & VM_LOCKED) || vma->vm_file - || (vma->vm_flags & VM_STACK) || (vma->vm_flags & (VM_IO | VM_PFNMAP))) { - ret = -EINVAL; - goto out; - } - if (!(vma->vm_flags & VM_UFFD_MISSING)) { - ret = -EAGAIN; - goto out; - } -get_again: - /* follow_page will inc page ref, dec the ref after we remap the page */ - page = follow_page(vma, addr, FOLL_GET); - if (IS_ERR_OR_NULL(page)) { - ret = -ENODEV; - goto out; - } - pages[page_num] = page; - page_num++; - if (!PageAnon(page) || !PageSwapBacked(page) || PageHuge(page) || PageSwapCache(page)) { - ret = -EINVAL; - goto out; - } else if (PageTransCompound(page)) { - if (trylock_page(page)) { - if (!split_huge_page(page)) { - put_page(page); - page_num--; - unlock_page(page); - goto get_again; - } else { - unlock_page(page); - ret = -EINVAL; - goto out; - } - } else { - ret = -EINVAL; - goto out; - } - } - if (page_mapcount(page) > 1 || page_mapcount(page) + 1 != page_count(page)) { - ret = -EBUSY; - goto out; - } - addr += PAGE_SIZE; - } - - *ppages = pages; - return 0; - -out: - for (i = 0; i < page_num; i++) - put_page(pages[i]); - if (pages) - kfree(pages); - *ppages = NULL; - return ret; -} - -/* - * In uswap situation, we use the bit 0 of the returned address to indicate - * whether the pages are dirty. - */ -#define USWAP_PAGES_DIRTY 1 - -/* unmap the pages between 'addr ~ addr+len' and remap them to a new address */ -unsigned long do_user_swap(struct mm_struct *mm, unsigned long addr_start, - unsigned long len, struct page **pages, unsigned long new_addr) -{ - struct vm_area_struct *vma; - struct page *page; - pmd_t *pmd; - pte_t *pte, old_pte; - spinlock_t *ptl; - unsigned long addr, addr_end; - bool pages_dirty = false; - int i, err; - - addr_end = addr_start + len; - lru_add_drain(); - mmu_notifier_invalidate_range_start(mm, addr_start, addr_end); - addr = addr_start; - i = 0; - while (addr < addr_end) { - page = pages[i]; - vma = find_vma(mm, addr); - if (!vma) { - mmu_notifier_invalidate_range_end(mm, addr_start, addr_end); - WARN_ON("find_vma failed\n"); - return -EINVAL; - } - pmd = mm_find_pmd(mm, addr); - if (!pmd) { - mmu_notifier_invalidate_range_end(mm, addr_start, addr_end); - WARN_ON("mm_find_pmd failed, addr:%llx\n"); - return -ENXIO; - } - pte = pte_offset_map_lock(mm, pmd, addr, &ptl); - flush_cache_page(vma, addr, pte_pfn(*pte)); - old_pte = ptep_clear_flush(vma, addr, pte); - if (pte_dirty(old_pte) || PageDirty(page)) - pages_dirty = true; - set_pte(pte, swp_entry_to_pte(swp_entry(SWP_USERSWAP_ENTRY, page_to_pfn(page)))); - dec_mm_counter(mm, MM_ANONPAGES); - page_remove_rmap(page, false); - put_page(page); - - pte_unmap_unlock(pte, ptl); - vma->vm_flags |= VM_USWAP; - page->mapping = NULL; - addr += PAGE_SIZE; - i++; - } - mmu_notifier_invalidate_range_end(mm, addr_start, addr_end); - - addr_start = new_addr; - addr_end = new_addr + len; - addr = addr_start; - vma = find_vma(mm, addr); - i = 0; - while (addr < addr_end) { - page = pages[i]; - if (addr > vma->vm_end - 1) - vma = find_vma(mm, addr); - err = vm_insert_page(vma, addr, page); - if (err) { - pr_err("vm_insert_page failed:%d\n", err); - } - i++; - addr += PAGE_SIZE; - } - vma->vm_flags |= VM_USWAP; - - if (pages_dirty) - new_addr = new_addr | USWAP_PAGES_DIRTY; - - return new_addr; -} -#endif - -/* - * The caller must hold down_write(&current->mm->mmap_sem). - */ unsigned long __do_mmap(struct mm_struct *mm, struct file *file, unsigned long addr, unsigned long len, unsigned long prot, unsigned long flags, @@ -1557,12 +1391,6 @@ unsigned long __do_mmap(struct mm_struct *mm, struct file *file, unsigned long *populate, struct list_head *uf) { int pkey = 0; -#ifdef CONFIG_USERSWAP - struct page **pages = NULL; - unsigned long addr_start = addr; - int i, page_num = 0; - unsigned long ret; -#endif *populate = 0; @@ -1579,17 +1407,6 @@ unsigned long __do_mmap(struct mm_struct *mm, struct file *file, if (!(file && path_noexec(&file->f_path))) prot |= PROT_EXEC; -#ifdef CONFIG_USERSWAP - if (enable_userswap && (flags & MAP_REPLACE)) { - if (offset_in_page(addr) || (len % PAGE_SIZE)) - return -EINVAL; - page_num = len / PAGE_SIZE; - ret = pages_can_be_swapped(mm, addr, len, &pages); - if (ret) - return ret; - } -#endif - /* force arch specific MAP_FIXED handling in get_unmapped_area */ if (flags & MAP_FIXED_NOREPLACE) flags |= MAP_FIXED; @@ -1766,25 +1583,203 @@ unsigned long __do_mmap(struct mm_struct *mm, struct file *file, if (flags & MAP_CHECKNODE) set_vm_checknode(&vm_flags, flags); -#ifdef CONFIG_USERSWAP - /* mark the vma as special to avoid merging with other vmas */ - if (enable_userswap && (flags & MAP_REPLACE)) - vm_flags |= VM_SPECIAL; -#endif - addr = __mmap_region(mm, file, addr, len, vm_flags, pgoff, uf); if (!IS_ERR_VALUE(addr) && ((vm_flags & VM_LOCKED) || (flags & (MAP_POPULATE | MAP_NONBLOCK)) == MAP_POPULATE)) *populate = len; -#ifndef CONFIG_USERSWAP return addr; -#else - if (!enable_userswap || !(flags & MAP_REPLACE)) - return addr; +} +#ifdef CONFIG_USERSWAP +/* + * Check if pages between 'addr ~ addr+len' can be user swapped. If so, get + * the reference of the pages and return the pages through input parameters + * 'ppages'. + */ +int pages_can_be_swapped(struct mm_struct *mm, unsigned long addr, + unsigned long len, struct page ***ppages) +{ + struct vm_area_struct *vma; + struct page *page = NULL; + struct page **pages = NULL; + unsigned long addr_start, addr_end; + unsigned long ret; + int i, page_num = 0; + + pages = kmalloc(sizeof(struct page *) * (len / PAGE_SIZE), GFP_KERNEL); + if (!pages) + return -ENOMEM; + + addr_start = addr; + addr_end = addr + len; + while (addr < addr_end) { + vma = find_vma(mm, addr); + if (!vma || !vma_is_anonymous(vma) || + (vma->vm_flags & VM_LOCKED) || vma->vm_file + || (vma->vm_flags & VM_STACK) || (vma->vm_flags & (VM_IO | VM_PFNMAP))) { + ret = -EINVAL; + goto out; + } + if (!(vma->vm_flags & VM_UFFD_MISSING)) { + ret = -EAGAIN; + goto out; + } +get_again: + /* follow_page will inc page ref, dec the ref after we remap the page */ + page = follow_page(vma, addr, FOLL_GET); + if (IS_ERR_OR_NULL(page)) { + ret = -ENODEV; + goto out; + } + pages[page_num] = page; + page_num++; + if (!PageAnon(page) || !PageSwapBacked(page) || PageHuge(page) || PageSwapCache(page)) { + ret = -EINVAL; + goto out; + } else if (PageTransCompound(page)) { + if (trylock_page(page)) { + if (!split_huge_page(page)) { + put_page(page); + page_num--; + unlock_page(page); + goto get_again; + } else { + unlock_page(page); + ret = -EINVAL; + goto out; + } + } else { + ret = -EINVAL; + goto out; + } + } + if (page_mapcount(page) > 1 || page_mapcount(page) + 1 != page_count(page)) { + ret = -EBUSY; + goto out; + } + addr += PAGE_SIZE; + } + + *ppages = pages; + return 0; + +out: + for (i = 0; i < page_num; i++) + put_page(pages[i]); + if (pages) + kfree(pages); + *ppages = NULL; + return ret; +} + +/* + * In uswap situation, we use the bit 0 of the returned address to indicate + * whether the pages are dirty. + */ +#define USWAP_PAGES_DIRTY 1 + +/* unmap the pages between 'addr ~ addr+len' and remap them to a new address */ +unsigned long do_user_swap(struct mm_struct *mm, unsigned long addr_start, + unsigned long len, struct page **pages, unsigned long new_addr) +{ + struct vm_area_struct *vma; + struct page *page; + pmd_t *pmd; + pte_t *pte, old_pte; + spinlock_t *ptl; + unsigned long addr, addr_end; + bool pages_dirty = false; + int i, err; + + addr_end = addr_start + len; + lru_add_drain(); + mmu_notifier_invalidate_range_start(mm, addr_start, addr_end); + addr = addr_start; + i = 0; + while (addr < addr_end) { + page = pages[i]; + vma = find_vma(mm, addr); + if (!vma) { + mmu_notifier_invalidate_range_end(mm, addr_start, addr_end); + WARN_ON("find_vma failed\n"); + return -EINVAL; + } + pmd = mm_find_pmd(mm, addr); + if (!pmd) { + mmu_notifier_invalidate_range_end(mm, addr_start, addr_end); + WARN_ON("mm_find_pmd failed, addr:%llx\n"); + return -ENXIO; + } + pte = pte_offset_map_lock(mm, pmd, addr, &ptl); + flush_cache_page(vma, addr, pte_pfn(*pte)); + old_pte = ptep_clear_flush(vma, addr, pte); + if (pte_dirty(old_pte) || PageDirty(page)) + pages_dirty = true; + set_pte(pte, swp_entry_to_pte(swp_entry(SWP_USERSWAP_ENTRY, page_to_pfn(page)))); + dec_mm_counter(mm, MM_ANONPAGES); + page_remove_rmap(page, false); + put_page(page); + + pte_unmap_unlock(pte, ptl); + vma->vm_flags |= VM_USWAP; + page->mapping = NULL; + addr += PAGE_SIZE; + i++; + } + mmu_notifier_invalidate_range_end(mm, addr_start, addr_end); + + addr_start = new_addr; + addr_end = new_addr + len; + addr = addr_start; + vma = find_vma(mm, addr); + i = 0; + while (addr < addr_end) { + page = pages[i]; + if (addr > vma->vm_end - 1) + vma = find_vma(mm, addr); + err = vm_insert_page(vma, addr, page); + if (err) { + pr_err("vm_insert_page failed:%d\n", err); + } + i++; + addr += PAGE_SIZE; + } + vma->vm_flags |= VM_USWAP; + + if (pages_dirty) + new_addr = new_addr | USWAP_PAGES_DIRTY; + + return new_addr; +} + +static inline +unsigned long do_uswap_mmap(struct file *file, unsigned long addr, + unsigned long len, unsigned long prot, + unsigned long flags, vm_flags_t vm_flags, + unsigned long pgoff, unsigned long *populate, + struct list_head *uf) +{ + struct mm_struct *mm = current->mm; + unsigned long addr_start = addr; + struct page **pages = NULL; + unsigned long ret; + int i, page_num = 0; + + if (!len || offset_in_page(addr) || (len % PAGE_SIZE)) + return -EINVAL; + + page_num = len / PAGE_SIZE; + ret = pages_can_be_swapped(mm, addr, len, &pages); + if (ret) + return ret; + + /* mark the vma as special to avoid merging with other vmas */ + vm_flags |= VM_SPECIAL; + + addr = __do_mmap(current->mm, file, addr, len, prot, flags, vm_flags, + pgoff, populate, uf); if (IS_ERR_VALUE(addr)) { - pr_info("mmap_region failed, return addr:%lx\n", addr); ret = addr; goto out; } @@ -1794,23 +1789,32 @@ unsigned long __do_mmap(struct mm_struct *mm, struct file *file, /* follow_page() above increased the reference*/ for (i = 0; i < page_num; i++) put_page(pages[i]); + if (pages) kfree(pages); + return ret; -#endif } +#endif /* * The caller must hold down_write(&current->mm->mmap_sem). */ -unsigned long do_mmap(struct file *file, unsigned long addr, unsigned long len, - unsigned long prot, unsigned long flags, vm_flags_t vm_flags, - unsigned long pgoff, unsigned long *populate, struct list_head *uf) +unsigned long do_mmap(struct file *file, unsigned long addr, + unsigned long len, unsigned long prot, + unsigned long flags, vm_flags_t vm_flags, + unsigned long pgoff, unsigned long *populate, + struct list_head *uf) { - return __do_mmap(current->mm, file, addr, len, prot, flags, vm_flags, pgoff, populate, uf); +#ifdef CONFIG_USERSWAP + if (enable_userswap && (flags & MAP_REPLACE)) + return do_uswap_mmap(file, addr, len, prot, flags, vm_flags, + pgoff, populate, uf); +#endif + return __do_mmap(current->mm, file, addr, len, prot, flags, vm_flags, + pgoff, populate, uf); } - unsigned long ksys_mmap_pgoff(unsigned long addr, unsigned long len, unsigned long prot, unsigned long flags, unsigned long fd, unsigned long pgoff) -- 2.25.1

1 1

[PATCH kernel-4.19] blktrace: Fix uaf in blk_trace access after removing by sysfs
by Yang Yingliang 18 Oct '21

18 Oct '21

From: Zhihao Cheng <chengzhihao1(a)huawei.com> mainline inclusion from mainline-5.15-rc3 commit 5afedf670caf30a2b5a52da96eb7eac7dee6a9c9 category: bugfix bugzilla: 181454 CVE: NA --------------------------- There is an use-after-free problem triggered by following process: P1(sda) P2(sdb) echo 0 > /sys/block/sdb/trace/enable blk_trace_remove_queue synchronize_rcu blk_trace_free relay_close rcu_read_lock __blk_add_trace trace_note_tsk (Iterate running_trace_list) relay_close_buf relay_destroy_buf kfree(buf) trace_note(sdb's bt) relay_reserve buf->offset <- nullptr deference (use-after-free) !!! rcu_read_unlock [ 502.714379] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ 502.715260] #PF: supervisor read access in kernel mode [ 502.715903] #PF: error_code(0x0000) - not-present page [ 502.716546] PGD 103984067 P4D 103984067 PUD 17592b067 PMD 0 [ 502.717252] Oops: 0000 [#1] SMP [ 502.720308] RIP: 0010:trace_note.isra.0+0x86/0x360 [ 502.732872] Call Trace: [ 502.733193] __blk_add_trace.cold+0x137/0x1a3 [ 502.733734] blk_add_trace_rq+0x7b/0xd0 [ 502.734207] blk_add_trace_rq_issue+0x54/0xa0 [ 502.734755] blk_mq_start_request+0xde/0x1b0 [ 502.735287] scsi_queue_rq+0x528/0x1140 ... [ 502.742704] sg_new_write.isra.0+0x16e/0x3e0 [ 502.747501] sg_ioctl+0x466/0x1100 Reproduce method: ioctl(/dev/sda, BLKTRACESETUP, blk_user_trace_setup[buf_size=127]) ioctl(/dev/sda, BLKTRACESTART) ioctl(/dev/sdb, BLKTRACESETUP, blk_user_trace_setup[buf_size=127]) ioctl(/dev/sdb, BLKTRACESTART) echo 0 > /sys/block/sdb/trace/enable & // Add delay(mdelay/msleep) before kernel enters blk_trace_free() ioctl$SG_IO(/dev/sda, SG_IO, ...) // Enters trace_note_tsk() after blk_trace_free() returned // Use mdelay in rcu region rather than msleep(which may schedule out) Remove blk_trace from running_list before calling blk_trace_free() by sysfs if blk_trace is at Blktrace_running state. Fixes: c71a896154119f ("blktrace: add ftrace plugin") Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Link: https://lore.kernel.org/r/20210923134921.109194-1-chengzhihao1@huawei.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/trace/blktrace.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c index da0ee8cc15a72..2df442fb46bb2 100644 --- a/kernel/trace/blktrace.c +++ b/kernel/trace/blktrace.c @@ -1662,6 +1662,14 @@ static int blk_trace_remove_queue(struct request_queue *q) if (bt == NULL) return -EINVAL; + if (bt->trace_state == Blktrace_running) { + bt->trace_state = Blktrace_stopped; + spin_lock_irq(&running_trace_lock); + list_del_init(&bt->running_list); + spin_unlock_irq(&running_trace_lock); + relay_flush(bt->rchan); + } + put_probe_ref(); synchronize_rcu(); blk_trace_free(bt); -- 2.25.1

1 0

[PATCH openEuler-21.03] drm: Lock pointer access in drm_master_release()
by holmes 18 Oct '21

18 Oct '21

From: Desmond Cheong Zhi Xi <desmondcheongzx(a)gmail.com> stable inclusion from stable-v5.10.44 commit aa8591a58cbd2986090709e4202881f18e8ae30e bugzilla:https://bugzilla.openeuler.org/show_bug.cgi?id=435 CVE: NA ------------------------------------------------- commit c336a5ee984708db4826ef9e47d184e638e29717 upstream. This patch eliminates the following smatch warning: drivers/gpu/drm/drm_auth.c:320 drm_master_release() warn: unlocked access 'master' (line 318) expected lock '&dev->master_mutex' The 'file_priv->master' field should be protected by the mutex lock to '&dev->master_mutex'. This is because other processes can concurrently modify this field and free the current 'file_priv->master' pointer. This could result in a use-after-free error when 'master' is dereferenced in subsequent function calls to 'drm_legacy_lock_master_cleanup()' or to 'drm_lease_revoke()'. An example of a scenario that would produce this error can be seen from a similar bug in 'drm_getunique()' that was reported by Syzbot: https://syzkaller.appspot.com/bug?id=148d2f1dfac64af52ffd27b661981a540724f8… In the Syzbot report, another process concurrently acquired the device's master mutex in 'drm_setmaster_ioctl()', then overwrote 'fpriv->master' in 'drm_new_set_master()'. The old value of 'fpriv->master' was subsequently freed before the mutex was unlocked. Reported-by: Dan Carpenter <dan.carpenter(a)oracle.com> Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx(a)gmail.com> Cc: stable(a)vger.kernel.org Signed-off-by: Daniel Vetter <daniel.vetter(a)ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/20210609092119.173590-1-desmo… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: holmes <holmes(a)my.swjtu.edu.cn> --- drivers/gpu/drm/drm_auth.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c index f2d46b7ac6f9..232abbba3686 100644 --- a/drivers/gpu/drm/drm_auth.c +++ b/drivers/gpu/drm/drm_auth.c @@ -314,9 +314,10 @@ int drm_master_open(struct drm_file *file_priv) void drm_master_release(struct drm_file *file_priv) { struct drm_device *dev = file_priv->minor->dev; - struct drm_master *master = file_priv->master; + struct drm_master *master; mutex_lock(&dev->master_mutex); + master = file_priv->master; if (file_priv->magic) idr_remove(&file_priv->master->magic_map, file_priv->magic); -- 2.23.0

1 1

[PATCH OLK-5.10 v2 0/1] scsi: spfc: initial commit the spfc module
by Yanling Song 18 Oct '21

18 Oct '21

Ramaxel inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4DBD7 CVE: NA Initial commit the spfc module for ramaxel Super FC adapter Changes since v1: - Add UNF_PORT_CFG_SET_PORT_STATE state Yanling Song (1): scsi: spfc: initial commit the spfc module arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + drivers/scsi/Kconfig | 1 + drivers/scsi/Makefile | 1 + drivers/scsi/spfc/Kconfig | 17 + drivers/scsi/spfc/Makefile | 47 + drivers/scsi/spfc/common/unf_common.h | 1755 +++++++ drivers/scsi/spfc/common/unf_disc.c | 1276 +++++ drivers/scsi/spfc/common/unf_disc.h | 51 + drivers/scsi/spfc/common/unf_event.c | 517 ++ drivers/scsi/spfc/common/unf_event.h | 84 + drivers/scsi/spfc/common/unf_exchg.c | 2317 +++++++++ drivers/scsi/spfc/common/unf_exchg.h | 436 ++ drivers/scsi/spfc/common/unf_exchg_abort.c | 825 +++ drivers/scsi/spfc/common/unf_exchg_abort.h | 23 + drivers/scsi/spfc/common/unf_fcstruct.h | 459 ++ drivers/scsi/spfc/common/unf_gs.c | 2521 +++++++++ drivers/scsi/spfc/common/unf_gs.h | 58 + drivers/scsi/spfc/common/unf_init.c | 353 ++ drivers/scsi/spfc/common/unf_io.c | 1220 +++++ drivers/scsi/spfc/common/unf_io.h | 96 + drivers/scsi/spfc/common/unf_io_abnormal.c | 986 ++++ drivers/scsi/spfc/common/unf_io_abnormal.h | 19 + drivers/scsi/spfc/common/unf_log.h | 178 + drivers/scsi/spfc/common/unf_lport.c | 1008 ++++ drivers/scsi/spfc/common/unf_lport.h | 519 ++ drivers/scsi/spfc/common/unf_ls.c | 4884 ++++++++++++++++++ drivers/scsi/spfc/common/unf_ls.h | 61 + drivers/scsi/spfc/common/unf_npiv.c | 1005 ++++ drivers/scsi/spfc/common/unf_npiv.h | 47 + drivers/scsi/spfc/common/unf_npiv_portman.c | 360 ++ drivers/scsi/spfc/common/unf_npiv_portman.h | 17 + drivers/scsi/spfc/common/unf_portman.c | 2431 +++++++++ drivers/scsi/spfc/common/unf_portman.h | 96 + drivers/scsi/spfc/common/unf_rport.c | 2286 ++++++++ drivers/scsi/spfc/common/unf_rport.h | 301 ++ drivers/scsi/spfc/common/unf_scsi.c | 1463 ++++++ drivers/scsi/spfc/common/unf_scsi_common.h | 570 ++ drivers/scsi/spfc/common/unf_service.c | 1439 ++++++ drivers/scsi/spfc/common/unf_service.h | 66 + drivers/scsi/spfc/common/unf_type.h | 216 + drivers/scsi/spfc/hw/spfc_chipitf.c | 1105 ++++ drivers/scsi/spfc/hw/spfc_chipitf.h | 797 +++ drivers/scsi/spfc/hw/spfc_cqm_bat_cla.c | 1646 ++++++ drivers/scsi/spfc/hw/spfc_cqm_bat_cla.h | 215 + drivers/scsi/spfc/hw/spfc_cqm_bitmap_table.c | 891 ++++ drivers/scsi/spfc/hw/spfc_cqm_bitmap_table.h | 65 + drivers/scsi/spfc/hw/spfc_cqm_main.c | 1257 +++++ drivers/scsi/spfc/hw/spfc_cqm_main.h | 414 ++ drivers/scsi/spfc/hw/spfc_cqm_object.c | 959 ++++ drivers/scsi/spfc/hw/spfc_cqm_object.h | 279 + drivers/scsi/spfc/hw/spfc_hba.c | 1751 +++++++ drivers/scsi/spfc/hw/spfc_hba.h | 341 ++ drivers/scsi/spfc/hw/spfc_hw_wqe.h | 1645 ++++++ drivers/scsi/spfc/hw/spfc_io.c | 1193 +++++ drivers/scsi/spfc/hw/spfc_io.h | 138 + drivers/scsi/spfc/hw/spfc_lld.c | 998 ++++ drivers/scsi/spfc/hw/spfc_lld.h | 76 + drivers/scsi/spfc/hw/spfc_module.h | 297 ++ drivers/scsi/spfc/hw/spfc_parent_context.h | 269 + drivers/scsi/spfc/hw/spfc_queue.c | 4857 +++++++++++++++++ drivers/scsi/spfc/hw/spfc_queue.h | 711 +++ drivers/scsi/spfc/hw/spfc_service.c | 2169 ++++++++ drivers/scsi/spfc/hw/spfc_service.h | 282 + drivers/scsi/spfc/hw/spfc_utils.c | 102 + drivers/scsi/spfc/hw/spfc_utils.h | 202 + drivers/scsi/spfc/hw/spfc_wqe.c | 646 +++ drivers/scsi/spfc/hw/spfc_wqe.h | 239 + 68 files changed, 53555 insertions(+) create mode 100644 drivers/scsi/spfc/Kconfig create mode 100644 drivers/scsi/spfc/Makefile create mode 100644 drivers/scsi/spfc/common/unf_common.h create mode 100644 drivers/scsi/spfc/common/unf_disc.c create mode 100644 drivers/scsi/spfc/common/unf_disc.h create mode 100644 drivers/scsi/spfc/common/unf_event.c create mode 100644 drivers/scsi/spfc/common/unf_event.h create mode 100644 drivers/scsi/spfc/common/unf_exchg.c create mode 100644 drivers/scsi/spfc/common/unf_exchg.h create mode 100644 drivers/scsi/spfc/common/unf_exchg_abort.c create mode 100644 drivers/scsi/spfc/common/unf_exchg_abort.h create mode 100644 drivers/scsi/spfc/common/unf_fcstruct.h create mode 100644 drivers/scsi/spfc/common/unf_gs.c create mode 100644 drivers/scsi/spfc/common/unf_gs.h create mode 100644 drivers/scsi/spfc/common/unf_init.c create mode 100644 drivers/scsi/spfc/common/unf_io.c create mode 100644 drivers/scsi/spfc/common/unf_io.h create mode 100644 drivers/scsi/spfc/common/unf_io_abnormal.c create mode 100644 drivers/scsi/spfc/common/unf_io_abnormal.h create mode 100644 drivers/scsi/spfc/common/unf_log.h create mode 100644 drivers/scsi/spfc/common/unf_lport.c create mode 100644 drivers/scsi/spfc/common/unf_lport.h create mode 100644 drivers/scsi/spfc/common/unf_ls.c create mode 100644 drivers/scsi/spfc/common/unf_ls.h create mode 100644 drivers/scsi/spfc/common/unf_npiv.c create mode 100644 drivers/scsi/spfc/common/unf_npiv.h create mode 100644 drivers/scsi/spfc/common/unf_npiv_portman.c create mode 100644 drivers/scsi/spfc/common/unf_npiv_portman.h create mode 100644 drivers/scsi/spfc/common/unf_portman.c create mode 100644 drivers/scsi/spfc/common/unf_portman.h create mode 100644 drivers/scsi/spfc/common/unf_rport.c create mode 100644 drivers/scsi/spfc/common/unf_rport.h create mode 100644 drivers/scsi/spfc/common/unf_scsi.c create mode 100644 drivers/scsi/spfc/common/unf_scsi_common.h create mode 100644 drivers/scsi/spfc/common/unf_service.c create mode 100644 drivers/scsi/spfc/common/unf_service.h create mode 100644 drivers/scsi/spfc/common/unf_type.h create mode 100644 drivers/scsi/spfc/hw/spfc_chipitf.c create mode 100644 drivers/scsi/spfc/hw/spfc_chipitf.h create mode 100644 drivers/scsi/spfc/hw/spfc_cqm_bat_cla.c create mode 100644 drivers/scsi/spfc/hw/spfc_cqm_bat_cla.h create mode 100644 drivers/scsi/spfc/hw/spfc_cqm_bitmap_table.c create mode 100644 drivers/scsi/spfc/hw/spfc_cqm_bitmap_table.h create mode 100644 drivers/scsi/spfc/hw/spfc_cqm_main.c create mode 100644 drivers/scsi/spfc/hw/spfc_cqm_main.h create mode 100644 drivers/scsi/spfc/hw/spfc_cqm_object.c create mode 100644 drivers/scsi/spfc/hw/spfc_cqm_object.h create mode 100644 drivers/scsi/spfc/hw/spfc_hba.c create mode 100644 drivers/scsi/spfc/hw/spfc_hba.h create mode 100644 drivers/scsi/spfc/hw/spfc_hw_wqe.h create mode 100644 drivers/scsi/spfc/hw/spfc_io.c create mode 100644 drivers/scsi/spfc/hw/spfc_io.h create mode 100644 drivers/scsi/spfc/hw/spfc_lld.c create mode 100644 drivers/scsi/spfc/hw/spfc_lld.h create mode 100644 drivers/scsi/spfc/hw/spfc_module.h create mode 100644 drivers/scsi/spfc/hw/spfc_parent_context.h create mode 100644 drivers/scsi/spfc/hw/spfc_queue.c create mode 100644 drivers/scsi/spfc/hw/spfc_queue.h create mode 100644 drivers/scsi/spfc/hw/spfc_service.c create mode 100644 drivers/scsi/spfc/hw/spfc_service.h create mode 100644 drivers/scsi/spfc/hw/spfc_utils.c create mode 100644 drivers/scsi/spfc/hw/spfc_utils.h create mode 100644 drivers/scsi/spfc/hw/spfc_wqe.c create mode 100644 drivers/scsi/spfc/hw/spfc_wqe.h -- 2.30.0

2 2

[PATCH kernel-4.19 v5 00/23] support psi feature
by Liu Xinpeng 17 Oct '21

17 Oct '21

backport psi feature from upstream 5.4 bugzilla: https://gitee.com/openeuler/kernel/issues/I47QS2 Baruch Siach (1): psi: fix reference to kernel commandline enable Dan Schatzberg (1): kernel/sched/psi.c: expose pressure metrics on root cgroup Johannes Weiner (11): sched: loadavg: consolidate LOAD_INT, LOAD_FRAC, CALC_LOAD sched: loadavg: make calc_load_n() public sched: sched.h: make rq locking and clock functions available in stats.h sched: introduce this_rq_lock_irq() psi: pressure stall information for CPU, memory, and IO psi: cgroup support psi: make disabling/enabling easier for vendor kernels psi: fix aggregation idle shut-off psi: avoid divide-by-zero crash inside virtual machines fs: kernfs: add poll file operation sched/psi: Fix sampling error and rare div0 crashes with cgroups and high uptime Josef Bacik (1): blk-iolatency: use a percentile approache for ssd's Liu Xinpeng (2): psi:enable psi in config psi:avoid kabi change Olof Johansson (1): kernel/sched/psi.c: simplify cgroup_move_task() Suren Baghdasaryan (6): psi: introduce state_mask to represent stalled psi states psi: make psi_enable static psi: rename psi fields in preparation for psi trigger addition psi: split update_stats into parts psi: track changed states include/: refactor headers to allow kthread.h inclusion in psi_types.h Documentation/accounting/psi.txt | 73 +++ Documentation/admin-guide/cgroup-v2.rst | 18 + Documentation/admin-guide/kernel-parameters.txt | 4 + arch/arm64/configs/openeuler_defconfig | 2 + arch/powerpc/platforms/cell/cpufreq_spudemand.c | 2 +- arch/powerpc/platforms/cell/spufs/sched.c | 9 +- arch/s390/appldata/appldata_os.c | 4 - arch/x86/configs/openeuler_defconfig | 2 + block/blk-iolatency.c | 183 +++++- drivers/cpuidle/governors/menu.c | 4 - drivers/spi/spi-rockchip.c | 1 + fs/kernfs/file.c | 31 +- fs/proc/loadavg.c | 3 - include/linux/cgroup-defs.h | 12 + include/linux/cgroup.h | 17 + include/linux/kernfs.h | 8 + include/linux/kthread.h | 4 + include/linux/psi.h | 55 ++ include/linux/psi_types.h | 95 +++ include/linux/sched.h | 13 + include/linux/sched/loadavg.h | 24 +- init/Kconfig | 28 + kernel/cgroup/cgroup.c | 55 +- kernel/debug/kdb/kdb_main.c | 7 +- kernel/fork.c | 4 + kernel/kthread.c | 3 + kernel/sched/Makefile | 1 + kernel/sched/core.c | 16 +- kernel/sched/loadavg.c | 139 ++-- kernel/sched/psi.c | 823 ++++++++++++++++++++++++ kernel/sched/sched.h | 178 ++--- kernel/sched/stats.h | 86 +++ kernel/workqueue.c | 23 + kernel/workqueue_internal.h | 6 +- mm/compaction.c | 5 + mm/filemap.c | 11 + mm/page_alloc.c | 9 + mm/vmscan.c | 9 + 38 files changed, 1726 insertions(+), 241 deletions(-) create mode 100644 Documentation/accounting/psi.txt create mode 100644 include/linux/psi.h create mode 100644 include/linux/psi_types.h create mode 100644 kernel/sched/psi.c -- 1.8.3.1

1 22

Re: Re: [PATCH kernel-4.19 v4 19/22] kernel/sched/psi.c: expose pressure metrics on root cgroup
by 刘新朋 17 Oct '21

17 Oct '21

1 0

[PATCH kernel-4.19 v4 00/22] support PSI feature
by Liu Xinpeng 16 Oct '21

16 Oct '21

backport psi feature from upstream 5.4 bugzilla: https://gitee.com/openeuler/kernel/issues/I47QS2 Dan Schatzberg (1): kernel/sched/psi.c: expose pressure metrics on root cgroup Johannes Weiner (11): sched: loadavg: consolidate LOAD_INT, LOAD_FRAC, CALC_LOAD sched: loadavg: make calc_load_n() public sched: sched.h: make rq locking and clock functions available in stats.h sched: introduce this_rq_lock_irq() psi: pressure stall information for CPU, memory, and IO psi: cgroup support psi: make disabling/enabling easier for vendor kernels psi: fix aggregation idle shut-off psi: avoid divide-by-zero crash inside virtual machines fs: kernfs: add poll file operation sched/psi: Fix sampling error and rare div0 crashes with cgroups and high uptime Josef Bacik (1): blk-iolatency: use a percentile approache for ssd's Liu Xinpeng (2): psi:enable psi in config psi:avoid kabi change Olof Johansson (1): kernel/sched/psi.c: simplify cgroup_move_task() Suren Baghdasaryan (6): psi: introduce state_mask to represent stalled psi states psi: make psi_enable static psi: rename psi fields in preparation for psi trigger addition psi: split update_stats into parts psi: track changed states include/: refactor headers to allow kthread.h inclusion in psi_types.h Documentation/accounting/psi.txt | 73 +++ Documentation/admin-guide/cgroup-v2.rst | 18 + Documentation/admin-guide/kernel-parameters.txt | 4 + arch/arm64/configs/openeuler_defconfig | 2 + arch/powerpc/platforms/cell/cpufreq_spudemand.c | 2 +- arch/powerpc/platforms/cell/spufs/sched.c | 9 +- arch/s390/appldata/appldata_os.c | 4 - arch/x86/configs/openeuler_defconfig | 2 + block/blk-iolatency.c | 183 +++++- drivers/cpuidle/governors/menu.c | 4 - drivers/spi/spi-rockchip.c | 1 + fs/kernfs/file.c | 31 +- fs/proc/loadavg.c | 3 - include/linux/cgroup-defs.h | 12 + include/linux/cgroup.h | 16 + include/linux/kernfs.h | 8 + include/linux/kthread.h | 4 + include/linux/psi.h | 55 ++ include/linux/psi_types.h | 95 +++ include/linux/sched.h | 13 + include/linux/sched/loadavg.h | 24 +- init/Kconfig | 28 + kernel/cgroup/cgroup.c | 55 +- kernel/debug/kdb/kdb_main.c | 7 +- kernel/fork.c | 4 + kernel/kthread.c | 3 + kernel/sched/Makefile | 1 + kernel/sched/core.c | 16 +- kernel/sched/loadavg.c | 139 ++-- kernel/sched/psi.c | 823 ++++++++++++++++++++++++ kernel/sched/sched.h | 178 ++--- kernel/sched/stats.h | 86 +++ kernel/workqueue.c | 23 + kernel/workqueue_internal.h | 6 +- mm/compaction.c | 5 + mm/filemap.c | 11 + mm/page_alloc.c | 9 + mm/vmscan.c | 9 + 38 files changed, 1725 insertions(+), 241 deletions(-) create mode 100644 Documentation/accounting/psi.txt create mode 100644 include/linux/psi.h create mode 100644 include/linux/psi_types.h create mode 100644 kernel/sched/psi.c -- 1.8.3.1

2 27

[PATCH openEuler-5.10 000/133] Backport LTS 5.10.58
by Zheng Zengkai 15 Oct '21

15 Oct '21

Backport LTS 5.10.58 patches from upstream. Aharon Landau (1): RDMA/mlx5: Delay emptying a cache entry when a new MR is added to it recently Alex Deucher (1): drm/amdgpu/display: only enable aux backlight control for OLED panels Alex Xu (Hello71) (1): pipe: increase minimum default pipe size to 2 pages Alexander Monakov (1): ALSA: hda/realtek: add mic quirk for Acer SF314-42 Alexander Tsoy (1): ALSA: usb-audio: Add registration quirk for JBL Quantum 600 Allen Pais (1): optee: fix tee out of memory failure seen during kexec reboot Andy Shevchenko (1): serial: 8250_pci: Enumerate Elkhart Lake UARTs via dedicated driver Anirudh Rayabharam (2): firmware_loader: use -ETIMEDOUT instead of -EAGAIN in fw_load_sysfs_fallback firmware_loader: fix use-after-free in firmware_fallback_sysfs Antoine Tenart (1): net: ipv6: fix returned variable type in ip6_skb_dst_mtu Arnd Bergmann (2): soc: ixp4xx: fix printing resources soc: ixp4xx/qmgr: fix invalid __iomem access Brian Norris (1): clk: fix leak on devm_clk_bulk_get_all() unwind Christoph Hellwig (1): libata: fix ata_pio_sector for CONFIG_HIGHMEM Claudiu Beznea (1): usb: host: ohci-at91: suspend/resume ports after/before OHCI accesses Colin Ian King (2): ARM: imx: fix missing 3rd argument in macro imx_mmdc_perf_init interconnect: Fix undersized devress_alloc allocation Dan Carpenter (1): bnx2x: fix an error code in bnx2x_nic_load() Daniele Palmas (1): USB: serial: option: add Telit FD980 composition 0x1056 Dario Binacchi (2): clk: stm32f4: fix post divisor setup for I2S/SAI PLLs ARM: dts: am437x-l4: fix typo in can@0 node David Bauer (1): USB: serial: ftdi_sio: add device ID for Auto-M3 OP-COM v2 Dmitry Osipenko (2): clk: tegra: Implement disable_unused() of tegra_clk_sdmmc_mux_ops usb: otg-fsm: Fix hrtimer list corruption Dmitry Safonov (1): net/xfrm/compat: Copy xfrm_spdattr_type_t atributes Dongliang Mu (1): spi: meson-spicc: fix memory leak in meson_spicc_remove Fei Qin (1): nfp: update ethtool reporting of pauseframe control Filip Schauer (1): drivers core: Fix oops when driver probe fails Frederic Weisbecker (1): xfrm: Fix RCU vs hash_resize_mutex lock inversion H. Nikolaus Schaller (2): omap5-board-common: remove not physically existing vdds_1v8_main fixed-regulator mips: Fix non-POSIX regexp Hans Verkuil (1): media: videobuf2-core: dequeue if start_streaming fails Harshvardhan Jha (1): net: qede: Fix end of loop tests for list_for_each_entry Huang Pei (1): MIPS: check return value of pgtable_pmd_page_ctor Hui Su (1): scripts/tracing: fix the bug that can't parse raw_trace_func Jakub Sitnicki (1): net, gro: Set inner transport header offset in tcp/udp GRO hook Jaroslav Kysela (1): ALSA: pcm - fix mmap capability check for the snd-dummy driver Jens Wiklander (1): tee: add tee_shm_alloc_kernel_buf() Johan Hovold (1): media: rtl28xxu: fix zero-length control request Jon Hunter (1): serial: tegra: Only print FIFO error message when an error occurs Jonathan Gray (1): drm/i915: avoid uninitialised var in eb_parse() Juergen Borleis (1): dmaengine: imx-dma: configure the generic DMA type to make it work Kajol Jain (1): fpga: dfl: fme: Fix cpu hotplug issue in performance reporting Kamal Agrawal (1): tracing: Fix NULL pointer dereference in start_creating Kevin Hilman (1): bus: ti-sysc: AM3: RNG is GP only Kunihiko Hayashi (1): dmaengine: uniphier-xdmac: Use readl_poll_timeout_atomic() in atomic state Kyle Tso (1): usb: typec: tcpm: Keep other events when receiving FRS and Sourcing_vbus events Letu Ren (1): net/qla3xxx: fix schedule while atomic in ql_wait_for_drvr_lock and ql_adapter_reset Li Manyi (1): scsi: sr: Return correct event when media event code is 3 Like Xu (1): perf/x86/amd: Don't touch the AMD64_EVENTSEL_HOSTONLY bit inside the guest Maciej W. Rozycki (2): serial: 8250: Mask out floating 16/32-bit bus bits MIPS: Malta: Do not byte-swap accesses to the CBUS UART Marek Vasut (5): ARM: dts: imx: Swap M53Menlo pinctrl_power_button/pinctrl_power_out pins spi: imx: mx51-ecspi: Reinstate low-speed CONFIGREG delay spi: imx: mx51-ecspi: Fix low-speed CONFIGREG delay calculation ARM: dts: stm32: Disable LAN8710 EDPD on DHCOM ARM: dts: stm32: Fix touchscreen IRQ line assignment on DHCOM Mario Kleiner (1): serial: 8250_pci: Avoid irq sharing for MSI(-X) interrupts. Mark Rutland (1): arm64: stacktrace: avoid tracing arch_stack_walk() Masami Hiramatsu (1): tracing: Reject string operand in the histogram expression Mathieu Desnoyers (2): tracepoint: static call: Compare data on transition from 2->1 callees tracepoint: Fix static call function vs data state mismatch Matt Roper (1): drm/i915: Correct SFC_DONE register offset Matteo Croce (1): virt_wifi: fix error on connect Matthias Schiffer (1): gpio: tqmx86: really make IRQ optional Maxim Devaev (2): usb: gadget: f_hid: added GET_IDLE and SET_IDLE handlers usb: gadget: f_hid: idle uses the highest byte for duration Maxime Chevallier (1): ARM: dts: imx6qdl-sr-som: Increase the PHY reset duration to 10ms Michael Walle (1): arm64: dts: ls1028: sl28: fix networking for variant 2 Mike Tipton (3): interconnect: Zero initial BW after sync-state interconnect: Always call pre_aggregate before aggregate interconnect: qcom: icc-rpmh: Ensure floor BW is enforced for all nodes Nikos Liolios (1): ALSA: hda/realtek: Fix headset mic for Acer SWIFT SF314-56 (ALC256) Oleksandr Suvorov (1): ARM: dts: colibri-imx6ull: limit SDIO clock to 25MHz Oleksij Rempel (1): net: dsa: qca: ar9331: reorder MDIO write sequence Pali Rohár (1): arm64: dts: armada-3720-turris-mox: remove mrvl,i2c-fast-mode Paolo Bonzini (2): KVM: x86: accept userspace interrupt only if no event is injected KVM: Do not leak memory for duplicate debugfs directories Pavel Skripkin (6): net: xfrm: fix memory leak in xfrm_user_rcv_msg net: pegasus: fix uninit-value in get_interrupt_interval net: fec: fix use-after-free in fec_drv_remove net: vxge: fix use-after-free in vxge_device_unregister staging: rtl8712: get rid of flush_scheduled_work staging: rtl8712: error handling refactoring Pawel Laszczak (1): usb: cdns3: Fixed incorrect gadget state Peter Zijlstra (1): sched/rt: Fix double enqueue caused by rt_effective_prio Phil Elwell (1): usb: gadget: f_hid: fixed NULL pointer dereference Prarit Bhargava (1): alpha: Send stop IPI to send to online CPUs Qiang.zhang (1): USB: usbtmc: Fix RCU stall warning Rafael J. Wysocki (1): Revert "ACPICA: Fix memory leak caused by _CID repair function" Rasmus Villemoes (1): Revert "gpio: mpc8xxx: change the gpio interrupt flags." Sean Christopherson (1): KVM: x86/mmu: Fix per-cpu counter corruption on 32-bit builds Shirish S (1): drm/amdgpu/display: fix DMUB firmware version info Shreyansh Chouhan (1): reiserfs: check directory items on read from disk Steve Bennett (1): net: phy: micrel: Fix detection of ksz87xx switch Steve French (1): smb3: rc uninitialized in one fallocate path Steven Rostedt (VMware) (1): tracing / histogram: Give calculation hist_fields a size Takashi Iwai (2): ALSA: seq: Fix racy deletion of subscriber ALSA: usb-audio: Fix superfluous autosuspend recovery Tero Kristo (1): ARM: omap2+: hwmod: fix potential NULL pointer access Tetsuo Handa (1): Bluetooth: defer cleanup of resources in hci_unregister_dev() Theodore Ts'o (1): ext4: fix potential htree corruption when growing large_dir directories Thomas Gleixner (1): timers: Move clearing of base::timer_running under base:: Lock Tony Lindgren (1): bus: ti-sysc: Fix gpt12 system timer issue with reserved status Tyler Hicks (4): optee: Clear stale cache entries during initialization optee: Fix memory leak when failing to register shm pages optee: Refuse to load the driver under the kdump kernel tpm_ftpm_tee: Free and unregister TEE shared memory during kexec Vladimir Oltean (6): arm64: dts: ls1028a: fix node name for the sysclk arm64: dts: armada-3720-turris-mox: fixed indices for the SDHC controllers net: dsa: sja1105: overwrite dynamic FDB entries with static ones in .port_fdb_add net: dsa: sja1105: invalidate dynamic FDB entries learned concurrently with statically added ones net: dsa: sja1105: be stateless with FDB entries on SJA1105P/Q/R/S/SJA1110 too net: dsa: sja1105: match FDB entries regardless of inner/outer VLAN tag Wang Hai (1): net: natsemi: Fix missing pci_disable_device() in probe and remove Wei Shuyu (1): md/raid10: properly indicate failure when ending a failed write request Wesley Cheng (1): usb: dwc3: gadget: Avoid runtime resume if disabling pullup Will Deacon (1): arm64: vdso: Avoid ISB after reading from cntvct_el0 Willy Tarreau (1): USB: serial: ch341: fix character loss at high transfer rates Xiangyang Zhang (1): staging: rtl8723bs: Fix a resource leak in sd_int_dpc Xin Long (1): sctp: move the active_key update after sh_keys is added Xiu Jianfeng (1): selinux: correct the return value when loads initial sids Yang Yingliang (2): ARM: imx: add missing iounmap() ARM: imx: add missing clk_disable_unprepare() Yu Kuai (2): blk-iolatency: error out if blk_get_queue() failed in iolatency_set_limit() reiserfs: add check for root_inode in reiserfs_fill_super Yunsheng Lin (1): net: sched: fix lockdep_set_class() typo error for sch->seqlock Zhang Qilong (3): dmaengine: stm32-dma: Fix PM usage counter imbalance in stm32 dma ops dmaengine: stm32-dmamux: Fix PM usage counter unbalance in stm32 dmamux ops usb: gadget: remove leaked entry from udc driver list Zheyu Ma (1): pcmcia: i82092: fix a null pointer dereference bug Zhiyong Tao (1): serial: 8250_mtk: fix uart corruption issue when rx power off chihhao.chen (1): ALSA: usb-audio: fix incorrect clock source setting arch/alpha/kernel/smp.c | 2 +- arch/arm/boot/dts/am437x-l4.dtsi | 2 +- arch/arm/boot/dts/imx53-m53menlo.dts | 4 +- arch/arm/boot/dts/imx6qdl-sr-som.dtsi | 8 +- arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi | 1 + arch/arm/boot/dts/omap5-board-common.dtsi | 9 +- arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi | 24 +++-- arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi | 1 + arch/arm/mach-imx/mmdc.c | 17 ++- arch/arm/mach-omap2/omap_hwmod.c | 10 +- .../fsl-ls1028a-kontron-sl28-var2.dts | 2 + .../arm64/boot/dts/freescale/fsl-ls1028a.dtsi | 2 +- .../dts/marvell/armada-3720-turris-mox.dts | 3 + arch/arm64/include/asm/arch_timer.h | 21 ---- arch/arm64/include/asm/barrier.h | 19 ++++ arch/arm64/include/asm/vdso/gettimeofday.h | 6 +- arch/arm64/kernel/stacktrace.c | 2 +- arch/mips/Makefile | 2 +- arch/mips/include/asm/pgalloc.h | 17 +-- arch/mips/mti-malta/malta-platform.c | 3 +- arch/x86/events/perf_event.h | 3 +- arch/x86/kvm/mmu/mmu.c | 2 +- arch/x86/kvm/x86.c | 13 ++- block/blk-iolatency.c | 6 +- drivers/acpi/acpica/nsrepair2.c | 7 -- drivers/ata/libata-sff.c | 35 ++++-- drivers/base/dd.c | 4 +- drivers/base/firmware_loader/fallback.c | 14 +-- drivers/base/firmware_loader/firmware.h | 10 +- drivers/base/firmware_loader/main.c | 2 + drivers/bus/ti-sysc.c | 22 ++-- drivers/char/tpm/tpm_ftpm_tee.c | 8 +- drivers/clk/clk-devres.c | 9 +- drivers/clk/clk-stm32f4.c | 10 +- drivers/clk/tegra/clk-sdmmc-mux.c | 10 ++ drivers/dma/imx-dma.c | 2 + drivers/dma/stm32-dma.c | 4 +- drivers/dma/stm32-dmamux.c | 6 +- drivers/dma/uniphier-xdmac.c | 4 +- drivers/fpga/dfl-fme-perf.c | 2 + drivers/gpio/gpio-mpc8xxx.c | 2 +- drivers/gpio/gpio-tqmx86.c | 6 +- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 +- .../gpu/drm/i915/gem/i915_gem_execbuffer.c | 7 ++ drivers/gpu/drm/i915/i915_reg.h | 2 +- drivers/infiniband/hw/mlx5/mr.c | 4 +- drivers/interconnect/core.c | 9 +- drivers/interconnect/qcom/icc-rpmh.c | 12 +-- drivers/md/raid1.c | 2 - drivers/md/raid10.c | 4 +- .../media/common/videobuf2/videobuf2-core.c | 13 ++- drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 11 +- drivers/net/dsa/qca/ar9331.c | 14 ++- drivers/net/dsa/sja1105/sja1105_main.c | 85 +++++++++++---- .../net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 3 +- drivers/net/ethernet/freescale/fec_main.c | 2 +- drivers/net/ethernet/natsemi/natsemi.c | 8 +- .../net/ethernet/neterion/vxge/vxge-main.c | 6 +- .../ethernet/netronome/nfp/nfp_net_ethtool.c | 2 + .../net/ethernet/qlogic/qede/qede_filter.c | 4 +- drivers/net/ethernet/qlogic/qla3xxx.c | 6 +- drivers/net/phy/micrel.c | 10 +- drivers/net/usb/pegasus.c | 14 ++- drivers/net/wireless/virt_wifi.c | 52 +++++---- drivers/pcmcia/i82092.c | 1 + drivers/scsi/sr.c | 2 +- drivers/soc/ixp4xx/ixp4xx-npe.c | 11 +- drivers/soc/ixp4xx/ixp4xx-qmgr.c | 9 +- drivers/spi/spi-imx.c | 52 +++++---- drivers/spi/spi-meson-spicc.c | 2 + drivers/staging/rtl8712/hal_init.c | 30 ++++-- drivers/staging/rtl8712/rtl8712_led.c | 8 ++ drivers/staging/rtl8712/rtl871x_led.h | 1 + drivers/staging/rtl8712/rtl871x_pwrctrl.c | 8 ++ drivers/staging/rtl8712/rtl871x_pwrctrl.h | 1 + drivers/staging/rtl8712/usb_intf.c | 51 ++++----- drivers/staging/rtl8723bs/hal/sdio_ops.c | 2 + drivers/tee/optee/call.c | 36 ++++++- drivers/tee/optee/core.c | 40 +++++++ drivers/tee/optee/optee_private.h | 1 + drivers/tee/optee/shm_pool.c | 12 ++- drivers/tee/tee_shm.c | 18 ++++ drivers/tty/serial/8250/8250_mtk.c | 5 + drivers/tty/serial/8250/8250_pci.c | 7 ++ drivers/tty/serial/8250/8250_port.c | 12 ++- drivers/tty/serial/serial-tegra.c | 6 +- drivers/usb/cdns3/ep0.c | 1 + drivers/usb/class/usbtmc.c | 9 +- drivers/usb/common/usb-otg-fsm.c | 6 +- drivers/usb/dwc3/gadget.c | 11 ++ drivers/usb/gadget/function/f_hid.c | 44 ++++++-- drivers/usb/gadget/udc/max3420_udc.c | 14 ++- drivers/usb/host/ohci-at91.c | 9 +- drivers/usb/serial/ch341.c | 1 + drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 3 + drivers/usb/serial/option.c | 2 + drivers/usb/typec/tcpm/tcpm.c | 4 +- fs/cifs/smb2ops.c | 3 +- fs/ext4/namei.c | 2 +- fs/pipe.c | 19 +++- fs/reiserfs/stree.c | 31 +++++- fs/reiserfs/super.c | 8 ++ include/linux/tee_drv.h | 1 + include/linux/usb/otg-fsm.h | 1 + include/net/bluetooth/hci_core.h | 1 + include/net/ip6_route.h | 2 +- include/net/netns/xfrm.h | 1 + kernel/sched/core.c | 90 ++++++---------- kernel/time/timer.c | 6 +- kernel/trace/trace.c | 4 +- kernel/trace/trace_events_hist.c | 24 ++++- kernel/tracepoint.c | 102 ++++++++++++++---- net/bluetooth/hci_core.c | 16 +-- net/bluetooth/hci_sock.c | 49 ++++++--- net/bluetooth/hci_sysfs.c | 3 + net/ipv4/tcp_offload.c | 3 + net/ipv4/udp_offload.c | 4 + net/sched/sch_generic.c | 2 +- net/sctp/auth.c | 14 ++- net/xfrm/xfrm_compat.c | 49 ++++++++- net/xfrm/xfrm_policy.c | 17 ++- net/xfrm/xfrm_user.c | 10 ++ scripts/tracing/draw_functrace.py | 6 +- security/selinux/ss/policydb.c | 10 +- sound/core/pcm_native.c | 2 +- sound/core/seq/seq_ports.c | 39 ++++--- sound/pci/hda/patch_realtek.c | 2 + sound/usb/card.c | 2 +- sound/usb/clock.c | 6 ++ sound/usb/quirks.c | 1 + virt/kvm/kvm_main.c | 18 +++- 132 files changed, 1110 insertions(+), 470 deletions(-) -- 2.20.1

2 132

[PATCH openEuler-1.0-LTS] qxl_fb.c: fix variable "shadow" which going out of scope in qxlfb_create
by shenzijun 15 Oct '21

15 Oct '21

From: 沈子俊 <shenzijun(a)kylinos.cn> kylin inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4AH6F?from=project-issue CVE: NA --------------------------------------------------- Free the variable "shadow" Signed-off-by: 沈子俊 <shenzijun(a)kylinos.cn> --- drivers/gpu/drm/qxl/qxl_fb.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/qxl/qxl_fb.c b/drivers/gpu/drm/qxl/qxl_fb.c index ca465c0d49fa..a1e91d36b034 100644 --- a/drivers/gpu/drm/qxl/qxl_fb.c +++ b/drivers/gpu/drm/qxl/qxl_fb.c @@ -252,6 +252,7 @@ static int qxlfb_create(struct qxl_fbdev *qfbdev, info = drm_fb_helper_alloc_fbi(&qfbdev->helper); if (IS_ERR(info)) { ret = PTR_ERR(info); + vfree(shadow); goto out_unref; } -- 2.30.0

1 0

[PATCH openEuler-5.10 0/3] Add smart halt polling and schedule
by Zheng Zengkai 15 Oct '21

15 Oct '21

Add smart halt polling and schedule wakeup ipi optimization Li Hua (2): arm: Optimize ttwu IPI sched/idle: Add IAS_SMART_HALT_POLL config for smart halt polling feature Xiangyou Xie (1): sched/idle: introduce smart halt polling arch/arm/include/asm/thread_info.h | 2 ++ include/linux/kernel.h | 4 +++ init/Kconfig | 8 ++++++ kernel/sched/idle.c | 42 ++++++++++++++++++++++++++++++ kernel/sysctl.c | 9 +++++++ 5 files changed, 65 insertions(+) -- 2.20.1

1 3

[PATCH openEuler-5.10 00/13] bugfix for arch/fs/kernel modules
by Zheng Zengkai 15 Oct '21

15 Oct '21

bugfix for arch/fs/kernel modules Arnd Bergmann (2): asm-generic: fix ffs -Wshadow warning seqlock: avoid -Wshadow warnings Chen Jiahao (1): arm64: seccomp: fix the incorrect name of syscall __NR_compat_exit in secure computing mode Liang Wang (1): lib: use PFN_PHYS() in devmem_is_allowed() Lin Ruizhe (1): amba-pl011: Fix no irq issue due to no IRQ domain found Mark Rutland (1): arm64: fix compat syscall return truncation Peter Zijlstra (1): kthread: Fix PF_KTHREAD vs to_kthread() race Yu Kuai (4): block: ensure the memory order between bi_private and bi_status Revert "[Huawei] block: avoid creating invalid symlink file for patitions" Revert "[Backport] block: take bd_mutex around delete_partitions in del_gendisk" blk: reuse lookup_sem to serialize partition operations Zhihao Cheng (2): mtd: mtdconcat: Judge callback existence based on the master mtd: mtdconcat: Check _read,_write callbacks existence before assignment arch/arm/mm/mmap.c | 2 +- arch/arm64/include/asm/ptrace.h | 12 +++++++- arch/arm64/include/asm/seccomp.h | 2 +- arch/arm64/include/asm/syscall.h | 19 +++++++------ arch/arm64/kernel/ptrace.c | 2 +- arch/arm64/kernel/signal.c | 3 +- arch/arm64/kernel/syscall.c | 9 ++---- block/genhd.c | 14 +-------- block/partitions/core.c | 4 +++ drivers/mtd/mtdconcat.c | 33 +++++++++++++++------- drivers/tty/serial/amba-pl011.c | 12 +++++++- fs/block_dev.c | 36 ++++++++++++++++++++---- include/asm-generic/bitops/builtin-ffs.h | 5 +--- include/linux/seqlock.h | 14 ++++----- kernel/kthread.c | 33 ++++++++++++++++++---- kernel/sched/fair.c | 2 +- 16 files changed, 134 insertions(+), 68 deletions(-) -- 2.20.1

1 13

[PATCH openEuler-5.10 00/30] Backport LTS 5.10.57
by Zheng Zengkai 15 Oct '21

15 Oct '21

Backport LTS 5.10.57 patches from upstream. Alain Volmat (1): spi: stm32h7: fix full duplex irq handler handling Andrei Matei (2): selftest/bpf: Adjust expected verifier errors selftest/bpf: Verifier tests for var-off access Axel Lin (1): regulator: rt5033: Fix n_voltages settings for BUCK and LDO Borislav Petkov (1): efi/mokvar: Reserve the table only if it is in boot services data ChiYuan Huang (1): regulator: rtmv20: Fix wrong mask for strobe-polarity-high Cristian Marussi (1): firmware: arm_scmi: Add delayed response status check Daniel Borkmann (3): bpf, selftests: Adjust few selftest result_unpriv outcomes bpf: Update selftests to reflect new error states bpf, selftests: Adjust few selftest outcomes wrt unreachable code Filipe Manana (2): btrfs: fix race causing unnecessary inode logging during link and rename btrfs: fix lost inode on log replay after mix of fsync, rename and inode eviction Greg Kroah-Hartman (2): Revert "Bluetooth: Shutdown controller after workqueues are flushed or cancelled" Revert "watchdog: iTCO_wdt: Account for rebooting on second timeout" Guenter Roeck (1): spi: mediatek: Fix fifo transfer Jason Ekstrand (2): drm/i915: Revert "drm/i915/gem: Asynchronous cmdparser" Revert "drm/i915: Propagate errors on awaiting already signaled fences" Jia He (1): qed: fix possible unpaired spin_{un}lock_bh in _qed_mcp_cmd_and_union() Keith Busch (1): nvme: fix nvme_setup_command metadata trace event Kyle Russell (1): ASoC: tlv320aic31xx: fix reversed bclk/wclk master bits Linus Torvalds (1): ACPI: fix NULL pointer dereference Nicholas Kazlauskas (1): drm/amd/display: Fix max vstartup calculation for modes with borders Oder Chiou (1): ASoC: rt5682: Fix the issue of garbled recording after powerd_dbus_suspend Peter Ujfalusi (2): ASoC: ti: j721e-evm: Fix unbalanced domain activity tracking during startup ASoC: ti: j721e-evm: Check for not initialized parent_clk_id Pravin B Shelar (1): net: Fix zero-copy head len calculation. Sudeep Holla (1): firmware: arm_scmi: Ensure drivers provide a probe function Takashi Iwai (1): r8152: Fix potential PM refcount imbalance Victor Lu (1): drm/amd/display: Fix comparison error in dcn21 DML Yonghong Song (1): selftests/bpf: Add a test for ptr_to_map_value on stack for helper access drivers/firmware/arm_scmi/bus.c | 3 + drivers/firmware/arm_scmi/driver.c | 8 +- drivers/firmware/efi/mokvar-table.c | 5 +- .../drm/amd/display/dc/dcn20/dcn20_resource.c | 6 +- .../dc/dml/dcn21/display_mode_vba_21.c | 2 +- .../gpu/drm/i915/gem/i915_gem_execbuffer.c | 164 +----------------- drivers/gpu/drm/i915/i915_cmd_parser.c | 28 +-- drivers/gpu/drm/i915/i915_request.c | 8 +- drivers/net/ethernet/qlogic/qed/qed_mcp.c | 23 ++- drivers/net/usb/r8152.c | 3 +- drivers/nvme/host/trace.h | 6 +- drivers/regulator/rtmv20-regulator.c | 2 +- drivers/spi/spi-mt65xx.c | 19 +- drivers/spi/spi-stm32.c | 15 +- drivers/watchdog/iTCO_wdt.c | 12 +- fs/btrfs/tree-log.c | 5 +- include/acpi/acpi_bus.h | 3 +- include/linux/mfd/rt5033-private.h | 4 +- net/bluetooth/hci_core.c | 16 +- net/core/skbuff.c | 5 +- sound/soc/codecs/rt5682.c | 8 +- sound/soc/codecs/tlv320aic31xx.h | 4 +- sound/soc/ti/j721e-evm.c | 18 +- .../selftests/bpf/progs/bpf_iter_task.c | 3 +- tools/testing/selftests/bpf/test_verifier.c | 2 +- tools/testing/selftests/bpf/verifier/and.c | 2 + .../selftests/bpf/verifier/basic_stack.c | 2 +- tools/testing/selftests/bpf/verifier/bounds.c | 19 +- .../selftests/bpf/verifier/bounds_deduction.c | 21 +-- .../bpf/verifier/bounds_mix_sign_unsign.c | 13 -- tools/testing/selftests/bpf/verifier/calls.c | 4 +- .../testing/selftests/bpf/verifier/const_or.c | 4 +- .../selftests/bpf/verifier/dead_code.c | 2 + .../bpf/verifier/helper_access_var_len.c | 12 +- .../testing/selftests/bpf/verifier/int_ptr.c | 6 +- tools/testing/selftests/bpf/verifier/jmp32.c | 22 +++ tools/testing/selftests/bpf/verifier/jset.c | 10 +- .../testing/selftests/bpf/verifier/map_ptr.c | 4 +- .../selftests/bpf/verifier/raw_stack.c | 10 +- .../selftests/bpf/verifier/stack_ptr.c | 22 +-- tools/testing/selftests/bpf/verifier/unpriv.c | 9 +- .../selftests/bpf/verifier/value_ptr_arith.c | 17 +- .../testing/selftests/bpf/verifier/var_off.c | 115 ++++++++++-- 43 files changed, 331 insertions(+), 335 deletions(-) -- 2.20.1

1 30

[PATCH openEuler-5.10 00/30] Backport LTS 5.10.57
by Zheng Zengkai 15 Oct '21

15 Oct '21

Backport LTS 5.10.57 patches from upstream. Alain Volmat (1): spi: stm32h7: fix full duplex irq handler handling Andrei Matei (2): selftest/bpf: Adjust expected verifier errors selftest/bpf: Verifier tests for var-off access Axel Lin (1): regulator: rt5033: Fix n_voltages settings for BUCK and LDO Borislav Petkov (1): efi/mokvar: Reserve the table only if it is in boot services data ChiYuan Huang (1): regulator: rtmv20: Fix wrong mask for strobe-polarity-high Cristian Marussi (1): firmware: arm_scmi: Add delayed response status check Daniel Borkmann (3): bpf, selftests: Adjust few selftest result_unpriv outcomes bpf: Update selftests to reflect new error states bpf, selftests: Adjust few selftest outcomes wrt unreachable code Filipe Manana (2): btrfs: fix race causing unnecessary inode logging during link and rename btrfs: fix lost inode on log replay after mix of fsync, rename and inode eviction Greg Kroah-Hartman (2): Revert "Bluetooth: Shutdown controller after workqueues are flushed or cancelled" Revert "watchdog: iTCO_wdt: Account for rebooting on second timeout" Guenter Roeck (1): spi: mediatek: Fix fifo transfer Jason Ekstrand (2): drm/i915: Revert "drm/i915/gem: Asynchronous cmdparser" Revert "drm/i915: Propagate errors on awaiting already signaled fences" Jia He (1): qed: fix possible unpaired spin_{un}lock_bh in _qed_mcp_cmd_and_union() Keith Busch (1): nvme: fix nvme_setup_command metadata trace event Kyle Russell (1): ASoC: tlv320aic31xx: fix reversed bclk/wclk master bits Linus Torvalds (1): ACPI: fix NULL pointer dereference Nicholas Kazlauskas (1): drm/amd/display: Fix max vstartup calculation for modes with borders Oder Chiou (1): ASoC: rt5682: Fix the issue of garbled recording after powerd_dbus_suspend Peter Ujfalusi (2): ASoC: ti: j721e-evm: Fix unbalanced domain activity tracking during startup ASoC: ti: j721e-evm: Check for not initialized parent_clk_id Pravin B Shelar (1): net: Fix zero-copy head len calculation. Sudeep Holla (1): firmware: arm_scmi: Ensure drivers provide a probe function Takashi Iwai (1): r8152: Fix potential PM refcount imbalance Victor Lu (1): drm/amd/display: Fix comparison error in dcn21 DML Yonghong Song (1): selftests/bpf: Add a test for ptr_to_map_value on stack for helper access drivers/firmware/arm_scmi/bus.c | 3 + drivers/firmware/arm_scmi/driver.c | 8 +- drivers/firmware/efi/mokvar-table.c | 5 +- .../drm/amd/display/dc/dcn20/dcn20_resource.c | 6 +- .../dc/dml/dcn21/display_mode_vba_21.c | 2 +- .../gpu/drm/i915/gem/i915_gem_execbuffer.c | 164 +----------------- drivers/gpu/drm/i915/i915_cmd_parser.c | 28 +-- drivers/gpu/drm/i915/i915_request.c | 8 +- drivers/net/ethernet/qlogic/qed/qed_mcp.c | 23 ++- drivers/net/usb/r8152.c | 3 +- drivers/nvme/host/trace.h | 6 +- drivers/regulator/rtmv20-regulator.c | 2 +- drivers/spi/spi-mt65xx.c | 19 +- drivers/spi/spi-stm32.c | 15 +- drivers/watchdog/iTCO_wdt.c | 12 +- fs/btrfs/tree-log.c | 5 +- include/acpi/acpi_bus.h | 3 +- include/linux/mfd/rt5033-private.h | 4 +- net/bluetooth/hci_core.c | 16 +- net/core/skbuff.c | 5 +- sound/soc/codecs/rt5682.c | 8 +- sound/soc/codecs/tlv320aic31xx.h | 4 +- sound/soc/ti/j721e-evm.c | 18 +- .../selftests/bpf/progs/bpf_iter_task.c | 3 +- tools/testing/selftests/bpf/test_verifier.c | 2 +- tools/testing/selftests/bpf/verifier/and.c | 2 + .../selftests/bpf/verifier/basic_stack.c | 2 +- tools/testing/selftests/bpf/verifier/bounds.c | 19 +- .../selftests/bpf/verifier/bounds_deduction.c | 21 +-- .../bpf/verifier/bounds_mix_sign_unsign.c | 13 -- tools/testing/selftests/bpf/verifier/calls.c | 4 +- .../testing/selftests/bpf/verifier/const_or.c | 4 +- .../selftests/bpf/verifier/dead_code.c | 2 + .../bpf/verifier/helper_access_var_len.c | 12 +- .../testing/selftests/bpf/verifier/int_ptr.c | 6 +- tools/testing/selftests/bpf/verifier/jmp32.c | 22 +++ tools/testing/selftests/bpf/verifier/jset.c | 10 +- .../testing/selftests/bpf/verifier/map_ptr.c | 4 +- .../selftests/bpf/verifier/raw_stack.c | 10 +- .../selftests/bpf/verifier/stack_ptr.c | 22 +-- tools/testing/selftests/bpf/verifier/unpriv.c | 9 +- .../selftests/bpf/verifier/value_ptr_arith.c | 17 +- .../testing/selftests/bpf/verifier/var_off.c | 115 ++++++++++-- 43 files changed, 331 insertions(+), 335 deletions(-) -- 2.20.1

1 26

[PATCH openEuler-5.10 0/5] bugfix for mm/sched/kprobes
by Zheng Zengkai 15 Oct '21

15 Oct '21

backport some bugfix patches for mm/sched/kprobes modules. Aili Yao (1): mm,hwpoison: return -EHWPOISON to denote that the page has already been poisoned Pu Lehui (1): powerpc/kprobes: Fix kprobe Oops happens in booke Tony Luck (1): mm/memory-failure: use a mutex to avoid memory_failure() races Yu Jiahua (2): sched: Access control for sysctl_update_load_latency sched: Fix branch prediction error in static_key arch/powerpc/kernel/kprobes.c | 3 ++- kernel/sched/fair.c | 5 ++++- mm/memory-failure.c | 40 ++++++++++++++++++++++------------- 3 files changed, 31 insertions(+), 17 deletions(-) -- 2.20.1

1 5

[PATCH openEuler-5.10 00/68] Backport LTS 5.10.56
by Zheng Zengkai 15 Oct '21

15 Oct '21

Backport LTS 5.10.56 from upstream. Arkadiusz Kubalewski (2): i40e: Fix logic of disabling queues i40e: Fix firmware LLDP agent related warning Arnaldo Carvalho de Melo (1): Revert "perf map: Fix dso->nsinfo refcounting" Bjorn Andersson (1): drm/msm/dp: Initialize the INTF_CONFIG register Cong Wang (1): skmsg: Make sk_psock_destroy() static Dale Zhao (1): drm/amd/display: ensure dentist display clock update finished in DCN20 Dan Carpenter (1): can: hi311x: fix a signedness bug in hi3110_cmd() Daniel Borkmann (4): bpf: Introduce BPF nospec instruction for mitigating Spectre v4 bpf: Fix leakage due to insufficient speculative store bypass mitigation bpf: Remove superfluous aux sanitation on subprog rejection bpf: Fix pointer arithmetic mask tightening under state pruning Desmond Cheong Zhi Xi (1): btrfs: fix rw device counting in __btrfs_free_extra_devids Dima Chumak (1): net/mlx5e: Fix nullptr in mlx5e_hairpin_get_mdev() Felix Fietkau (1): mac80211: fix enabling 4-address mode on a sta vif after assoc Florian Westphal (1): netfilter: conntrack: adjust stop timestamp to real expiry value Geetha sowjanya (1): octeontx2-pf: Fix interface down flag on error Gilad Naaman (1): net: Set true network header for ECN decapsulation Goldwyn Rodrigues (1): btrfs: mark compressed range uptodate only if all bio succeed Greg Kroah-Hartman (1): selftest: fix build error in tools/testing/selftests/vm/userfaultfd.c Hoang Le (1): tipc: fix sleeping in tipc accept routine Hui Wang (1): Revert "ACPI: resources: Add checks for ACPI IRQ override" Jan Kiszka (1): x86/asm: Ensure asm/proto.h can be included stand-alone Jason Gerecke (1): HID: wacom: Re-enable touch by default for Cintiq 24HDT / 27QHDT Jedrzej Jagielski (2): i40e: Fix queue-to-TC mapping on Tx i40e: Fix log TC creation failure when max num of queues is exceeded Jiapeng Chong (1): mlx4: Fix missing error code in mlx4_load_one() Jiri Kosina (2): drm/amdgpu: Avoid printing of stack contents on firmware load error drm/amdgpu: Fix resource leak on probe error path Juergen Gross (1): x86/kvm: fix vcpu-id indexed array sizes Junxiao Bi (2): ocfs2: fix zero out valid data ocfs2: issue zeroout to EOF blocks Krzysztof Kozlowski (1): nfc: nfcsim: fix use after free during module unload Linus Torvalds (1): pipe: make pipe writes always wake up readers Lorenz Bauer (2): bpf: Fix OOB read when printing XDP link fdinfo bpf: verifier: Allocate idmap scratch in verifier env Lukasz Cieplicki (1): i40e: Add additional info to PHY type error Maor Gottlieb (1): net/mlx5: Fix flow table chaining Marcelo Ricardo Leitner (1): sctp: fix return value check in __sctp_rcv_asconf_lookup Mike Rapoport (1): alpha: register early reserved memory in memblock Naresh Kumar PBS (1): RDMA/bnxt_re: Fix stats counters Nguyen Dinh Phi (1): cfg80211: Fix possible memory leak in function cfg80211_bss_update Oleksij Rempel (1): can: j1939: j1939_session_deactivate(): clarify lifetime of session object Pablo Neira Ayuso (1): netfilter: nft_nat: allow to specify layer 4 protocol NAT only Paolo Bonzini (1): KVM: add missing compat KVM_CLEAR_DIRTY_LOG Paul Jakma (1): NIU: fix incorrect error return, missed in previous revert Pavel Skripkin (6): can: mcba_usb_start(): add missing urb->transfer_dma initialization can: usb_8dev: fix memory leak can: ems_usb: fix memory leak can: esd_usb2: fix memory leak net: qrtr: fix memory leaks net: llc: fix skb_over_panic Robert Foss (1): drm/msm/dpu: Fix sm8250_mdp register length Shannon Nelson (3): ionic: remove intr coalesce update from napi ionic: fix up dim accounting for tx and rx ionic: count csum_none when offload enabled Srikar Dronamraju (1): powerpc/pseries: Fix regression while building external modules Srinivas Pandruvada (1): ACPI: DPTF: Fix reading of attributes Stephane Grosjean (1): can: peak_usb: pcan_usb_handle_bus_evt(): fix reading rxerr/txerr values Steve French (1): SMB3: fix readpage for large swap cache Tejun Heo (1): blk-iocost: fix operation ordering in iocg_wake_fn() Vitaly Kuznetsov (1): KVM: x86: Check the right feature bit for MSR_KVM_ASYNC_PF_ACK access Wang Hai (2): tulip: windbond-840: Fix missing pci_disable_device() in probe and remove sis900: Fix missing pci_disable_device() in probe and remove Xin Long (2): tipc: fix implicit-connect for SYN+ tipc: do not write skb_shinfo frags when doing decrytion Yang Yingliang (1): io_uring: fix null-ptr-deref in io_sq_offload_start() Zhang Changzhong (1): can: j1939: j1939_xtp_rx_dat_one(): fix rxtimer value between consecutive TP.DT to 750ms Ziyang Xuan (1): can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF arch/alpha/kernel/setup.c | 13 +- arch/arm/net/bpf_jit_32.c | 3 + arch/arm64/net/bpf_jit_comp.c | 13 ++ arch/mips/net/ebpf_jit.c | 3 + arch/powerpc/net/bpf_jit_comp64.c | 6 + arch/powerpc/platforms/pseries/setup.c | 2 +- arch/riscv/net/bpf_jit_comp32.c | 4 + arch/riscv/net/bpf_jit_comp64.c | 4 + arch/s390/net/bpf_jit_comp.c | 5 + arch/sparc/net/bpf_jit_comp_64.c | 3 + arch/x86/include/asm/proto.h | 2 + arch/x86/kvm/ioapic.c | 2 +- arch/x86/kvm/ioapic.h | 4 +- arch/x86/kvm/x86.c | 4 +- arch/x86/net/bpf_jit_comp.c | 7 + arch/x86/net/bpf_jit_comp32.c | 6 + block/blk-iocost.c | 11 +- drivers/acpi/dptf/dptf_pch_fivr.c | 51 ++++- drivers/acpi/resource.c | 9 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 +- drivers/gpu/drm/amd/amdgpu/psp_v12_0.c | 7 +- .../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c | 2 +- .../gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c | 2 +- drivers/gpu/drm/msm/dp/dp_catalog.c | 1 + drivers/hid/wacom_wac.c | 2 +- drivers/infiniband/hw/bnxt_re/main.c | 4 +- drivers/infiniband/hw/bnxt_re/qplib_res.c | 10 +- drivers/infiniband/hw/bnxt_re/qplib_res.h | 1 + drivers/net/can/spi/hi311x.c | 2 +- drivers/net/can/usb/ems_usb.c | 14 +- drivers/net/can/usb/esd_usb2.c | 16 +- drivers/net/can/usb/mcba_usb.c | 2 + drivers/net/can/usb/peak_usb/pcan_usb.c | 10 +- drivers/net/can/usb/usb_8dev.c | 15 +- drivers/net/ethernet/dec/tulip/winbond-840.c | 7 +- .../net/ethernet/intel/i40e/i40e_ethtool.c | 6 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 61 +++--- drivers/net/ethernet/intel/i40e/i40e_txrx.c | 50 +++++ drivers/net/ethernet/intel/i40e/i40e_txrx.h | 2 + .../marvell/octeontx2/nic/otx2_ethtool.c | 7 +- .../ethernet/marvell/octeontx2/nic/otx2_pf.c | 5 + drivers/net/ethernet/mellanox/mlx4/main.c | 1 + .../net/ethernet/mellanox/mlx5/core/en_tc.c | 33 +++- .../net/ethernet/mellanox/mlx5/core/fs_core.c | 10 +- .../net/ethernet/pensando/ionic/ionic_lif.c | 14 +- .../net/ethernet/pensando/ionic/ionic_txrx.c | 41 ++-- drivers/net/ethernet/sis/sis900.c | 7 +- drivers/net/ethernet/sun/niu.c | 3 +- drivers/nfc/nfcsim.c | 3 +- fs/btrfs/compression.c | 2 +- fs/btrfs/volumes.c | 1 + fs/cifs/file.c | 2 +- fs/io_uring.c | 2 +- fs/ocfs2/file.c | 103 ++++++---- fs/pipe.c | 10 +- include/linux/bpf_types.h | 1 + include/linux/bpf_verifier.h | 11 +- include/linux/filter.h | 15 ++ include/linux/skmsg.h | 1 - include/net/llc_pdu.h | 31 ++- kernel/bpf/core.c | 19 +- kernel/bpf/disasm.c | 16 +- kernel/bpf/verifier.c | 186 ++++++------------ net/can/j1939/transport.c | 11 +- net/can/raw.c | 20 +- net/core/skmsg.c | 3 +- net/ipv4/ip_tunnel.c | 2 +- net/llc/af_llc.c | 10 +- net/llc/llc_s_ac.c | 2 +- net/mac80211/cfg.c | 19 ++ net/mac80211/ieee80211_i.h | 2 + net/mac80211/mlme.c | 4 +- net/netfilter/nf_conntrack_core.c | 7 +- net/netfilter/nft_nat.c | 4 +- net/qrtr/qrtr.c | 6 +- net/sctp/input.c | 2 +- net/tipc/crypto.c | 14 +- net/tipc/socket.c | 30 +-- net/wireless/scan.c | 6 +- tools/perf/util/map.c | 2 - tools/testing/selftests/vm/userfaultfd.c | 2 +- virt/kvm/kvm_main.c | 28 +++ 82 files changed, 706 insertions(+), 366 deletions(-) -- 2.20.1

1 68

[PATCH openEuler-5.10 00/24] Backport LTS 5.10.55
by Zheng Zengkai 15 Oct '21

15 Oct '21

Backport LTS 5.10.55 from upstream. Christoph Hellwig (2): iomap: remove the length variable in iomap_seek_data iomap: remove the length variable in iomap_seek_hole Cristian Marussi (1): firmware: arm_scmi: Fix range check for the maximum number of pending messages Desmond Cheong Zhi Xi (3): hfs: add missing clean-up in hfs_fill_super hfs: fix high memory mapping in hfs_bnode_read hfs: add lock nesting notation to hfs_find_init Eric Dumazet (1): net: annotate data race around sk_ll_usec Hyunchul Lee (1): cifs: fix the out of range assignment to bit fields in parse_server_interfaces Maxim Levitsky (1): KVM: x86: determine if an exception has an error code only when injecting it. Miklos Szeredi (1): af_unix: fix garbage collect vs MSG_PEEK Paul E. McKenney (2): rcu-tasks: Don't delete holdouts within trc_inspect_reader() rcu-tasks: Don't delete holdouts within trc_wait_for_one_reader() Paul Gortmaker (1): cgroup1: fix leaked context root causing sporadic NULL deref in LTP Pavel Begunkov (1): io_uring: fix link timeout refs Sudeep Holla (2): firmware: arm_scmi: Fix possible scmi_linux_errmap buffer overflow ARM: dts: versatile: Fix up interrupt controller node names Vasily Averin (2): ipv6: allocate enough headroom in ip6_finish_output2() ipv6: ip6_finish_output2: set sk into newly allocated nskb Xin Long (1): sctp: move 198 addresses from unusable to private scope Yang Yingliang (3): workqueue: fix UAF in pwq_unbound_release_workfn() net/802/mrp: fix memleak in mrp_request_join() net/802/garp: fix memleak in garp_request_join() Yonghong Song (1): tools: Allow proper CC/CXX/... override with LLVM=1 in Makefile.include Zheyu Ma (1): drm/ttm: add a check against null pointer dereference arch/arm/boot/dts/versatile-ab.dts | 5 +-- arch/arm/boot/dts/versatile-pb.dts | 2 +- arch/x86/kvm/x86.c | 13 +++++-- drivers/firmware/arm_scmi/driver.c | 12 +++--- drivers/gpu/drm/ttm/ttm_range_manager.c | 3 ++ fs/cifs/smb2ops.c | 4 +- fs/hfs/bfind.c | 14 ++++++- fs/hfs/bnode.c | 25 +++++++++--- fs/hfs/btree.h | 7 ++++ fs/hfs/super.c | 10 ++--- fs/internal.h | 1 - fs/io_uring.c | 1 - fs/iomap/seek.c | 25 +++++------- include/linux/fs_context.h | 1 + include/net/busy_poll.h | 2 +- include/net/sctp/constants.h | 4 +- kernel/cgroup/cgroup-v1.c | 4 +- kernel/rcu/tasks.h | 6 +-- kernel/workqueue.c | 20 ++++++---- net/802/garp.c | 14 +++++++ net/802/mrp.c | 14 +++++++ net/core/sock.c | 2 +- net/ipv6/ip6_output.c | 28 ++++++++++++++ net/sctp/protocol.c | 3 +- net/unix/af_unix.c | 51 ++++++++++++++++++++++++- tools/scripts/Makefile.include | 12 +++++- 26 files changed, 215 insertions(+), 68 deletions(-) -- 2.20.1

1 24

[PATCH openEuler-1.0-LTS 1/2] io_uring: hold uring_lock while completing failed polled io in io_wq_submit_work()
by Yang Yingliang 15 Oct '21

15 Oct '21

From: Xiaoguang Wang <xiaoguang.wang(a)linux.alibaba.com> mainline inclusion from mainline-5.11-rc1 commit c07e6719511e77c4b289f62bfe96423eb6ea061d category: bugfix bugzilla: 182869 CVE: NA --------------------------- io_iopoll_complete() does not hold completion_lock to complete polled io, so in io_wq_submit_work(), we can not call io_req_complete() directly, to complete polled io, otherwise there maybe concurrent access to cqring, defer_list, etc, which is not safe. Commit dad1b1242fd5 ("io_uring: always let io_iopoll_complete() complete polled io") has fixed this issue, but Pavel reported that IOPOLL apart from rw can do buf reg/unreg requests( IORING_OP_PROVIDE_BUFFERS or IORING_OP_REMOVE_BUFFERS), so the fix is not good. Given that io_iopoll_complete() is always called under uring_lock, so here for polled io, we can also get uring_lock to fix this issue. Fixes: dad1b1242fd5 ("io_uring: always let io_iopoll_complete() complete polled io") Cc: <stable(a)vger.kernel.org> # 5.5+ Signed-off-by: Xiaoguang Wang <xiaoguang.wang(a)linux.alibaba.com> Reviewed-by: Pavel Begunkov <asml.silence(a)gmail.com> [axboe: don't deref 'req' after completing it'] Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/io_uring.c | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index c944a27178a48..b5fb86e2ed597 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -5782,19 +5782,28 @@ static struct io_wq_work *io_wq_submit_work(struct io_wq_work *work) } if (ret) { + struct io_ring_ctx *lock_ctx = NULL; + + if (req->ctx->flags & IORING_SETUP_IOPOLL) + lock_ctx = req->ctx; + /* - * io_iopoll_complete() does not hold completion_lock to complete - * polled io, so here for polled io, just mark it done and still let - * io_iopoll_complete() complete it. + * io_iopoll_complete() does not hold completion_lock to + * complete polled io, so here for polled io, we can not call + * io_req_complete() directly, otherwise there maybe concurrent + * access to cqring, defer_list, etc, which is not safe. Given + * that io_iopoll_complete() is always called under uring_lock, + * so here for polled io, we also get uring_lock to complete + * it. */ - if (req->ctx->flags & IORING_SETUP_IOPOLL) { - struct kiocb *kiocb = &req->rw.kiocb; + if (lock_ctx) + mutex_lock(&lock_ctx->uring_lock); - kiocb_done(kiocb, ret, NULL); - } else { - req_set_fail_links(req); - io_req_complete(req, ret); - } + req_set_fail_links(req); + io_req_complete(req, ret); + + if (lock_ctx) + mutex_unlock(&lock_ctx->uring_lock); } return io_steal_work(req); -- 2.25.1

1 1

[PATCH kernel-4.19] block: fix UAF from race of ioc_release_fn() and __ioc_clear_queue()
by Yang Yingliang 15 Oct '21

15 Oct '21

From: Laibin Qiu <qiulaibin(a)huawei.com> hulk inclusion category: bugfix bugzilla: 182666 CVE: NA -------------------------- KASAN reports a use-after-free report when doing block test: [293762.535116] ================================================================== [293762.535129] BUG: KASAN: use-after-free in queued_spin_lock_slowpath+0x78/0x4c8 [293762.535133] Write of size 2 at addr ffff8000d5f12bc8 by task sh/9148 [293762.535135] [293762.535145] CPU: 1 PID: 9148 Comm: sh Kdump: loaded Tainted: G W 4.19.90-vhulk2108.6.0.h824.kasan.eulerosv2r10.aarch64 #1 [293762.535148] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 [293762.535150] Call trace: [293762.535154] dump_backtrace+0x0/0x310 [293762.535158] show_stack+0x28/0x38 [293762.535165] dump_stack+0xec/0x15c [293762.535172] print_address_description+0x68/0x2d0 [293762.535177] kasan_report+0x130/0x2f0 [293762.535182] __asan_store2+0x80/0xa8 [293762.535189] queued_spin_lock_slowpath+0x78/0x4c8 [293762.535194] __ioc_clear_queue+0x158/0x160 [293762.535198] ioc_clear_queue+0x194/0x258 [293762.535202] elevator_switch_mq+0x64/0x170 [293762.535206] elevator_switch+0x140/0x270 [293762.535211] elv_iosched_store+0x1a4/0x2a0 [293762.535215] queue_attr_store+0x90/0xe0 [293762.535219] sysfs_kf_write+0xa8/0xe8 [293762.535222] kernfs_fop_write+0x1f8/0x378 [293762.535227] __vfs_write+0xe0/0x360 [293762.535233] vfs_write+0xf0/0x270 [293762.535237] ksys_write+0xdc/0x1b8 [293762.535241] __arm64_sys_write+0x50/0x60 [293762.535245] el0_svc_common+0xc8/0x320 [293762.535250] el0_svc_handler+0xf8/0x160 [293762.535253] el0_svc+0x10/0x218 [293762.535254] [293762.535258] Allocated by task 3466763: [293762.535264] kasan_kmalloc+0xe0/0x190 [293762.535269] kasan_slab_alloc+0x14/0x20 [293762.535276] kmem_cache_alloc_node+0x1b4/0x420 [293762.535280] create_task_io_context+0x40/0x210 [293762.535284] generic_make_request_checks+0xc78/0xe38 [293762.535288] generic_make_request+0xf8/0x640 [293762.535394] generic_file_direct_write+0x100/0x268 [293762.535401] __generic_file_write_iter+0x128/0x370 [293762.535467] vfs_iter_write+0x64/0x90 [293762.535489] ovl_write_iter+0x2f8/0x458 [overlay] [293762.535493] __vfs_write+0x264/0x360 [293762.535497] vfs_write+0xf0/0x270 [293762.535501] ksys_write+0xdc/0x1b8 [293762.535505] __arm64_sys_write+0x50/0x60 [293762.535509] el0_svc_common+0xc8/0x320 [293762.535387] ext4_direct_IO+0x3c8/0xe80 [ext4] [293762.535394] generic_file_direct_write+0x100/0x268 [293762.535401] __generic_file_write_iter+0x128/0x370 [293762.535452] ext4_file_write_iter+0x610/0xa80 [ext4] [293762.535457] do_iter_readv_writev+0x28c/0x390 [293762.535463] do_iter_write+0xfc/0x360 [293762.535467] vfs_iter_write+0x64/0x90 [293762.535489] ovl_write_iter+0x2f8/0x458 [overlay] [293762.535493] __vfs_write+0x264/0x360 [293762.535497] vfs_write+0xf0/0x270 [293762.535501] ksys_write+0xdc/0x1b8 [293762.535505] __arm64_sys_write+0x50/0x60 [293762.535509] el0_svc_common+0xc8/0x320 [293762.535513] el0_svc_handler+0xf8/0x160 [293762.535517] el0_svc+0x10/0x218 [293762.535521] [293762.535523] Freed by task 3466763: [293762.535528] __kasan_slab_free+0x120/0x228 [293762.535532] kasan_slab_free+0x10/0x18 [293762.535536] kmem_cache_free+0x68/0x248 [293762.535540] put_io_context+0x104/0x190 [293762.535545] put_io_context_active+0x204/0x2c8 [293762.535549] exit_io_context+0x74/0xa0 [293762.535553] do_exit+0x658/0xae0 [293762.535557] do_group_exit+0x74/0x1a8 [293762.535561] get_signal+0x21c/0xf38 [293762.535564] do_signal+0x10c/0x450 [293762.535568] do_notify_resume+0x224/0x4b0 [293762.535573] work_pending+0x8/0x10 [293762.535574] [293762.535578] The buggy address belongs to the object at ffff8000d5f12bb8 which belongs to the cache blkdev_ioc of size 136 [293762.535582] The buggy address is located 16 bytes inside of 136-byte region [ffff8000d5f12bb8, ffff8000d5f12c40) [293762.535583] The buggy address belongs to the page: [293762.535588] page:ffff7e000357c480 count:1 mapcount:0 mapping:ffff8000d8563c00 index:0x0 [293762.536201] flags: 0x7ffff0000000100(slab) [293762.536540] raw: 07ffff0000000100 ffff7e0003118588 ffff8000d8adb530 ffff8000d8563c00 [293762.536546] raw: 0000000000000000 0000000000140014 00000001ffffffff 0000000000000000 [293762.536551] page dumped because: kasan: bad access detected [293762.536552] [293762.536554] Memory state around the buggy address: [293762.536558] ffff8000d5f12a80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fb fb [293762.536562] ffff8000d5f12b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc [293762.536566] >ffff8000d5f12b80: fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb fb [293762.536568] ^ [293762.536572] ffff8000d5f12c00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [293762.536576] ffff8000d5f12c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [293762.536577] ================================================================== ioc_release_fn() will destroy icq from ioc->icq_list and __ioc_clear_queue() will destroy icq from request_queue->icq_list. However, the ioc_release_fn() will hold ioc_lock firstly, and free ioc finally. Then __ioc_clear_queue() will get ioc from icq and hold ioc_lock, but ioc has been released, which will result in a use-after-free. CPU0 CPU1 put_io_context elevator_switch_mq queue_work &ioc->release_work ioc_clear_queue ^^^ splice q->icq_list __ioc_clear_queue ^^^get icq from icq_list get ioc from icq->ioc ioc_release_fn spin_lock(ioc->lock) ioc_destroy_icq(icq) spin_unlock(ioc->lock) free(ioc) spin_lock(ioc->lock) <= UAF Fix by grabbing the request_queue->queue_lock in ioc_clear_queue() to avoid this race scene. Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> Link: https://lore.kernel.org/lkml/1c9ad9f2-c487-c793-1ffc-5c3ec0fcc0ae@kernel.dk/ Conflicts: block/blk-ioc.c Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/blk-ioc.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/block/blk-ioc.c b/block/blk-ioc.c index 4c810969c3e2f..281b7a93e340a 100644 --- a/block/blk-ioc.c +++ b/block/blk-ioc.c @@ -261,13 +261,8 @@ void ioc_clear_queue(struct request_queue *q) spin_lock_irq(q->queue_lock); list_splice_init(&q->icq_list, &icq_list); - if (q->mq_ops) { - spin_unlock_irq(q->queue_lock); - __ioc_clear_queue(&icq_list); - } else { - __ioc_clear_queue(&icq_list); - spin_unlock_irq(q->queue_lock); - } + __ioc_clear_queue(&icq_list); + spin_unlock_irq(q->queue_lock); } int create_task_io_context(struct task_struct *task, gfp_t gfp_flags, int node) -- 2.25.1

1 0

2024

2023

2022

2021

2020

2019

Kernel