- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/3] memcg: support OOM priority for memcg
by Jinjiang Tu 28 Dec '23

28 Dec '23

Support memcg oom priority. Changelog: * rename CONFIG_MEMCG_QOS to CONFIG_MEMCG_OOM_PRIORITY * move CONFIG_MEMCG_OOM_PRIORITY to init/Kconfig * set CONFIG_MEMCG_OOM_PRIORITY default from y to n, and enable it in openeuler_defconfig * add rcu_read_lock() protection for mem_cgroup_from_task() * Instead of static key, use variable to check if the feature is enabled * use READ_ONCE/WRITE_ONCE protection when read/write oom_prio * cleanup Jing Xiangfeng (3): memcg: support priority for oom memcg: Add sysctl memcg_qos_enable memcg: enable CONFIG_MEMCG_OOM_PRIORITY by default arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/linux/memcontrol.h | 25 +++ init/Kconfig | 14 ++ mm/memcontrol.c | 222 +++++++++++++++++++++++++ mm/oom_kill.c | 61 ++++++- 6 files changed, 319 insertions(+), 5 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10] jbd2: fix soft lockup in journal_finish_inode_data_buffers()
by Zizhi Wo 28 Dec '23

28 Dec '23

From: Ye Bin <yebin10(a)huawei.com> mainline inclusion from mainline-v6.7-rc6 commit 6c02757c936063f0631b4e43fe156f8c8f1f351f category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8RRXU?from=project-issue CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There's issue when do io test: WARN: soft lockup - CPU#45 stuck for 11s! [jbd2/dm-2-8:4170] CPU: 45 PID: 4170 Comm: jbd2/dm-2-8 Kdump: loaded Tainted: G OE Call trace: dump_backtrace+0x0/0x1a0 show_stack+0x24/0x30 dump_stack+0xb0/0x100 watchdog_timer_fn+0x254/0x3f8 __hrtimer_run_queues+0x11c/0x380 hrtimer_interrupt+0xfc/0x2f8 arch_timer_handler_phys+0x38/0x58 handle_percpu_devid_irq+0x90/0x248 generic_handle_irq+0x3c/0x58 __handle_domain_irq+0x68/0xc0 gic_handle_irq+0x90/0x320 el1_irq+0xcc/0x180 queued_spin_lock_slowpath+0x1d8/0x320 jbd2_journal_commit_transaction+0x10f4/0x1c78 [jbd2] kjournald2+0xec/0x2f0 [jbd2] kthread+0x134/0x138 ret_from_fork+0x10/0x18 Analyzed informations from vmcore as follows: (1) There are about 5k+ jbd2_inode in 'commit_transaction->t_inode_list'; (2) Now is processing the 855th jbd2_inode; (3) JBD2 task has TIF_NEED_RESCHED flag; (4) There's no pags in address_space around the 855th jbd2_inode; (5) There are some process is doing drop caches; (6) Mounted with 'nodioread_nolock' option; (7) 128 CPUs; According to informations from vmcore we know 'journal->j_list_lock' spin lock competition is fierce. So journal_finish_inode_data_buffers() maybe process slowly. Theoretically, there is scheduling point in the filemap_fdatawait_range_keep_errors(). However, if inode's address_space has no pages which taged with PAGECACHE_TAG_WRITEBACK, will not call cond_resched(). So may lead to soft lockup. journal_finish_inode_data_buffers filemap_fdatawait_range_keep_errors __filemap_fdatawait_range while (index <= end) nr_pages = pagevec_lookup_range_tag(&pvec, mapping, &index, end, PAGECACHE_TAG_WRITEBACK); if (!nr_pages) break; --> If 'nr_pages' is equal zero will break, then will not call cond_resched() for (i = 0; i < nr_pages; i++) wait_on_page_writeback(page); cond_resched(); To solve above issue, add scheduling point in the journal_finish_inode_data_buffers(); Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20231211112544.3879780-1-yebin10@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/jbd2/commit.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c index f082836e6d40..e782f1d42dd7 100644 --- a/fs/jbd2/commit.c +++ b/fs/jbd2/commit.c @@ -300,6 +300,7 @@ static int journal_finish_inode_data_buffers(journal_t *journal, if (!ret) ret = err; } + cond_resched(); spin_lock(&journal->j_list_lock); jinode->i_flags &= ~JI_COMMIT_RUNNING; smp_mb(); -- 2.39.2

2 1

[PATCH OLK-6.6 0/8] Introduce qos smt expeller for co-location
by Xia Fukun 27 Dec '23

27 Dec '23

We introduce the qos smt expeller, which lets online tasks to expel offline tasks on the smt sibling cpus, and exclusively occupy CPU resources.In this way we are able to improve QOS of online tasks in co-location. Guan Jing (8): sched: Introduce qos smt expeller for co-location sched: Implement the function of qos smt expeller sched: Add statistics for qos smt expeller sched: Add tracepoint for qos smt expeller config: Enable CONFIG_QOS_SCHED_SMT_EXPELLER sched/fair: Start tracking qos_offline tasks count in cfs_rq sched/fair: Introduce QOS_SMT_EXPELL priority reversion mechanism sched/fair: Add cmdline nosmtexpell arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/linux/sched.h | 13 + include/trace/events/sched.h | 55 ++++ init/Kconfig | 9 + kernel/sched/debug.c | 5 + kernel/sched/fair.c | 345 +++++++++++++++++++++++-- kernel/sched/sched.h | 27 ++ 8 files changed, 440 insertions(+), 16 deletions(-) -- 2.34.1

2 9

[PATCH OLK-6.6 0/1] iommu: Enable smmu-v3 when 3408iMR/3416iMRraid card exist
by zhangnaichuan 27 Dec '23

27 Dec '23

arm64 cannot support virtualization pass-through feature when using the 3408iMR/3416iMR raid card. For solving the problem, we add two fuctions: 1.we prepare init bypass level2 entry for specific devices when smmu uses 2 level streamid entry. 2.we add smmu.bypassdev cmdline to allow SMMU bypass streams for some specific devices. usage: 3408iMRraid: smmu.bypassdev=0x1000:0x17 3416iMRraid: smmu.bypassdev=0x1000:0x15 drivers/iommu/Kconfig | 9 ++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 120 +++++++++++++++++++- 2 files changed, 128 insertions(+), 1 deletion(-) -- 2.33.0

2 2

[PATCH OLK-6.6 0/1] Support priority load balance for qos scheduler
by Song Zhang 27 Dec '23

27 Dec '23

Song Zhang (1): sched: Introduce priority load balance for qos scheduler arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + init/Kconfig | 9 +++ kernel/sched/core.c | 3 + kernel/sched/fair.c | 83 +++++++++++++++++++++++++- kernel/sched/sched.h | 3 + 6 files changed, 99 insertions(+), 1 deletion(-) -- 2.33.0

2 2

[PATCH OLK-6.6 0/1] Support priority load balance for qos scheduler
by Song Zhang 27 Dec '23

27 Dec '23

Song Zhang (1): sched: Introduce priority load balance for qos scheduler arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + init/Kconfig | 9 +++ kernel/sched/core.c | 3 + kernel/sched/fair.c | 83 +++++++++++++++++++++++++- kernel/sched/sched.h | 3 + 6 files changed, 99 insertions(+), 1 deletion(-) -- 2.33.0

2 2

[PATCH OLK-6.6 0/1] drm: fix free illegal pointer when create drm_property_blob failed
by zhangnaichuan 27 Dec '23

27 Dec '23

we get (Unable to handle kernel NULL pointer dereference at virtual address 000000000000000c) when call drm_property_blob_put(). After analysis, we get the following process: alloc failed: drm_atomic_set_mode_for_crtc() drm_property_create_blob() // failed state->mode_blob = ERR_PTR(-ENOMEM) free illegal pointer: __drm_atomic_helper_crtc_destroy_state() drm_property_blob_put(state->mode_blob) drm_mode_object_put(&blob->base); // here blob is ERR_PTR(-ENOMEM) So do we have to determine if blob is an error code before calling drm_mode_object_put(). Fixes: 6bcacf51d050 (drm: Add reference counting to blob properties) drivers/gpu/drm/drm_property.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.33.0

2 2

[PATCH OLK-6.6 V1 00/12] sched: basic infrastructure for scheduler bpf
by Guan Jing 27 Dec '23

27 Dec '23

sched: basic infrastructure for scheduler bpf Guan Jing (12): sched: programmable: Introduce bpf sched sched: programmable: Add a tag for the task sched: programmable: Add a tag for the task group sched: programmable: Add user interface of task group tag sched: programmable: Add user interface of task tag sched: basic infrastructure for scheduler bpf sched: introduce bpf_sched_enable() libbpf: add support for scheduler bpf programs bpftool: recognize scheduler programs sched: Add helper functions to get cpu statistics sched: programmable: Add hook in select_task_rq_fair() sched: programmable: Add hook in can_migrate_task() fs/proc/base.c | 64 +++++++++++++++++ include/linux/bpf_sched.h | 50 ++++++++++++++ include/linux/bpf_types.h | 4 ++ include/linux/sched.h | 38 ++++++++++ include/linux/sched_hook_defs.h | 3 + include/uapi/linux/bpf.h | 9 +++ init/init_task.c | 3 + kernel/bpf/Kconfig | 10 +++ kernel/bpf/btf.c | 1 + kernel/bpf/syscall.c | 27 ++++++++ kernel/bpf/trampoline.c | 1 + kernel/bpf/verifier.c | 11 ++- kernel/sched/bpf_sched.c | 102 +++++++++++++++++++++++++++ kernel/sched/build_utility.c | 4 ++ kernel/sched/core.c | 118 ++++++++++++++++++++++++++++++++ kernel/sched/fair.c | 46 +++++++++++++ kernel/sched/sched.h | 10 +++ scripts/bpf_doc.py | 4 ++ tools/include/uapi/linux/bpf.h | 9 +++ tools/lib/bpf/bpf.c | 1 + tools/lib/bpf/libbpf.c | 23 ++++++- tools/lib/bpf/libbpf.h | 2 + tools/lib/bpf/libbpf.map | 1 + 23 files changed, 539 insertions(+), 2 deletions(-) create mode 100644 include/linux/bpf_sched.h create mode 100644 include/linux/sched_hook_defs.h create mode 100644 kernel/sched/bpf_sched.c -- 2.34.1

2 13

[PATCH v2 OLK-6.6 0/1] x86/kdump: make crash kernel boot faster
by zhangnaichuan 27 Dec '23

27 Dec '23

description: If other cpus offline before handle the crash NMI, the waiting_for_crash_ipi can not be decreased to 0, and current cpu will wait 1 second. So break if all other cpus offline. arch/x86/kernel/reboot.c | 8 ++++++++ 1 file changed, 8 insertions(+) -- 2.33.0

2 2

[PATCH OLK-6.6 0/1] arm64: Add non nmi ipi backtrace support
by Liao Chen 27 Dec '23

27 Dec '23

From: linruizhe <linruizhe(a)huawei.com> Dependencies: CONFIG_DETECT_HUNG_TASK=y CONFIG_WATCHDOG=y Li Zhengyu (1): arm64: Add non nmi ipi backtrace support arch/arm64/kernel/ipi_nmi.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) -- 2.25.1

2 2

[PATCH OLK-6.6 0/1] x86/kdump: add log before booting crash kernel
by zhangnaichuan 27 Dec '23

27 Dec '23

description: Just like arm64, print "Bye!" before booting crash kernel. arch/x86/kernel/machine_kexec_64.c | 2 ++ 1 file changed, 2 insertions(+) -- 2.33.0

2 2

[PATCH OLK-6.6 0/1]
by zhangnaichuan 27 Dec '23

27 Dec '23

description: Just like arm64, print "Bye!" before booting crash kernel. arch/x86/kernel/machine_kexec_64.c | 2 ++ 1 file changed, 2 insertions(+) -- 2.33.0

2 6

[PATCH openEuler-1.0-LTS] jbd2: fix soft lockup in journal_finish_inode_data_buffers()
by Zizhi Wo 27 Dec '23

27 Dec '23

From: Ye Bin <yebin10(a)huawei.com> mainline inclusion from mainline-v6.7-rc6 commit 6c02757c936063f0631b4e43fe156f8c8f1f351f category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8RRXU?from=project-issue CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There's issue when do io test: WARN: soft lockup - CPU#45 stuck for 11s! [jbd2/dm-2-8:4170] CPU: 45 PID: 4170 Comm: jbd2/dm-2-8 Kdump: loaded Tainted: G OE Call trace: dump_backtrace+0x0/0x1a0 show_stack+0x24/0x30 dump_stack+0xb0/0x100 watchdog_timer_fn+0x254/0x3f8 __hrtimer_run_queues+0x11c/0x380 hrtimer_interrupt+0xfc/0x2f8 arch_timer_handler_phys+0x38/0x58 handle_percpu_devid_irq+0x90/0x248 generic_handle_irq+0x3c/0x58 __handle_domain_irq+0x68/0xc0 gic_handle_irq+0x90/0x320 el1_irq+0xcc/0x180 queued_spin_lock_slowpath+0x1d8/0x320 jbd2_journal_commit_transaction+0x10f4/0x1c78 [jbd2] kjournald2+0xec/0x2f0 [jbd2] kthread+0x134/0x138 ret_from_fork+0x10/0x18 Analyzed informations from vmcore as follows: (1) There are about 5k+ jbd2_inode in 'commit_transaction->t_inode_list'; (2) Now is processing the 855th jbd2_inode; (3) JBD2 task has TIF_NEED_RESCHED flag; (4) There's no pags in address_space around the 855th jbd2_inode; (5) There are some process is doing drop caches; (6) Mounted with 'nodioread_nolock' option; (7) 128 CPUs; According to informations from vmcore we know 'journal->j_list_lock' spin lock competition is fierce. So journal_finish_inode_data_buffers() maybe process slowly. Theoretically, there is scheduling point in the filemap_fdatawait_range_keep_errors(). However, if inode's address_space has no pages which taged with PAGECACHE_TAG_WRITEBACK, will not call cond_resched(). So may lead to soft lockup. journal_finish_inode_data_buffers filemap_fdatawait_range_keep_errors __filemap_fdatawait_range while (index <= end) nr_pages = pagevec_lookup_range_tag(&pvec, mapping, &index, end, PAGECACHE_TAG_WRITEBACK); if (!nr_pages) break; --> If 'nr_pages' is equal zero will break, then will not call cond_resched() for (i = 0; i < nr_pages; i++) wait_on_page_writeback(page); cond_resched(); To solve above issue, add scheduling point in the journal_finish_inode_data_buffers(); Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20231211112544.3879780-1-yebin10@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/jbd2/commit.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c index 8c13c0a030a4..99562835be45 100644 --- a/fs/jbd2/commit.c +++ b/fs/jbd2/commit.c @@ -274,6 +274,7 @@ static int journal_finish_inode_data_buffers(journal_t *journal, dirty_end); if (!ret) ret = err; + cond_resched(); spin_lock(&journal->j_list_lock); jinode->i_flags &= ~JI_COMMIT_RUNNING; smp_mb(); -- 2.39.2

2 1

[PATCH OLK-6.6 0/1]
by zhangnaichuan 27 Dec '23

27 Dec '23

Just like arm64, print "Bye!" before booting crash kernel. arch/x86/kernel/machine_kexec_64.c | 2 ++ 1 file changed, 2 insertions(+) -- 2.33.0

2 6

[PATCH openEuler-22.03-LTS-SP2] ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
by Guo Mengqi 27 Dec '23

27 Dec '23

From: Zhengchao Shao <shaozhengchao(a)huawei.com> mainline inclusion from mainline-v6.7-rc2 commit e2b706c691905fe78468c361aaabc719d0a496f1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8PT5 CVE: CVE-2023-6932 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When I perform the following test operations: 1.ip link add br0 type bridge 2.brctl addif br0 eth0 3.ip addr add 239.0.0.1/32 dev eth0 4.ip addr add 239.0.0.1/32 dev br0 5.ip addr add 224.0.0.1/32 dev br0 6.while ((1)) do ifconfig br0 up ifconfig br0 down done 7.send IGMPv2 query packets to port eth0 continuously. For example, ./mausezahn ethX -c 0 "01 00 5e 00 00 01 00 72 19 88 aa 02 08 00 45 00 00 1c 00 01 00 00 01 02 0e 7f c0 a8 0a b7 e0 00 00 01 11 64 ee 9b 00 00 00 00" The preceding tests may trigger the refcnt uaf issue of the mc list. The stack is as follows: refcount_t: addition on 0; use-after-free. WARNING: CPU: 21 PID: 144 at lib/refcount.c:25 refcount_warn_saturate (lib/refcount.c:25) CPU: 21 PID: 144 Comm: ksoftirqd/21 Kdump: loaded Not tainted 6.7.0-rc1-next-20231117-dirty #80 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 RIP: 0010:refcount_warn_saturate (lib/refcount.c:25) RSP: 0018:ffffb68f00657910 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff8a00c3bf96c0 RCX: ffff8a07b6160908 RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff8a07b6160900 RBP: ffff8a00cba36862 R08: 0000000000000000 R09: 00000000ffff7fff R10: ffffb68f006577c0 R11: ffffffffb0fdcdc8 R12: ffff8a00c3bf9680 R13: ffff8a00c3bf96f0 R14: 0000000000000000 R15: ffff8a00d8766e00 FS: 0000000000000000(0000) GS:ffff8a07b6140000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f10b520b28 CR3: 000000039741a000 CR4: 00000000000006f0 Call Trace: <TASK> igmp_heard_query (net/ipv4/igmp.c:1068) igmp_rcv (net/ipv4/igmp.c:1132) ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205) ip_local_deliver_finish (net/ipv4/ip_input.c:234) __netif_receive_skb_one_core (net/core/dev.c:5529) netif_receive_skb_internal (net/core/dev.c:5729) netif_receive_skb (net/core/dev.c:5788) br_handle_frame_finish (net/bridge/br_input.c:216) nf_hook_bridge_pre (net/bridge/br_input.c:294) __netif_receive_skb_core (net/core/dev.c:5423) __netif_receive_skb_list_core (net/core/dev.c:5606) __netif_receive_skb_list (net/core/dev.c:5674) netif_receive_skb_list_internal (net/core/dev.c:5764) napi_gro_receive (net/core/gro.c:609) e1000_clean_rx_irq (drivers/net/ethernet/intel/e1000/e1000_main.c:4467) e1000_clean (drivers/net/ethernet/intel/e1000/e1000_main.c:3805) __napi_poll (net/core/dev.c:6533) net_rx_action (net/core/dev.c:6735) __do_softirq (kernel/softirq.c:554) run_ksoftirqd (kernel/softirq.c:913) smpboot_thread_fn (kernel/smpboot.c:164) kthread (kernel/kthread.c:388) ret_from_fork (arch/x86/kernel/process.c:153) ret_from_fork_asm (arch/x86/entry/entry_64.S:250) </TASK> The root causes are as follows: Thread A Thread B ... netif_receive_skb br_dev_stop ... br_multicast_leave_snoopers ... __ip_mc_dec_group ... __igmp_group_dropped igmp_rcv igmp_stop_timer igmp_heard_query //ref = 1 ip_ma_put igmp_mod_timer refcount_dec_and_test igmp_start_timer //ref = 0 ... refcount_inc //ref increases from 0 When the device receives an IGMPv2 Query message, it starts the timer immediately, regardless of whether the device is running. If the device is down and has left the multicast group, it will cause the mc list refcount uaf issue. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Hangbin Liu <liuhangbin(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/ipv4/igmp.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- net/ipv4/igmp.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c index c71b863093ac..73c24ce011f0 100644 --- a/net/ipv4/igmp.c +++ b/net/ipv4/igmp.c @@ -216,8 +216,10 @@ static void igmp_start_timer(struct ip_mc_list *im, int max_delay) int tv = prandom_u32() % max_delay; im->tm_running = 1; - if (!mod_timer(&im->timer, jiffies+tv+2)) - refcount_inc(&im->refcnt); + if (refcount_inc_not_zero(&im->refcnt)) { + if (mod_timer(&im->timer, jiffies + tv + 2)) + ip_ma_put(im); + } } static void igmp_gq_start_timer(struct in_device *in_dev) -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
by Guo Mengqi 27 Dec '23

27 Dec '23

From: Zhengchao Shao <shaozhengchao(a)huawei.com> mainline inclusion from mainline-v6.7-rc2 commit e2b706c691905fe78468c361aaabc719d0a496f1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8PT5 CVE: CVE-2023-6932 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When I perform the following test operations: 1.ip link add br0 type bridge 2.brctl addif br0 eth0 3.ip addr add 239.0.0.1/32 dev eth0 4.ip addr add 239.0.0.1/32 dev br0 5.ip addr add 224.0.0.1/32 dev br0 6.while ((1)) do ifconfig br0 up ifconfig br0 down done 7.send IGMPv2 query packets to port eth0 continuously. For example, ./mausezahn ethX -c 0 "01 00 5e 00 00 01 00 72 19 88 aa 02 08 00 45 00 00 1c 00 01 00 00 01 02 0e 7f c0 a8 0a b7 e0 00 00 01 11 64 ee 9b 00 00 00 00" The preceding tests may trigger the refcnt uaf issue of the mc list. The stack is as follows: refcount_t: addition on 0; use-after-free. WARNING: CPU: 21 PID: 144 at lib/refcount.c:25 refcount_warn_saturate (lib/refcount.c:25) CPU: 21 PID: 144 Comm: ksoftirqd/21 Kdump: loaded Not tainted 6.7.0-rc1-next-20231117-dirty #80 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 RIP: 0010:refcount_warn_saturate (lib/refcount.c:25) RSP: 0018:ffffb68f00657910 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff8a00c3bf96c0 RCX: ffff8a07b6160908 RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff8a07b6160900 RBP: ffff8a00cba36862 R08: 0000000000000000 R09: 00000000ffff7fff R10: ffffb68f006577c0 R11: ffffffffb0fdcdc8 R12: ffff8a00c3bf9680 R13: ffff8a00c3bf96f0 R14: 0000000000000000 R15: ffff8a00d8766e00 FS: 0000000000000000(0000) GS:ffff8a07b6140000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f10b520b28 CR3: 000000039741a000 CR4: 00000000000006f0 Call Trace: <TASK> igmp_heard_query (net/ipv4/igmp.c:1068) igmp_rcv (net/ipv4/igmp.c:1132) ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205) ip_local_deliver_finish (net/ipv4/ip_input.c:234) __netif_receive_skb_one_core (net/core/dev.c:5529) netif_receive_skb_internal (net/core/dev.c:5729) netif_receive_skb (net/core/dev.c:5788) br_handle_frame_finish (net/bridge/br_input.c:216) nf_hook_bridge_pre (net/bridge/br_input.c:294) __netif_receive_skb_core (net/core/dev.c:5423) __netif_receive_skb_list_core (net/core/dev.c:5606) __netif_receive_skb_list (net/core/dev.c:5674) netif_receive_skb_list_internal (net/core/dev.c:5764) napi_gro_receive (net/core/gro.c:609) e1000_clean_rx_irq (drivers/net/ethernet/intel/e1000/e1000_main.c:4467) e1000_clean (drivers/net/ethernet/intel/e1000/e1000_main.c:3805) __napi_poll (net/core/dev.c:6533) net_rx_action (net/core/dev.c:6735) __do_softirq (kernel/softirq.c:554) run_ksoftirqd (kernel/softirq.c:913) smpboot_thread_fn (kernel/smpboot.c:164) kthread (kernel/kthread.c:388) ret_from_fork (arch/x86/kernel/process.c:153) ret_from_fork_asm (arch/x86/entry/entry_64.S:250) </TASK> The root causes are as follows: Thread A Thread B ... netif_receive_skb br_dev_stop ... br_multicast_leave_snoopers ... __ip_mc_dec_group ... __igmp_group_dropped igmp_rcv igmp_stop_timer igmp_heard_query //ref = 1 ip_ma_put igmp_mod_timer refcount_dec_and_test igmp_start_timer //ref = 0 ... refcount_inc //ref increases from 0 When the device receives an IGMPv2 Query message, it starts the timer immediately, regardless of whether the device is running. If the device is down and has left the multicast group, it will cause the mc list refcount uaf issue. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Hangbin Liu <liuhangbin(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/ipv4/igmp.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- net/ipv4/igmp.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c index c71b863093ac..73c24ce011f0 100644 --- a/net/ipv4/igmp.c +++ b/net/ipv4/igmp.c @@ -216,8 +216,10 @@ static void igmp_start_timer(struct ip_mc_list *im, int max_delay) int tv = prandom_u32() % max_delay; im->tm_running = 1; - if (!mod_timer(&im->timer, jiffies+tv+2)) - refcount_inc(&im->refcnt); + if (refcount_inc_not_zero(&im->refcnt)) { + if (mod_timer(&im->timer, jiffies + tv + 2)) + ip_ma_put(im); + } } static void igmp_gq_start_timer(struct in_device *in_dev) -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
by Guo Mengqi 27 Dec '23

27 Dec '23

From: Zhengchao Shao <shaozhengchao(a)huawei.com> mainline inclusion from mainline-v6.7-rc2 commit e2b706c691905fe78468c361aaabc719d0a496f1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8PT5 CVE: CVE-2023-6932 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When I perform the following test operations: 1.ip link add br0 type bridge 2.brctl addif br0 eth0 3.ip addr add 239.0.0.1/32 dev eth0 4.ip addr add 239.0.0.1/32 dev br0 5.ip addr add 224.0.0.1/32 dev br0 6.while ((1)) do ifconfig br0 up ifconfig br0 down done 7.send IGMPv2 query packets to port eth0 continuously. For example, ./mausezahn ethX -c 0 "01 00 5e 00 00 01 00 72 19 88 aa 02 08 00 45 00 00 1c 00 01 00 00 01 02 0e 7f c0 a8 0a b7 e0 00 00 01 11 64 ee 9b 00 00 00 00" The preceding tests may trigger the refcnt uaf issue of the mc list. The stack is as follows: refcount_t: addition on 0; use-after-free. WARNING: CPU: 21 PID: 144 at lib/refcount.c:25 refcount_warn_saturate (lib/refcount.c:25) CPU: 21 PID: 144 Comm: ksoftirqd/21 Kdump: loaded Not tainted 6.7.0-rc1-next-20231117-dirty #80 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 RIP: 0010:refcount_warn_saturate (lib/refcount.c:25) RSP: 0018:ffffb68f00657910 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff8a00c3bf96c0 RCX: ffff8a07b6160908 RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff8a07b6160900 RBP: ffff8a00cba36862 R08: 0000000000000000 R09: 00000000ffff7fff R10: ffffb68f006577c0 R11: ffffffffb0fdcdc8 R12: ffff8a00c3bf9680 R13: ffff8a00c3bf96f0 R14: 0000000000000000 R15: ffff8a00d8766e00 FS: 0000000000000000(0000) GS:ffff8a07b6140000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f10b520b28 CR3: 000000039741a000 CR4: 00000000000006f0 Call Trace: <TASK> igmp_heard_query (net/ipv4/igmp.c:1068) igmp_rcv (net/ipv4/igmp.c:1132) ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205) ip_local_deliver_finish (net/ipv4/ip_input.c:234) __netif_receive_skb_one_core (net/core/dev.c:5529) netif_receive_skb_internal (net/core/dev.c:5729) netif_receive_skb (net/core/dev.c:5788) br_handle_frame_finish (net/bridge/br_input.c:216) nf_hook_bridge_pre (net/bridge/br_input.c:294) __netif_receive_skb_core (net/core/dev.c:5423) __netif_receive_skb_list_core (net/core/dev.c:5606) __netif_receive_skb_list (net/core/dev.c:5674) netif_receive_skb_list_internal (net/core/dev.c:5764) napi_gro_receive (net/core/gro.c:609) e1000_clean_rx_irq (drivers/net/ethernet/intel/e1000/e1000_main.c:4467) e1000_clean (drivers/net/ethernet/intel/e1000/e1000_main.c:3805) __napi_poll (net/core/dev.c:6533) net_rx_action (net/core/dev.c:6735) __do_softirq (kernel/softirq.c:554) run_ksoftirqd (kernel/softirq.c:913) smpboot_thread_fn (kernel/smpboot.c:164) kthread (kernel/kthread.c:388) ret_from_fork (arch/x86/kernel/process.c:153) ret_from_fork_asm (arch/x86/entry/entry_64.S:250) </TASK> The root causes are as follows: Thread A Thread B ... netif_receive_skb br_dev_stop ... br_multicast_leave_snoopers ... __ip_mc_dec_group ... __igmp_group_dropped igmp_rcv igmp_stop_timer igmp_heard_query //ref = 1 ip_ma_put igmp_mod_timer refcount_dec_and_test igmp_start_timer //ref = 0 ... refcount_inc //ref increases from 0 When the device receives an IGMPv2 Query message, it starts the timer immediately, regardless of whether the device is running. If the device is down and has left the multicast group, it will cause the mc list refcount uaf issue. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Hangbin Liu <liuhangbin(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/ipv4/igmp.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- net/ipv4/igmp.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c index c71b863093ac..73c24ce011f0 100644 --- a/net/ipv4/igmp.c +++ b/net/ipv4/igmp.c @@ -216,8 +216,10 @@ static void igmp_start_timer(struct ip_mc_list *im, int max_delay) int tv = prandom_u32() % max_delay; im->tm_running = 1; - if (!mod_timer(&im->timer, jiffies+tv+2)) - refcount_inc(&im->refcnt); + if (refcount_inc_not_zero(&im->refcnt)) { + if (mod_timer(&im->timer, jiffies + tv + 2)) + ip_ma_put(im); + } } static void igmp_gq_start_timer(struct in_device *in_dev) -- 2.17.1

2 1

[PATCH OLK-6.6 0/1] x86/kdump: make crash kernel boot faster
by zhangnaichuan 27 Dec '23

27 Dec '23

description: If other cpus offline before handle the crash NMI, the waiting_for_crash_ipi can not be decreased to 0, and current cpu will wait 1 second. So break if all other cpus offline. arch/x86/kernel/reboot.c | 8 ++++++++ 1 file changed, 8 insertions(+) -- 2.33.0

2 2

openEuler Kernel SIG双周例会
by openEuler conference 27 Dec '23

27 Dec '23

您好！ Kernel SIG 邀请您参加 2023-12-29 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中（新增议题可回复本邮件申请，或直接填写至会议看板）会议链接：https://bmeeting.huaweicloud.com:36443/#/j/986451425 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the WeLink conference(auto recording) will be held at 2023-12-29 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 议题征集中（新增议题可回复本邮件申请，或直接填写至会议看板） You can join the meeting at https://bmeeting.huaweicloud.com:36443/#/j/986451425. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-22.03-LTS-SP1 v3] netfilter: nft_set_pipapo: skip inactive elements during set walk
by Dong Chenchen 27 Dec '23

27 Dec '23

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v5.10.203 commit bf72b44fe81be08a9fcd58aabf417cd3337ffc99 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8PGNK CVE: CVE-2023-6817 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 317eb9685095678f2c9f5a8189de698c5354316a upstream. Otherwise set elements can be deactivated twice which will cause a crash. Reported-by: Xingyuan Mo <hdthky0(a)gmail.com> Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: net/netfilter/nft_set_pipapo.c Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nft_set_pipapo.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 3be93175b3ff..08fc65ca31d4 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -1984,6 +1984,9 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set, if (nft_set_elem_expired(&e->ext)) goto cont; + if (!nft_set_elem_active(&e->ext, iter->genmask)) + goto cont; + elem.priv = e; iter->err = iter->fn(ctx, set, iter, &elem); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS v3] netfilter: nft_set_pipapo: skip inactive elements during set walk
by Dong Chenchen 27 Dec '23

27 Dec '23

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v5.10.203 commit bf72b44fe81be08a9fcd58aabf417cd3337ffc99 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8PGNK CVE: CVE-2023-6817 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 317eb9685095678f2c9f5a8189de698c5354316a upstream. Otherwise set elements can be deactivated twice which will cause a crash. Reported-by: Xingyuan Mo <hdthky0(a)gmail.com> Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: net/netfilter/nft_set_pipapo.c Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nft_set_pipapo.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 3be93175b3ff..08fc65ca31d4 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -1984,6 +1984,9 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set, if (nft_set_elem_expired(&e->ext)) goto cont; + if (!nft_set_elem_active(&e->ext, iter->genmask)) + goto cont; + elem.priv = e; iter->err = iter->fn(ctx, set, iter, &elem); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP2 v3] netfilter: nft_set_pipapo: skip inactive elements during set walk
by Dong Chenchen 27 Dec '23

27 Dec '23

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v5.10.203 commit bf72b44fe81be08a9fcd58aabf417cd3337ffc99 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8PGNK CVE: CVE-2023-6817 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 317eb9685095678f2c9f5a8189de698c5354316a upstream. Otherwise set elements can be deactivated twice which will cause a crash. Reported-by: Xingyuan Mo <hdthky0(a)gmail.com> Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: net/netfilter/nft_set_pipapo.c Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nft_set_pipapo.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 3be93175b3ff..08fc65ca31d4 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -1984,6 +1984,9 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set, if (nft_set_elem_expired(&e->ext)) goto cont; + if (!nft_set_elem_active(&e->ext, iter->genmask)) + goto cont; + elem.priv = e; iter->err = iter->fn(ctx, set, iter, &elem); -- 2.25.1

2 1

[PATCH OLK-6.6] openeuler_defconfig: enable CONFIG_EROFS_FS_ONDEMAND for x86 and arm64
by Baokun Li 27 Dec '23

27 Dec '23

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8RP48 -------------------------------- Enable CONFIG_EROFS_FS_ONDEMAND on x86 and arm64 by default to support lazy loading, and also enable the dependent CONFIG_CACHEFILES_ONDEMAND and CONFIG_EROFS_FS. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 8 ++++++-- arch/x86/configs/openeuler_defconfig | 8 ++++++-- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 9297e3ca9f92..fe5e81f6eede 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -6843,7 +6843,7 @@ CONFIG_FSCACHE_STATS=y CONFIG_CACHEFILES=m # CONFIG_CACHEFILES_DEBUG is not set # CONFIG_CACHEFILES_ERROR_INJECTION is not set -# CONFIG_CACHEFILES_ONDEMAND is not set +CONFIG_CACHEFILES_ONDEMAND=y # end of Caches # @@ -6949,7 +6949,11 @@ CONFIG_PSTORE_RAM=m # CONFIG_PSTORE_BLK is not set # CONFIG_SYSV_FS is not set # CONFIG_UFS_FS is not set -# CONFIG_EROFS_FS is not set +CONFIG_EROFS_FS=m +# CONFIG_EROFS_FS_DEBUG is not set +# CONFIG_EROFS_FS_XATTR is not set +# CONFIG_EROFS_FS_ZIP is not set +CONFIG_EROFS_FS_ONDEMAND=y CONFIG_NETWORK_FILESYSTEMS=y CONFIG_NFS_FS=m CONFIG_NFS_V2=m diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index c7b4a4b80b66..f660a490d921 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -8048,7 +8048,7 @@ CONFIG_FSCACHE_STATS=y CONFIG_CACHEFILES=m # CONFIG_CACHEFILES_DEBUG is not set # CONFIG_CACHEFILES_ERROR_INJECTION is not set -# CONFIG_CACHEFILES_ONDEMAND is not set +CONFIG_CACHEFILES_ONDEMAND=y # end of Caches # @@ -8157,7 +8157,11 @@ CONFIG_PSTORE_RAM=m # CONFIG_PSTORE_BLK is not set # CONFIG_SYSV_FS is not set # CONFIG_UFS_FS is not set -# CONFIG_EROFS_FS is not set +CONFIG_EROFS_FS=m +# CONFIG_EROFS_FS_DEBUG is not set +# CONFIG_EROFS_FS_XATTR is not set +# CONFIG_EROFS_FS_ZIP is not set +CONFIG_EROFS_FS_ONDEMAND=y CONFIG_NETWORK_FILESYSTEMS=y CONFIG_NFS_FS=m # CONFIG_NFS_V2 is not set -- 2.31.1

2 1

[PATCH OLK-6.6 0/1] optimize inlining
by Yuntao Liu 27 Dec '23

27 Dec '23

From: Yuntao Liu liuyuntao12(a)huawei.com *** BLURB HERE *** Jinjie Ruan (1): optimize inlining arch/arm64/kvm/sys_regs.h | 5 +++++ arch/x86/configs/i386_defconfig | 1 + arch/x86/configs/x86_64_defconfig | 1 + drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h | 5 ++++- .../pci/hive_isp_css_include/print_support.h | 4 ++++ include/linux/compiler_types.h | 6 +++++- include/trace/trace_events.h | 2 +- kernel/configs/tiny.config | 1 + lib/Kconfig.debug | 13 +++++++++++++ 9 files changed, 35 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10 v3] netfilter: nft_set_pipapo: skip inactive elements during set walk
by Dong Chenchen 27 Dec '23

27 Dec '23

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v5.10.203 commit bf72b44fe81be08a9fcd58aabf417cd3337ffc99 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8PGNK CVE: CVE-2023-6817 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 317eb9685095678f2c9f5a8189de698c5354316a upstream. Otherwise set elements can be deactivated twice which will cause a crash. Reported-by: Xingyuan Mo <hdthky0(a)gmail.com> Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: net/netfilter/nft_set_pipapo.c Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nft_set_pipapo.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 3be93175b3ff..08fc65ca31d4 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -1984,6 +1984,9 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set, if (nft_set_elem_expired(&e->ext)) goto cont; + if (!nft_set_elem_active(&e->ext, iter->genmask)) + goto cont; + elem.priv = e; iter->err = iter->fn(ctx, set, iter, &elem); -- 2.25.1

2 1

[PATCH OLK-5.10 v2] netfilter: nft_set_pipapo: skip inactive elements during set walk
by Dong Chenchen 27 Dec '23

27 Dec '23

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v5.10.203 commit bf72b44fe81be08a9fcd58aabf417cd3337ffc99 category: bugfix bugzilla: 189434 CVE: CVE-2023-6817 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 317eb9685095678f2c9f5a8189de698c5354316a upstream. Otherwise set elements can be deactivated twice which will cause a crash. Reported-by: Xingyuan Mo <hdthky0(a)gmail.com> Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: net/netfilter/nft_set_pipapo.c Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nft_set_pipapo.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 3be93175b3ff..08fc65ca31d4 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -1984,6 +1984,9 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set, if (nft_set_elem_expired(&e->ext)) goto cont; + if (!nft_set_elem_active(&e->ext, iter->genmask)) + goto cont; + elem.priv = e; iter->err = iter->fn(ctx, set, iter, &elem); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP2 v2] netfilter: nft_set_pipapo: skip inactive elements during set walk
by Dong Chenchen 27 Dec '23

27 Dec '23

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v5.10.203 commit bf72b44fe81be08a9fcd58aabf417cd3337ffc99 category: bugfix bugzilla: 189434 CVE: CVE-2023-6817 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 317eb9685095678f2c9f5a8189de698c5354316a upstream. Otherwise set elements can be deactivated twice which will cause a crash. Reported-by: Xingyuan Mo <hdthky0(a)gmail.com> Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: net/netfilter/nft_set_pipapo.c Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nft_set_pipapo.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 3be93175b3ff..08fc65ca31d4 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -1984,6 +1984,9 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set, if (nft_set_elem_expired(&e->ext)) goto cont; + if (!nft_set_elem_active(&e->ext, iter->genmask)) + goto cont; + elem.priv = e; iter->err = iter->fn(ctx, set, iter, &elem); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 v2] netfilter: nft_set_pipapo: skip inactive elements during set walk
by Dong Chenchen 27 Dec '23

27 Dec '23

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v5.10.203 commit bf72b44fe81be08a9fcd58aabf417cd3337ffc99 category: bugfix bugzilla: 189434 CVE: CVE-2023-6817 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 317eb9685095678f2c9f5a8189de698c5354316a upstream. Otherwise set elements can be deactivated twice which will cause a crash. Reported-by: Xingyuan Mo <hdthky0(a)gmail.com> Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: net/netfilter/nft_set_pipapo.c Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nft_set_pipapo.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 3be93175b3ff..08fc65ca31d4 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -1984,6 +1984,9 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set, if (nft_set_elem_expired(&e->ext)) goto cont; + if (!nft_set_elem_active(&e->ext, iter->genmask)) + goto cont; + elem.priv = e; iter->err = iter->fn(ctx, set, iter, &elem); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS v2] netfilter: nft_set_pipapo: skip inactive elements during set walk
by Dong Chenchen 27 Dec '23

27 Dec '23

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v5.10.203 commit bf72b44fe81be08a9fcd58aabf417cd3337ffc99 category: bugfix bugzilla: 189434 CVE: CVE-2023-6817 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 317eb9685095678f2c9f5a8189de698c5354316a upstream. Otherwise set elements can be deactivated twice which will cause a crash. Reported-by: Xingyuan Mo <hdthky0(a)gmail.com> Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: net/netfilter/nft_set_pipapo.c Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nft_set_pipapo.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 3be93175b3ff..08fc65ca31d4 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -1984,6 +1984,9 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set, if (nft_set_elem_expired(&e->ext)) goto cont; + if (!nft_set_elem_active(&e->ext, iter->genmask)) + goto cont; + elem.priv = e; iter->err = iter->fn(ctx, set, iter, &elem); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] netfilter: nft_set_pipapo: skip inactive elements during set walk
by Dong Chenchen 27 Dec '23

27 Dec '23

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-5.10.203 commit bf72b44fe81be08a9fcd58aabf417cd3337ffc99 category: bugfix bugzilla: 189434 CVE: CVE-2023-6817 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 317eb9685095678f2c9f5a8189de698c5354316a upstream. Otherwise set elements can be deactivated twice which will cause a crash. Reported-by: Xingyuan Mo <hdthky0(a)gmail.com> Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: net/netfilter/nft_set_pipapo.c Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nft_set_pipapo.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 3be93175b3ff..08fc65ca31d4 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -1984,6 +1984,9 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set, if (nft_set_elem_expired(&e->ext)) goto cont; + if (!nft_set_elem_active(&e->ext, iter->genmask)) + goto cont; + elem.priv = e; iter->err = iter->fn(ctx, set, iter, &elem); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP2] netfilter: nft_set_pipapo: skip inactive elements during set walk
by Dong Chenchen 27 Dec '23

27 Dec '23

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-5.10.203 commit bf72b44fe81be08a9fcd58aabf417cd3337ffc99 category: bugfix bugzilla: 189434 CVE: CVE-2023-6817 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 317eb9685095678f2c9f5a8189de698c5354316a upstream. Otherwise set elements can be deactivated twice which will cause a crash. Reported-by: Xingyuan Mo <hdthky0(a)gmail.com> Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: net/netfilter/nft_set_pipapo.c Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nft_set_pipapo.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 3be93175b3ff..08fc65ca31d4 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -1984,6 +1984,9 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set, if (nft_set_elem_expired(&e->ext)) goto cont; + if (!nft_set_elem_active(&e->ext, iter->genmask)) + goto cont; + elem.priv = e; iter->err = iter->fn(ctx, set, iter, &elem); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS] netfilter: nft_set_pipapo: skip inactive elements during set walk
by Dong Chenchen 27 Dec '23

27 Dec '23

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-5.10.203 commit bf72b44fe81be08a9fcd58aabf417cd3337ffc99 category: bugfix bugzilla: 189434 CVE: CVE-2023-6817 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 317eb9685095678f2c9f5a8189de698c5354316a upstream. Otherwise set elements can be deactivated twice which will cause a crash. Reported-by: Xingyuan Mo <hdthky0(a)gmail.com> Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: net/netfilter/nft_set_pipapo.c Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nft_set_pipapo.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 3be93175b3ff..08fc65ca31d4 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -1984,6 +1984,9 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set, if (nft_set_elem_expired(&e->ext)) goto cont; + if (!nft_set_elem_active(&e->ext, iter->genmask)) + goto cont; + elem.priv = e; iter->err = iter->fn(ctx, set, iter, &elem); -- 2.25.1

2 1

[PATCH OLK-5.10] netfilter: nft_set_pipapo: skip inactive elements during set walk
by Dong Chenchen 27 Dec '23

27 Dec '23

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-5.10.203 commit bf72b44fe81be08a9fcd58aabf417cd3337ffc99 category: bugfix bugzilla: 189434 CVE: CVE-2023-6817 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 317eb9685095678f2c9f5a8189de698c5354316a upstream. Otherwise set elements can be deactivated twice which will cause a crash. Reported-by: Xingyuan Mo <hdthky0(a)gmail.com> Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: net/netfilter/nft_set_pipapo.c Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nft_set_pipapo.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 3be93175b3ff..08fc65ca31d4 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -1984,6 +1984,9 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set, if (nft_set_elem_expired(&e->ext)) goto cont; + if (!nft_set_elem_active(&e->ext, iter->genmask)) + goto cont; + elem.priv = e; iter->err = iter->fn(ctx, set, iter, &elem); -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] xfs: fix two corruption problems
by Long Li 27 Dec '23

27 Dec '23

This patch set fix two corruption problems: Long Li (1): xfs: shutdown to ensure submits buffers on LSN boundaries yangerkun (1): xfs: shutdown xfs once inode double free fs/xfs/libxfs/xfs_ialloc.c | 6 +++++- fs/xfs/xfs_log_recover.c | 6 +++++- 2 files changed, 10 insertions(+), 2 deletions(-) -- 2.31.1

2 3

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2023-6546
by Yi Yang 27 Dec '23

27 Dec '23

Fix CVE-2023-6546 Daniel Starke (1): tty: n_gsm: fix restart handling via CLD command Yi Yang (1): tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux drivers/tty/n_gsm.c | 71 ++++++++++++++------------------------------- 1 file changed, 22 insertions(+), 49 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS 0/2] perf/core: Fix CVE-2023-6931
by Yang Jihong 27 Dec '23

27 Dec '23

Mark Rutland (1): perf: Fix perf_event_validate_size() lockdep splat Peter Zijlstra (1): perf: Fix perf_event_validate_size() kernel/events/core.c | 67 ++++++++++++++++++++++++++++++-------------- 1 file changed, 46 insertions(+), 21 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 v2] openeuler_defconfig: enable CONFIG_UNICODE for x86 and arm64
by Baokun Li 26 Dec '23

26 Dec '23

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I853Y8 -------------------------------- Enable CONFIG_UNICODE on x86 and arm64 by default to support the ext4 casefold feature. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- V1->V2: Remove the bugzilla number and just keep the gitee issue link to silence checkpatch warning. arch/arm64/configs/openeuler_defconfig | 2 +- arch/x86/configs/openeuler_defconfig | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 9297e3ca9f92..5f23e68df237 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -7074,7 +7074,7 @@ CONFIG_NLS_MAC_TURKISH=m CONFIG_NLS_UTF8=m CONFIG_NLS_UCS2_UTILS=m # CONFIG_DLM is not set -# CONFIG_UNICODE is not set +CONFIG_UNICODE=y CONFIG_IO_WQ=y # end of File systems diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index c7b4a4b80b66..4323520457a3 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -8279,7 +8279,7 @@ CONFIG_NLS_UTF8=m CONFIG_NLS_UCS2_UTILS=m CONFIG_DLM=m CONFIG_DLM_DEBUG=y -# CONFIG_UNICODE is not set +CONFIG_UNICODE=y CONFIG_IO_WQ=y # end of File systems -- 2.31.1

2 1

[PATCH OLK-6.6] openeuler_defconfig: enable CONFIG_UNICODE for x86 and arm64
by Baokun Li 26 Dec '23

26 Dec '23

hulk inclusion category: feature bugzilla: 189255, https://gitee.com/openeuler/kernel/issues/I853Y8 CVE: NA -------------------------------- Enable CONFIG_UNICODE on x86 and arm64 by default to support the ext4 casefold feature. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 2 +- arch/x86/configs/openeuler_defconfig | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 9297e3ca9f92..5f23e68df237 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -7074,7 +7074,7 @@ CONFIG_NLS_MAC_TURKISH=m CONFIG_NLS_UTF8=m CONFIG_NLS_UCS2_UTILS=m # CONFIG_DLM is not set -# CONFIG_UNICODE is not set +CONFIG_UNICODE=y CONFIG_IO_WQ=y # end of File systems diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index c7b4a4b80b66..4323520457a3 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -8279,7 +8279,7 @@ CONFIG_NLS_UTF8=m CONFIG_NLS_UCS2_UTILS=m CONFIG_DLM=m CONFIG_DLM_DEBUG=y -# CONFIG_UNICODE is not set +CONFIG_UNICODE=y CONFIG_IO_WQ=y # end of File systems -- 2.31.1

2 1

[PATCH OLK-6.6 0/3] memcg: support OOM priority for memcg
by Jinjiang Tu 26 Dec '23

26 Dec '23

Changelog: * rename CONFIG_MEMCG_QOS to CONFIG_MEMCG_OOM_PRIORITY * move CONFIG_MEMCG_OOM_PRIORITY to init/Kconfig * set CONFIG_MEMCG_OOM_PRIORITY default from y to n, and enbale it in openeuler_defconfig * add rcu_read_lock() protection for mem_cgroup_from_task() * Instead of static key, use variable to check if the feature is enabled * use READ_ONCE/WRITE_ONCE protection when read/write oom_prio * cleanup Jing Xiangfeng (3): memcg: support priority for oom memcg: Add sysctl memcg_qos_enable memcg: enable CONFIG_MEMCG_OOM_PRIORITY by default arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/linux/memcontrol.h | 26 +++ init/Kconfig | 14 ++ mm/memcontrol.c | 222 +++++++++++++++++++++++++ mm/oom_kill.c | 61 ++++++- 6 files changed, 320 insertions(+), 5 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6 v2 0/3] xfs: fix attr inactive problems
by Long Li 26 Dec '23

26 Dec '23

This patch set fix two attr inactive problems: Guo Xuenan (1): xfs: force shutdown xfs when xfs_attr_inactive fails Zhang Yi (2): xfs: factor out __xfs_da3_node_read() xfs: atomic drop extent entries when inactiving attr fs/xfs/libxfs/xfs_da_btree.c | 5 +-- fs/xfs/libxfs/xfs_da_btree.h | 15 ++++++-- fs/xfs/xfs_attr_inactive.c | 66 ++++++++++++++++++++++++++---------- 3 files changed, 65 insertions(+), 21 deletions(-) -- 2.31.1

2 4

[PATCH OLK-6.6 0/2] xfs: fix perag leak when growfs fails
by Long Li 26 Dec '23

26 Dec '23

This patch set fix perag leak problems when growfs fails. Long Li (2): xfs: add lock protection when remove perag from radix tree xfs: fix perag leak when growfs fails fs/xfs/libxfs/xfs_ag.c | 36 ++++++++++++++++++++++++++++-------- fs/xfs/libxfs/xfs_ag.h | 2 ++ fs/xfs/xfs_fsops.c | 5 ++++- 3 files changed, 34 insertions(+), 9 deletions(-) -- 2.31.1

2 3

[PATCH V4 OLK-6.6] iommu/arm-smmu-v3: Add a SYNC command to avoid broken page table prefetch
by Zhang Zekun 26 Dec '23

26 Dec '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8QSLV CVE: NA ----------------------------------------------- On Hisilicon LINXICORE9100 cores, SMMU pagetable prefetch features may prefetch and use a invalid PTE even the PTE is valid at that time. This will cause the device trigger fake pagefaults. If the SMMU works in terminate mode, transactions which occur fake pagefaults will be aborted, and could result in unexpected errors. To fix this problem, we need to add a SYNC command after smmu has map a iova, then smmu will always try to get the newest PTE. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- v3->v4: Change the config code style. arch/arm64/Kconfig | 13 +++++++++++++ arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/kernel/cpu_errata.c | 14 ++++++++++++++ arch/arm64/tools/cpucaps | 1 + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 20 ++++++++++++++++++++ 5 files changed, 49 insertions(+) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 2aca373a7038..42079bfdf40a 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -1180,6 +1180,19 @@ config HISILICON_ERRATUM_1980005 If unsure, say N. +config HISILICON_ERRATUM_162100602 + bool "Hisilicon erratum 162100602" + depends on ARM_SMMU_V3 + default y + help + On Hisilicon LINXICORE9100 cores, SMMU pagetable prefetch features may + prefetch and use a invalid PTE even the PTE is valid at that time. This + will cause the device trigger fake pagefaults. If the SMMU works in + terminate mode, transactions which occur fake pagefaults will be aborted, + and could result in unexpected errors. + + If unsure, say Y. + config QCOM_FALKOR_ERRATUM_1003 bool "Falkor E1003: Incorrect translation due to ASID change" default y diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 33ba39711884..98fa4d2f3b13 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -399,6 +399,7 @@ CONFIG_CAVIUM_TX2_ERRATUM_219=y CONFIG_FUJITSU_ERRATUM_010001=y CONFIG_HISILICON_ERRATUM_161600802=y CONFIG_HISILICON_ERRATUM_162100125=y +CONFIG_HISILICON_ERRATUM_162100602=y CONFIG_QCOM_FALKOR_ERRATUM_1003=y CONFIG_QCOM_FALKOR_ERRATUM_1009=y CONFIG_QCOM_QDF2400_ERRATUM_0065=y diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c index a686a96d966a..c569e6c0ac07 100644 --- a/arch/arm64/kernel/cpu_errata.c +++ b/arch/arm64/kernel/cpu_errata.c @@ -360,6 +360,13 @@ static const struct midr_range hisilicon_erratum_162100125_cpus[] = { }; #endif +#ifdef CONFIG_HISILICON_ERRATUM_162100602 +static const struct midr_range hisilicon_erratum_162100602_cpus[] = { + MIDR_REV(MIDR_HISI_LINXICORE9100, 0, 0), + {}, +}; +#endif + #ifdef CONFIG_QCOM_FALKOR_ERRATUM_1003 static const struct arm64_cpu_capabilities qcom_erratum_1003_list[] = { { @@ -591,6 +598,13 @@ const struct arm64_cpu_capabilities arm64_errata[] = { ERRATA_MIDR_RANGE_LIST(hisilicon_erratum_162100125_cpus), }, #endif +#ifdef CONFIG_HISILICON_ERRATUM_162100602 + { + .desc = "Hisilicon erratum 162100602", + .capability = ARM64_WORKAROUND_HISILICON_ERRATUM_162100602, + ERRATA_MIDR_RANGE_LIST(hisilicon_erratum_162100602_cpus), + }, +#endif #ifdef CONFIG_HISILICON_ERRATUM_1980005 { .desc = "Hisilicon erratum 1980005 (IDC)", diff --git a/arch/arm64/tools/cpucaps b/arch/arm64/tools/cpucaps index 0b62edb91876..569ecec76c16 100644 --- a/arch/arm64/tools/cpucaps +++ b/arch/arm64/tools/cpucaps @@ -103,3 +103,4 @@ WORKAROUND_SPECULATIVE_AT WORKAROUND_HISILICON_ERRATUM_162100125 WORKAROUND_HISI_HIP08_RU_PREFETCH WORKAROUND_HISILICON_1980005 +WORKAROUND_HISILICON_ERRATUM_162100602 diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index 5055a66644af..d0422bb13724 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -2528,6 +2528,23 @@ static void arm_smmu_iotlb_sync(struct iommu_domain *domain, gather->pgsize, true, smmu_domain); } +#ifdef CONFIG_HISILICON_ERRATUM_162100602 +static void arm_smmu_iotlb_sync_map(struct iommu_domain *domain, + unsigned long iova, size_t size) +{ + struct arm_smmu_domain *smmu_domain = to_smmu_domain(domain); + size_t granule_size; + + if (!cpus_have_const_cap(ARM64_WORKAROUND_HISILICON_ERRATUM_162100602)) + return; + + granule_size = 1 << __ffs(smmu_domain->domain.pgsize_bitmap); + + /* Add a SYNC command to sync io-pgtale to avoid errors in pgtable prefetch*/ + arm_smmu_tlb_inv_range_domain(iova, granule_size, granule_size, true, smmu_domain); +} +#endif + static phys_addr_t arm_smmu_iova_to_phys(struct iommu_domain *domain, dma_addr_t iova) { @@ -2883,6 +2900,9 @@ static struct iommu_ops arm_smmu_ops = { .unmap_pages = arm_smmu_unmap_pages, .flush_iotlb_all = arm_smmu_flush_iotlb_all, .iotlb_sync = arm_smmu_iotlb_sync, +#ifdef CONFIG_HISILICON_ERRATUM_162100602 + .iotlb_sync_map = arm_smmu_iotlb_sync_map, +#endif .iova_to_phys = arm_smmu_iova_to_phys, .enable_nesting = arm_smmu_enable_nesting, .free = arm_smmu_domain_free, -- 2.17.1

2 1

[PATCH OLK-6.6 0/7] arm64: Add framework to turn IPI as NMI
by Liao Chen 26 Dec '23

26 Dec '23

Config Dependencies: CONFIG_PSEUDO_NMI=y CONFIG_LOCKUP_DETECTOR=y CONFIG_SOFTLOCKUP_DETECTOR=y CONFIG_LKDTM=y CONFIG_HAVE_ARCH_KGDB=y CONFIG_KGDB=y CONFIG_KGDB_HONOUR_BLOCKLIST=y CONFIG_KGDB_SERIAL_CONSOLE=y CONFIG_KGDB_KDB=y Sumit Garg (7): arm64: Add framework to turn IPI as NMI irqchip/gic-v3: Enable support for SGIs to act as NMIs arm64: smp: Assign and setup an IPI as NMI nmi: backtrace: Allow runtime arch specific override arm64: ipi_nmi: Add support for NMI backtrace kgdb: Expose default CPUs roundup fallback mechanism arm64: kgdb: Roundup cpus using IPI as NMI arch/arm/include/asm/irq.h | 2 +- arch/arm/kernel/smp.c | 3 +- arch/arm64/include/asm/irq.h | 6 +++ arch/arm64/include/asm/nmi.h | 17 +++++++ arch/arm64/kernel/Makefile | 2 +- arch/arm64/kernel/ipi_nmi.c | 84 ++++++++++++++++++++++++++++++++ arch/arm64/kernel/kgdb.c | 18 +++++++ arch/arm64/kernel/smp.c | 8 +++ arch/mips/include/asm/irq.h | 2 +- arch/mips/kernel/process.c | 3 +- arch/powerpc/include/asm/irq.h | 2 +- arch/powerpc/include/asm/nmi.h | 6 +++ arch/powerpc/kernel/stacktrace.c | 3 +- arch/sparc/include/asm/irq_64.h | 2 +- arch/sparc/kernel/process_64.c | 4 +- arch/x86/include/asm/irq.h | 2 +- arch/x86/kernel/apic/hw_nmi.c | 3 +- drivers/irqchip/irq-gic-v3.c | 29 ++++++++--- include/linux/kgdb.h | 12 +++++ include/linux/nmi.h | 12 ++--- kernel/debug/debug_core.c | 8 ++- 21 files changed, 200 insertions(+), 28 deletions(-) create mode 100644 arch/arm64/include/asm/nmi.h create mode 100644 arch/arm64/kernel/ipi_nmi.c -- 2.34.1

2 8

[PATCH OLK-6.6 0/2] arm64: Add config switch and kernel parameter for
by Zheng Zengkai 26 Dec '23

26 Dec '23

Some features depend on cpu0. Cpu0 offline may cause some problems or malfunctions. Known dependency may be: MegaRAID Tri-Mode SAS3508 may block the reboot process after offline CPU0. Add config switch and kernel parameter for CPU0 hotplug to avoid these issues for arm64 platform. Zheng Zengkai (2): arm64: Add config switch and kernel parameter for CPU0 hotplug config: disable config ARM64_BOOTPARAM_HOTPLUG_CPU0 by default .../admin-guide/kernel-parameters.txt | 8 ++++++ arch/arm64/Kconfig | 28 +++++++++++++++++++ arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/kernel/setup.c | 21 ++++++++++++-- 4 files changed, 56 insertions(+), 2 deletions(-) -- 2.20.1

2 3

[PATCH OLK-6.6 0/7] Support nokaslr memmap parameter for kaslr collision
by felix 26 Dec '23

26 Dec '23

From: Felix Fu <fuzhen5(a)huawei.com> Felix Fu (7): kaslr: add nokaslr memory region Kconfig support efi/libstub: arm64: Add kaslr skip memmap kconfig support efi/libstub: arm64: support strchr function for EFI stub efi/libstub: add arm64 kaslr memory region avoid support efi/libstub: arm64: Add macro isolation memmap detection code efi/libstub: add arm64 nokaslr memory regions x86/boot: add x86 nokaslr memory regions arch/arm64/Kconfig | 12 ++ arch/x86/boot/compressed/kaslr.c | 41 +++++ drivers/firmware/efi/libstub/arm64-stub.c | 173 ++++++++++++++++++ .../firmware/efi/libstub/efi-stub-helper.c | 11 +- drivers/firmware/efi/libstub/efistub.h | 14 ++ drivers/firmware/efi/libstub/randomalloc.c | 11 +- drivers/firmware/efi/libstub/string.c | 19 ++ init/Kconfig | 8 + 8 files changed, 286 insertions(+), 3 deletions(-) -- 2.34.1

1 8

[PATCH OLK-5.10 0/2] CVE-2023-35827 patchset
by Ziyang Xuan 26 Dec '23

26 Dec '23

CVE-2023-35827 patchset. Yoshihiro Shimoda (2): ravb: Fix use-after-free issue in ravb_tx_timeout_work() ravb: Fix races between ravb_tx_timeout_work() and net related ops drivers/net/ethernet/renesas/ravb_main.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH OLK-6.6] block: support to account io_ticks precisely
by Yu Kuai 26 Dec '23

26 Dec '23

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8RIME CVE: NA ----------------------------------------------- Currently, io_ticks is accounted based on sampling, specifically update_io_ticks() will always account io_ticks by 1 jiffies from bdev_start_io_acct()/blk_account_io_start(), and the result can be inaccurate, for example(HZ is 250): Test script: fio -filename=/dev/sda -bs=4k -rw=write -direct=1 -name=test -thinktime=4ms Test result: util is about 90%, while the disk is really idle. In order to account io_ticks precisely, update_io_ticks() must know if there are IO inflight already, and this requires overhead slightly, hence precise io accounting is disabled by default, and user can enable it through sysfs entry or add bool cmd "precise_iostat=1"; Noted that for rq-based devcie, part_stat_local_inc/dec() and part_in_flight() is used to track inflight instead of iterating tags, which is not supposed to be used in fast path because 'tags->lock' is grabbed in blk_mq_find_and_get_req(). Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- Documentation/ABI/stable/sysfs-block | 8 ++++-- block/blk-core.c | 34 +++++++++++++++++++---- block/blk-merge.c | 3 +++ block/blk-mq.c | 18 ++++++++++--- block/blk-sysfs.c | 40 ++++++++++++++++++++++++++-- block/blk.h | 4 ++- block/genhd.c | 6 ++--- include/linux/blk-mq.h | 1 + include/linux/blkdev.h | 3 +++ 9 files changed, 100 insertions(+), 17 deletions(-) diff --git a/Documentation/ABI/stable/sysfs-block b/Documentation/ABI/stable/sysfs-block index 1fe9a553c37b..e5fedecf7bdf 100644 --- a/Documentation/ABI/stable/sysfs-block +++ b/Documentation/ABI/stable/sysfs-block @@ -358,8 +358,12 @@ What: /sys/block/<disk>/queue/iostats Date: January 2009 Contact: linux-block(a)vger.kernel.org Description: - [RW] This file is used to control (on/off) the iostats - accounting of the disk. + [RW] This file is used to control the iostats accounting of the + disk. If this value is 0, iostats accounting is disabled; If + this value is 1, iostats accounting is enabled, but io_ticks is + accounted by sampling and the result is not accurate; If this + value is 2, iostats accounting is enabled and io_ticks is + accounted precisely, but there will be slightly overhead. What: /sys/block/<disk>/queue/logical_block_size diff --git a/block/blk-core.c b/block/blk-core.c index fdf25b8d6e78..d599d9c3fdde 100644 --- a/block/blk-core.c +++ b/block/blk-core.c @@ -71,6 +71,21 @@ static struct kmem_cache *blk_requestq_cachep; */ static struct workqueue_struct *kblockd_workqueue; +static bool precise_iostat; + +static int __init precise_iostat_setup(char *str) +{ + bool precise; + + if (!strtobool(str, &precise)) { + precise_iostat = precise; + pr_info("precise iostat %d\n", precise_iostat); + } + + return 1; +} +__setup("precise_iostat=", precise_iostat_setup); + /** * blk_queue_flag_set - atomically set a queue flag * @flag: flag to be set @@ -441,6 +456,8 @@ struct request_queue *blk_alloc_queue(int node_id) blk_set_default_limits(&q->limits); q->nr_requests = BLKDEV_DEFAULT_RQ; + if (precise_iostat) + blk_queue_flag_set(QUEUE_FLAG_PRECISE_IO_STAT, q); return q; @@ -935,14 +952,20 @@ int iocb_bio_iopoll(struct kiocb *kiocb, struct io_comp_batch *iob, } EXPORT_SYMBOL_GPL(iocb_bio_iopoll); -void update_io_ticks(struct block_device *part, unsigned long now, bool end) +void update_io_ticks(struct block_device *part, unsigned long now, bool end, + bool precise) { unsigned long stamp; again: stamp = READ_ONCE(part->bd_stamp); - if (unlikely(time_after(now, stamp))) { - if (likely(try_cmpxchg(&part->bd_stamp, &stamp, now))) + if (unlikely(time_after(now, stamp)) && + likely(try_cmpxchg(&part->bd_stamp, &stamp, now))) { + if (precise) { + if (end || part_in_flight(part)) + __part_stat_add(part, io_ticks, now - stamp); + } else { __part_stat_add(part, io_ticks, end ? now - stamp : 1); + } } if (part->bd_partno) { part = bdev_whole(part); @@ -954,7 +977,8 @@ unsigned long bdev_start_io_acct(struct block_device *bdev, enum req_op op, unsigned long start_time) { part_stat_lock(); - update_io_ticks(bdev, start_time, false); + update_io_ticks(bdev, start_time, false, + blk_queue_precise_io_stat(bdev->bd_queue)); part_stat_local_inc(bdev, in_flight[op_is_write(op)]); part_stat_unlock(); @@ -982,7 +1006,7 @@ void bdev_end_io_acct(struct block_device *bdev, enum req_op op, unsigned long duration = now - start_time; part_stat_lock(); - update_io_ticks(bdev, now, true); + update_io_ticks(bdev, now, true, true); part_stat_inc(bdev, ios[sgrp]); part_stat_add(bdev, sectors[sgrp], sectors); part_stat_add(bdev, nsecs[sgrp], jiffies_to_nsecs(duration)); diff --git a/block/blk-merge.c b/block/blk-merge.c index 65e75efa9bd3..5db8228c46fc 100644 --- a/block/blk-merge.c +++ b/block/blk-merge.c @@ -783,6 +783,9 @@ static void blk_account_io_merge_request(struct request *req) if (blk_do_io_stat(req)) { part_stat_lock(); part_stat_inc(req->part, merges[op_stat_group(req_op(req))]); + if (req->rq_flags & RQF_PRECISE_IO_STAT) + part_stat_local_dec(req->part, + in_flight[op_is_write(req_op(req))]); part_stat_unlock(); } } diff --git a/block/blk-mq.c b/block/blk-mq.c index baef592ecb41..8a18330d31ce 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -360,8 +360,11 @@ static struct request *blk_mq_rq_ctx_init(struct blk_mq_alloc_data *data, if (data->flags & BLK_MQ_REQ_PM) data->rq_flags |= RQF_PM; - if (blk_queue_io_stat(q)) + if (blk_queue_io_stat(q)) { data->rq_flags |= RQF_IO_STAT; + if (blk_queue_precise_io_stat(q)) + data->rq_flags |= RQF_PRECISE_IO_STAT; + } rq->rq_flags = data->rq_flags; if (data->rq_flags & RQF_SCHED_TAGS) { @@ -991,17 +994,21 @@ static inline void blk_account_io_done(struct request *req, u64 now) const int sgrp = op_stat_group(req_op(req)); part_stat_lock(); - update_io_ticks(req->part, jiffies, true); + update_io_ticks(req->part, jiffies, true, true); part_stat_inc(req->part, ios[sgrp]); part_stat_add(req->part, nsecs[sgrp], now - req->start_time_ns); + if (req->rq_flags & RQF_PRECISE_IO_STAT) + part_stat_local_dec(req->part, + in_flight[op_is_write(req_op(req))]); part_stat_unlock(); } } static inline void blk_account_io_start(struct request *req) { - trace_block_io_start(req); + bool precise = req->rq_flags & RQF_PRECISE_IO_STAT; + trace_block_io_start(req); if (blk_do_io_stat(req)) { /* * All non-passthrough requests are created from a bio with one @@ -1015,7 +1022,10 @@ static inline void blk_account_io_start(struct request *req) req->part = req->q->disk->part0; part_stat_lock(); - update_io_ticks(req->part, jiffies, false); + update_io_ticks(req->part, jiffies, false, precise); + if (precise) + part_stat_local_inc(req->part, + in_flight[op_is_write(req_op(req))]); part_stat_unlock(); } } diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c index 63e481262336..d3e07d865755 100644 --- a/block/blk-sysfs.c +++ b/block/blk-sysfs.c @@ -303,7 +303,6 @@ queue_##name##_store(struct request_queue *q, const char *page, size_t count) \ QUEUE_SYSFS_BIT_FNS(nonrot, NONROT, 1); QUEUE_SYSFS_BIT_FNS(random, ADD_RANDOM, 0); -QUEUE_SYSFS_BIT_FNS(iostats, IO_STAT, 0); QUEUE_SYSFS_BIT_FNS(stable_writes, STABLE_WRITES, 0); #undef QUEUE_SYSFS_BIT_FNS @@ -473,6 +472,43 @@ static ssize_t queue_dax_show(struct request_queue *q, char *page) return queue_var_show(blk_queue_dax(q), page); } +static ssize_t queue_iostats_show(struct request_queue *q, char *page) +{ + int val = 0; + + if (blk_queue_io_stat(q)) + val = blk_queue_precise_io_stat(q) ? 2 : 1; + + return sprintf(page, "%u\n", val); +} + +static ssize_t +queue_iostats_store(struct request_queue *q, const char *page, size_t count) +{ + unsigned long nr; + int ret; + + ret = queue_var_store(&nr, page, count); + if (ret < 0) + return ret; + + if (nr > 2) + return -EINVAL; + + if (nr == 0) { + blk_queue_flag_clear(QUEUE_FLAG_IO_STAT, q); + blk_queue_flag_clear(QUEUE_FLAG_PRECISE_IO_STAT, q); + } else if (nr == 1) { + blk_queue_flag_set(QUEUE_FLAG_IO_STAT, q); + blk_queue_flag_clear(QUEUE_FLAG_PRECISE_IO_STAT, q); + } else { + blk_queue_flag_set(QUEUE_FLAG_IO_STAT, q); + blk_queue_flag_set(QUEUE_FLAG_PRECISE_IO_STAT, q); + } + + return count; +} + #define QUEUE_RO_ENTRY(_prefix, _name) \ static struct queue_sysfs_entry _prefix##_entry = { \ .attr = { .name = _name, .mode = 0444 }, \ @@ -494,6 +530,7 @@ QUEUE_RO_ENTRY(queue_max_segments, "max_segments"); QUEUE_RO_ENTRY(queue_max_integrity_segments, "max_integrity_segments"); QUEUE_RO_ENTRY(queue_max_segment_size, "max_segment_size"); QUEUE_RW_ENTRY(elv_iosched, "scheduler"); +QUEUE_RW_ENTRY(queue_iostats, "iostats"); QUEUE_RO_ENTRY(queue_logical_block_size, "logical_block_size"); QUEUE_RO_ENTRY(queue_physical_block_size, "physical_block_size"); @@ -539,7 +576,6 @@ static struct queue_sysfs_entry queue_hw_sector_size_entry = { }; QUEUE_RW_ENTRY(queue_nonrot, "rotational"); -QUEUE_RW_ENTRY(queue_iostats, "iostats"); QUEUE_RW_ENTRY(queue_random, "add_random"); QUEUE_RW_ENTRY(queue_stable_writes, "stable_writes"); diff --git a/block/blk.h b/block/blk.h index 08a358bc0919..d2321709a9ce 100644 --- a/block/blk.h +++ b/block/blk.h @@ -343,7 +343,9 @@ static inline bool blk_do_io_stat(struct request *rq) return (rq->rq_flags & RQF_IO_STAT) && !blk_rq_is_passthrough(rq); } -void update_io_ticks(struct block_device *part, unsigned long now, bool end); +void update_io_ticks(struct block_device *part, unsigned long now, bool end, + bool precise); +unsigned int part_in_flight(struct block_device *part); static inline void req_set_nomerge(struct request_queue *q, struct request *req) { diff --git a/block/genhd.c b/block/genhd.c index 4a16a424f57d..5db94cb32634 100644 --- a/block/genhd.c +++ b/block/genhd.c @@ -118,7 +118,7 @@ static void part_stat_read_all(struct block_device *part, } } -static unsigned int part_in_flight(struct block_device *part) +unsigned int part_in_flight(struct block_device *part) { unsigned int inflight = 0; int cpu; @@ -955,7 +955,7 @@ ssize_t part_stat_show(struct device *dev, if (inflight) { part_stat_lock(); - update_io_ticks(bdev, jiffies, true); + update_io_ticks(bdev, jiffies, true, true); part_stat_unlock(); } part_stat_read_all(bdev, &stat); @@ -1248,7 +1248,7 @@ static int diskstats_show(struct seq_file *seqf, void *v) if (inflight) { part_stat_lock(); - update_io_ticks(hd, jiffies, true); + update_io_ticks(hd, jiffies, true, true); part_stat_unlock(); } part_stat_read_all(hd, &stat); diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h index 65e95a2c4718..83e36851c129 100644 --- a/include/linux/blk-mq.h +++ b/include/linux/blk-mq.h @@ -46,6 +46,7 @@ typedef __u32 __bitwise req_flags_t; #define RQF_QUIET ((__force req_flags_t)(1 << 11)) /* account into disk and partition IO statistics */ #define RQF_IO_STAT ((__force req_flags_t)(1 << 13)) +#define RQF_PRECISE_IO_STAT ((__force req_flags_t)(1 << 14)) /* runtime pm request */ #define RQF_PM ((__force req_flags_t)(1 << 15)) /* on IO scheduler merge hash */ diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h index 9f3bcbcb156d..bea0b5fdac74 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h @@ -536,6 +536,7 @@ struct request_queue { #define QUEUE_FLAG_NONROT 6 /* non-rotational device (SSD) */ #define QUEUE_FLAG_VIRT QUEUE_FLAG_NONROT /* paravirt device */ #define QUEUE_FLAG_IO_STAT 7 /* do disk/partitions IO accounting */ +#define QUEUE_FLAG_PRECISE_IO_STAT 8 /* do disk/partitions IO accounting precisely */ #define QUEUE_FLAG_NOXMERGES 9 /* No extended merges */ #define QUEUE_FLAG_ADD_RANDOM 10 /* Contributes to random pool */ #define QUEUE_FLAG_SYNCHRONOUS 11 /* always completes in submit context */ @@ -576,6 +577,8 @@ bool blk_queue_flag_test_and_set(unsigned int flag, struct request_queue *q); #define blk_queue_stable_writes(q) \ test_bit(QUEUE_FLAG_STABLE_WRITES, &(q)->queue_flags) #define blk_queue_io_stat(q) test_bit(QUEUE_FLAG_IO_STAT, &(q)->queue_flags) +#define blk_queue_precise_io_stat(q) \ + test_bit(QUEUE_FLAG_PRECISE_IO_STAT, &(q)->queue_flags) #define blk_queue_add_random(q) test_bit(QUEUE_FLAG_ADD_RANDOM, &(q)->queue_flags) #define blk_queue_zone_resetall(q) \ test_bit(QUEUE_FLAG_ZONE_RESETALL, &(q)->queue_flags) -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2023-35827 patchset
by Ziyang Xuan 26 Dec '23

26 Dec '23

CVE-2023-35827 patchset. Yoshihiro Shimoda (2): ravb: Fix use-after-free issue in ravb_tx_timeout_work() ravb: Fix races between ravb_tx_timeout_work() and net related ops drivers/net/ethernet/renesas/ravb_main.c | 10 ++++++++++ 1 file changed, 10 insertions(+) -- 2.25.1

2 3

[PATCH] block: support to account io_ticks precisely
by Yu Kuai 26 Dec '23

26 Dec '23

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8RIME CVE: NA ----------------------------------------------- Currently, io_ticks is accounted based on sampling, specifically update_io_ticks() will always account io_ticks by 1 jiffies from bdev_start_io_acct()/blk_account_io_start(), and the result can be inaccurate, for example(HZ is 250): Test script: fio -filename=/dev/sda -bs=4k -rw=write -direct=1 -name=test -thinktime=4ms Test result: util is about 90%, while the disk is really idle. In order to account io_ticks precisely, update_io_ticks() must know if there are IO inflight already, and this requires overhead slightly, hence precise io accounting is disabled by default, and user can enable it through sysfs entry or add bool cmd "precise_iostat=1"; Noted that for rq-based devcie, part_stat_local_inc/dec() and part_in_flight() is used to track inflight instead of iterating tags, which is not supposed to be used in fast path because 'tags->lock' is grabbed in blk_mq_find_and_get_req(). Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- Documentation/ABI/stable/sysfs-block | 8 ++++-- block/blk-core.c | 34 +++++++++++++++++++---- block/blk-merge.c | 3 +++ block/blk-mq.c | 18 ++++++++++--- block/blk-sysfs.c | 40 ++++++++++++++++++++++++++-- block/blk.h | 4 ++- block/genhd.c | 6 ++--- include/linux/blk-mq.h | 1 + include/linux/blkdev.h | 3 +++ 9 files changed, 100 insertions(+), 17 deletions(-) diff --git a/Documentation/ABI/stable/sysfs-block b/Documentation/ABI/stable/sysfs-block index 1fe9a553c37b..e5fedecf7bdf 100644 --- a/Documentation/ABI/stable/sysfs-block +++ b/Documentation/ABI/stable/sysfs-block @@ -358,8 +358,12 @@ What: /sys/block/<disk>/queue/iostats Date: January 2009 Contact: linux-block(a)vger.kernel.org Description: - [RW] This file is used to control (on/off) the iostats - accounting of the disk. + [RW] This file is used to control the iostats accounting of the + disk. If this value is 0, iostats accounting is disabled; If + this value is 1, iostats accounting is enabled, but io_ticks is + accounted by sampling and the result is not accurate; If this + value is 2, iostats accounting is enabled and io_ticks is + accounted precisely, but there will be slightly overhead. What: /sys/block/<disk>/queue/logical_block_size diff --git a/block/blk-core.c b/block/blk-core.c index fdf25b8d6e78..d599d9c3fdde 100644 --- a/block/blk-core.c +++ b/block/blk-core.c @@ -71,6 +71,21 @@ static struct kmem_cache *blk_requestq_cachep; */ static struct workqueue_struct *kblockd_workqueue; +static bool precise_iostat; + +static int __init precise_iostat_setup(char *str) +{ + bool precise; + + if (!strtobool(str, &precise)) { + precise_iostat = precise; + pr_info("precise iostat %d\n", precise_iostat); + } + + return 1; +} +__setup("precise_iostat=", precise_iostat_setup); + /** * blk_queue_flag_set - atomically set a queue flag * @flag: flag to be set @@ -441,6 +456,8 @@ struct request_queue *blk_alloc_queue(int node_id) blk_set_default_limits(&q->limits); q->nr_requests = BLKDEV_DEFAULT_RQ; + if (precise_iostat) + blk_queue_flag_set(QUEUE_FLAG_PRECISE_IO_STAT, q); return q; @@ -935,14 +952,20 @@ int iocb_bio_iopoll(struct kiocb *kiocb, struct io_comp_batch *iob, } EXPORT_SYMBOL_GPL(iocb_bio_iopoll); -void update_io_ticks(struct block_device *part, unsigned long now, bool end) +void update_io_ticks(struct block_device *part, unsigned long now, bool end, + bool precise) { unsigned long stamp; again: stamp = READ_ONCE(part->bd_stamp); - if (unlikely(time_after(now, stamp))) { - if (likely(try_cmpxchg(&part->bd_stamp, &stamp, now))) + if (unlikely(time_after(now, stamp)) && + likely(try_cmpxchg(&part->bd_stamp, &stamp, now))) { + if (precise) { + if (end || part_in_flight(part)) + __part_stat_add(part, io_ticks, now - stamp); + } else { __part_stat_add(part, io_ticks, end ? now - stamp : 1); + } } if (part->bd_partno) { part = bdev_whole(part); @@ -954,7 +977,8 @@ unsigned long bdev_start_io_acct(struct block_device *bdev, enum req_op op, unsigned long start_time) { part_stat_lock(); - update_io_ticks(bdev, start_time, false); + update_io_ticks(bdev, start_time, false, + blk_queue_precise_io_stat(bdev->bd_queue)); part_stat_local_inc(bdev, in_flight[op_is_write(op)]); part_stat_unlock(); @@ -982,7 +1006,7 @@ void bdev_end_io_acct(struct block_device *bdev, enum req_op op, unsigned long duration = now - start_time; part_stat_lock(); - update_io_ticks(bdev, now, true); + update_io_ticks(bdev, now, true, true); part_stat_inc(bdev, ios[sgrp]); part_stat_add(bdev, sectors[sgrp], sectors); part_stat_add(bdev, nsecs[sgrp], jiffies_to_nsecs(duration)); diff --git a/block/blk-merge.c b/block/blk-merge.c index 65e75efa9bd3..5db8228c46fc 100644 --- a/block/blk-merge.c +++ b/block/blk-merge.c @@ -783,6 +783,9 @@ static void blk_account_io_merge_request(struct request *req) if (blk_do_io_stat(req)) { part_stat_lock(); part_stat_inc(req->part, merges[op_stat_group(req_op(req))]); + if (req->rq_flags & RQF_PRECISE_IO_STAT) + part_stat_local_dec(req->part, + in_flight[op_is_write(req_op(req))]); part_stat_unlock(); } } diff --git a/block/blk-mq.c b/block/blk-mq.c index baef592ecb41..8a18330d31ce 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -360,8 +360,11 @@ static struct request *blk_mq_rq_ctx_init(struct blk_mq_alloc_data *data, if (data->flags & BLK_MQ_REQ_PM) data->rq_flags |= RQF_PM; - if (blk_queue_io_stat(q)) + if (blk_queue_io_stat(q)) { data->rq_flags |= RQF_IO_STAT; + if (blk_queue_precise_io_stat(q)) + data->rq_flags |= RQF_PRECISE_IO_STAT; + } rq->rq_flags = data->rq_flags; if (data->rq_flags & RQF_SCHED_TAGS) { @@ -991,17 +994,21 @@ static inline void blk_account_io_done(struct request *req, u64 now) const int sgrp = op_stat_group(req_op(req)); part_stat_lock(); - update_io_ticks(req->part, jiffies, true); + update_io_ticks(req->part, jiffies, true, true); part_stat_inc(req->part, ios[sgrp]); part_stat_add(req->part, nsecs[sgrp], now - req->start_time_ns); + if (req->rq_flags & RQF_PRECISE_IO_STAT) + part_stat_local_dec(req->part, + in_flight[op_is_write(req_op(req))]); part_stat_unlock(); } } static inline void blk_account_io_start(struct request *req) { - trace_block_io_start(req); + bool precise = req->rq_flags & RQF_PRECISE_IO_STAT; + trace_block_io_start(req); if (blk_do_io_stat(req)) { /* * All non-passthrough requests are created from a bio with one @@ -1015,7 +1022,10 @@ static inline void blk_account_io_start(struct request *req) req->part = req->q->disk->part0; part_stat_lock(); - update_io_ticks(req->part, jiffies, false); + update_io_ticks(req->part, jiffies, false, precise); + if (precise) + part_stat_local_inc(req->part, + in_flight[op_is_write(req_op(req))]); part_stat_unlock(); } } diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c index 63e481262336..d3e07d865755 100644 --- a/block/blk-sysfs.c +++ b/block/blk-sysfs.c @@ -303,7 +303,6 @@ queue_##name##_store(struct request_queue *q, const char *page, size_t count) \ QUEUE_SYSFS_BIT_FNS(nonrot, NONROT, 1); QUEUE_SYSFS_BIT_FNS(random, ADD_RANDOM, 0); -QUEUE_SYSFS_BIT_FNS(iostats, IO_STAT, 0); QUEUE_SYSFS_BIT_FNS(stable_writes, STABLE_WRITES, 0); #undef QUEUE_SYSFS_BIT_FNS @@ -473,6 +472,43 @@ static ssize_t queue_dax_show(struct request_queue *q, char *page) return queue_var_show(blk_queue_dax(q), page); } +static ssize_t queue_iostats_show(struct request_queue *q, char *page) +{ + int val = 0; + + if (blk_queue_io_stat(q)) + val = blk_queue_precise_io_stat(q) ? 2 : 1; + + return sprintf(page, "%u\n", val); +} + +static ssize_t +queue_iostats_store(struct request_queue *q, const char *page, size_t count) +{ + unsigned long nr; + int ret; + + ret = queue_var_store(&nr, page, count); + if (ret < 0) + return ret; + + if (nr > 2) + return -EINVAL; + + if (nr == 0) { + blk_queue_flag_clear(QUEUE_FLAG_IO_STAT, q); + blk_queue_flag_clear(QUEUE_FLAG_PRECISE_IO_STAT, q); + } else if (nr == 1) { + blk_queue_flag_set(QUEUE_FLAG_IO_STAT, q); + blk_queue_flag_clear(QUEUE_FLAG_PRECISE_IO_STAT, q); + } else { + blk_queue_flag_set(QUEUE_FLAG_IO_STAT, q); + blk_queue_flag_set(QUEUE_FLAG_PRECISE_IO_STAT, q); + } + + return count; +} + #define QUEUE_RO_ENTRY(_prefix, _name) \ static struct queue_sysfs_entry _prefix##_entry = { \ .attr = { .name = _name, .mode = 0444 }, \ @@ -494,6 +530,7 @@ QUEUE_RO_ENTRY(queue_max_segments, "max_segments"); QUEUE_RO_ENTRY(queue_max_integrity_segments, "max_integrity_segments"); QUEUE_RO_ENTRY(queue_max_segment_size, "max_segment_size"); QUEUE_RW_ENTRY(elv_iosched, "scheduler"); +QUEUE_RW_ENTRY(queue_iostats, "iostats"); QUEUE_RO_ENTRY(queue_logical_block_size, "logical_block_size"); QUEUE_RO_ENTRY(queue_physical_block_size, "physical_block_size"); @@ -539,7 +576,6 @@ static struct queue_sysfs_entry queue_hw_sector_size_entry = { }; QUEUE_RW_ENTRY(queue_nonrot, "rotational"); -QUEUE_RW_ENTRY(queue_iostats, "iostats"); QUEUE_RW_ENTRY(queue_random, "add_random"); QUEUE_RW_ENTRY(queue_stable_writes, "stable_writes"); diff --git a/block/blk.h b/block/blk.h index 08a358bc0919..d2321709a9ce 100644 --- a/block/blk.h +++ b/block/blk.h @@ -343,7 +343,9 @@ static inline bool blk_do_io_stat(struct request *rq) return (rq->rq_flags & RQF_IO_STAT) && !blk_rq_is_passthrough(rq); } -void update_io_ticks(struct block_device *part, unsigned long now, bool end); +void update_io_ticks(struct block_device *part, unsigned long now, bool end, + bool precise); +unsigned int part_in_flight(struct block_device *part); static inline void req_set_nomerge(struct request_queue *q, struct request *req) { diff --git a/block/genhd.c b/block/genhd.c index 4a16a424f57d..5db94cb32634 100644 --- a/block/genhd.c +++ b/block/genhd.c @@ -118,7 +118,7 @@ static void part_stat_read_all(struct block_device *part, } } -static unsigned int part_in_flight(struct block_device *part) +unsigned int part_in_flight(struct block_device *part) { unsigned int inflight = 0; int cpu; @@ -955,7 +955,7 @@ ssize_t part_stat_show(struct device *dev, if (inflight) { part_stat_lock(); - update_io_ticks(bdev, jiffies, true); + update_io_ticks(bdev, jiffies, true, true); part_stat_unlock(); } part_stat_read_all(bdev, &stat); @@ -1248,7 +1248,7 @@ static int diskstats_show(struct seq_file *seqf, void *v) if (inflight) { part_stat_lock(); - update_io_ticks(hd, jiffies, true); + update_io_ticks(hd, jiffies, true, true); part_stat_unlock(); } part_stat_read_all(hd, &stat); diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h index 65e95a2c4718..83e36851c129 100644 --- a/include/linux/blk-mq.h +++ b/include/linux/blk-mq.h @@ -46,6 +46,7 @@ typedef __u32 __bitwise req_flags_t; #define RQF_QUIET ((__force req_flags_t)(1 << 11)) /* account into disk and partition IO statistics */ #define RQF_IO_STAT ((__force req_flags_t)(1 << 13)) +#define RQF_PRECISE_IO_STAT ((__force req_flags_t)(1 << 14)) /* runtime pm request */ #define RQF_PM ((__force req_flags_t)(1 << 15)) /* on IO scheduler merge hash */ diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h index 9f3bcbcb156d..bea0b5fdac74 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h @@ -536,6 +536,7 @@ struct request_queue { #define QUEUE_FLAG_NONROT 6 /* non-rotational device (SSD) */ #define QUEUE_FLAG_VIRT QUEUE_FLAG_NONROT /* paravirt device */ #define QUEUE_FLAG_IO_STAT 7 /* do disk/partitions IO accounting */ +#define QUEUE_FLAG_PRECISE_IO_STAT 8 /* do disk/partitions IO accounting precisely */ #define QUEUE_FLAG_NOXMERGES 9 /* No extended merges */ #define QUEUE_FLAG_ADD_RANDOM 10 /* Contributes to random pool */ #define QUEUE_FLAG_SYNCHRONOUS 11 /* always completes in submit context */ @@ -576,6 +577,8 @@ bool blk_queue_flag_test_and_set(unsigned int flag, struct request_queue *q); #define blk_queue_stable_writes(q) \ test_bit(QUEUE_FLAG_STABLE_WRITES, &(q)->queue_flags) #define blk_queue_io_stat(q) test_bit(QUEUE_FLAG_IO_STAT, &(q)->queue_flags) +#define blk_queue_precise_io_stat(q) \ + test_bit(QUEUE_FLAG_PRECISE_IO_STAT, &(q)->queue_flags) #define blk_queue_add_random(q) test_bit(QUEUE_FLAG_ADD_RANDOM, &(q)->queue_flags) #define blk_queue_zone_resetall(q) \ test_bit(QUEUE_FLAG_ZONE_RESETALL, &(q)->queue_flags) -- 2.39.2

1 0

[PATCH OLK-6.6 0/1] crypto: kabi: KABI reservation for crypto
by GUO Zihua 26 Dec '23

26 Dec '23

This patchset reserves some KABI space for future crypto development. GUO Zihua (1): crypto: kabi: KABI reservation for crypto include/crypto/aead.h | 3 +++ include/crypto/akcipher.h | 4 ++++ include/crypto/algapi.h | 4 ++++ include/crypto/hash.h | 2 ++ include/crypto/if_alg.h | 3 +++ include/crypto/public_key.h | 3 +++ include/crypto/rng.h | 2 ++ include/crypto/skcipher.h | 3 +++ include/linux/crypto.h | 2 ++ include/linux/kernel_read_file.h | 3 +++ include/linux/kexec.h | 5 +++++ 11 files changed, 34 insertions(+) -- 2.34.1

2 2