- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/3] cgroupv1 enable writeback
by chenridong 05 Dec '23

05 Dec '23

Lu Jialin (3): cgroup: Add cgroup1_get_from_id() cgroup: support cgroup writeback on cgroupv1 openeuler_defconfig: enable CONFIG_CGROUP_V1_WRITEBACK in openeuler_defconfig for x86 and arm64 arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + block/blk-cgroup.c | 3 + block/blk-cgroup.h | 3 + include/linux/backing-dev.h | 29 +++++- include/linux/cgroup-defs.h | 2 + include/linux/cgroup.h | 3 + include/linux/memcontrol.h | 5 ++ init/Kconfig | 5 ++ kernel/cgroup/cgroup.c | 46 +++++++++- mm/backing-dev.c | 117 ++++++++++++++++++++++++- mm/memcontrol.c | 83 +++++++++++++++++- 12 files changed, 289 insertions(+), 9 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6 v5 0/2] ipvlan: Introduce l2e mode
by Zhengchao Shao 05 Dec '23

05 Dec '23

Inherited features of olk5.10 version. Keefe LIU (2): ipvlan: Introduce l2e mode ipvlan: Introduce local xmit queue for l2e mode drivers/net/Kconfig | 7 + drivers/net/ipvlan/ipvlan.h | 11 ++ drivers/net/ipvlan/ipvlan_core.c | 232 +++++++++++++++++++++++++++++++ drivers/net/ipvlan/ipvlan_main.c | 103 +++++++++++++- include/uapi/linux/if_link.h | 1 + 5 files changed, 352 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] block: fix inaccurate io_ticks by set 'precise_iostat'
by Li Lingfeng 05 Dec '23

05 Dec '23

From: Zhang Wensheng <zhangwensheng5(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8M01Q CVE: NA -------------------------------- After introducing commit 5b18b5a73760 ("block: delete part_round_stats and switch to less precise counting"), '%util' accounted by iostat will be over reality data. In fact, the device is quite idle, but iostat may show '%util' as a big number (e.g. 50%). It can produce by fio: fio --name=1 --direct=1 --bs=4k --rw=read --filename=/dev/sda \ --thinktime=4ms --runtime=180 We fix this by using a switch(precise_iostat=1) to control whether or not acconut ioticks precisely. fixes: 5b18b5a73760 ("block: delete part_round_stats and switch to less precise counting") Signed-off-by: Zhang Wensheng <zhangwensheng5(a)huawei.com> Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Conflicts: block/blk-core.c block/blk-merge.c block/genhd.c include/linux/blkdev.h Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- block/blk-core.c | 25 +++++++++++++++++++++++-- block/blk-merge.c | 2 ++ block/blk-mq.c | 4 ++++ block/genhd.c | 2 +- include/linux/blkdev.h | 2 ++ 5 files changed, 32 insertions(+), 3 deletions(-) diff --git a/block/blk-core.c b/block/blk-core.c index fdf25b8d6e78..16d645532ce9 100644 --- a/block/blk-core.c +++ b/block/blk-core.c @@ -61,6 +61,22 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(block_rq_insert); static DEFINE_IDA(blk_queue_ida); +bool precise_iostat; + +static int __init precise_iostat_setup(char *str) +{ + bool precise; + + if (!strtobool(str, &precise)) { + precise_iostat = precise; + pr_info("precise iostat %d\n", precise_iostat); + } + + return 1; +} +__setup("precise_iostat=", precise_iostat_setup); + + /* * For queue allocation */ @@ -940,9 +956,14 @@ void update_io_ticks(struct block_device *part, unsigned long now, bool end) unsigned long stamp; again: stamp = READ_ONCE(part->bd_stamp); - if (unlikely(time_after(now, stamp))) { - if (likely(try_cmpxchg(&part->bd_stamp, &stamp, now))) + if (unlikely(time_after(now, stamp)) && + likely(try_cmpxchg(&part->bd_stamp, &stamp, now))) { + if (precise_iostat) { + if (end || part_in_flight(part)) + __part_stat_add(part, io_ticks, now - stamp); + } else { __part_stat_add(part, io_ticks, end ? now - stamp : 1); + } } if (part->bd_partno) { part = bdev_whole(part); diff --git a/block/blk-merge.c b/block/blk-merge.c index 65e75efa9bd3..463611c7c944 100644 --- a/block/blk-merge.c +++ b/block/blk-merge.c @@ -783,6 +783,8 @@ static void blk_account_io_merge_request(struct request *req) if (blk_do_io_stat(req)) { part_stat_lock(); part_stat_inc(req->part, merges[op_stat_group(req_op(req))]); + if (precise_iostat) + part_stat_local_dec(req->part, in_flight[rq_data_dir(req)]); part_stat_unlock(); } } diff --git a/block/blk-mq.c b/block/blk-mq.c index 6ab7f360ff2a..387528a9f3df 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -994,6 +994,8 @@ static inline void blk_account_io_done(struct request *req, u64 now) update_io_ticks(req->part, jiffies, true); part_stat_inc(req->part, ios[sgrp]); part_stat_add(req->part, nsecs[sgrp], now - req->start_time_ns); + if (precise_iostat) + part_stat_local_dec(req->part, in_flight[rq_data_dir(req)]); part_stat_unlock(); } } @@ -1016,6 +1018,8 @@ static inline void blk_account_io_start(struct request *req) part_stat_lock(); update_io_ticks(req->part, jiffies, false); + if (precise_iostat) + part_stat_local_inc(req->part, in_flight[rq_data_dir(req)]); part_stat_unlock(); } } diff --git a/block/genhd.c b/block/genhd.c index cc32a0c704eb..8cf16dc7e195 100644 --- a/block/genhd.c +++ b/block/genhd.c @@ -118,7 +118,7 @@ static void part_stat_read_all(struct block_device *part, } } -static unsigned int part_in_flight(struct block_device *part) +unsigned int part_in_flight(struct block_device *part) { unsigned int inflight = 0; int cpu; diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h index eef450f25982..99c2e6aa5e10 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h @@ -25,6 +25,7 @@ #include <linux/uuid.h> #include <linux/xarray.h> +extern bool precise_iostat; struct module; struct request_queue; struct elevator_queue; @@ -832,6 +833,7 @@ dev_t part_devt(struct gendisk *disk, u8 partno); void inc_diskseq(struct gendisk *disk); void blk_request_module(dev_t devt); +extern unsigned int part_in_flight(struct block_device *part); extern int blk_register_queue(struct gendisk *disk); extern void blk_unregister_queue(struct gendisk *disk); void submit_bio_noacct(struct bio *bio); -- 2.31.1

2 1

[PATCH OLK-6.6 v2 0/2] dm btree spine: show warning if
by Li Lingfeng 05 Dec '23

05 Dec '23

Add extra node_check function declaration back and show warning if node_check failed in node_prep_for_write(). v1->v2: Revert commit 851a8cd3f05b ("dm btree spine: remove extra node_check function declaration") to add extra node_check function declaration back. Fix commit message. Li Lingfeng (1): Revert "dm btree spine: remove extra node_check function declaration" Zhang Xiaoxu (1): dm btree spine: show warning if node_check failed in node_prep_for_write() drivers/md/persistent-data/dm-btree-spine.c | 6 ++++++ 1 file changed, 6 insertions(+) -- 2.31.1

2 3

[PATCH v2 OLK-5.10 0/7] bring mc support to page eject
by Wupeng Ma 05 Dec '23

05 Dec '23

From: Ma Wupeng <mawupeng1(a)huawei.com> During page eject, machine check safe is enhanced as follow: During soft offline page, page is copied to new page in kernel. If the origin page has UCE, there will lead to kernel panic. In order to solve this problem, use machine check safe to catch this error which can be achieved by using copy_mc_to_kernel to replace copy_page. Signal SIGBUS will be send to user task if this UCE is consumed by this situation to avoid kernel panic. Changelog since v1: - remove unused ret in patch #4 - add a bugfix for page eject Jiaqi Yan (1): mm/hwpoison: introduce copy_mc_highpage Ma Wupeng (6): mm: page_eject: Return right value during removal mm/hwpoison: arm64: introduce copy_mc_highpage mm/hwpoison: introduce copy_mc_highpages mm/hwpoison: add migrate_page_mc_extra() mm: Update PF_COREDUMP_MCS to PF_MCS mm: page_eject: Add mc support during offline page arch/arm64/include/asm/page.h | 1 + arch/arm64/mm/copypage.c | 13 ++++++ drivers/ras/page_eject.c | 10 ++++- fs/coredump.c | 4 +- include/linux/highmem.h | 52 ++++++++++++++++++++++++ include/linux/sched.h | 2 +- lib/iov_iter.c | 2 +- mm/migrate.c | 76 ++++++++++++++++++++++++++++++----- 8 files changed, 145 insertions(+), 15 deletions(-) -- 2.25.1

2 8

[PATCH OLK-6.6 0/2] feature:cgroupv1 enable cgroup writeback
by chenridong 05 Dec '23

05 Dec '23

Lu Jialin (2): cgroup: Add cgroup1_get_from_id() cgroup: support cgroup writeback on cgroupv1 block/blk-cgroup.c | 3 + block/blk-cgroup.h | 3 + include/linux/backing-dev.h | 29 +++++++-- include/linux/cgroup-defs.h | 2 + include/linux/cgroup.h | 3 + include/linux/memcontrol.h | 5 ++ init/Kconfig | 5 ++ kernel/cgroup/cgroup.c | 64 +++++++++++++++++++ mm/backing-dev.c | 117 +++++++++++++++++++++++++++++++++- mm/memcontrol.c | 122 +++++++++++++++++++++++++++++++++++- 10 files changed, 346 insertions(+), 7 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] block: fix inaccurate io_ticks by set 'precise_iostat'
by Li Lingfeng 05 Dec '23

05 Dec '23

From: Zhang Wensheng <zhangwensheng5(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8M01Q CVE: NA -------------------------------- After introducing commit 5b18b5a73760 ("block: delete part_round_stats and switch to less precise counting"), '%util' accounted by iostat will be over reality data. In fact, the device is quite idle, but iostat may show '%util' as a big number (e.g. 50%). It can produce by fio: fio --name=1 --direct=1 --bs=4k --rw=read --filename=/dev/sda \ --thinktime=4ms --runtime=180 We fix this by using a switch(precise_iostat=1) to control whether or not acconut ioticks precisely. fixes: 5b18b5a73760 ("block: delete part_round_stats and switch to less precise counting") Signed-off-by: Zhang Wensheng <zhangwensheng5(a)huawei.com> Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Conflicts: block/blk-core.c block/blk-merge.c block/genhd.c include/linux/blkdev.h Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- block/blk-core.c | 25 +++++++++++++++++++++++-- block/blk-merge.c | 2 ++ block/blk-mq.c | 4 ++++ block/genhd.c | 2 +- include/linux/blkdev.h | 2 ++ 5 files changed, 32 insertions(+), 3 deletions(-) diff --git a/block/blk-core.c b/block/blk-core.c index fdf25b8d6e78..16d645532ce9 100644 --- a/block/blk-core.c +++ b/block/blk-core.c @@ -61,6 +61,22 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(block_rq_insert); static DEFINE_IDA(blk_queue_ida); +bool precise_iostat; + +static int __init precise_iostat_setup(char *str) +{ + bool precise; + + if (!strtobool(str, &precise)) { + precise_iostat = precise; + pr_info("precise iostat %d\n", precise_iostat); + } + + return 1; +} +__setup("precise_iostat=", precise_iostat_setup); + + /* * For queue allocation */ @@ -940,9 +956,14 @@ void update_io_ticks(struct block_device *part, unsigned long now, bool end) unsigned long stamp; again: stamp = READ_ONCE(part->bd_stamp); - if (unlikely(time_after(now, stamp))) { - if (likely(try_cmpxchg(&part->bd_stamp, &stamp, now))) + if (unlikely(time_after(now, stamp)) && + likely(try_cmpxchg(&part->bd_stamp, &stamp, now))) { + if (precise_iostat) { + if (end || part_in_flight(part)) + __part_stat_add(part, io_ticks, now - stamp); + } else { __part_stat_add(part, io_ticks, end ? now - stamp : 1); + } } if (part->bd_partno) { part = bdev_whole(part); diff --git a/block/blk-merge.c b/block/blk-merge.c index 65e75efa9bd3..463611c7c944 100644 --- a/block/blk-merge.c +++ b/block/blk-merge.c @@ -783,6 +783,8 @@ static void blk_account_io_merge_request(struct request *req) if (blk_do_io_stat(req)) { part_stat_lock(); part_stat_inc(req->part, merges[op_stat_group(req_op(req))]); + if (precise_iostat) + part_stat_local_dec(req->part, in_flight[rq_data_dir(req)]); part_stat_unlock(); } } diff --git a/block/blk-mq.c b/block/blk-mq.c index 6ab7f360ff2a..387528a9f3df 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -994,6 +994,8 @@ static inline void blk_account_io_done(struct request *req, u64 now) update_io_ticks(req->part, jiffies, true); part_stat_inc(req->part, ios[sgrp]); part_stat_add(req->part, nsecs[sgrp], now - req->start_time_ns); + if (precise_iostat) + part_stat_local_dec(req->part, in_flight[rq_data_dir(req)]); part_stat_unlock(); } } @@ -1016,6 +1018,8 @@ static inline void blk_account_io_start(struct request *req) part_stat_lock(); update_io_ticks(req->part, jiffies, false); + if (precise_iostat) + part_stat_local_inc(req->part, in_flight[rq_data_dir(req)]); part_stat_unlock(); } } diff --git a/block/genhd.c b/block/genhd.c index cc32a0c704eb..8cf16dc7e195 100644 --- a/block/genhd.c +++ b/block/genhd.c @@ -118,7 +118,7 @@ static void part_stat_read_all(struct block_device *part, } } -static unsigned int part_in_flight(struct block_device *part) +unsigned int part_in_flight(struct block_device *part) { unsigned int inflight = 0; int cpu; diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h index eef450f25982..99c2e6aa5e10 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h @@ -25,6 +25,7 @@ #include <linux/uuid.h> #include <linux/xarray.h> +extern bool precise_iostat; struct module; struct request_queue; struct elevator_queue; @@ -832,6 +833,7 @@ dev_t part_devt(struct gendisk *disk, u8 partno); void inc_diskseq(struct gendisk *disk); void blk_request_module(dev_t devt); +extern unsigned int part_in_flight(struct block_device *part); extern int blk_register_queue(struct gendisk *disk); extern void blk_unregister_queue(struct gendisk *disk); void submit_bio_noacct(struct bio *bio); -- 2.31.1

1 0

[PATCH OLK-6.6 v5 0/2] ipvlan: Introduce l2e mode
by Zhengchao Shao 05 Dec '23

05 Dec '23

Inherited features of olk5.10 version. Keefe LIU (2): ipvlan: Introduce l2e mode ipvlan: Introduce local xmit queue for l2e mode drivers/net/Kconfig | 7 + drivers/net/ipvlan/ipvlan.h | 11 ++ drivers/net/ipvlan/ipvlan_core.c | 232 +++++++++++++++++++++++++++++++ drivers/net/ipvlan/ipvlan_main.c | 103 +++++++++++++- include/uapi/linux/if_link.h | 1 + 5 files changed, 352 insertions(+), 2 deletions(-) -- 2.34.1

1 2

[PATCH OLK-5.10] md/raid5: fix miscalculation of 'end_sector' in raid5_read_one_chunk()
by Li Nan 05 Dec '23

05 Dec '23

From: Yu Kuai <yukuai3(a)huawei.com> mainline inclusion from mainline-v6.4-rc5 commit 8557dc27126949c702bd3aafe8a7e0b7e4fcb44c category: bugfix bugzilla: 189405, https://gitee.com/openeuler/kernel/issues/I8LZMK Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- 'end_sector' is compared to 'rdev->recovery_offset', which is offset to rdev, however, commit e82ed3a4fbb5 ("md/raid6: refactor raid5_read_one_chunk") changes the calculation of 'end_sector' to offset to the array. Fix this miscalculation. Fixes: e82ed3a4fbb5 ("md/raid6: refactor raid5_read_one_chunk") Cc: stable(a)vger.kernel.org # v5.12+ Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Song Liu <song(a)kernel.org> Link: https://lore.kernel.org/r/20230524014118.3172781-1-yukuai1@huaweicloud.com Conflict: Commit 2c897e63a100 ("[Backport] md/raid6: refactor raid5_read_one_chunk") missed the space of the previous line. Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/md/raid5.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c index 5af25898baad..b4d004b623e7 100644 --- a/drivers/md/raid5.c +++ b/drivers/md/raid5.c @@ -5408,8 +5408,8 @@ static int raid5_read_one_chunk(struct mddev *mddev, struct bio *raid_bio) } sector = raid5_compute_sector(conf, raid_bio->bi_iter.bi_sector, 0, - &dd_idx, NULL); - end_sector = bio_end_sector(raid_bio); + &dd_idx, NULL); + end_sector = sector + bio_sectors(raid_bio); rcu_read_lock(); if (r5c_big_stripe_cached(conf, sector)) -- 2.39.2

1 0

[PATCH OLK-5.10] drivers/perf: hisi: UC PMU support statistics in power saving mode
by Junhao He 05 Dec '23

05 Dec '23

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8LYGD CVE: NA -------------------------------- When the UC enable the power saving mode, the UC power management system will turn off the counters register clock if the PMU is not enabled, and we cannot write values to the counters register. Set the UC PMU enable to turn on the clock, and then restore the UC PMU configuration. Signed-off-by: Junhao He <hejunhao3(a)huawei.com> --- drivers/perf/hisilicon/hisi_uncore_uc_pmu.c | 28 +++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c b/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c index 636fb79647c8..80811c5d8eab 100644 --- a/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c +++ b/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c @@ -287,10 +287,38 @@ static u64 hisi_uc_pmu_read_counter(struct hisi_pmu *uc_pmu, return readq(uc_pmu->base + HISI_UC_CNTR_REGn(hwc->idx)); } +static bool hisi_uc_pmu_get_glb_en_state(struct hisi_pmu *uc_pmu) +{ + u32 val; + + val = readl(uc_pmu->base + HISI_UC_EVENT_CTRL_REG); + return !!FIELD_GET(HISI_UC_EVENT_GLB_EN, val); +} + static void hisi_uc_pmu_write_counter(struct hisi_pmu *uc_pmu, struct hw_perf_event *hwc, u64 val) { + bool enable = hisi_uc_pmu_get_glb_en_state(uc_pmu); + + /* + * If the PMU is not enabled, the UC power management system will + * turn off the clock of the counters register and we cannot write + * values to the counters register. Set the UC PMU enable to turn + * on the clock. + */ + if (!enable) + hisi_uc_pmu_start_counters(uc_pmu); + writeq(val, uc_pmu->base + HISI_UC_CNTR_REGn(hwc->idx)); + + /* + * Restore the UC PMU configuration. The Perf schedule will enable PMU + * at appropriate time. + * The irq handler will also call the function to set period. At this + * time, PMU is still enabled and we cannot directly disable the PMU. + */ + if (!enable) + hisi_uc_pmu_stop_counters(uc_pmu); } static void hisi_uc_pmu_enable_counter_int(struct hisi_pmu *uc_pmu, -- 2.33.0

2 1

[PATCH OLK-6.6 V3 00/12] Add SDEI Watchdog Support
by Xiongfeng Wang 05 Dec '23

05 Dec '23

Xiongfeng Wang (12): firmware: arm_sdei: add interrupt binding api firmware: arm_sdei: make 'sdei_api_event_disable/enable' public lockup_detector: init lockup detector after all the init_calls watchdog: add nmi_watchdog support for arm64 based on SDEI sdei_watchdog: clear EOI of the secure timer before kdump sdei_watchdog: set secure timer period base on 'watchdog_thresh' sdei_watchdog: avoid possible false hardlockup init: only move down lockup_detector_init() when sdei_watchdog is enabled kprobes/arm64: Blacklist sdei watchdog callback functions openeuler_defconfig: Enable SDEI Watchdog stop_machine: mask sdei before running the callback arm64: kexec: only clear EOI for SDEI in NMI context arch/arm64/configs/openeuler_defconfig | 3 +- arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/machine_kexec.c | 11 ++ arch/arm64/kernel/watchdog_sdei.c | 151 +++++++++++++++++++++++++ drivers/firmware/arm_sdei.c | 26 ++++- include/linux/arm_sdei.h | 5 + include/linux/nmi.h | 8 ++ include/uapi/linux/arm_sdei.h | 2 + init/main.c | 7 +- kernel/stop_machine.c | 10 ++ kernel/watchdog.c | 3 + lib/Kconfig.debug | 9 ++ 12 files changed, 232 insertions(+), 4 deletions(-) create mode 100644 arch/arm64/kernel/watchdog_sdei.c -- 2.20.1

2 13

[PATCH OLK-6.6] exec: Remove redundant check in do_open_execat/uselib
by Zhihao Cheng 05 Dec '23

05 Dec '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8LX53 CVE: NA -------------------------------- There is a false positive WARNON happening in execve(2)/uselib(2) syscalls with concurrent noexec-remount. execveat remount do_open_execat(path/bin) do_filp_open path_openat do_open may_open path_noexec() // PASS remount(path->mnt, MS_NOEXEC) WARNON(path_noexec(&file->f_path)) // path_noexec() checks fail Since may_open() has already checked the same conditions, fix it by removing 'S_ISREG' and 'path_noexec' check in do_open_execat()/uselib(2). Fixes: 0fd338b2d2cdf8 ("exec: move path_noexec() check earlier") Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- fs/exec.c | 22 +--------------------- 1 file changed, 1 insertion(+), 21 deletions(-) diff --git a/fs/exec.c b/fs/exec.c index 6518e33ea813..73b833e8b548 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -142,16 +142,6 @@ SYSCALL_DEFINE1(uselib, const char __user *, library) if (IS_ERR(file)) goto out; - /* - * may_open() has already checked for this, so it should be - * impossible to trip now. But we need to be extra cautious - * and check again at the very end too. - */ - error = -EACCES; - if (WARN_ON_ONCE(!S_ISREG(file_inode(file)->i_mode) || - path_noexec(&file->f_path))) - goto exit; - error = -ENOEXEC; read_lock(&binfmt_lock); @@ -168,7 +158,7 @@ SYSCALL_DEFINE1(uselib, const char __user *, library) break; } read_unlock(&binfmt_lock); -exit: + fput(file); out: return error; @@ -925,16 +915,6 @@ static struct file *do_open_execat(int fd, struct filename *name, int flags) if (IS_ERR(file)) goto out; - /* - * may_open() has already checked for this, so it should be - * impossible to trip now. But we need to be extra cautious - * and check again at the very end too. - */ - err = -EACCES; - if (WARN_ON_ONCE(!S_ISREG(file_inode(file)->i_mode) || - path_noexec(&file->f_path))) - goto exit; - err = deny_write_access(file); if (err) goto exit; -- 2.31.1

2 1

[OLK-5.10 00/13] crypto: some bugfixs and cleanup
by Weili Qian 05 Dec '23

05 Dec '23

From: JiangShui Yang <yangjiangshui(a)h-partners.com> Chenghai Huang (3): crypto: hisilicon/qm - delete a dbg function vfio/migration - delete a dbg function crypto: hisilicon/sec2 - optimize the error return process JiangShui Yang (1): crypto: hisilicon/qm - increase the maximum waiting timeout interval of the moilbox. Weili Qian (8): crypto: hisilicon/sec2: fix memory use-after-free issue crypto: hisilicon/qm - modify interrupt resource application process crypto: hisilicon/hpre - mask cluster timeout error crypto: hisilicon/qm - support get deivce state crypto: hisilicon/qm - dump important registers values before resetting crypto: hisilicon/qm - remove duplicate configurations crypto: hisilicon/qm - add stop function by hardware crypto: hisilicon/qm - reset device before enabling it Wenkai Lin (1): crypto: hisilicon/qm - add size check in qm set algs Documentation/ABI/testing/debugfs-hisi-hpre | 7 + Documentation/ABI/testing/debugfs-hisi-sec | 7 + Documentation/ABI/testing/debugfs-hisi-zip | 7 + drivers/crypto/hisilicon/debugfs.c | 53 +++ drivers/crypto/hisilicon/hpre/hpre_main.c | 58 ++-- .../hisilicon/migration/acc_vf_migration.c | 3 - drivers/crypto/hisilicon/qm.c | 328 ++++++++++++------ drivers/crypto/hisilicon/sec2/sec.h | 2 - drivers/crypto/hisilicon/sec2/sec_crypto.c | 57 +-- drivers/crypto/hisilicon/sec2/sec_main.c | 23 +- drivers/crypto/hisilicon/zip/zip_main.c | 25 +- include/linux/hisi_acc_qm.h | 5 +- 12 files changed, 362 insertions(+), 213 deletions(-) -- 2.33.0

1 13

[PATCH OLK-6.6] blk-throttle: enable hierarchical throttle in cgroup v1
by Yu Kuai 05 Dec '23

05 Dec '23

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4R7RE CVE: NA ----------------------------------------------- blkio subsytem is not under default hierarchy in cgroup v1 by default, which means configurations will only be effective on current cgroup for io throttle. This patch introduces a new feature that enable default hierarchy for io throttle, which means configurations will be effective on child cgroups. Such feature is disabled by default, and can be enabled by adding "blkcg_global_limit=1" or "blkcg_global_limit=Y" or "blkcg_global_limit=y" in boot cmd. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Tao Hou <houtao1(a)huawei.com> --- block/blk-throttle.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/block/blk-throttle.c b/block/blk-throttle.c index 13e4377a8b28..c3bd159163d7 100644 --- a/block/blk-throttle.c +++ b/block/blk-throttle.c @@ -41,6 +41,19 @@ /* A workqueue to queue throttle related work */ static struct workqueue_struct *kthrotld_workqueue; +/* True if global limit is enabled in cgroup v1 */ +static bool global_limit; + +static int __init setup_global_limit(char *str) +{ + if (!strcmp(str, "1") || !strcmp(str, "Y") || !strcmp(str, "y")) + global_limit = true; + + return 1; +} + +__setup("blkcg_global_limit=", setup_global_limit); + #define rb_entry_tg(node) rb_entry((node), struct throtl_grp, rb_node) /* We measure latency for request size from <= 4k to >= 1M */ @@ -405,7 +418,8 @@ static void throtl_pd_init(struct blkg_policy_data *pd) * regardless of the position of the group in the hierarchy. */ sq->parent_sq = &td->service_queue; - if (cgroup_subsys_on_dfl(io_cgrp_subsys) && blkg->parent) + if ((cgroup_subsys_on_dfl(io_cgrp_subsys) || global_limit) && + blkg->parent) sq->parent_sq = &blkg_to_tg(blkg->parent)->service_queue; tg->td = td; } -- 2.39.2

2 1

[PATCH OLK-5.10 v2 0/2] Two bugfix patch about memcg swap qos
by Liu Shixin 05 Dec '23

05 Dec '23

Two bugfix patch about memcg swap qos. Liu Shixin (2): mm/swap_slots: fix out-of-bounds access of percpu area memcg: fix use-after-free of mm_struct mm/memcontrol.c | 6 ++++++ mm/swap_slots.c | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH OLK-6.6] Revert "dm space maps: don't reset space map allocation cursor when committing"
by Li Lingfeng 05 Dec '23

05 Dec '23

From: Luo Meng <luomeng12(a)huawei.com> hulk inclusion category: bugfix bugzilla: 185894, https://gitee.com/openeuler/kernel/issues/I4SJ8H?from=project-issue CVE: NA ----------------------------------------------- This reverts commit b0d9aeb41d5d5e90601fdf89834eba0a0613291c. This commit b0d9aeb41d5d ("dm space maps: don't reset space map allocation cursor when committing") change the way to find free block. But when use ramdisk(not support discard) for thin-pool,and storage over-commitment. Then constantly create and delete file, can find block in thin-pool, but can't find block in ramdisk. So need revert this patch. Signed-off-by: Luo Meng <luomeng12(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Conflicts: drivers/md/persistent-data/dm-space-map-disk.c commit 2d0f25cbc0d9 ("dm: remove unnecessary braces from single statement blocks") removes some braces; commit d6db294fd819 ("dm space map disk: remove redundant calls to sm_disk_get_nr_free()") removes calls to sm_disk_get_nr_free(). Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/md/persistent-data/dm-space-map-disk.c | 8 +------- drivers/md/persistent-data/dm-space-map-metadata.c | 9 +-------- 2 files changed, 2 insertions(+), 15 deletions(-) diff --git a/drivers/md/persistent-data/dm-space-map-disk.c b/drivers/md/persistent-data/dm-space-map-disk.c index f4241f54e20e..8d98bdd58db8 100644 --- a/drivers/md/persistent-data/dm-space-map-disk.c +++ b/drivers/md/persistent-data/dm-space-map-disk.c @@ -137,13 +137,6 @@ static int sm_disk_new_block(struct dm_space_map *sm, dm_block_t *b) * Any block we allocate has to be free in both the old and current ll. */ r = sm_ll_find_common_free_block(&smd->old_ll, &smd->ll, smd->begin, smd->ll.nr_blocks, b); - if (r == -ENOSPC) - /* - * There's no free block between smd->begin and the end of the metadata device. - * We search before smd->begin in case something has been freed. - */ - r = sm_ll_find_common_free_block(&smd->old_ll, &smd->ll, 0, smd->begin, b); - if (r) return r; @@ -165,6 +158,7 @@ static int sm_disk_commit(struct dm_space_map *sm) return r; memcpy(&smd->old_ll, &smd->ll, sizeof(smd->old_ll)); + smd->begin = 0; smd->nr_allocated_this_transaction = 0; return 0; diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c index 04698fd03e60..b59191649cff 100644 --- a/drivers/md/persistent-data/dm-space-map-metadata.c +++ b/drivers/md/persistent-data/dm-space-map-metadata.c @@ -456,14 +456,6 @@ static int sm_metadata_new_block_(struct dm_space_map *sm, dm_block_t *b) * Any block we allocate has to be free in both the old and current ll. */ r = sm_ll_find_common_free_block(&smm->old_ll, &smm->ll, smm->begin, smm->ll.nr_blocks, b); - if (r == -ENOSPC) { - /* - * There's no free block between smm->begin and the end of the metadata device. - * We search before smm->begin in case something has been freed. - */ - r = sm_ll_find_common_free_block(&smm->old_ll, &smm->ll, 0, smm->begin, b); - } - if (r) return r; @@ -516,6 +508,7 @@ static int sm_metadata_commit(struct dm_space_map *sm) return r; memcpy(&smm->old_ll, &smm->ll, sizeof(smm->old_ll)); + smm->begin = 0; smm->allocated_this_transaction = 0; return 0; -- 2.31.1

2 1

[OLK-5.10 0/4 v2] A set of patchs for openEuler
by Chengchang Tang 05 Dec '23

05 Dec '23

From: Juan Zhou <zhoujuan51(a)h-partners.com> The first two patches support more netdev speed, the third adds check for resource values and adjusts the invalid ones, and last patch renames the RoCE interrupts. Chengchang Tang (2): RDMA/hns: Fix port active speed RDMA/hns: Rename the interrupts Haoyue Xu (1): RDMA/core:Add support more netdev speed Junxian Huang (1): RDMA/hns: Add check and adjust for function resource values drivers/infiniband/core/verbs.c | 13 ++- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 123 +++++++++++++++++++-- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 37 +++++++ drivers/infiniband/hw/hns/hns_roce_main.c | 7 +- 4 files changed, 168 insertions(+), 12 deletions(-) -- 2.30.0

1 4

[PATCH openEuler-1.0-LTS] regmap: fix NULL deref on lookup
by Zhang Zekun 05 Dec '23

05 Dec '23

From: Johan Hovold <johan+linaro(a)kernel.org> stable inclusion from stable-v4.19.135 commit 7219c6b8fa24ec55a19d7a5ea58fb09151e37950 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8LTOI CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------- commit c6df843348d6b71ea986266c12831cb60c2cf325 upstream. Not all regmaps have a name so make sure to check for that to avoid dereferencing a NULL pointer when dev_get_regmap() is used to lookup a named regmap. Fixes: e84861fec32d ("regmap: dev_get_regmap_match(): fix string comparison") Cc: stable(a)vger.kernel.org # 5.8 Cc: Marc Kleine-Budde <mkl(a)pengutronix.de> Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org> Link: https://lore.kernel.org/r/20231006082104.16707-1-johan+linaro@kernel.org Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/base/regmap/regmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c index 6c9f6988bc09..3315bd1ddf30 100644 --- a/drivers/base/regmap/regmap.c +++ b/drivers/base/regmap/regmap.c @@ -1350,7 +1350,7 @@ static int dev_get_regmap_match(struct device *dev, void *res, void *data) /* If the user didn't specify a name match any */ if (data) - return (*r)->name == data; + return (*r)->name && !strcmp((*r)->name, data); else return 1; } -- 2.17.1

2 1

[PATCH OLK-6.6] dm btree spine: show warning if node_check failed in node_prep_for_write()
by Li Lingfeng 05 Dec '23

05 Dec '23

From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5JCAH -------------------------------- The BUG_ON is unneed Since f73e2e70ec48 ("dm btree spine: remove paranoid node_check call in node_prep_for_write()") merged in v5.13. For debug reason, we also want to know the data on disk is corrupted by write or disk fault. So also add check and print some info when data corrupted. Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> Reviewed-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/md/persistent-data/dm-btree-spine.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/md/persistent-data/dm-btree-spine.c b/drivers/md/persistent-data/dm-btree-spine.c index 7540383b7cf3..418cac548ce6 100644 --- a/drivers/md/persistent-data/dm-btree-spine.c +++ b/drivers/md/persistent-data/dm-btree-spine.c @@ -27,6 +27,8 @@ static void node_prepare_for_write(struct dm_block_validator *v, h->csum = cpu_to_le32(dm_bm_checksum(&h->flags, block_size - sizeof(__le32), BTREE_CSUM_XOR)); + if (node_check(v, b, 4096)) + DMWARN_LIMIT("%s node_check failed", __func__); } static int node_check(struct dm_block_validator *v, -- 2.31.1

2 1

[PATCH OLK-6.6] loop: Add parm check in loop_control_ioctl
by Li Lingfeng 05 Dec '23

05 Dec '23

From: Zhong Jinghua <zhongjinghua(a)huawei.com> hulk inclusion category: bugfix bugzilla: 188586, https://gitee.com/openeuler/kernel/issues/I6TFPJ CVE: NA ---------------------------------------- We found that in loop_control_ioctl, the kernel panic can be easily caused: 1. syscall(__NR_ioctl, r[1], 0x4c80, 0x80000200000ul); Create a loop device 0x80000200000ul. In fact, in the code, it is used as the first_minor number, and the first_minor number is 0. So the created loop device number is 7:0. 2. syscall(__NR_ioctl, r[2], 0x4c80, 0ul); Create a loop device 0x0ul. Since the 7:0 device has been created in 1, add_disk will fail because the major and first_minor numbers are consistent. 3. syscall(__NR_ioctl, r[5], 0x4c81, 0ul); Delete the device that failed to create, the kernel panics. Panic like below: BUG: KASAN: null-ptr-deref in device_del+0xb3/0x840 drivers/base/core.c:3107 Call Trace: kill_device drivers/base/core.c:3079 [inline] device_del+0xb3/0x840 drivers/base/core.c:3107 del_gendisk+0x463/0x5f0 block/genhd.c:971 loop_remove drivers/block/loop.c:2190 [inline] loop_control_ioctl drivers/block/loop.c:2289 [inline] The stack like below: Create loop device: loop_control_ioctl loop_add add_disk device_add_disk bdi_register bdi_register_va device_create device_create_groups_vargs device_add kfree(dev->p); dev->p = NULL; Remove loop device: loop_control_ioctl loop_remove del_gendisk device_del kill_device if (dev->p->dead) // p is null Fix it by adding a check for parm. Fixes: 770fe30a46a1 ("loop: add management interface for on-demand device allocation") Signed-off-by: Zhong Jinghua <zhongjinghua(a)huawei.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> Conflict: drivers/block/loop.c Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/block/loop.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/drivers/block/loop.c b/drivers/block/loop.c index 9f2d412fc560..631bc2543d74 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c @@ -1992,6 +1992,17 @@ static int loop_add(int i) struct gendisk *disk; int err; + /* + * i << part_shift is actually used as the first_minor. + * So here should avoid i << part_shift overflow. + * And, MKDEV() expect that the max bits of + * first_minor is 20. + */ + if (i > 0 && i > MINORMASK >> part_shift) { + err = -EINVAL; + goto out; + } + err = -ENOMEM; lo = kzalloc(sizeof(*lo), GFP_KERNEL); if (!lo) @@ -2011,7 +2022,8 @@ static int loop_add(int i) if (err == -ENOSPC) err = -EEXIST; } else { - err = idr_alloc(&loop_index_idr, lo, 0, 0, GFP_KERNEL); + err = idr_alloc(&loop_index_idr, lo, 0, + (MINORMASK >> part_shift) + 1, GFP_KERNEL); } mutex_unlock(&loop_ctl_mutex); if (err < 0) -- 2.31.1

2 1

[PATCH OLK-6.6 V3 00/12] Add SDEI Watchdog Support
by Xiongfeng Wang 05 Dec '23

05 Dec '23

Xiongfeng Wang (12): firmware: arm_sdei: add interrupt binding api firmware: arm_sdei: make 'sdei_api_event_disable/enable' public lockup_detector: init lockup detector after all the init_calls watchdog: add nmi_watchdog support for arm64 based on SDEI sdei_watchdog: clear EOI of the secure timer before kdump sdei_watchdog: set secure timer period base on 'watchdog_thresh' sdei_watchdog: avoid possible false hardlockup init: only move down lockup_detector_init() when sdei_watchdog is enabled kprobes/arm64: Blacklist sdei watchdog callback functions openeuler_defconfig: Enable SDEI Watchdog stop_machine: mask sdei before running the callback arm64: kexec: only clear EOI for SDEI in NMI context arch/arm64/configs/openeuler_defconfig | 3 +- arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/machine_kexec.c | 11 ++ arch/arm64/kernel/watchdog_sdei.c | 151 +++++++++++++++++++++++++ drivers/firmware/arm_sdei.c | 26 ++++- include/linux/arm_sdei.h | 5 + include/linux/nmi.h | 8 ++ include/uapi/linux/arm_sdei.h | 2 + init/main.c | 7 +- kernel/stop_machine.c | 10 ++ kernel/watchdog.c | 3 + lib/Kconfig.debug | 9 ++ 12 files changed, 232 insertions(+), 4 deletions(-) create mode 100644 arch/arm64/kernel/watchdog_sdei.c -- 2.20.1

2 13

[PATCH OLK-6.6] nbd: get config_lock before sock_shutdown
by Li Lingfeng 05 Dec '23

05 Dec '23

From: Zhong Jinghua <zhongjinghua(a)huawei.com> hulk inclusion category: bugfix bugzilla: 188799, https://gitee.com/openeuler/kernel/issues/I79QWO CVE: NA ---------------------------------------- Config->socks in sock_shutdown may trigger a UAF problem. The reason is that sock_shutdown does not hold the config_lock, so that nbd_ioctl can release config->socks at this time. T0: NBD_SET_SOCK T1: NBD_DO_IT T0 T1 nbd_ioctl mutex_lock(&nbd->config_lock) // get lock __nbd_ioctl nbd_start_device_ioctl nbd_start_device mutex_unlock(&nbd->config_lock) // relase lock wait_event_interruptible (kill, enter sock_shutdown) sock_shutdown nbd_ioctl mutex_lock(&nbd->config_lock) // get lock __nbd_ioctl nbd_add_socket krealloc kfree(p) //config->socks is NULL nbd_sock *nsock = config->socks // error Fix it by moving config_lock up before sock_shutdown. Signed-off-by: Zhong Jinghua <zhongjinghua(a)huawei.com> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/block/nbd.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 855fdf5c3b4e..9f03cdcb86c7 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -1417,13 +1417,18 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd) mutex_unlock(&nbd->config_lock); ret = wait_event_interruptible(config->recv_wq, atomic_read(&config->recv_threads) == 0); + + /* + * recv_work in flush_workqueue will not get this lock, because nbd_open + * will hold nbd->config_refs + */ + mutex_lock(&nbd->config_lock); if (ret) { sock_shutdown(nbd); nbd_clear_que(nbd); } flush_workqueue(nbd->recv_workq); - mutex_lock(&nbd->config_lock); nbd_bdev_reset(nbd); /* user requested, ignore socket errors */ if (test_bit(NBD_RT_DISCONNECT_REQUESTED, &config->runtime_flags)) -- 2.31.1

2 1

[PATCH OLK-5.10] drivers/perf: hisi: Fix some event id for HiSilicon UC pmu
by Junhao He 05 Dec '23

05 Dec '23

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8LSBA CVE: NA Reference: https://lore.kernel.org/lkml/20231204110425.20354-1-hejunhao3@huawei.com/ -------------------------------- Some event id of HiSilicon uncore UC PMU driver is incorrect, fix them. Fixes: 312eca95e28d ("drivers/perf: hisi: Add support for HiSilicon UC PMU driver") Signed-off-by: Junhao He <hejunhao3(a)huawei.com> --- drivers/perf/hisilicon/hisi_uncore_uc_pmu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c b/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c index 63da05e5831c..636fb79647c8 100644 --- a/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c +++ b/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c @@ -383,8 +383,8 @@ static struct attribute *hisi_uc_pmu_events_attr[] = { HISI_PMU_EVENT_ATTR(cpu_rd, 0x10), HISI_PMU_EVENT_ATTR(cpu_rd64, 0x17), HISI_PMU_EVENT_ATTR(cpu_rs64, 0x19), - HISI_PMU_EVENT_ATTR(cpu_mru, 0x1a), - HISI_PMU_EVENT_ATTR(cycles, 0x9c), + HISI_PMU_EVENT_ATTR(cpu_mru, 0x1c), + HISI_PMU_EVENT_ATTR(cycles, 0x95), HISI_PMU_EVENT_ATTR(spipe_hit, 0xb3), HISI_PMU_EVENT_ATTR(hpipe_hit, 0xdb), HISI_PMU_EVENT_ATTR(cring_rxdat_cnt, 0xfa), -- 2.33.0

2 1

[PATCH openEuler-1.0-LTS v2] net: prevent rewrite of msg_name in sock_sendmsg()
by Lu Wei 05 Dec '23

05 Dec '23

From: Jordan Rife <jrife(a)google.com> stable inclusion from stable-v4.19.297 commit 3d62f2577c7414e5b94e4baad6eb621165960f30 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8EZY4 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 86a7e0b69bd5b812e48a20c66c2161744f3caa16 ] Callers of sock_sendmsg(), and similarly kernel_sendmsg(), in kernel space may observe their value of msg_name change in cases where BPF sendmsg hooks rewrite the send address. This has been confirmed to break NFS mounts running in UDP mode and has the potential to break other systems. This patch: 1) Creates a new function called __sock_sendmsg() with same logic as the old sock_sendmsg() function. 2) Replaces calls to sock_sendmsg() made by __sys_sendto() and __sys_sendmsg() with __sock_sendmsg() to avoid an unnecessary copy, as these system calls are already protected. 3) Modifies sock_sendmsg() so that it makes a copy of msg_name if present before passing it down the stack to insulate callers from changes to the send address. Link: https://lore.kernel.org/netdev/20230912013332.2048422-1-jrife@google.com/ Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg") Cc: stable(a)vger.kernel.org Reviewed-by: Willem de Bruijn <willemb(a)google.com> Signed-off-by: Jordan Rife <jrife(a)google.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> conflict: net/socket.c Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/socket.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) diff --git a/net/socket.c b/net/socket.c index 3d3632fe4a34..691dd9fb5d1f 100644 --- a/net/socket.c +++ b/net/socket.c @@ -653,13 +653,30 @@ static inline int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg) return ret; } -int sock_sendmsg(struct socket *sock, struct msghdr *msg) +static int __sock_sendmsg(struct socket *sock, struct msghdr *msg) { int err = security_socket_sendmsg(sock, msg, msg_data_left(msg)); return err ?: sock_sendmsg_nosec(sock, msg); } + +int sock_sendmsg(struct socket *sock, struct msghdr *msg) +{ + struct sockaddr_storage *save_addr = (struct sockaddr_storage *)msg->msg_name; + struct sockaddr_storage address; + int ret; + + if (msg->msg_name) { + memcpy(&address, msg->msg_name, msg->msg_namelen); + msg->msg_name = &address; + } + + ret = __sock_sendmsg(sock, msg); + msg->msg_name = save_addr; + + return ret; +} EXPORT_SYMBOL(sock_sendmsg); /** @@ -963,7 +980,7 @@ static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from) if (sock->type == SOCK_SEQPACKET) msg.msg_flags |= MSG_EOR; - res = sock_sendmsg(sock, &msg); + res = __sock_sendmsg(sock, &msg); *from = msg.msg_iter; return res; } @@ -1940,7 +1957,7 @@ int __sys_sendto(int fd, void __user *buff, size_t len, unsigned int flags, if (sock->file->f_flags & O_NONBLOCK) flags |= MSG_DONTWAIT; msg.msg_flags = flags; - err = sock_sendmsg(sock, &msg); + err = __sock_sendmsg(sock, &msg); out_put: fput_light(sock->file, fput_needed); @@ -2272,7 +2289,7 @@ static int ____sys_sendmsg(struct socket *sock, struct msghdr *msg_sys, err = sock_sendmsg_nosec(sock, msg_sys); goto out_freectl; } - err = sock_sendmsg(sock, msg_sys); + err = __sock_sendmsg(sock, msg_sys); /* * If this is sendmmsg() and sending to current destination address was * successful, remember it. -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] fs: don't audit the capability check in simple_xattr_list()
by Zizhi Wo 04 Dec '23

04 Dec '23

From: Ondrej Mosnacek <omosnace(a)redhat.com> mainline inclusion from mainline-v6.2-rc1 commit e7eda157c4071cd1e69f4b1687b0fbe1ae5e6f46 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8LQI5?from=project-issue CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The check being unconditional may lead to unwanted denials reported by LSMs when a process has the capability granted by DAC, but denied by an LSM. In the case of SELinux such denials are a problem, since they can't be effectively filtered out via the policy and when not silenced, they produce noise that may hide a true problem or an attack. Checking for the capability only if any trusted xattr is actually present wouldn't really address the issue, since calling listxattr(2) on such node on its own doesn't indicate an explicit attempt to see the trusted xattrs. Additionally, it could potentially leak the presence of trusted xattrs to an unprivileged user if they can check for the denials (e.g. through dmesg). Therefore, it's best (and simplest) to keep the check unconditional and instead use ns_capable_noaudit() that will silence any associated LSM denials. Fixes: 38f38657444d ("xattr: extract simple_xattr code from tmpfs") Reported-by: Martin Pitt <mpitt(a)redhat.com> Suggested-by: Christian Brauner (Microsoft) <brauner(a)kernel.org> Signed-off-by: Ondrej Mosnacek <omosnace(a)redhat.com> Reviewed-by: Christian Brauner (Microsoft) <brauner(a)kernel.org> Reviewed-by: Paul Moore <paul(a)paul-moore.com> Signed-off-by: Christian Brauner (Microsoft) <brauner(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/xattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/xattr.c b/fs/xattr.c index 470ee0af3200..5c3407e18e15 100644 --- a/fs/xattr.c +++ b/fs/xattr.c @@ -1012,7 +1012,7 @@ static int xattr_list_one(char **buffer, ssize_t *remaining_size, ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs, char *buffer, size_t size) { - bool trusted = capable(CAP_SYS_ADMIN); + bool trusted = ns_capable_noaudit(&init_user_ns, CAP_SYS_ADMIN); struct simple_xattr *xattr; ssize_t remaining_size = size; int err = 0; -- 2.39.2

2 1

[PATCH OLK-6.6 V3 00/12] Add SDEI Watchdog Support
by Xiongfeng Wang 04 Dec '23

04 Dec '23

Xiongfeng Wang (12): firmware: arm_sdei: add interrupt binding api firmware: arm_sdei: make 'sdei_api_event_disable/enable' public lockup_detector: init lockup detector after all the init_calls watchdog: add nmi_watchdog support for arm64 based on SDEI sdei_watchdog: clear EOI of the secure timer before kdump sdei_watchdog: set secure timer period base on 'watchdog_thresh' sdei_watchdog: avoid possible false hardlockup init: only move down lockup_detector_init() when sdei_watchdog is enabled kprobes/arm64: Blacklist sdei watchdog callback functions openeuler_defconfig: Enable SDEI Watchdog stop_machine: mask sdei before running the callback arm64: kexec: only clear EOI for SDEI in NMI context arch/arm64/configs/openeuler_defconfig | 3 +- arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/machine_kexec.c | 11 ++ arch/arm64/kernel/watchdog_sdei.c | 151 +++++++++++++++++++++++++ drivers/firmware/arm_sdei.c | 26 ++++- include/linux/arm_sdei.h | 5 + include/linux/nmi.h | 8 ++ include/uapi/linux/arm_sdei.h | 2 + init/main.c | 7 +- kernel/stop_machine.c | 10 ++ kernel/watchdog.c | 3 + lib/Kconfig.debug | 9 ++ 12 files changed, 232 insertions(+), 4 deletions(-) create mode 100644 arch/arm64/kernel/watchdog_sdei.c -- 2.20.1

1 12

[PATCH OLK-5.10 0/6] bring mc support to page eject
by Wupeng Ma 04 Dec '23

04 Dec '23

From: Ma Wupeng <mawupeng1(a)huawei.com> During page eject, machine check safe is enhanced as follow: During soft offline page, page is copied to new page in kernel. If the origin page has UCE, there will lead to kernel panic. In order to solve this problem, use machine check safe to catch this error which can be achieved by using copy_mc_to_kernel to replace copy_page. Signal SIGBUS will be send to user task if this UCE is consumed by this situation to avoid kernel panic. Jiaqi Yan (1): mm/hwpoison: introduce copy_mc_highpage Ma Wupeng (5): mm/hwpoison: arm64: introduce copy_mc_highpage mm/hwpoison: introduce copy_mc_highpages mm/hwpoison: add migrate_page_mc_extra() mm: Update PF_COREDUMP_MCS to PF_MCS mm: page_eject: Add mc support during offline page arch/arm64/include/asm/page.h | 1 + arch/arm64/mm/copypage.c | 13 ++++++ drivers/ras/page_eject.c | 5 +++ fs/coredump.c | 4 +- include/linux/highmem.h | 52 +++++++++++++++++++++++ include/linux/sched.h | 2 +- lib/iov_iter.c | 2 +- mm/migrate.c | 77 +++++++++++++++++++++++++++++++---- 8 files changed, 143 insertions(+), 13 deletions(-) -- 2.25.1

2 7

[PATCH OLK-6.6 00/19] Add sharepool support
by Wang Wensheng 04 Dec '23

04 Dec '23

This patch series migrates share pool features from OLK-5.10 to OLK-6.6. We don't want to do this work patch by patch since there are hundreds of patches in OLK-5.10 including bugfix and small features generation. Instead we just take the final version and split it into a few small patches, each of which contains one feature at the final version. The share pool features is a big feature, it is mainly used to share user virtual memory for different processes in the same group. It could be used by this steps: Process A create a new group which is owned by process A. Process A add process B to the group. Process A add process C to the same group. Process B alloc a new memory VA, and write something in it. The VA was send to the process C by IPC, then process C got it. The process C access the VA and got the data directly. The process A could add more processes in the group to share the memory. Fix the memory by use the free function or exit the group. The new features is enabled both by CONFIG_SHARE_POOL and the enable_ascend_share_pool bootarg, it would not affect anything if disabled. Wang Wensheng (19): mm/hugetlb: Introduce hugetlb_insert_hugepage_pte[_by_pa] mm/vmalloc: Extend vmalloc usage about hugepage mm: Extend mmap assocated functions to accept mm_struct mm/sharepool: Add base framework for share_pool mm/sharepool: Add sp_area management code mm/sharepool: Reserve the va space for share_pool mm/sharepool: Implement mg_sp_make_share_u2k() mm/sharepool: Implement mg_sp_unshare_kva mm/sharepool: Implement mg_sp_walk_page_range() mm/sharepool: Implement mg_sp_free() mm/sharepool: Implement mg_sp_alloc() mm/sharepool: Implement mg_sp_make_share_k2u() mm/sharepool: Implement mg_sp_group_add_task() mm/sharepool: Implement mg_sp_group_id_by_pid() mm/sharepool: Implement mg_sp_id_of_current() mm/sharepool: Implement mg_sp_config_dvpp_range() mm/sharepool: Add proc interfaces to show sp info mm/sharepool: support fork() and exit() to handle the mm mm/sharepool: Protect the va reserved for sharepool include/linux/hugetlb.h | 32 + include/linux/mempolicy.h | 11 + include/linux/mm.h | 17 + include/linux/mm_types.h | 6 + include/linux/share_pool.h | 277 +++ include/linux/vmalloc.h | 18 + kernel/fork.c | 3 + mm/Kconfig | 34 + mm/Makefile | 1 + mm/gup.c | 23 +- mm/hugetlb.c | 78 + mm/mempolicy.c | 12 +- mm/mmap.c | 50 +- mm/mremap.c | 4 + mm/share_pool.c | 3450 ++++++++++++++++++++++++++++++++++++ mm/util.c | 4 + mm/vmalloc.c | 205 ++- 17 files changed, 4204 insertions(+), 21 deletions(-) create mode 100644 include/linux/share_pool.h create mode 100644 mm/share_pool.c -- 2.17.1

3 22

[PATCH OLK-5.10 0/6] bring mc support to page eject
by Wupeng Ma 04 Dec '23

04 Dec '23

From: Ma Wupeng <mawupeng1(a)huawei.com> During page eject, machine check safe is enhanced as follow: During soft offline page, page is copied to new page in kernel. If the origin page has UCE, there will lead to kernel panic. In order to solve this problem, use machine check safe to catch this error which can be achieved by using copy_mc_to_kernel to replace copy_page. Signal SIGBUS will be send to user task if this UCE is consumed by this situation to avoid kernel panic. Jiaqi Yan (1): mm/hwpoison: introduce copy_mc_highpage Ma Wupeng (5): mm/hwpoison: arm64: introduce copy_mc_highpage mm/hwpoison: introduce copy_mc_highpages mm/hwpoison: add migrate_page_mc_extra() mm: Update PF_COREDUMP_MCS to PF_MCS mm: page_eject: Add mc support during offline page arch/arm64/include/asm/page.h | 1 + arch/arm64/mm/copypage.c | 13 ++++++ drivers/ras/page_eject.c | 5 +++ fs/coredump.c | 4 +- include/linux/highmem.h | 52 +++++++++++++++++++++++ include/linux/sched.h | 2 +- lib/iov_iter.c | 2 +- mm/migrate.c | 77 +++++++++++++++++++++++++++++++---- 8 files changed, 143 insertions(+), 13 deletions(-) -- 2.25.1

1 6

[PATCH OLK-5.10 00/15] Some fixes and optimizations for hisi_sas
by Yihang Li 04 Dec '23

04 Dec '23

From: xiabing <xiabing12(a)h-partners.com> This patchset includes some changes for hisi_sas: - Fix NULL pointer issue when removing debugfs. - Directly calling register snapshot instead of workqueue. - Allocate debugfs memory during triggering debugfs dump. - Fix issue that device is not found because .phy_attached is not set. - Replace with standard error code return value. - Check the variable slot before use it. - Clear HISI_SAS_RESET_BIT, release hisi_hba semaphore, unblock the scsi host, clear HISI_SAS_REJECT_CMD_BIT if FLR failed. - Use the correct number of registers when reading register information. - Fix warnings detected by sparse - Handle the NCQ error returned by D2H frame Xiang Chen (1): scsi: hisi_sas: Remove unused variable and check in hisi_sas_send_ata_reset_each_phy() Xingui Yang (3): scsi: hisi_sas: Fix normally completed I/O analysed as failed scsi: hisi_sas: Fix warnings detected by sparse scsi: hisi_sas: Handle the NCQ error returned by D2H frame Yihang Li (11): scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs scsi: hisi_sas: Directly call register snapshot instead of using workqueue scsi: hisi_sas: Allocate DFX memory during dump trigger scsi: hisi_sas: Remove redundant checks for automatic debugfs dump scsi: hisi_sas: Set .phy_attached before notifing phyup event HISI_PHYE_PHY_UP_PM scsi: hisi_sas: Replace with standard error code return value scsi: hisi_sas: Check before using pointer variables scsi: hisi_sas: Rollback some operations if FLR failed scsi: hisi_sas: Correct the number of global debugfs registers scsi: hisi_sas: Fix the deadlock issue that occurs during automatic dump scsi: hisi_sas: Check whether debugfs is enabled before removing or releasing it drivers/scsi/hisi_sas/hisi_sas.h | 3 +- drivers/scsi/hisi_sas/hisi_sas_main.c | 37 ++++-- drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 11 +- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 164 +++++++++++++------------ 4 files changed, 120 insertions(+), 95 deletions(-) -- 2.30.0

1 15

[PATCH OLK-5.10 0/2] Two bugfix patch about memcg swap qos
by Liu Shixin 04 Dec '23

04 Dec '23

Two bugfix patch about memcg swap qos. Liu Shixin (2): mm/swap_slots: fix out-of-bounds access of percpu area memcg: fix use-after-free of mm_struct mm/memcontrol.c | 4 ++++ mm/swap_slots.c | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH OLK-6.6 v4 0/2] ipvlan: Introduce l2e mode
by Zhengchao Shao 04 Dec '23

04 Dec '23

Inherited features of olk5.10 version. Keefe LIU (2): ipvlan: Introduce l2e mode ipvlan: Introduce local xmit queue for l2e mode drivers/net/Kconfig | 7 + drivers/net/ipvlan/ipvlan.h | 11 ++ drivers/net/ipvlan/ipvlan_core.c | 232 +++++++++++++++++++++++++++++++ drivers/net/ipvlan/ipvlan_main.c | 103 +++++++++++++- include/uapi/linux/if_link.h | 3 + 5 files changed, 354 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/5] xfs: fix some misc issue
by Long Li 04 Dec '23

04 Dec '23

This patch set fix some mics xfs issue: Long Li (5): xfs: fix a UAF when inode item push xfs: fix a UAF in xfs_iflush_abort_clean xfs: fix dir3 block read verify fail during log recover xfs: don't verify agf length when log recovery xfs: xfs_trans_cancel() path must check for log shutdown fs/xfs/libxfs/xfs_alloc.c | 3 ++- fs/xfs/xfs_buf.c | 5 +++++ fs/xfs/xfs_buf_item_recover.c | 9 +++------ fs/xfs/xfs_inode_item.c | 8 +++++++- fs/xfs/xfs_trans.c | 2 +- 5 files changed, 18 insertions(+), 9 deletions(-) -- 2.31.1

2 6

[PATCH OLK-5.10] fs: Fix error checking for d_hash_and_lookup()
by Zizhi Wo 04 Dec '23

04 Dec '23

From: Wang Ming <machel(a)vivo.com> mainline inclusion from mainline-v6.6-rc1 commit 0d5a4f8f775ff990142cdc810a84eae078589d27 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8LNLY?from=project-issue Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The d_hash_and_lookup() function returns error pointers or NULL. Most incorrect error checks were fixed, but the one in int path_pts() was forgotten. Fixes: eedf265aa003 ("devpts: Make each mount of devpts an independent filesystem.") Signed-off-by: Wang Ming <machel(a)vivo.com> Message-Id: <20230713120555.7025-1-machel(a)vivo.com> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/namei.c b/fs/namei.c index ff140e2943a0..3588e12d6130 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -2647,7 +2647,7 @@ int path_pts(struct path *path) dput(path->dentry); path->dentry = parent; child = d_hash_and_lookup(parent, &this); - if (!child) + if (IS_ERR_OR_NULL(child)) return -ENOENT; path->dentry = child; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] net: prevent rewrite of msg_name in sock_sendmsg()
by Lu Wei 04 Dec '23

04 Dec '23

From: Jordan Rife <jrife(a)google.com> stable inclusion from stable-v4.19.297 commit 3d62f2577c7414e5b94e4baad6eb621165960f30 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8EZY4 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 86a7e0b69bd5b812e48a20c66c2161744f3caa16 ] Callers of sock_sendmsg(), and similarly kernel_sendmsg(), in kernel space may observe their value of msg_name change in cases where BPF sendmsg hooks rewrite the send address. This has been confirmed to break NFS mounts running in UDP mode and has the potential to break other systems. This patch: 1) Creates a new function called __sock_sendmsg() with same logic as the old sock_sendmsg() function. 2) Replaces calls to sock_sendmsg() made by __sys_sendto() and __sys_sendmsg() with __sock_sendmsg() to avoid an unnecessary copy, as these system calls are already protected. 3) Modifies sock_sendmsg() so that it makes a copy of msg_name if present before passing it down the stack to insulate callers from changes to the send address. Link: https://lore.kernel.org/netdev/20230912013332.2048422-1-jrife@google.com/ Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg") Cc: stable(a)vger.kernel.org Reviewed-by: Willem de Bruijn <willemb(a)google.com> Signed-off-by: Jordan Rife <jrife(a)google.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> conflict: net/socket.c Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/socket.c | 29 +++++++++++++++++++++++------ 1 file changed, 23 insertions(+), 6 deletions(-) diff --git a/net/socket.c b/net/socket.c index 3d3632fe4a34..0cc52ba0b0e2 100644 --- a/net/socket.c +++ b/net/socket.c @@ -637,6 +637,14 @@ void __sock_tx_timestamp(__u16 tsflags, __u8 *tx_flags) } EXPORT_SYMBOL(__sock_tx_timestamp); +static int __sock_sendmsg(struct socket *sock, struct msghdr *msg) +{ + int err = security_socket_sendmsg(sock, msg, + msg_data_left(msg)); + + return err ?: sock_sendmsg_nosec(sock, msg); +} + /** * sock_sendmsg - send a message through @sock * @sock: socket @@ -655,10 +663,19 @@ static inline int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg) int sock_sendmsg(struct socket *sock, struct msghdr *msg) { - int err = security_socket_sendmsg(sock, msg, - msg_data_left(msg)); + struct sockaddr_storage *save_addr = (struct sockaddr_storage *)msg->msg_name; + struct sockaddr_storage address; + int ret; - return err ?: sock_sendmsg_nosec(sock, msg); + if (msg->msg_name) { + memcpy(&address, msg->msg_name, msg->msg_namelen); + msg->msg_name = &address; + } + + ret = __sock_sendmsg(sock, msg); + msg->msg_name = save_addr; + + return ret; } EXPORT_SYMBOL(sock_sendmsg); @@ -963,7 +980,7 @@ static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from) if (sock->type == SOCK_SEQPACKET) msg.msg_flags |= MSG_EOR; - res = sock_sendmsg(sock, &msg); + res = __sock_sendmsg(sock, &msg); *from = msg.msg_iter; return res; } @@ -1940,7 +1957,7 @@ int __sys_sendto(int fd, void __user *buff, size_t len, unsigned int flags, if (sock->file->f_flags & O_NONBLOCK) flags |= MSG_DONTWAIT; msg.msg_flags = flags; - err = sock_sendmsg(sock, &msg); + err = __sock_sendmsg(sock, &msg); out_put: fput_light(sock->file, fput_needed); @@ -2272,7 +2289,7 @@ static int ____sys_sendmsg(struct socket *sock, struct msghdr *msg_sys, err = sock_sendmsg_nosec(sock, msg_sys); goto out_freectl; } - err = sock_sendmsg(sock, msg_sys); + err = __sock_sendmsg(sock, msg_sys); /* * If this is sendmmsg() and sending to current destination address was * successful, remember it. -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] arm64: errata: add option to disable cache readunique prefetch on HIP08
by Yang Yingliang 04 Dec '23

04 Dec '23

Random performance decreases appear on cases of Hackbench which test pipe or socket communication among multi-threads on Hisi HIP08 SoC. Cache sharing which caused by the change of the data layout and the cache readunique prefetch mechanism both lead to this problem. Readunique mechanism which may caused by store operation will invalid cachelines on other cores during data fetching stage which can cause cacheline invalidation happens frequently in a sharing data access situation. Disable cache readunique prefetch can trackle this problem. Test cases are like: for i in 20;do echo "--------pipe thread num=$i----------" for j in $(seq 1 10);do ./hackbench -pipe $i thread 1000 done done We disable readunique prefetch only in el2 for in el1 disabling readunique prefetch may cause panic due to lack of related priority which often be set in BIOS. Introduce CONFIG_HISILICON_ERRATUM_HIP08_RU_PREFETCH and disable RU prefetch using boot cmdline 'readunique_prefetch=off'. Kai Shen (1): arm64: errata: add option to disable cache readunique prefetch on HIP08 Xie XiuQi (1): arm64: errata: enable HISILICON_ERRATUM_HIP08_RU_PREFETCH arch/arm64/Kconfig | 18 +++++++++ arch/arm64/configs/openeuler_defconfig | 2 + arch/arm64/kernel/cpu_errata.c | 56 ++++++++++++++++++++++++++ arch/arm64/tools/cpucaps | 1 + 4 files changed, 77 insertions(+) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] mm: don't let userspace spam allocations warnings
by Peng Zhang 04 Dec '23

04 Dec '23

From: Daniel Vetter <daniel.vetter(a)ffwll.ch> mainline inclusion from mainline-v5.0-rc8 commit 6c8fcc096be9d02f478c508052a41a4430506ab3 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8LMVO CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- memdump_user usually gets fed unchecked userspace input. Blasting a full backtrace into dmesg every time is a bit excessive - I'm not sure on the kernel rule in general, but at least in drm we're trying not to let unpriviledge userspace spam the logs freely. Definitely not entire warning backtraces. It also means more filtering for our CI, because our testsuite exercises these corner cases and so hits these a lot. Link: http://lkml.kernel.org/r/20190220204058.11676-1-daniel.vetter@ffwll.ch Signed-off-by: Daniel Vetter <daniel.vetter(a)intel.com> Reviewed-by: Andrew Morton <akpm(a)linux-foundation.org> Acked-by: Michal Hocko <mhocko(a)suse.com> Reviewed-by: Kees Cook <keescook(a)chromium.org> Cc: Mike Rapoport <rppt(a)linux.vnet.ibm.com> Cc: Roman Gushchin <guro(a)fb.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Jan Stancek <jstancek(a)redhat.com> Cc: Andrey Ryabinin <aryabinin(a)virtuozzo.com> Cc: "Michael S. Tsirkin" <mst(a)redhat.com> Cc: Huang Ying <ying.huang(a)intel.com> Cc: Bartosz Golaszewski <brgl(a)bgdev.pl> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- mm/util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/util.c b/mm/util.c index 2b04ff4675d6..3a69fd0a15ca 100644 --- a/mm/util.c +++ b/mm/util.c @@ -160,7 +160,7 @@ void *memdup_user(const void __user *src, size_t len) { void *p; - p = kmalloc_track_caller(len, GFP_USER); + p = kmalloc_track_caller(len, GFP_USER | __GFP_NOWARN); if (!p) return ERR_PTR(-ENOMEM); -- 2.25.1

2 1

[PATCH OLK-6.6] mm: Add sysctl to clear free list pages
by Yu Liao 04 Dec '23

04 Dec '23

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4SK3S CVE: NA -------------------------------- This patch add sysctl to clear pages in free lists of each NUMA node. For each NUMA node, clear each page in the free list, these work is scheduled on a random CPU of the NUMA node. When kasan is enabled and the pages are free, the shadow memory will be filled with 0xFF, writing these free pages will cause UAF, so just disable KASAN for clear freelist. In the case of large memory, the clear freelist will hold zone lock for a long time. As a result, the process may be blocked unless clear freelist thread exit, and causing the system to be reset by the watchdog. Provide a mechanism to stop clear freelist threads when elapsed time exceeds cfp_timeout, which can be set by module_param(). Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> --- .../admin-guide/kernel-parameters.txt | 3 + Documentation/admin-guide/sysctl/vm.rst | 13 ++ mm/Kconfig | 13 ++ mm/Makefile | 2 + mm/clear_freelist_page.c | 187 ++++++++++++++++++ 5 files changed, 218 insertions(+) create mode 100644 mm/clear_freelist_page.c diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index 41644336e358..97c91370b01c 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -618,6 +618,9 @@ Also note the kernel might malfunction if you disable some critical bits. + clear_freelist + Enable clear_freelist feature. + clk_ignore_unused [CLK] Prevents the clock framework from automatically gating diff --git a/Documentation/admin-guide/sysctl/vm.rst b/Documentation/admin-guide/sysctl/vm.rst index 45ba1f4dc004..cc15ea0fc406 100644 --- a/Documentation/admin-guide/sysctl/vm.rst +++ b/Documentation/admin-guide/sysctl/vm.rst @@ -25,6 +25,7 @@ files can be found in mm/swap.c. Currently, these files are in /proc/sys/vm: - admin_reserve_kbytes +- clear_freelist_pages - compact_memory - compaction_proactiveness - compact_unevictable_allowed @@ -106,6 +107,18 @@ On x86_64 this is about 128MB. Changing this takes effect whenever an application requests memory. +clear_freelist_pages +==================== + +Available only when CONFIG_CLEAR_FREELIST_PAGE is set. When 1 is written to the +file, all pages in free lists will be written with 0. + +Zone lock is held during clear_freelist_pages, if the execution time is too +long, RCU CPU Stall warnings will be print. For each NUMA node, +clear_freelist_pages is performed on a "random" CPU of the NUMA node. +The time consuming is related to the hardware. + + compact_memory ============== diff --git a/mm/Kconfig b/mm/Kconfig index ece4f2847e2b..e652d267e87e 100644 --- a/mm/Kconfig +++ b/mm/Kconfig @@ -1269,6 +1269,19 @@ config LOCK_MM_AND_FIND_VMA bool depends on !STACK_GROWSUP +config CLEAR_FREELIST_PAGE + bool "Support for clear free list pages" + depends on MMU && SYSCTL + default n + help + Say y here to enable the clear free list pages feature. When + writing to clear_freelist, trigger to clean up the free memory + of the buddy system. + + To enable this feature, kernel parameter "clear_freelist" also + needs to be added. + + source "mm/damon/Kconfig" endmenu diff --git a/mm/Makefile b/mm/Makefile index ec65984e2ade..1dc5d64a54f0 100644 --- a/mm/Makefile +++ b/mm/Makefile @@ -7,6 +7,7 @@ KASAN_SANITIZE_slab_common.o := n KASAN_SANITIZE_slab.o := n KASAN_SANITIZE_slub.o := n KCSAN_SANITIZE_kmemleak.o := n +KASAN_SANITIZE_clear_freelist_page.o := n # These produce frequent data race reports: most of them are due to races on # the same word but accesses to different bits of that word. Re-enable KCSAN @@ -138,3 +139,4 @@ obj-$(CONFIG_IO_MAPPING) += io-mapping.o obj-$(CONFIG_HAVE_BOOTMEM_INFO_NODE) += bootmem_info.o obj-$(CONFIG_GENERIC_IOREMAP) += ioremap.o obj-$(CONFIG_SHRINKER_DEBUG) += shrinker_debug.o +obj-$(CONFIG_CLEAR_FREELIST_PAGE) += clear_freelist_page.o diff --git a/mm/clear_freelist_page.c b/mm/clear_freelist_page.c new file mode 100644 index 000000000000..50b7ec918bfb --- /dev/null +++ b/mm/clear_freelist_page.c @@ -0,0 +1,187 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Support for clear free list pages. + */ + +#include <linux/mmzone.h> +#include <linux/mm_types.h> +#include <linux/mm.h> +#include <linux/sysctl.h> +#include <linux/highmem.h> +#include <linux/slab.h> +#include <linux/workqueue.h> +#include <linux/sched.h> +#include <linux/atomic.h> +#include <linux/nmi.h> +#include <linux/sched/clock.h> +#include <linux/module.h> + +#define CFP_DEFAULT_TIMEOUT 2000 +#define for_each_populated_zone_pgdat(pgdat, zone) \ + for (zone = pgdat->node_zones; \ + zone; \ + zone = next_pgdat_zone(zone)) \ + if (!populated_zone(zone)) \ + ; /* do nothing */ \ + else + +struct pgdat_entry { + struct pglist_data *pgdat; + struct work_struct work; +}; + +static DECLARE_WAIT_QUEUE_HEAD(clear_freelist_wait); +static DEFINE_MUTEX(clear_freelist_lock); +static atomic_t clear_freelist_workers; +static atomic_t clear_pages_num; +static ulong cfp_timeout_ms = CFP_DEFAULT_TIMEOUT; + +/* + * next_pgdat_zone - helper magic for for_each_populated_zone_pgdat() + */ +static struct zone *next_pgdat_zone(struct zone *zone) +{ + pg_data_t *pgdat = zone->zone_pgdat; + + if (zone < pgdat->node_zones + MAX_NR_ZONES - 1) + zone++; + else + zone = NULL; + return zone; +} + +static void clear_pgdat_freelist_pages(struct work_struct *work) +{ + struct pgdat_entry *entry = container_of(work, struct pgdat_entry, work); + u64 cfp_timeout_ns = cfp_timeout_ms * NSEC_PER_MSEC; + struct pglist_data *pgdat = entry->pgdat; + unsigned long flags, order, t; + struct page *page; + struct zone *zone; + u64 start, now; + + start = sched_clock(); + + for_each_populated_zone_pgdat(pgdat, zone) { + spin_lock_irqsave(&zone->lock, flags); + for_each_migratetype_order(order, t) { + list_for_each_entry(page, &zone->free_area[order].free_list[t], lru) { + now = sched_clock(); + if (unlikely(now - start > cfp_timeout_ns)) { + spin_unlock_irqrestore(&zone->lock, flags); + goto out; + } + +#ifdef CONFIG_KMAP_LOCAL + int i; + + /* Clear highmem by clear_highpage() */ + for (i = 0; i < (1 << order); i++) + clear_highpage(page + i); +#else + memset(page_address(page), 0, (1 << order) * PAGE_SIZE); +#endif + touch_nmi_watchdog(); + atomic_add(1 << order, &clear_pages_num); + } + } + spin_unlock_irqrestore(&zone->lock, flags); + + cond_resched(); + } + +out: + kfree(entry); + + if (atomic_dec_and_test(&clear_freelist_workers)) + wake_up(&clear_freelist_wait); +} + +static void init_clear_freelist_work(struct pglist_data *pgdat) +{ + struct pgdat_entry *entry; + + entry = kzalloc(sizeof(struct pgdat_entry), GFP_KERNEL); + if (!entry) + return; + + entry->pgdat = pgdat; + INIT_WORK(&entry->work, clear_pgdat_freelist_pages); + queue_work_node(pgdat->node_id, system_unbound_wq, &entry->work); +} + +static void clear_freelist_pages(void) +{ + struct pglist_data *pgdat; + + mutex_lock(&clear_freelist_lock); + drain_all_pages(NULL); + + for_each_online_pgdat(pgdat) { + atomic_inc(&clear_freelist_workers); + init_clear_freelist_work(pgdat); + } + + wait_event(clear_freelist_wait, atomic_read(&clear_freelist_workers) == 0); + + pr_debug("Cleared pages %d\nFree pages %lu\n", atomic_read(&clear_pages_num), + global_zone_page_state(NR_FREE_PAGES)); + atomic_set(&clear_pages_num, 0); + + mutex_unlock(&clear_freelist_lock); +} + +static int sysctl_clear_freelist_handler(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, loff_t *ppos) +{ + int ret; + int val; + + table->data = &val; + ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); + + if (!ret && write) + clear_freelist_pages(); + + return ret; +} + +static struct ctl_table clear_freelist_table[] = { + { + .procname = "clear_freelist_pages", + .data = NULL, + .maxlen = sizeof(int), + .mode = 0200, + .proc_handler = &sysctl_clear_freelist_handler, + .extra1 = SYSCTL_ONE, + .extra2 = SYSCTL_ONE, + }, + { } +}; + +static struct ctl_table sys_ctl_table[] = { + { + .procname = "vm", + .mode = 0555, + .child = clear_freelist_table, + }, + { } +}; + +static bool clear_freelist_enabled; +static int __init setup_clear_freelist(char *str) +{ + clear_freelist_enabled = true; + return 1; +} +__setup("clear_freelist", setup_clear_freelist); + +static int __init clear_freelist_init(void) +{ + if (clear_freelist_enabled) + register_sysctl_table(sys_ctl_table); + + return 0; +} +module_init(clear_freelist_init); +module_param(cfp_timeout_ms, ulong, 0644); -- 2.33.0

2 1

[PATCH OLK-6.6 0/2] xfs: fix intent item leak during reovery
by Long Li 04 Dec '23

04 Dec '23

This patch set fix intent item leak during reovery when recovery intent fails. Long Li (2): xfs: factor out xfs_defer_pending_abort xfs: abort intent items when recovery intents fail fs/xfs/libxfs/xfs_defer.c | 28 ++++++++++++++++++---------- fs/xfs/libxfs/xfs_defer.h | 2 +- fs/xfs/xfs_log_recover.c | 2 +- 3 files changed, 20 insertions(+), 12 deletions(-) -- 2.31.1

2 3

[PATCH openEuler-22.03-LTS 0/6] backport Broadcom NIC driver patches
by Dapeng Yu 04 Dec '23

04 Dec '23

Backport the latest patches from upstream stable branch linux-5.10.y for Broadcom NIC driver. Florian Fainelli (2): net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop() net: bcmgenet: Restore phy_stop() depending upon suspend/close Somnath Kotur (2): bnxt_en: Query default VLAN before VNIC setup on a VF bnxt_en: Implement .set_port / .unset_port UDP tunnel callbacks Sreekanth Reddy (1): bnxt_en: Don't issue AP reset during ethtool's reset operation Tobias Heider (1): Add MODULE_FIRMWARE() for FIRMWARE_TG357766. drivers/net/ethernet/broadcom/bnxt/bnxt.c | 28 ++++++++++++++----- .../net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- .../net/ethernet/broadcom/genet/bcmgenet.c | 9 +++--- drivers/net/ethernet/broadcom/tg3.c | 1 + 4 files changed, 28 insertions(+), 12 deletions(-) -- 2.43.0

2 1

[PATCH openEuler-22.03-LTS 1/6] net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop()
by Dapeng Yu 04 Dec '23

04 Dec '23

From: Florian Fainelli <f.fainelli(a)gmail.com> stable inclusion from stable-v5.10.181 commit e92727ed9e8b6798efc1e7ae44bbe7c44c453670 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8L4MY CVE: NA backport: OLK-5.10, openEuler-22.03-LTS, openEuler-22.03-LTS-SP1, openEuler-22.03-LTS-SP2 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 93e0401e0fc0c54b0ac05b687cd135c2ac38187c ] The call to phy_stop() races with the later call to phy_disconnect(), resulting in concurrent phy_suspend() calls being run from different CPUs. The final call to phy_disconnect() ensures that the PHY is stopped and suspended, too. Fixes: c96e731c93ff ("net: bcmgenet: connect and disconnect from the PHY state machine") Signed-off-by: Florian Fainelli <f.fainelli(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dapeng Yu <dapeng.yu(a)windriver.com> --- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c index 6ee6c34f28f2..52c93701a9e4 100644 --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c @@ -3408,7 +3408,6 @@ static void bcmgenet_netif_stop(struct net_device *dev) /* Disable MAC transmit. TX DMA disabled must be done before this */ umac_enable_set(priv, CMD_TX_EN, false); - phy_stop(dev->phydev); bcmgenet_disable_rx_napi(priv); bcmgenet_intr_disable(priv); -- 2.43.0

1 5

[PATCH OLK-6.6] arm64: errata: add option to disable cache readunique prefetch on HIP08
by Yang Yingliang 04 Dec '23

04 Dec '23

From: Kai Shen <shenkai8(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I3ZFV2 CVE: NA ----------------------------------------------------------- Random performance decreases appear on cases of Hackbench which test pipe or socket communication among multi-threads on Hisi HIP08 SoC. Cache sharing which caused by the change of the data layout and the cache readunique prefetch mechanism both lead to this problem. Readunique mechanism which may caused by store operation will invalid cachelines on other cores during data fetching stage which can cause cacheline invalidation happens frequently in a sharing data access situation. Disable cache readunique prefetch can trackle this problem. Test cases are like: for i in 20;do echo "--------pipe thread num=$i----------" for j in $(seq 1 10);do ./hackbench -pipe $i thread 1000 done done We disable readunique prefetch only in el2 for in el1 disabling readunique prefetch may cause panic due to lack of related priority which often be set in BIOS. Introduce CONFIG_HISILICON_ERRATUM_HIP08_RU_PREFETCH and disable RU prefetch using boot cmdline 'readunique_prefetch=off'. Signed-off-by: Kai Shen <shenkai8(a)huawei.com> Signed-off-by: Hanjun Guo <guohanjun(a)huawei.com> [XQ: adjusted context] Signed-off-by: Xie XiuQi <xiexiuqi(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Cheng Jian <cj.chengjian(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/arm64/Kconfig | 18 +++++++++++ arch/arm64/kernel/cpu_errata.c | 56 ++++++++++++++++++++++++++++++++++ arch/arm64/tools/cpucaps | 1 + 3 files changed, 75 insertions(+) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 78f20e632712..bbe85ca456c9 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -1229,6 +1229,24 @@ config SOCIONEXT_SYNQUACER_PREITS If unsure, say Y. +config HISILICON_ERRATUM_HIP08_RU_PREFETCH + bool "HIP08 RU: HiSilicon HIP08 cache readunique might cause performance drop" + default y + help + The HiSilicon HIP08 cache readunique might compromise performance, + use cmdline "readunique_prefetch_disable" to disable RU prefetch. + + If unsure, say Y. + +config HISILICON_HIP08_RU_PREFETCH_DEFAULT_OFF + bool "HIP08 RU: disable HiSilicon HIP08 cache readunique by default" + depends on HISILICON_ERRATUM_HIP08_RU_PREFETCH + default n + help + Disable HiSilicon HIP08 cache readunique by default. + + If unsure, say N. + endmenu # "ARM errata workarounds via the alternatives framework" choice diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c index 5706e74c5578..6a2ae67e85f7 100644 --- a/arch/arm64/kernel/cpu_errata.c +++ b/arch/arm64/kernel/cpu_errata.c @@ -13,6 +13,11 @@ #include <asm/cpufeature.h> #include <asm/kvm_asm.h> #include <asm/smp_plat.h> +#ifdef CONFIG_HISILICON_ERRATUM_HIP08_RU_PREFETCH +#include <asm/ptrace.h> +#include <asm/sysreg.h> +#include <linux/smp.h> +#endif static bool __maybe_unused is_affected_midr_range(const struct arm64_cpu_capabilities *entry, int scope) @@ -121,6 +126,48 @@ cpu_enable_cache_maint_trap(const struct arm64_cpu_capabilities *__unused) sysreg_clear_set(sctlr_el1, SCTLR_EL1_UCI, 0); } +#ifdef CONFIG_HISILICON_ERRATUM_HIP08_RU_PREFETCH +# ifdef CONFIG_HISILICON_HIP08_RU_PREFETCH_DEFAULT_OFF +static bool readunique_prefetch_enabled; +# else +static bool readunique_prefetch_enabled = true; +# endif +static int __init readunique_prefetch_switch(char *data) +{ + if (!data) + return -EINVAL; + + if (strcmp(data, "off") == 0) + readunique_prefetch_enabled = false; + else if (strcmp(data, "on") == 0) + readunique_prefetch_enabled = true; + else + return -EINVAL; + + return 0; +} +early_param("readunique_prefetch", readunique_prefetch_switch); + +static bool +should_disable_hisi_hip08_ru_prefetch(const struct arm64_cpu_capabilities *entry, int unused) +{ + u64 el; + + if (readunique_prefetch_enabled) + return false; + + el = read_sysreg(CurrentEL); + return el == CurrentEL_EL2; +} + +#define CTLR_HISI_HIP08_RU_PREFETCH (1L << 40) +static void __maybe_unused +hisi_hip08_ru_prefetch_disable(const struct arm64_cpu_capabilities *__unused) +{ + sysreg_clear_set(S3_1_c15_c6_4, 0, CTLR_HISI_HIP08_RU_PREFETCH); +} +#endif + static DEFINE_RAW_SPINLOCK(reg_user_mask_modification); static void __maybe_unused cpu_clear_bf16_from_user_emulation(const struct arm64_cpu_capabilities *__unused) @@ -744,6 +791,15 @@ const struct arm64_cpu_capabilities arm64_errata[] = { .capability = ARM64_WORKAROUND_AMPERE_AC03_CPU_38, ERRATA_MIDR_ALL_VERSIONS(MIDR_AMPERE1), }, +#endif +#ifdef CONFIG_HISILICON_ERRATUM_HIP08_RU_PREFETCH + { + .desc = "HiSilicon HIP08 Cache Readunique Prefetch Disable", + .capability = ARM64_WORKAROUND_HISI_HIP08_RU_PREFETCH, + ERRATA_MIDR_ALL_VERSIONS(MIDR_HISI_TSV110), + .matches = should_disable_hisi_hip08_ru_prefetch, + .cpu_enable = hisi_hip08_ru_prefetch_disable, + }, #endif { } diff --git a/arch/arm64/tools/cpucaps b/arch/arm64/tools/cpucaps index dea3dc89234b..bbb97036074b 100644 --- a/arch/arm64/tools/cpucaps +++ b/arch/arm64/tools/cpucaps @@ -100,3 +100,4 @@ WORKAROUND_NVIDIA_CARMEL_CNP WORKAROUND_QCOM_FALKOR_E1003 WORKAROUND_REPEAT_TLBI WORKAROUND_SPECULATIVE_AT +WORKAROUND_HISI_HIP08_RU_PREFETCH -- 2.25.1

2 1

[PATCH OLK-5.10 0/3] scsi: scsi_device_gets returns failure
by Li Lingfeng 04 Dec '23

04 Dec '23

If scsi is compiled as a module, scsi_device_gets returns failure when the module is NULL. Li Lingfeng (2): scsi: don't fail if hostt->module is NULL scsi: fix kabi broken in struct Scsi_Host Zhong Jinghua (1): scsi: scsi_device_gets returns failure when the module is NULL. drivers/scsi/hosts.c | 3 +++ drivers/scsi/scsi.c | 6 +++++- include/scsi/scsi_host.h | 2 +- 3 files changed, 9 insertions(+), 2 deletions(-) -- 2.31.1

2 4

openEuler Kernel SIG双周例会
by openEuler conference 04 Dec '23

04 Dec '23

您好！ Kernel SIG 邀请您参加 2023-12-08 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中（新增议题可回复邮件申报，也可直接填至会议看板）会议链接：https://bmeeting.huaweicloud.com:36443/#/j/981980862 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the WeLink conference(auto recording) will be held at 2023-12-08 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 议题征集中（新增议题可回复邮件申报，也可直接填至会议看板） You can join the meeting at https://bmeeting.huaweicloud.com:36443/#/j/981980862. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[openEuler-1.0-LTS] net: prevent rewrite of msg_name in sock_sendmsg()
by Lu Wei 04 Dec '23

04 Dec '23

From: Jordan Rife <jrife(a)google.com> stable inclusion from stable-v4.19.297 commit 3d62f2577c7414e5b94e4baad6eb621165960f30 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8EZY4 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 86a7e0b69bd5b812e48a20c66c2161744f3caa16 ] Callers of sock_sendmsg(), and similarly kernel_sendmsg(), in kernel space may observe their value of msg_name change in cases where BPF sendmsg hooks rewrite the send address. This has been confirmed to break NFS mounts running in UDP mode and has the potential to break other systems. This patch: 1) Creates a new function called __sock_sendmsg() with same logic as the old sock_sendmsg() function. 2) Replaces calls to sock_sendmsg() made by __sys_sendto() and __sys_sendmsg() with __sock_sendmsg() to avoid an unnecessary copy, as these system calls are already protected. 3) Modifies sock_sendmsg() so that it makes a copy of msg_name if present before passing it down the stack to insulate callers from changes to the send address. Link: https://lore.kernel.org/netdev/20230912013332.2048422-1-jrife@google.com/ Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg") Cc: stable(a)vger.kernel.org Reviewed-by: Willem de Bruijn <willemb(a)google.com> Signed-off-by: Jordan Rife <jrife(a)google.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> conflict: net/socket.c Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/socket.c | 29 +++++++++++++++++++++++------ 1 file changed, 23 insertions(+), 6 deletions(-) diff --git a/net/socket.c b/net/socket.c index 3d3632fe4a34..0cc52ba0b0e2 100644 --- a/net/socket.c +++ b/net/socket.c @@ -637,6 +637,14 @@ void __sock_tx_timestamp(__u16 tsflags, __u8 *tx_flags) } EXPORT_SYMBOL(__sock_tx_timestamp); +static int __sock_sendmsg(struct socket *sock, struct msghdr *msg) +{ + int err = security_socket_sendmsg(sock, msg, + msg_data_left(msg)); + + return err ?: sock_sendmsg_nosec(sock, msg); +} + /** * sock_sendmsg - send a message through @sock * @sock: socket @@ -655,10 +663,19 @@ static inline int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg) int sock_sendmsg(struct socket *sock, struct msghdr *msg) { - int err = security_socket_sendmsg(sock, msg, - msg_data_left(msg)); + struct sockaddr_storage *save_addr = (struct sockaddr_storage *)msg->msg_name; + struct sockaddr_storage address; + int ret; - return err ?: sock_sendmsg_nosec(sock, msg); + if (msg->msg_name) { + memcpy(&address, msg->msg_name, msg->msg_namelen); + msg->msg_name = &address; + } + + ret = __sock_sendmsg(sock, msg); + msg->msg_name = save_addr; + + return ret; } EXPORT_SYMBOL(sock_sendmsg); @@ -963,7 +980,7 @@ static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from) if (sock->type == SOCK_SEQPACKET) msg.msg_flags |= MSG_EOR; - res = sock_sendmsg(sock, &msg); + res = __sock_sendmsg(sock, &msg); *from = msg.msg_iter; return res; } @@ -1940,7 +1957,7 @@ int __sys_sendto(int fd, void __user *buff, size_t len, unsigned int flags, if (sock->file->f_flags & O_NONBLOCK) flags |= MSG_DONTWAIT; msg.msg_flags = flags; - err = sock_sendmsg(sock, &msg); + err = __sock_sendmsg(sock, &msg); out_put: fput_light(sock->file, fput_needed); @@ -2272,7 +2289,7 @@ static int ____sys_sendmsg(struct socket *sock, struct msghdr *msg_sys, err = sock_sendmsg_nosec(sock, msg_sys); goto out_freectl; } - err = sock_sendmsg(sock, msg_sys); + err = __sock_sendmsg(sock, msg_sys); /* * If this is sendmmsg() and sending to current destination address was * successful, remember it. -- 2.34.1

1 0

[PATCH OLK-5.10 0/3] scsi: scsi_device_gets returns failure
by Li Lingfeng 04 Dec '23

04 Dec '23

If scsi is compiled as a module, scsi_device_gets returns failure when the module is NULL. Li Lingfeng (2): scsi: don't fail if hostt->module is NULL scsi: fix kabi broken in struct Scsi_Host Zhong Jinghua (1): scsi: scsi_device_gets returns failure when the module is NULL. drivers/scsi/hosts.c | 3 +++ drivers/scsi/scsi.c | 6 +++++- include/scsi/scsi_host.h | 2 +- 3 files changed, 9 insertions(+), 2 deletions(-) -- 2.31.1

2 5

[PATCH OLK-6.6 0/5] xfs: fix some misc issue
by Long Li 04 Dec '23

04 Dec '23

Long Li (5): xfs: fix a UAF when inode item push xfs: fix a UAF in xfs_iflush_abort_clean xfs: fix dir3 block read verify fail during log recover xfs: don't verify agf length when log recovery xfs: xfs_trans_cancel() path must check for log shutdown fs/xfs/libxfs/xfs_alloc.c | 3 ++- fs/xfs/xfs_buf.c | 5 +++++ fs/xfs/xfs_buf_item_recover.c | 9 +++------ fs/xfs/xfs_inode_item.c | 8 +++++++- fs/xfs/xfs_trans.c | 2 +- 5 files changed, 18 insertions(+), 9 deletions(-) -- 2.31.1

1 5

[PATCH OLK-6.6 v2 0/3] Introduce NEON implementation of CRCT10DIF algorithm
by GUO Zihua 04 Dec '23

04 Dec '23

This patchset introduces ARM64 NEON implementation of CRC T10 DIF algorithm. This algorithm could be enabled by enabling CONFIG_CRYPTO_CRCT10DIF_ARM64_NEON, and the compiled KO is named crct10dif-neon.ko GUO Zihua (2): arm64/crypto: Introduce individual config for CRCT10DIF-NEON algorithm crypto: crct10dif-neon - fix use via crypto_shash_digest() YueHaibing (1): arm64/crypto: Accelerated CRC T10 DIF computation arch/arm64/crypto/Kconfig | 10 + arch/arm64/crypto/Makefile | 4 + arch/arm64/crypto/crct10dif-neon-asm_64.S | 752 ++++++++++++++++++++++ arch/arm64/crypto/crct10dif-neon_glue.c | 114 ++++ 4 files changed, 880 insertions(+) create mode 100644 arch/arm64/crypto/crct10dif-neon-asm_64.S create mode 100644 arch/arm64/crypto/crct10dif-neon_glue.c -- 2.34.1

2 4

[PATCH OLK-6.6] arm64: errata: add option to disable cache readunique prefetch on HIP08
by Yang Yingliang 04 Dec '23

04 Dec '23

From: Kai Shen <shenkai8(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I3ZFV2 CVE: NA ----------------------------------------------------------- Random performance decreases appear on cases of Hackbench which test pipe or socket communication among multi-threads on Hisi HIP08 SoC. Cache sharing which caused by the change of the data layout and the cache readunique prefetch mechanism both lead to this problem. Readunique mechanism which may caused by store operation will invalid cachelines on other cores during data fetching stage which can cause cacheline invalidation happens frequently in a sharing data access situation. Disable cache readunique prefetch can trackle this problem. Test cases are like: for i in 20;do echo "--------pipe thread num=$i----------" for j in $(seq 1 10);do ./hackbench -pipe $i thread 1000 done done We disable readunique prefetch only in el2 for in el1 disabling readunique prefetch may cause panic due to lack of related priority which often be set in BIOS. Introduce CONFIG_HISILICON_ERRATUM_HIP08_RU_PREFETCH and disable RU prefetch using boot cmdline 'readunique_prefetch=off'. Signed-off-by: Kai Shen <shenkai8(a)huawei.com> Signed-off-by: Hanjun Guo <guohanjun(a)huawei.com> [XQ: adjusted context] Signed-off-by: Xie XiuQi <xiexiuqi(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Cheng Jian <cj.chengjian(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/arm64/Kconfig | 18 +++++++++++ arch/arm64/kernel/cpu_errata.c | 56 ++++++++++++++++++++++++++++++++++ arch/arm64/tools/cpucaps | 1 + 3 files changed, 75 insertions(+) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 78f20e632712..bbe85ca456c9 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -1229,6 +1229,24 @@ config SOCIONEXT_SYNQUACER_PREITS If unsure, say Y. +config HISILICON_ERRATUM_HIP08_RU_PREFETCH + bool "HIP08 RU: HiSilicon HIP08 cache readunique might cause performance drop" + default y + help + The HiSilicon HIP08 cache readunique might compromise performance, + use cmdline "readunique_prefetch_disable" to disable RU prefetch. + + If unsure, say Y. + +config HISILICON_HIP08_RU_PREFETCH_DEFAULT_OFF + bool "HIP08 RU: disable HiSilicon HIP08 cache readunique by default" + depends on HISILICON_ERRATUM_HIP08_RU_PREFETCH + default n + help + Disable HiSilicon HIP08 cache readunique by default. + + If unsure, say N. + endmenu # "ARM errata workarounds via the alternatives framework" choice diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c index 5706e74c5578..6a2ae67e85f7 100644 --- a/arch/arm64/kernel/cpu_errata.c +++ b/arch/arm64/kernel/cpu_errata.c @@ -13,6 +13,11 @@ #include <asm/cpufeature.h> #include <asm/kvm_asm.h> #include <asm/smp_plat.h> +#ifdef CONFIG_HISILICON_ERRATUM_HIP08_RU_PREFETCH +#include <asm/ptrace.h> +#include <asm/sysreg.h> +#include <linux/smp.h> +#endif static bool __maybe_unused is_affected_midr_range(const struct arm64_cpu_capabilities *entry, int scope) @@ -121,6 +126,48 @@ cpu_enable_cache_maint_trap(const struct arm64_cpu_capabilities *__unused) sysreg_clear_set(sctlr_el1, SCTLR_EL1_UCI, 0); } +#ifdef CONFIG_HISILICON_ERRATUM_HIP08_RU_PREFETCH +# ifdef CONFIG_HISILICON_HIP08_RU_PREFETCH_DEFAULT_OFF +static bool readunique_prefetch_enabled; +# else +static bool readunique_prefetch_enabled = true; +# endif +static int __init readunique_prefetch_switch(char *data) +{ + if (!data) + return -EINVAL; + + if (strcmp(data, "off") == 0) + readunique_prefetch_enabled = false; + else if (strcmp(data, "on") == 0) + readunique_prefetch_enabled = true; + else + return -EINVAL; + + return 0; +} +early_param("readunique_prefetch", readunique_prefetch_switch); + +static bool +should_disable_hisi_hip08_ru_prefetch(const struct arm64_cpu_capabilities *entry, int unused) +{ + u64 el; + + if (readunique_prefetch_enabled) + return false; + + el = read_sysreg(CurrentEL); + return el == CurrentEL_EL2; +} + +#define CTLR_HISI_HIP08_RU_PREFETCH (1L << 40) +static void __maybe_unused +hisi_hip08_ru_prefetch_disable(const struct arm64_cpu_capabilities *__unused) +{ + sysreg_clear_set(S3_1_c15_c6_4, 0, CTLR_HISI_HIP08_RU_PREFETCH); +} +#endif + static DEFINE_RAW_SPINLOCK(reg_user_mask_modification); static void __maybe_unused cpu_clear_bf16_from_user_emulation(const struct arm64_cpu_capabilities *__unused) @@ -744,6 +791,15 @@ const struct arm64_cpu_capabilities arm64_errata[] = { .capability = ARM64_WORKAROUND_AMPERE_AC03_CPU_38, ERRATA_MIDR_ALL_VERSIONS(MIDR_AMPERE1), }, +#endif +#ifdef CONFIG_HISILICON_ERRATUM_HIP08_RU_PREFETCH + { + .desc = "HiSilicon HIP08 Cache Readunique Prefetch Disable", + .capability = ARM64_WORKAROUND_HISI_HIP08_RU_PREFETCH, + ERRATA_MIDR_ALL_VERSIONS(MIDR_HISI_TSV110), + .matches = should_disable_hisi_hip08_ru_prefetch, + .cpu_enable = hisi_hip08_ru_prefetch_disable, + }, #endif { } diff --git a/arch/arm64/tools/cpucaps b/arch/arm64/tools/cpucaps index dea3dc89234b..bbb97036074b 100644 --- a/arch/arm64/tools/cpucaps +++ b/arch/arm64/tools/cpucaps @@ -100,3 +100,4 @@ WORKAROUND_NVIDIA_CARMEL_CNP WORKAROUND_QCOM_FALKOR_E1003 WORKAROUND_REPEAT_TLBI WORKAROUND_SPECULATIVE_AT +WORKAROUND_HISI_HIP08_RU_PREFETCH -- 2.25.1

1 0

[PATCH OLK-6.6 v2 0/4] add redis sockmap sample code
by Zhengchao Shao 04 Dec '23

04 Dec '23

add redis sockmap sample code. Liu Jian (4): cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted net: let sockops can use bpf_get_current_comm() net: add local_skb parameter to identify local tcp connection tools: add sample sockmap code for redis include/linux/cgroup.h | 1 + include/linux/filter.h | 3 + include/linux/skbuff.h | 5 + include/uapi/linux/bpf.h | 1 + kernel/bpf/cgroup.c | 8 +- kernel/cgroup/cgroup.c | 26 +++ net/Kconfig | 5 + net/core/filter.c | 13 ++ net/ipv4/tcp_input.c | 6 +- net/ipv4/tcp_output.c | 9 + tools/include/uapi/linux/bpf.h | 1 + tools/netacc/Makefile | 24 +++ tools/netacc/bpf_sockmap.h | 167 +++++++++++++++++++ tools/netacc/net-acc | 35 ++++ tools/netacc/netacc.c | 296 +++++++++++++++++++++++++++++++++ tools/netacc/netaccsockmap.c | 176 ++++++++++++++++++++ 16 files changed, 771 insertions(+), 5 deletions(-) create mode 100644 tools/netacc/Makefile create mode 100644 tools/netacc/bpf_sockmap.h create mode 100755 tools/netacc/net-acc create mode 100644 tools/netacc/netacc.c create mode 100644 tools/netacc/netaccsockmap.c -- 2.34.1

2 5