- Kernel - mailweb.openeuler.org

[PATCH] sched: optimise the way to get util
by Wang ShaoBo 15 Mar '23

15 Mar '23

From: tanghui <tanghui20(a)huawei.com> sched: optimise the way to get util, which only canbe used when CONFIG_QOS_SCHED_DYNAMIC_AFFINITY is set. Signed-off-by: tanghui <tanghui20(a)huawei.com> --- fs/proc/stat.c | 4 ++ include/linux/sched/cputime.h | 3 ++ include/linux/sched/sysctl.h | 2 + kernel/sched/fair.c | 97 ++++++++++++++++++++++++++++++----- kernel/sched/sched.h | 1 + kernel/sysctl.c | 9 ++++ 6 files changed, 104 insertions(+), 12 deletions(-) diff --git a/fs/proc/stat.c b/fs/proc/stat.c index c83a10e895f4..2eaba2b78f47 100644 --- a/fs/proc/stat.c +++ b/fs/proc/stat.c @@ -63,7 +63,11 @@ u64 get_idle_time(int cpu) return idle; } +#ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY +u64 get_iowait_time(int cpu) +#else static u64 get_iowait_time(int cpu) +#endif { u64 iowait, iowait_usecs = -1ULL; diff --git a/include/linux/sched/cputime.h b/include/linux/sched/cputime.h index 1ebbeec02051..f6244d48f357 100644 --- a/include/linux/sched/cputime.h +++ b/include/linux/sched/cputime.h @@ -190,5 +190,8 @@ extern int use_sched_idle_time; extern int sched_idle_time_adjust(int cpu, u64 *utime, u64 *stime); extern unsigned long long sched_get_idle_time(int cpu); extern u64 get_idle_time(int cpu); +#ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY +extern u64 get_iowait_time(int cpu); +#endif #endif /* _LINUX_SCHED_CPUTIME_H */ diff --git a/include/linux/sched/sysctl.h b/include/linux/sched/sysctl.h index f5031a607df8..386ef53017ca 100644 --- a/include/linux/sched/sysctl.h +++ b/include/linux/sched/sysctl.h @@ -28,6 +28,8 @@ extern unsigned int sysctl_sched_child_runs_first; extern int sysctl_sched_util_low_pct; extern int sysctl_sched_util_higher_pct; extern int sysctl_sched_load_higher_pct; +extern int sysctl_sched_util_update_interval; +extern unsigned long sysctl_sched_util_update_interval_max; #endif enum sched_tunable_scaling { diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 5344a68a463e..3217e3998fdf 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -6458,6 +6458,15 @@ static int wake_cap(struct task_struct *p, int cpu, int prev_cpu) } #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY +#define UTIL_PCT_HIGH 85 + +struct cpu_timeinfo { + u64 systime; + u64 idletime; + unsigned long next_update; + int vutil; +}; + /* * Light load threshold for CPU: just use cpu Utilization to measure * @@ -6484,15 +6493,75 @@ int sysctl_sched_util_higher_pct = 100; */ int sysctl_sched_load_higher_pct = 10; +/* + * The time interval to update CPU utilization + * (default 1ms, max 10min) + */ +int sysctl_sched_util_update_interval = 1; +unsigned long sysctl_sched_util_update_interval_max = 600000; + +static DEFINE_PER_CPU(struct cpu_timeinfo, qos_cputime); + +static inline u64 cpu_systime(int cpu) +{ + u64 user, nice, system, idle, iowait, irq, softirq, steal; + + user = kcpustat_cpu(cpu).cpustat[CPUTIME_USER]; + system = kcpustat_cpu(cpu).cpustat[CPUTIME_SYSTEM]; + iowait = get_iowait_time(cpu); + irq = kcpustat_cpu(cpu).cpustat[CPUTIME_IRQ]; + softirq = kcpustat_cpu(cpu).cpustat[CPUTIME_SOFTIRQ]; + nice = kcpustat_cpu(cpu).cpustat[CPUTIME_NICE]; + steal = kcpustat_cpu(cpu).cpustat[CPUTIME_STEAL]; + idle = get_idle_time(cpu); + + return user + system + iowait + irq + softirq + nice + idle + steal; +} + +static inline u64 cpu_idletime(int cpu) +{ + return get_idle_time(cpu) + get_iowait_time(cpu); +} + +static inline void update_cpu_vutil(void) +{ + struct cpu_timeinfo *cputime = per_cpu_ptr(&qos_cputime, smp_processor_id()); + u64 delta_systime, delta_idle, systime, idletime; + int cpu = smp_processor_id(); + unsigned long interval; + + if (time_after(jiffies, cputime->next_update)) { + interval = msecs_to_jiffies(sysctl_sched_util_update_interval); + cputime->next_update = jiffies + interval; + systime = cpu_systime(cpu); + idletime = cpu_idletime(cpu); + delta_systime = systime - cputime->systime; + delta_idle = idletime - cputime->idletime; + if (!delta_systime) + return; + + cputime->systime = systime; + cputime->idletime = idletime; + cputime->vutil = (delta_systime - delta_idle) * 100 / delta_systime; + } +} + +static inline int cpu_vutil_of(int cpu) +{ + struct cpu_timeinfo *cputime = per_cpu_ptr(&qos_cputime, cpu); + + return cputime->vutil; +} + static inline bool prefer_cpu_util_low(int cpu) { unsigned long capacity = capacity_of(cpu); - unsigned long util = cpu_util(cpu); + unsigned long util_pct = cpu_vutil_of(cpu); - if (util >= capacity || capacity <= 1) + if (util_pct >= 100 || capacity <= 1) return sysctl_sched_util_low_pct == 100; - return util * 100 <= capacity * sysctl_sched_util_low_pct; + return util_pct <= sysctl_sched_util_low_pct; } /* @@ -6504,8 +6573,8 @@ static inline int compare_cpu_util(int preferred_cpu, int external_cpu) { unsigned long capacity_cpux = capacity_of(preferred_cpu); unsigned long capacity_cpuy = capacity_of(external_cpu); - unsigned long cpu_util_x = cpu_util(preferred_cpu); - unsigned long cpu_util_y = cpu_util(external_cpu); + unsigned long cpu_util_x = cpu_vutil_of(preferred_cpu); + unsigned long cpu_util_y = cpu_vutil_of(external_cpu); int ratio; /* @@ -6519,7 +6588,7 @@ static inline int compare_cpu_util(int preferred_cpu, int external_cpu) if (capacity_cpux <= 1) return 1; - if (cpu_util_x >= capacity_cpux && available_idle_cpu(external_cpu)) + if (cpu_util_x >= UTIL_PCT_HIGH && available_idle_cpu(external_cpu)) return 1; if (!cpu_util_x) @@ -6529,12 +6598,12 @@ static inline int compare_cpu_util(int preferred_cpu, int external_cpu) * The lower the CPU utilization, the larger the ratio of * CPU utilization gap. */ - ratio = cpu_util_x >= capacity_cpux ? 1 : capacity_cpux / cpu_util_x; + ratio = cpu_util_x >= 100 ? 0 : 100 / cpu_util_x; if (ratio > 10) ratio = 10; - return (sysctl_sched_util_higher_pct * ratio + 100) * cpu_util_y * - capacity_cpux < 100 * cpu_util_x * capacity_cpuy; + return (sysctl_sched_util_higher_pct * ratio + 100) * + cpu_util_y * capacity_cpux < 100 * cpu_util_x * capacity_cpuy; } static inline bool prefer_cpus_valid(struct task_struct *p) @@ -6549,7 +6618,7 @@ static inline bool prefer_cpus_valid(struct task_struct *p) * @p: the task whose available cpu range will to set * @idlest_cpu: the cpu which is the idlest in prefer cpus * - * x: the cpu of min util_avg from preferred set + * x: the cpu of min util from preferred set * y: the cpu from allowed set but exclude preferred set * * If x's utilization is low, select preferred cpu range for task @@ -6578,7 +6647,7 @@ static void set_task_select_cpus(struct task_struct *p, int *idlest_cpu, goto cpus_allowed; cpu = cpumask_first(p->se.prefer_cpus); - min_util = cpu_util(cpu); + min_util = cpu_vutil_of(cpu); for_each_cpu(i, p->se.prefer_cpus) { if (prefer_cpu_util_low(i) || available_idle_cpu(i)) { cpu = i; @@ -6589,7 +6658,7 @@ static void set_task_select_cpus(struct task_struct *p, int *idlest_cpu, if (capacity_of(i) <= 1) continue; - c_util = cpu_util(i); + c_util = cpu_vutil_of(i); if (min_util * capacity_of(i) > c_util * capacity_of(cpu)) { min_util = c_util; cpu = i; @@ -10278,6 +10347,10 @@ static void task_tick_fair(struct rq *rq, struct task_struct *curr, int queued) if (static_branch_unlikely(&sched_numa_balancing)) task_tick_numa(rq, curr); + +#ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY + update_cpu_vutil(); +#endif } /* diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index 55216a03d327..4de9c966da01 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -2348,3 +2348,4 @@ static inline void membarrier_switch_mm(struct rq *rq, { } #endif + diff --git a/kernel/sysctl.c b/kernel/sysctl.c index b309aa206697..d52e003f3f56 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -1274,6 +1274,15 @@ static struct ctl_table kern_table[] = { .extra1 = &zero, .extra2 = &one_hundred, }, + { + .procname = "sched_util_update_interval_ms", + .data = &sysctl_sched_util_update_interval, + .maxlen = sizeof(sysctl_sched_util_update_interval), + .mode = 0644, + .proc_handler = proc_dointvec_minmax, + .extra1 = &one, + .extra2 = &sysctl_sched_util_update_interval_max, + }, #endif #endif { } -- 2.23.0

1 0

[PATCH openEuler-1.0-LTS 1/2] scsi: fix use-after-free problem in scsi_remove_target
by Yongqiang Liu 13 Mar '23

13 Mar '23

From: Zhong Jinghua <zhongjinghua(a)huawei.com> hulk inclusion category: bugfix bugzilla: 188355, https://gitee.com/openeuler/kernel/issues/I6E4JF CVE: NA ---------------------------------------- A use-after-free problem like below: BUG: KASAN: use-after-free in scsi_target_reap+0x6c/0x70 Workqueue: scsi_wq_1 __iscsi_unbind_session [scsi_transport_iscsi] Call trace: dump_backtrace+0x0/0x320 show_stack+0x24/0x30 dump_stack+0xdc/0x128 print_address_description+0x68/0x278 kasan_report+0x1e4/0x308 __asan_report_load4_noabort+0x30/0x40 scsi_target_reap+0x6c/0x70 scsi_remove_target+0x430/0x640 __iscsi_unbind_session+0x164/0x268 [scsi_transport_iscsi] process_one_work+0x67c/0x1350 worker_thread+0x370/0xf90 kthread+0x2a4/0x320 ret_from_fork+0x10/0x18 The problem is caused by a concurrency scenario: T0: delete target // echo 1 > /sys/devices/platform/host1/session1/target1:0:0/1:0:0:1/delete T1: logout // iscsiadm -m node --logout T0 T1 sdev_store_delete scsi_remove_device device_remove_file __scsi_remove_device __iscsi_unbind_session scsi_remove_target spin_lock_irqsave list_for_each_entry scsi_target_reap // starget->reap_ref 1 -> 0 kref_get(&starget->reap_ref); // warn use-after-free. spin_unlock_irqrestore scsi_target_reap_ref_release scsi_target_destroy ... // delete starget scsi_target_reap // UAF When T0 reduces the reference count to 0, but has not been released, T1 can still enter list_for_each_entry, and then kref_get reports UAF. Fix it by using kref_get_unless_zero() to check for a reference count of 0. Signed-off-by: Zhong Jinghua <zhongjinghua(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/scsi/scsi_sysfs.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c index 4030e1fa57e5..453f5a6fb96b 100644 --- a/drivers/scsi/scsi_sysfs.c +++ b/drivers/scsi/scsi_sysfs.c @@ -1500,7 +1500,16 @@ void scsi_remove_target(struct device *dev) starget->state == STARGET_CREATED_REMOVE) continue; if (starget->dev.parent == dev || &starget->dev == dev) { - kref_get(&starget->reap_ref); + /* + * If the reference count is already zero, skip + * this target. Calling kref_get_unless_zero() if + * the reference count is zero is safe because + * scsi_target_destroy() will wait until the host + * lock has been released before freeing starget. + */ + if (!kref_get_unless_zero(&starget->reap_ref)) + continue; + if (starget->state == STARGET_CREATED) starget->state = STARGET_CREATED_REMOVE; else -- 2.25.1

1 1

[OLK-5.10 v1] RDMA/hns: Support congestion control algorithm parameter configuration
by Chengchang Tang 13 Mar '23

13 Mar '23

driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I6J5O7 --------------------------------------------------------------- hns roce support 4 congestion control algorithms. Each algorihm involves multiple parameters. This patch add port sysfs directory for each algorithm, which allows users to modify the parameters of these algorithms. Signed-off-by: Chengchang Tang <tangchengchang(a)huawei.com> Reviewed-by: Yangyang Li <liyangyang20(a)huawei.com> --- drivers/infiniband/hw/hns/Makefile | 2 +- drivers/infiniband/hw/hns/hns_roce_device.h | 42 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 77 ++++ drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 132 ++++++ drivers/infiniband/hw/hns/hns_roce_main.c | 2 + drivers/infiniband/hw/hns/hns_roce_sysfs.c | 445 ++++++++++++++++++++ 6 files changed, 695 insertions(+), 5 deletions(-) create mode 100644 drivers/infiniband/hw/hns/hns_roce_sysfs.c diff --git a/drivers/infiniband/hw/hns/Makefile b/drivers/infiniband/hw/hns/Makefile index 77d8e41ffe7b..09f95fedd15d 100644 --- a/drivers/infiniband/hw/hns/Makefile +++ b/drivers/infiniband/hw/hns/Makefile @@ -10,7 +10,7 @@ ccflags-y += -I $(srctree)/drivers/net/ethernet/hisilicon/hns3/hns3_common hns-roce-objs := hns_roce_main.o hns_roce_cmd.o hns_roce_pd.o \ hns_roce_ah.o hns_roce_hem.o hns_roce_mr.o hns_roce_qp.o \ hns_roce_cq.o hns_roce_alloc.o hns_roce_db.o hns_roce_srq.o hns_roce_restrack.o \ - hns_roce_bond.o hns_roce_dca.o hns_roce_debugfs.o + hns_roce_bond.o hns_roce_dca.o hns_roce_debugfs.o hns_roce_sysfs.o ifdef CONFIG_INFINIBAND_HNS_HIP08 hns-roce-hw-v2-objs := hns_roce_hw_v2.o $(hns-roce-objs) diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h index 869d952b32b2..9d5580040e6b 100644 --- a/drivers/infiniband/hw/hns/hns_roce_device.h +++ b/drivers/infiniband/hw/hns/hns_roce_device.h @@ -767,11 +767,19 @@ struct hns_roce_eq_table { struct hns_roce_eq *eq; }; +enum hns_roce_scc_algo { + HNS_ROCE_SCC_ALGO_DCQCN = 0, + HNS_ROCE_SCC_ALGO_LDCP, + HNS_ROCE_SCC_ALGO_HC3, + HNS_ROCE_SCC_ALGO_DIP, + HNS_ROCE_SCC_ALGO_TOTAL, +}; + enum cong_type { - CONG_TYPE_DCQCN, - CONG_TYPE_LDCP, - CONG_TYPE_HC3, - CONG_TYPE_DIP, + CONG_TYPE_DCQCN = 1 << HNS_ROCE_SCC_ALGO_DCQCN, + CONG_TYPE_LDCP = 1 << HNS_ROCE_SCC_ALGO_LDCP, + CONG_TYPE_HC3 = 1 << HNS_ROCE_SCC_ALGO_HC3, + CONG_TYPE_DIP = 1 << HNS_ROCE_SCC_ALGO_DIP, }; struct hns_roce_caps { @@ -1016,6 +1024,28 @@ struct hns_roce_hw { int (*bond_init)(struct hns_roce_dev *hr_dev); bool (*bond_is_active)(struct hns_roce_dev *hr_dev); struct net_device *(*get_bond_netdev)(struct hns_roce_dev *hr_dev); + int (*config_scc_param)(struct hns_roce_dev *hr_dev, u8 port_num, + enum hns_roce_scc_algo algo); + int (*query_scc_param)(struct hns_roce_dev *hr_dev, u8 port_num, + enum hns_roce_scc_algo alog); +}; + +#define HNS_ROCE_SCC_PARAM_SIZE 4 +struct hns_roce_scc_param { + __le32 param[HNS_ROCE_SCC_PARAM_SIZE]; + u32 lifespan; + unsigned long timestamp; + enum hns_roce_scc_algo algo_type; + struct delayed_work scc_cfg_dwork; + struct hns_roce_dev *hr_dev; + u8 port_num; +}; + +struct hns_roce_port { + struct hns_roce_dev *hr_dev; + u8 port_num; + struct kobject kobj; + struct hns_roce_scc_param *scc_param; }; struct hns_roce_dev { @@ -1094,6 +1124,7 @@ struct hns_roce_dev { struct delayed_work bond_work; struct hns_roce_bond_group *bond_grp; struct netdev_lag_lower_state_info slave_state; + struct hns_roce_port port_data[HNS_ROCE_MAX_PORTS]; atomic64_t *dfx_cnt; }; @@ -1379,4 +1410,7 @@ struct hns_user_mmap_entry * hns_roce_user_mmap_entry_insert(struct ib_ucontext *ucontext, u64 address, size_t length, enum hns_roce_mmap_type mmap_type); +int hns_roce_create_port_files(struct ib_device *ibdev, u8 port_num, + struct kobject *kobj); +void hns_roce_unregister_sysfs(struct hns_roce_dev *hr_dev); #endif /* _HNS_ROCE_DEVICE_H */ diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c index a76a57c7e36a..c9826a010f38 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c @@ -7146,6 +7146,81 @@ static void hns_roce_v2_cleanup_eq_table(struct hns_roce_dev *hr_dev) kfree(eq_table->eq); } +static enum hns_roce_opcode_type scc_opcode[] = { + HNS_ROCE_OPC_CFG_DCQCN_PARAM, + HNS_ROCE_OPC_CFG_LDCP_PARAM, + HNS_ROCE_OPC_CFG_HC3_PARAM, + HNS_ROCE_OPC_CFG_DIP_PARAM, +}; + +static int hns_roce_v2_config_scc_param(struct hns_roce_dev *hr_dev, + u8 port_num, + enum hns_roce_scc_algo algo) +{ + struct hns_roce_scc_param *scc_param; + struct hns_roce_cmq_desc desc; + struct hns_roce_port *pdata; + int ret; + + if (port_num > hr_dev->caps.num_ports) { + ibdev_err_ratelimited(&hr_dev->ib_dev, + "invalid port num %u.\n", port_num); + return -ENODEV; + } + + if (algo >= HNS_ROCE_SCC_ALGO_TOTAL) { + ibdev_err_ratelimited(&hr_dev->ib_dev, "invalid SCC algo.\n"); + return -EINVAL; + } + + hns_roce_cmq_setup_basic_desc(&desc, scc_opcode[algo], false); + pdata = &hr_dev->port_data[port_num - 1]; + scc_param = &pdata->scc_param[algo]; + memcpy(&desc.data, scc_param, sizeof(scc_param->param)); + + ret = hns_roce_cmq_send(hr_dev, &desc, 1); + if (ret) + ibdev_err_ratelimited(&hr_dev->ib_dev, + "failed to configure scc param, opcode: 0x%x, ret = %d.\n", + le16_to_cpu(desc.opcode), ret); + return ret; +} + +static int hns_roce_v2_query_scc_param(struct hns_roce_dev *hr_dev, + u8 port_num, enum hns_roce_scc_algo algo) +{ + struct hns_roce_scc_param *scc_param; + struct hns_roce_cmq_desc desc; + struct hns_roce_port *pdata; + int ret; + + if (port_num > hr_dev->caps.num_ports) { + ibdev_err_ratelimited(&hr_dev->ib_dev, + "invalid port num %u.\n", port_num); + return -ENODEV; + } + + if (algo >= HNS_ROCE_SCC_ALGO_TOTAL) { + ibdev_err_ratelimited(&hr_dev->ib_dev, "invalid SCC algo.\n"); + return -EINVAL; + } + + hns_roce_cmq_setup_basic_desc(&desc, scc_opcode[algo], true); + ret = hns_roce_cmq_send(hr_dev, &desc, 1); + if (ret) { + ibdev_err_ratelimited(&hr_dev->ib_dev, + "failed to query scc param, opcode: 0x%x, ret = %d.\n", + le16_to_cpu(desc.opcode), ret); + return ret; + } + + pdata = &hr_dev->port_data[port_num - 1]; + scc_param = &pdata->scc_param[algo]; + memcpy(scc_param, &desc.data, sizeof(scc_param->param)); + + return 0; +} + static const struct ib_device_ops hns_roce_v2_dev_ops = { .destroy_qp = hns_roce_v2_destroy_qp, .modify_cq = hns_roce_v2_modify_cq, @@ -7198,6 +7273,8 @@ static const struct hns_roce_hw hns_roce_hw_v2 = { .bond_is_active = hns_roce_bond_is_active, .get_bond_netdev = hns_roce_get_bond_netdev, .query_hw_counter = hns_roce_hw_v2_query_counter, + .config_scc_param = hns_roce_v2_config_scc_param, + .query_scc_param = hns_roce_v2_query_scc_param, }; static const struct pci_device_id hns_roce_hw_v2_pci_tbl[] = { diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h index 7d5c304a8342..90401577865e 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h @@ -227,6 +227,10 @@ enum { enum hns_roce_opcode_type { HNS_QUERY_FW_VER = 0x0001, HNS_QUERY_MAC_TYPE = 0x0389, + HNS_ROCE_OPC_CFG_DCQCN_PARAM = 0x1A80, + HNS_ROCE_OPC_CFG_LDCP_PARAM = 0x1A81, + HNS_ROCE_OPC_CFG_HC3_PARAM = 0x1A82, + HNS_ROCE_OPC_CFG_DIP_PARAM = 0x1A83, HNS_ROCE_OPC_QUERY_HW_VER = 0x8000, HNS_ROCE_OPC_CFG_GLOBAL_PARAM = 0x8001, HNS_ROCE_OPC_ALLOC_PF_RES = 0x8004, @@ -1468,6 +1472,134 @@ struct hns_roce_wqe_atomic_seg { __le64 cmp_data; }; +#define HNS_ROCE_DCQCN_AI_OFS 0 +#define HNS_ROCE_DCQCN_AI_SZ sizeof(u16) +#define HNS_ROCE_DCQCN_AI_MAX ((u16)(~0U)) +#define HNS_ROCE_DCQCN_F_OFS (HNS_ROCE_DCQCN_AI_OFS + HNS_ROCE_DCQCN_AI_SZ) +#define HNS_ROCE_DCQCN_F_SZ sizeof(u8) +#define HNS_ROCE_DCQCN_F_MAX ((u8)(~0U)) +#define HNS_ROCE_DCQCN_TKP_OFS (HNS_ROCE_DCQCN_F_OFS + HNS_ROCE_DCQCN_F_SZ) +#define HNS_ROCE_DCQCN_TKP_SZ sizeof(u8) +#define HNS_ROCE_DCQCN_TKP_MAX 15 +#define HNS_ROCE_DCQCN_TMP_OFS (HNS_ROCE_DCQCN_TKP_OFS + HNS_ROCE_DCQCN_TKP_SZ) +#define HNS_ROCE_DCQCN_TMP_SZ sizeof(u16) +#define HNS_ROCE_DCQCN_TMP_MAX 15 +#define HNS_ROCE_DCQCN_ALP_OFS (HNS_ROCE_DCQCN_TMP_OFS + HNS_ROCE_DCQCN_TMP_SZ) +#define HNS_ROCE_DCQCN_ALP_SZ sizeof(u16) +#define HNS_ROCE_DCQCN_ALP_MAX ((u16)(~0U)) +#define HNS_ROCE_DCQCN_MAX_SPEED_OFS (HNS_ROCE_DCQCN_ALP_OFS + \ + HNS_ROCE_DCQCN_ALP_SZ) +#define HNS_ROCE_DCQCN_MAX_SPEED_SZ sizeof(u32) +#define HNS_ROCE_DCQCN_MAX_SPEED_MAX ((u32)(~0U)) +#define HNS_ROCE_DCQCN_G_OFS (HNS_ROCE_DCQCN_MAX_SPEED_OFS + \ + HNS_ROCE_DCQCN_MAX_SPEED_SZ) +#define HNS_ROCE_DCQCN_G_SZ sizeof(u8) +#define HNS_ROCE_DCQCN_G_MAX 15 +#define HNS_ROCE_DCQCN_AL_OFS (HNS_ROCE_DCQCN_G_OFS + HNS_ROCE_DCQCN_G_SZ) +#define HNS_ROCE_DCQCN_AL_SZ sizeof(u8) +#define HNS_ROCE_DCQCN_AL_MAX ((u8)(~0U)) +#define HNS_ROCE_DCQCN_CNP_TIME_OFS (HNS_ROCE_DCQCN_AL_OFS + \ + HNS_ROCE_DCQCN_AL_SZ) +#define HNS_ROCE_DCQCN_CNP_TIME_SZ sizeof(u8) +#define HNS_ROCE_DCQCN_CNP_TIME_MAX ((u8)(~0U)) +#define HNS_ROCE_DCQCN_ASHIFT_OFS (HNS_ROCE_DCQCN_CNP_TIME_OFS + \ + HNS_ROCE_DCQCN_CNP_TIME_SZ) +#define HNS_ROCE_DCQCN_ASHIFT_SZ sizeof(u8) +#define HNS_ROCE_DCQCN_ASHIFT_MAX 15 +#define HNS_ROCE_DCQCN_LIFESPAN_OFS (HNS_ROCE_DCQCN_ASHIFT_OFS + \ + HNS_ROCE_DCQCN_ASHIFT_SZ) +#define HNS_ROCE_DCQCN_LIFESPAN_SZ sizeof(u32) +#define HNS_ROCE_DCQCN_LIFESPAN_MAX 1000 + +#define HNS_ROCE_LDCP_CWD0_OFS 0 +#define HNS_ROCE_LDCP_CWD0_SZ sizeof(u32) +#define HNS_ROCE_LDCP_CWD0_MAX ((u32)(~0U)) +#define HNS_ROCE_LDCP_ALPHA_OFS (HNS_ROCE_LDCP_CWD0_OFS + HNS_ROCE_LDCP_CWD0_SZ) +#define HNS_ROCE_LDCP_ALPHA_SZ sizeof(u8) +#define HNS_ROCE_LDCP_ALPHA_MAX ((u8)(~0U)) +#define HNS_ROCE_LDCP_GAMMA_OFS (HNS_ROCE_LDCP_ALPHA_OFS + \ + HNS_ROCE_LDCP_ALPHA_SZ) +#define HNS_ROCE_LDCP_GAMMA_SZ sizeof(u8) +#define HNS_ROCE_LDCP_GAMMA_MAX ((u8)(~0U)) +#define HNS_ROCE_LDCP_BETA_OFS (HNS_ROCE_LDCP_GAMMA_OFS + \ + HNS_ROCE_LDCP_GAMMA_SZ) +#define HNS_ROCE_LDCP_BETA_SZ sizeof(u8) +#define HNS_ROCE_LDCP_BETA_MAX ((u8)(~0U)) +#define HNS_ROCE_LDCP_ETA_OFS (HNS_ROCE_LDCP_BETA_OFS + HNS_ROCE_LDCP_BETA_SZ) +#define HNS_ROCE_LDCP_ETA_SZ sizeof(u8) +#define HNS_ROCE_LDCP_ETA_MAX ((u8)(~0U)) +#define HNS_ROCE_LDCP_LIFESPAN_OFS (4 * sizeof(u32)) +#define HNS_ROCE_LDCP_LIFESPAN_SZ sizeof(u32) +#define HNS_ROCE_LDCP_LIFESPAN_MAX 1000 + +#define HNS_ROCE_HC3_INITIAL_WINDOW_OFS 0 +#define HNS_ROCE_HC3_INITIAL_WINDOW_SZ sizeof(u32) +#define HNS_ROCE_HC3_INITIAL_WINDOW_MAX ((u32)(~0U)) +#define HNS_ROCE_HC3_BANDWIDTH_OFS (HNS_ROCE_HC3_INITIAL_WINDOW_OFS + \ + HNS_ROCE_HC3_INITIAL_WINDOW_SZ) +#define HNS_ROCE_HC3_BANDWIDTH_SZ sizeof(u32) +#define HNS_ROCE_HC3_BANDWIDTH_MAX ((u32)(~0U)) +#define HNS_ROCE_HC3_QLEN_SHIFT_OFS (HNS_ROCE_HC3_BANDWIDTH_OFS + \ + HNS_ROCE_HC3_BANDWIDTH_SZ) +#define HNS_ROCE_HC3_QLEN_SHIFT_SZ sizeof(u8) +#define HNS_ROCE_HC3_QLEN_SHIFT_MAX ((u8)(~0U)) +#define HNS_ROCE_HC3_PORT_USAGE_SHIFT_OFS (HNS_ROCE_HC3_QLEN_SHIFT_OFS + \ + HNS_ROCE_HC3_QLEN_SHIFT_SZ) +#define HNS_ROCE_HC3_PORT_USAGE_SHIFT_SZ sizeof(u8) +#define HNS_ROCE_HC3_PORT_USAGE_SHIFT_MAX ((u8)(~0U)) +#define HNS_ROCE_HC3_OVER_PERIOD_OFS (HNS_ROCE_HC3_PORT_USAGE_SHIFT_OFS + \ + HNS_ROCE_HC3_PORT_USAGE_SHIFT_SZ) +#define HNS_ROCE_HC3_OVER_PERIOD_SZ sizeof(u8) +#define HNS_ROCE_HC3_OVER_PERIOD_MAX ((u8)(~0U)) +#define HNS_ROCE_HC3_MAX_STAGE_OFS (HNS_ROCE_HC3_OVER_PERIOD_OFS + \ + HNS_ROCE_HC3_OVER_PERIOD_SZ) +#define HNS_ROCE_HC3_MAX_STAGE_SZ sizeof(u8) +#define HNS_ROCE_HC3_MAX_STAGE_MAX ((u8)(~0U)) +#define HNS_ROCE_HC3_GAMMA_SHIFT_OFS (HNS_ROCE_HC3_MAX_STAGE_OFS + \ + HNS_ROCE_HC3_MAX_STAGE_SZ) +#define HNS_ROCE_HC3_GAMMA_SHIFT_SZ sizeof(u8) +#define HNS_ROCE_HC3_GAMMA_SHIFT_MAX 15 +#define HNS_ROCE_HC3_LIFESPAN_OFS (4 * sizeof(u32)) +#define HNS_ROCE_HC3_LIFESPAN_SZ sizeof(u32) +#define HNS_ROCE_HC3_LIFESPAN_MAX 1000 + +#define HNS_ROCE_DIP_AI_OFS 0 +#define HNS_ROCE_DIP_AI_SZ sizeof(u16) +#define HNS_ROCE_DIP_AI_MAX ((u16)(~0U)) +#define HNS_ROCE_DIP_F_OFS (HNS_ROCE_DIP_AI_OFS + HNS_ROCE_DIP_AI_SZ) +#define HNS_ROCE_DIP_F_SZ sizeof(u8) +#define HNS_ROCE_DIP_F_MAX ((u8)(~0U)) +#define HNS_ROCE_DIP_TKP_OFS (HNS_ROCE_DIP_F_OFS + HNS_ROCE_DIP_F_SZ) +#define HNS_ROCE_DIP_TKP_SZ sizeof(u8) +#define HNS_ROCE_DIP_TKP_MAX 15 +#define HNS_ROCE_DIP_TMP_OFS (HNS_ROCE_DIP_TKP_OFS + HNS_ROCE_DIP_TKP_SZ) +#define HNS_ROCE_DIP_TMP_SZ sizeof(u16) +#define HNS_ROCE_DIP_TMP_MAX 15 +#define HNS_ROCE_DIP_ALP_OFS (HNS_ROCE_DIP_TMP_OFS + HNS_ROCE_DIP_TMP_SZ) +#define HNS_ROCE_DIP_ALP_SZ sizeof(u16) +#define HNS_ROCE_DIP_ALP_MAX ((u16)(~0U)) +#define HNS_ROCE_DIP_MAX_SPEED_OFS (HNS_ROCE_DIP_ALP_OFS + HNS_ROCE_DIP_ALP_SZ) +#define HNS_ROCE_DIP_MAX_SPEED_SZ sizeof(u32) +#define HNS_ROCE_DIP_MAX_SPEED_MAX ((u32)(~0U)) +#define HNS_ROCE_DIP_G_OFS (HNS_ROCE_DIP_MAX_SPEED_OFS + \ + HNS_ROCE_DIP_MAX_SPEED_SZ) +#define HNS_ROCE_DIP_G_SZ sizeof(u8) +#define HNS_ROCE_DIP_G_MAX 15 +#define HNS_ROCE_DIP_AL_OFS (HNS_ROCE_DIP_G_OFS + HNS_ROCE_DIP_G_SZ) +#define HNS_ROCE_DIP_AL_SZ sizeof(u8) +#define HNS_ROCE_DIP_AL_MAX ((u8)(~0U)) +#define HNS_ROCE_DIP_CNP_TIME_OFS (HNS_ROCE_DIP_AL_OFS + HNS_ROCE_DIP_AL_SZ) +#define HNS_ROCE_DIP_CNP_TIME_SZ sizeof(u8) +#define HNS_ROCE_DIP_CNP_TIME_MAX ((u8)(~0U)) +#define HNS_ROCE_DIP_ASHIFT_OFS (HNS_ROCE_DIP_CNP_TIME_OFS + \ + HNS_ROCE_DIP_CNP_TIME_SZ) +#define HNS_ROCE_DIP_ASHIFT_SZ sizeof(u8) +#define HNS_ROCE_DIP_ASHIFT_MAX 15 +#define HNS_ROCE_DIP_LIFESPAN_OFS (HNS_ROCE_DIP_ASHIFT_OFS + \ + HNS_ROCE_DIP_ASHIFT_SZ) +#define HNS_ROCE_DIP_LIFESPAN_SZ sizeof(u32) +#define HNS_ROCE_DIP_LIFESPAN_MAX 1000 + struct hns_roce_sccc_clr { __le32 qpn; __le32 rsv[5]; diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c index d98825154a82..4d1d2629d8f0 100644 --- a/drivers/infiniband/hw/hns/hns_roce_main.c +++ b/drivers/infiniband/hw/hns/hns_roce_main.c @@ -870,6 +870,7 @@ static const struct ib_device_ops hns_roce_dev_ops = { .reg_user_mr = hns_roce_reg_user_mr, .alloc_hw_stats = hns_roce_alloc_hw_port_stats, .get_hw_stats = hns_roce_get_hw_stats, + .init_port = hns_roce_create_port_files, INIT_RDMA_OBJ_SIZE(ib_ah, hns_roce_ah, ibah), INIT_RDMA_OBJ_SIZE(ib_cq, hns_roce_cq, ib_cq), @@ -1441,6 +1442,7 @@ int hns_roce_init(struct hns_roce_dev *hr_dev) void hns_roce_exit(struct hns_roce_dev *hr_dev) { + hns_roce_unregister_sysfs(hr_dev); hns_roce_unregister_device(hr_dev); hns_roce_unregister_debugfs(hr_dev); diff --git a/drivers/infiniband/hw/hns/hns_roce_sysfs.c b/drivers/infiniband/hw/hns/hns_roce_sysfs.c new file mode 100644 index 000000000000..507cc7147a2e --- /dev/null +++ b/drivers/infiniband/hw/hns/hns_roce_sysfs.c @@ -0,0 +1,445 @@ +// SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB +/* + * Copyright (c) 2023 Hisilicon Limited. + */ + +#include "hnae3.h" +#include "hns_roce_device.h" +#include "hns_roce_hw_v2.h" + +struct hns_port_attribute { + struct attribute attr; + ssize_t (*show)(struct hns_roce_port *pdata, + struct hns_port_attribute *attr, char *buf); + ssize_t (*store)(struct hns_roce_port *pdata, + struct hns_port_attribute *attr, const char *buf, + size_t count); +}; + +static void scc_param_config_work(struct work_struct *work) +{ + struct hns_roce_scc_param *scc_param = container_of(work, + struct hns_roce_scc_param, scc_cfg_dwork.work); + struct hns_roce_dev *hr_dev = scc_param->hr_dev; + + hr_dev->hw->config_scc_param(hr_dev, scc_param->port_num, + scc_param->algo_type); +} + +static int alloc_scc_param(struct hns_roce_dev *hr_dev, + struct hns_roce_port *pdata) +{ + struct hns_roce_scc_param *scc_param; + int i; + + scc_param = kcalloc(HNS_ROCE_SCC_ALGO_TOTAL, sizeof(*scc_param), + GFP_KERNEL); + if (!scc_param) + return -ENOMEM; + + for (i = 0; i < HNS_ROCE_SCC_ALGO_TOTAL; i++) { + scc_param[i].algo_type = i; + scc_param[i].timestamp = jiffies; + scc_param[i].hr_dev = hr_dev; + scc_param[i].port_num = pdata->port_num; + INIT_DELAYED_WORK(&scc_param[i].scc_cfg_dwork, + scc_param_config_work); + } + + pdata->scc_param = scc_param; + return 0; +} + +struct hns_port_cc_attr { + struct hns_port_attribute port_attr; + enum hns_roce_scc_algo algo_type; + u32 offset; + u32 size; + u32 max; + u32 min; +}; + +static int scc_attr_check(struct hns_port_cc_attr *scc_attr) +{ + if (WARN_ON(scc_attr->size > sizeof(u32))) + return -EINVAL; + + if (WARN_ON(scc_attr->algo_type >= HNS_ROCE_SCC_ALGO_TOTAL)) + return -EINVAL; + return 0; +} + +static ssize_t scc_attr_show(struct hns_roce_port *pdata, + struct hns_port_attribute *attr, char *buf) +{ + struct hns_port_cc_attr *scc_attr = + container_of(attr, struct hns_port_cc_attr, port_attr); + struct hns_roce_scc_param *scc_param; + unsigned long exp_time; + __le32 val = 0; + int ret; + + ret = scc_attr_check(scc_attr); + if (ret) + return ret; + + scc_param = &pdata->scc_param[scc_attr->algo_type]; + + /* Only HW param need be queried */ + if (scc_attr->offset < offsetof(typeof(*scc_param), lifespan)) { + exp_time = scc_param->timestamp + + msecs_to_jiffies(scc_param->lifespan); + + if (time_is_before_eq_jiffies(exp_time)) { + scc_param->timestamp = jiffies; + pdata->hr_dev->hw->query_scc_param(pdata->hr_dev, + pdata->port_num, scc_attr->algo_type); + } + } + + memcpy(&val, (void *)scc_param + scc_attr->offset, scc_attr->size); + + return sysfs_emit(buf, "%u\n", le32_to_cpu(val)); +} + +static ssize_t scc_attr_store(struct hns_roce_port *pdata, + struct hns_port_attribute *attr, + const char *buf, size_t count) +{ + struct hns_port_cc_attr *scc_attr = + container_of(attr, struct hns_port_cc_attr, port_attr); + struct hns_roce_scc_param *scc_param; + unsigned long lifespan_jiffies; + unsigned long exp_time; + __le32 attr_val; + u32 val; + int ret; + + ret = scc_attr_check(scc_attr); + if (ret) + return ret; + + if (kstrtou32(buf, 0, &val)) + return -EINVAL; + + if (val > scc_attr->max || val < scc_attr->min) + return -EINVAL; + + attr_val = cpu_to_le32(val); + scc_param = &pdata->scc_param[scc_attr->algo_type]; + memcpy((void *)scc_param + scc_attr->offset, &attr_val, + scc_attr->size); + + /* lifespan is only used for driver */ + if (scc_attr->offset >= offsetof(typeof(*scc_param), lifespan)) + return count; + + lifespan_jiffies = msecs_to_jiffies(scc_param->lifespan); + exp_time = scc_param->timestamp + lifespan_jiffies; + + if (time_is_before_eq_jiffies(exp_time)) { + scc_param->timestamp = jiffies; + queue_delayed_work(pdata->hr_dev->irq_workq, + &scc_param->scc_cfg_dwork, lifespan_jiffies); + } + + return count; +} + +static umode_t scc_attr_is_visible(struct kobject *kobj, + struct attribute *attr, int i) +{ + struct hns_port_attribute *port_attr = + container_of(attr, struct hns_port_attribute, attr); + struct hns_port_cc_attr *scc_attr = + container_of(port_attr, struct hns_port_cc_attr, port_attr); + struct hns_roce_port *pdata = + container_of(kobj, struct hns_roce_port, kobj); + struct hns_roce_dev *hr_dev = pdata->hr_dev; + + if (hr_dev->is_vf || + !(hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_QP_FLOW_CTRL)) + return 0; + + if (!(hr_dev->caps.cong_type & (1 << scc_attr->algo_type))) + return 0; + + return 0644; +} + +#define __HNS_SCC_ATTR(_name, _type, _offset, _size, _min, _max) { \ + .port_attr = __ATTR(_name, 0644, scc_attr_show, scc_attr_store), \ + .algo_type = _type, \ + .offset = _offset, \ + .size = _size, \ + .min = _min, \ + .max = _max, \ +} + +#define HNS_PORT_DCQCN_CC_ATTR_RW(_name, NAME) \ + struct hns_port_cc_attr hns_roce_port_attr_dcqcn_##_name = \ + __HNS_SCC_ATTR(_name, HNS_ROCE_SCC_ALGO_DCQCN, \ + HNS_ROCE_DCQCN_##NAME##_OFS, \ + HNS_ROCE_DCQCN_##NAME##_SZ, \ + 0, HNS_ROCE_DCQCN_##NAME##_MAX) + +HNS_PORT_DCQCN_CC_ATTR_RW(ai, AI); +HNS_PORT_DCQCN_CC_ATTR_RW(f, F); +HNS_PORT_DCQCN_CC_ATTR_RW(tkp, TKP); +HNS_PORT_DCQCN_CC_ATTR_RW(tmp, TMP); +HNS_PORT_DCQCN_CC_ATTR_RW(alp, ALP); +HNS_PORT_DCQCN_CC_ATTR_RW(max_speed, MAX_SPEED); +HNS_PORT_DCQCN_CC_ATTR_RW(g, G); +HNS_PORT_DCQCN_CC_ATTR_RW(al, AL); +HNS_PORT_DCQCN_CC_ATTR_RW(cnp_time, CNP_TIME); +HNS_PORT_DCQCN_CC_ATTR_RW(ashift, ASHIFT); +HNS_PORT_DCQCN_CC_ATTR_RW(lifespan, LIFESPAN); + +static struct attribute *dcqcn_param_attrs[] = { + &hns_roce_port_attr_dcqcn_ai.port_attr.attr, + &hns_roce_port_attr_dcqcn_f.port_attr.attr, + &hns_roce_port_attr_dcqcn_tkp.port_attr.attr, + &hns_roce_port_attr_dcqcn_tmp.port_attr.attr, + &hns_roce_port_attr_dcqcn_alp.port_attr.attr, + &hns_roce_port_attr_dcqcn_max_speed.port_attr.attr, + &hns_roce_port_attr_dcqcn_g.port_attr.attr, + &hns_roce_port_attr_dcqcn_al.port_attr.attr, + &hns_roce_port_attr_dcqcn_cnp_time.port_attr.attr, + &hns_roce_port_attr_dcqcn_ashift.port_attr.attr, + &hns_roce_port_attr_dcqcn_lifespan.port_attr.attr, + NULL, +}; + +static const struct attribute_group dcqcn_cc_param_group = { + .name = "dcqcn_cc_param", + .attrs = dcqcn_param_attrs, + .is_visible = scc_attr_is_visible, +}; + +#define HNS_PORT_LDCP_CC_ATTR_RW(_name, NAME) \ + struct hns_port_cc_attr hns_roce_port_attr_ldcp_##_name = \ + __HNS_SCC_ATTR(_name, HNS_ROCE_SCC_ALGO_LDCP, \ + HNS_ROCE_LDCP_##NAME##_OFS, \ + HNS_ROCE_LDCP_##NAME##_SZ, \ + 0, HNS_ROCE_LDCP_##NAME##_MAX) + +HNS_PORT_LDCP_CC_ATTR_RW(cwd0, CWD0); +HNS_PORT_LDCP_CC_ATTR_RW(alpha, ALPHA); +HNS_PORT_LDCP_CC_ATTR_RW(gamma, GAMMA); +HNS_PORT_LDCP_CC_ATTR_RW(beta, BETA); +HNS_PORT_LDCP_CC_ATTR_RW(eta, ETA); +HNS_PORT_LDCP_CC_ATTR_RW(lifespan, LIFESPAN); + +static struct attribute *ldcp_param_attrs[] = { + &hns_roce_port_attr_ldcp_cwd0.port_attr.attr, + &hns_roce_port_attr_ldcp_alpha.port_attr.attr, + &hns_roce_port_attr_ldcp_gamma.port_attr.attr, + &hns_roce_port_attr_ldcp_beta.port_attr.attr, + &hns_roce_port_attr_ldcp_eta.port_attr.attr, + &hns_roce_port_attr_ldcp_lifespan.port_attr.attr, + NULL, +}; + +static const struct attribute_group ldcp_cc_param_group = { + .name = "ldcp_cc_param", + .attrs = ldcp_param_attrs, + .is_visible = scc_attr_is_visible, +}; + +#define HNS_PORT_HC3_CC_ATTR_RW(_name, NAME) \ + struct hns_port_cc_attr hns_roce_port_attr_hc3_##_name = \ + __HNS_SCC_ATTR(_name, HNS_ROCE_SCC_ALGO_HC3, \ + HNS_ROCE_HC3_##NAME##_OFS, \ + HNS_ROCE_HC3_##NAME##_SZ, \ + 0, HNS_ROCE_HC3_##NAME##_MAX) + +HNS_PORT_HC3_CC_ATTR_RW(initial_window, INITIAL_WINDOW); +HNS_PORT_HC3_CC_ATTR_RW(bandwidth, BANDWIDTH); +HNS_PORT_HC3_CC_ATTR_RW(qlen_shift, QLEN_SHIFT); +HNS_PORT_HC3_CC_ATTR_RW(port_usage_shift, PORT_USAGE_SHIFT); +HNS_PORT_HC3_CC_ATTR_RW(over_period, OVER_PERIOD); +HNS_PORT_HC3_CC_ATTR_RW(max_stage, MAX_STAGE); +HNS_PORT_HC3_CC_ATTR_RW(gamma_shift, GAMMA_SHIFT); +HNS_PORT_HC3_CC_ATTR_RW(lifespan, LIFESPAN); + +static struct attribute *hc3_param_attrs[] = { + &hns_roce_port_attr_hc3_initial_window.port_attr.attr, + &hns_roce_port_attr_hc3_bandwidth.port_attr.attr, + &hns_roce_port_attr_hc3_qlen_shift.port_attr.attr, + &hns_roce_port_attr_hc3_port_usage_shift.port_attr.attr, + &hns_roce_port_attr_hc3_over_period.port_attr.attr, + &hns_roce_port_attr_hc3_max_stage.port_attr.attr, + &hns_roce_port_attr_hc3_gamma_shift.port_attr.attr, + &hns_roce_port_attr_hc3_lifespan.port_attr.attr, + NULL, +}; + +static const struct attribute_group hc3_cc_param_group = { + .name = "hc3_cc_param", + .attrs = hc3_param_attrs, + .is_visible = scc_attr_is_visible, +}; + +#define HNS_PORT_DIP_CC_ATTR_RW(_name, NAME) \ + struct hns_port_cc_attr hns_roce_port_attr_dip_##_name = \ + __HNS_SCC_ATTR(_name, HNS_ROCE_SCC_ALGO_DIP, \ + HNS_ROCE_DIP_##NAME##_OFS, \ + HNS_ROCE_DIP_##NAME##_SZ, \ + 0, HNS_ROCE_DIP_##NAME##_MAX) + +HNS_PORT_DIP_CC_ATTR_RW(ai, AI); +HNS_PORT_DIP_CC_ATTR_RW(f, F); +HNS_PORT_DIP_CC_ATTR_RW(tkp, TKP); +HNS_PORT_DIP_CC_ATTR_RW(tmp, TMP); +HNS_PORT_DIP_CC_ATTR_RW(alp, ALP); +HNS_PORT_DIP_CC_ATTR_RW(max_speed, MAX_SPEED); +HNS_PORT_DIP_CC_ATTR_RW(g, G); +HNS_PORT_DIP_CC_ATTR_RW(al, AL); +HNS_PORT_DIP_CC_ATTR_RW(cnp_time, CNP_TIME); +HNS_PORT_DIP_CC_ATTR_RW(ashift, ASHIFT); +HNS_PORT_DIP_CC_ATTR_RW(lifespan, LIFESPAN); + +static struct attribute *dip_param_attrs[] = { + &hns_roce_port_attr_dip_ai.port_attr.attr, + &hns_roce_port_attr_dip_f.port_attr.attr, + &hns_roce_port_attr_dip_tkp.port_attr.attr, + &hns_roce_port_attr_dip_tmp.port_attr.attr, + &hns_roce_port_attr_dip_alp.port_attr.attr, + &hns_roce_port_attr_dip_max_speed.port_attr.attr, + &hns_roce_port_attr_dip_g.port_attr.attr, + &hns_roce_port_attr_dip_al.port_attr.attr, + &hns_roce_port_attr_dip_cnp_time.port_attr.attr, + &hns_roce_port_attr_dip_ashift.port_attr.attr, + &hns_roce_port_attr_dip_lifespan.port_attr.attr, + NULL, +}; + +static const struct attribute_group dip_cc_param_group = { + .name = "dip_cc_param", + .attrs = dip_param_attrs, + .is_visible = scc_attr_is_visible, +}; + +const struct attribute_group *hns_attr_port_groups[] = { + &dcqcn_cc_param_group, + &ldcp_cc_param_group, + &hc3_cc_param_group, + &dip_cc_param_group, + NULL, +}; + +static ssize_t hns_roce_port_attr_show(struct kobject *kobj, + struct attribute *attr, char *buf) +{ + struct hns_port_attribute *port_attr = + container_of(attr, struct hns_port_attribute, attr); + struct hns_roce_port *p = + container_of(kobj, struct hns_roce_port, kobj); + + if (!port_attr->show) + return -EIO; + + return port_attr->show(p, port_attr, buf); +} + +static ssize_t hns_roce_port_attr_store(struct kobject *kobj, + struct attribute *attr, + const char *buf, size_t count) +{ + struct hns_port_attribute *port_attr = + container_of(attr, struct hns_port_attribute, attr); + struct hns_roce_port *p = + container_of(kobj, struct hns_roce_port, kobj); + + if (!port_attr->store) + return -EIO; + + return port_attr->store(p, port_attr, buf, count); +} + +static void hns_roce_port_release(struct kobject *kobj) +{ + struct hns_roce_port *pdata = + container_of(kobj, struct hns_roce_port, kobj); + + kfree(pdata->scc_param); +} + +static const struct sysfs_ops hns_roce_port_ops = { + .show = hns_roce_port_attr_show, + .store = hns_roce_port_attr_store, +}; + +static struct kobj_type hns_roce_port_ktype = { + .release = hns_roce_port_release, + .sysfs_ops = &hns_roce_port_ops, +}; + +int hns_roce_create_port_files(struct ib_device *ibdev, u8 port_num, + struct kobject *kobj) +{ + struct hns_roce_dev *hr_dev = to_hr_dev(ibdev); + struct hns_roce_port *pdata; + int ret; + + if (!port_num || port_num > hr_dev->caps.num_ports) { + ibdev_err(ibdev, "fail to create port sysfs for invalid port %u.\n", + port_num); + return -ENODEV; + } + + pdata = &hr_dev->port_data[port_num - 1]; + pdata->hr_dev = hr_dev; + pdata->port_num = port_num; + ret = kobject_init_and_add(&pdata->kobj, &hns_roce_port_ktype, + kobj, "cc_param"); + if (ret) { + ibdev_err(ibdev, "fail to create port(%u) sysfs, ret = %d.\n", + port_num, ret); + goto fail_kobj; + } + kobject_uevent(&pdata->kobj, KOBJ_ADD); + + ret = sysfs_create_groups(&pdata->kobj, hns_attr_port_groups); + if (ret) { + ibdev_err(ibdev, + "fail to create port(%u) cc param sysfs, ret = %d.\n", + port_num, ret); + goto fail_kobj; + } + + ret = alloc_scc_param(hr_dev, pdata); + if (ret) { + dev_err(hr_dev->dev, "alloc scc param failed, ret = %d!\n", + ret); + goto fail_group; + } + + return ret; + +fail_group: + sysfs_remove_groups(&pdata->kobj, hns_attr_port_groups); + +fail_kobj: + kobject_put(&pdata->kobj); + + return ret; +} + +static void hns_roce_unregister_port_sysfs(struct hns_roce_dev *hr_dev, + u8 port_num) +{ + struct hns_roce_port *pdata; + + pdata = &hr_dev->port_data[port_num]; + sysfs_remove_groups(&pdata->kobj, hns_attr_port_groups); + kobject_put(&pdata->kobj); +} + +void hns_roce_unregister_sysfs(struct hns_roce_dev *hr_dev) +{ + int i; + + for (i = 0; i < hr_dev->caps.num_ports; i++) + hns_roce_unregister_port_sysfs(hr_dev, i); +} -- 2.30.0

1 0

Kernel sig 3.10 14:00-15:30 例会议题情况//答复: openEuler Kernel SIG双周例会
by liaotao (C) 10 Mar '23

10 Mar '23

当前例会议题：议题一：进展update（10min） --- 张伽琳 & 郑增凯议题二：内核热升级使用及技术探讨和规划 --- 桑琰欢迎大家继续申报~ 上期遗留问题： 1、openEuler缺陷issue处理流程介绍 2、内核热升级下一步规划，需求讨论 -----原始约会----- 发件人: openEuler conference <public(a)openeuler.org> 发送时间: 2023年3月7日 15:49 收件人: dev@openeuler.org,kernel-discuss@openeuler.org,kernel@openeuler.org 主题: openEuler Kernel SIG双周例会时间: 2023年3月10日星期五 14:00-15:30(UTC+08:00) 北京，重庆，香港特别行政区，乌鲁木齐。地点: 您好！ Kernel SIG 邀请您参加 2023-03-10 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容：欢迎您参加 Kernel SIG 双周例会，当前议题： 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板）会议链接：https://us06web.zoom.us/j/87191608489?pwd=eG96T0p2Y0NDRUdHOW9SYys5SElTQT09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2023-03-10 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 欢迎您参加 Kernel SIG 双周例会，当前议题： 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板） You can join the meeting at https://us06web.zoom.us/j/87191608489?pwd=eG96T0p2Y0NDRUdHOW9SYys5SElTQT09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-5.10-LTS-SP1] Revert "scsi: fix iscsi rescan fails to create block"
by Jialin Zhang 09 Mar '23

09 Mar '23

From: Zhong Jinghua <zhongjinghua(a)huawei.com> hulk inclusion category: bugfix bugzilla: 188150, https://gitee.com/openeuler/kernel/issues/I643OL ---------------------------------------- This reverts commit 7f10ea522db56188ae46c5bbee7052a2b2797515. This commit has a soft lock problem: watchdog: BUG: soft lockup - CPU#22 stuck for 67s! [iscsid:16369] Call Trace: scsi_remove_target+0x548/0x7b0 ? sdev_store_delete+0x90/0x90 ? __mutex_lock_slowpath+0x10/0x10 ? device_remove_class_symlinks+0x1b0/0x1b0 __iscsi_unbind_session+0x16b/0x250 [scsi_transport_iscsi] iscsi_remove_session+0x1d3/0x2f0 [scsi_transport_iscsi] iscsi_session_remove+0x5c/0x80 [libiscsi] iscsi_sw_tcp_session_destroy+0xd3/0x160 [iscsi_tcp] iscsi_if_rx+0x2369/0x5060 [scsi_transport_iscsi] The reason is that if other threads hold the reference count of the kobject while waiting for the device to be released, it will keep waiting in a loop. Fixes: 7f10ea522db5 ("scsi: fix iscsi rescan fails to create block") Signed-off-by: Zhong Jinghua <zhongjinghua(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/scsi/scsi_sysfs.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c index e7893835b99a..42db9c52208e 100644 --- a/drivers/scsi/scsi_sysfs.c +++ b/drivers/scsi/scsi_sysfs.c @@ -1503,13 +1503,6 @@ void scsi_remove_device(struct scsi_device *sdev) } EXPORT_SYMBOL(scsi_remove_device); -static int scsi_device_try_get(struct scsi_device *sdev) -{ - if (!kobject_get_unless_zero(&sdev->sdev_gendev.kobj)) - return -ENXIO; - return 0; -} - static void __scsi_remove_target(struct scsi_target *starget) { struct Scsi_Host *shost = dev_to_shost(starget->dev.parent); @@ -1528,7 +1521,9 @@ static void __scsi_remove_target(struct scsi_target *starget) if (sdev->channel != starget->channel || sdev->id != starget->id) continue; - if (scsi_device_try_get(sdev)) + if (sdev->sdev_state == SDEV_DEL || + sdev->sdev_state == SDEV_CANCEL || + !get_device(&sdev->sdev_gendev)) continue; spin_unlock_irqrestore(shost->host_lock, flags); scsi_remove_device(sdev); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/3] HID: asus: Remove check for same LED brightness on set
by Yongqiang Liu 09 Mar '23

09 Mar '23

From: "Luke D. Jones" <luke(a)ljones.dev> mainline inclusion from mainline-v5.14-rc4 commit 3fdcf7cdfc229346d028242e73562704ad644dd0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6I7U9 CVE: CVE-2023-1079 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Remove the early return on LED brightness set so that any controller application, daemon, or desktop may set the same brightness at any stage. This is required because many ASUS ROG keyboards will default to max brightness on laptop resume if the LEDs were set to off before sleep. Signed-off-by: Luke D Jones <luke(a)ljones.dev> Signed-off-by: Jiri Kosina <jkosina(a)suse.cz> Signed-off-by: Yuyao Lin <linyuyao1(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Reviewed-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/hid/hid-asus.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c index 800b2364e29e..9ae8e3d5edf1 100644 --- a/drivers/hid/hid-asus.c +++ b/drivers/hid/hid-asus.c @@ -318,9 +318,6 @@ static void asus_kbd_backlight_set(struct led_classdev *led_cdev, { struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds, cdev); - if (led->brightness == brightness) - return; - led->brightness = brightness; schedule_work(&led->work); } -- 2.25.1

1 2

[PATCH openEuler-1.0-LTS 01/16] netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state
by Yongqiang Liu 08 Mar '23

08 Mar '23

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v4.19.272 commit 01687e35df44dd09cc6943306db35d9efc507907 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6KOHU CVE: NA -------------------------------- [ Upstream commit e15d4cdf27cb0c1e977270270b2cea12e0955edd ] Consider: client -----> conntrack ---> Host client sends a SYN, but $Host is unreachable/silent. Client eventually gives up and the conntrack entry will time out. However, if the client is restarted with same addr/port pair, it may prevent the conntrack entry from timing out. This is noticeable when the existing conntrack entry has no NAT transformation or an outdated one and port reuse happens either on client or due to a NAT middlebox. This change prevents refresh of the timeout for SYN retransmits, so entry is going away after nf_conntrack_tcp_timeout_syn_sent seconds (default: 60). Entry will be re-created on next connection attempt, but then nat rules will be evaluated again. Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/netfilter/nf_conntrack_proto_tcp.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c index aab532b8c8c6..1600f35bfd49 100644 --- a/net/netfilter/nf_conntrack_proto_tcp.c +++ b/net/netfilter/nf_conntrack_proto_tcp.c @@ -1089,6 +1089,16 @@ static int tcp_packet(struct nf_conn *ct, nf_ct_kill_acct(ct, ctinfo, skb); return NF_ACCEPT; } + + if (index == TCP_SYN_SET && old_state == TCP_CONNTRACK_SYN_SENT) { + /* do not renew timeout on SYN retransmit. + * + * Else port reuse by client or NAT middlebox can keep + * entry alive indefinitely (including nat info). + */ + return NF_ACCEPT; + } + /* ESTABLISHED without SEEN_REPLY, i.e. mid-connection * pickup with loose=1. Avoid large ESTABLISHED timeout. */ -- 2.25.1

1 15

[PATCH openEuler-1.0-LTS 01/31] binder: use standard functions to allocate fds
by Yongqiang Liu 08 Mar '23

08 Mar '23

From: Todd Kjos <tkjos(a)android.com> mainline inclusion from mainline-v4.20-rc1 commit 44d8047f1d87adc2fd7eccc88533794f6d88c15e category: bugfix bugzilla: 188431, https://gitee.com/src-openeuler/kernel/issues/I6DKVG CVE: CVE-2023-20938 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Binder uses internal fs interfaces to allocate and install fds: __alloc_fd __fd_install __close_fd get_files_struct put_files_struct These were used to support the passing of fds between processes as part of a transaction. The actual allocation and installation of the fds in the target process was handled by the sending process so the standard functions, alloc_fd() and fd_install() which assume task==current couldn't be used. This patch refactors this mechanism so that the fds are allocated and installed by the target process allowing the standard functions to be used. The sender now creates a list of fd fixups that contains the struct *file and the address to fixup with the new fd once it is allocated. This list is processed by the target process when the transaction is dequeued. A new error case is introduced by this change. If an async transaction with file descriptors cannot allocate new fds in the target (probably due to out of file descriptors), the transaction is discarded with a log message. In the old implementation this would have been detected in the sender context and failed prior to sending. Signed-off-by: Todd Kjos <tkjos(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/android/binder.c Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Reviewed-by: Zheng Yejian <zhengyejian1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/android/Kconfig | 2 +- drivers/android/binder.c | 391 ++++++++++++++++++++------------- drivers/android/binder_trace.h | 36 ++- 3 files changed, 262 insertions(+), 167 deletions(-) diff --git a/drivers/android/Kconfig b/drivers/android/Kconfig index 432e9ad77070..51e8250d113f 100644 --- a/drivers/android/Kconfig +++ b/drivers/android/Kconfig @@ -10,7 +10,7 @@ if ANDROID config ANDROID_BINDER_IPC bool "Android Binder IPC Driver" - depends on MMU + depends on MMU && !CPU_CACHE_VIVT default n ---help--- Binder is used in Android for both communication between processes, diff --git a/drivers/android/binder.c b/drivers/android/binder.c index c5a39b8ae886..8a72aacd7a39 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -71,6 +71,7 @@ #include <linux/security.h> #include <linux/spinlock.h> #include <linux/ratelimit.h> +#include <linux/syscalls.h> #include <uapi/linux/android/binder.h> @@ -457,9 +458,8 @@ struct binder_ref { }; enum binder_deferred_state { - BINDER_DEFERRED_PUT_FILES = 0x01, - BINDER_DEFERRED_FLUSH = 0x02, - BINDER_DEFERRED_RELEASE = 0x04, + BINDER_DEFERRED_FLUSH = 0x01, + BINDER_DEFERRED_RELEASE = 0x02, }; /** @@ -480,9 +480,6 @@ enum binder_deferred_state { * (invariant after initialized) * @tsk task_struct for group_leader of process * (invariant after initialized) - * @files files_struct for process - * (protected by @files_lock) - * @files_lock mutex to protect @files * @cred struct cred associated with the `struct file` * in binder_open() * (invariant after initialized) @@ -530,8 +527,6 @@ struct binder_proc { struct list_head waiting_threads; int pid; struct task_struct *tsk; - struct files_struct *files; - struct mutex files_lock; const struct cred *cred; struct hlist_node deferred_work_node; int deferred_work; @@ -615,6 +610,23 @@ struct binder_thread { bool is_dead; }; +/** + * struct binder_txn_fd_fixup - transaction fd fixup list element + * @fixup_entry: list entry + * @file: struct file to be associated with new fd + * @offset: offset in buffer data to this fixup + * + * List element for fd fixups in a transaction. Since file + * descriptors need to be allocated in the context of the + * target process, we pass each fd to be processed in this + * struct. + */ +struct binder_txn_fd_fixup { + struct list_head fixup_entry; + struct file *file; + size_t offset; +}; + struct binder_transaction { int debug_id; struct binder_work work; @@ -632,6 +644,7 @@ struct binder_transaction { long priority; long saved_priority; kuid_t sender_euid; + struct list_head fd_fixups; /** * @lock: protects @from, @to_proc, and @to_thread * @@ -905,66 +918,6 @@ static void binder_free_thread(struct binder_thread *thread); static void binder_free_proc(struct binder_proc *proc); static void binder_inc_node_tmpref_ilocked(struct binder_node *node); -static int task_get_unused_fd_flags(struct binder_proc *proc, int flags) -{ - unsigned long rlim_cur; - unsigned long irqs; - int ret; - - mutex_lock(&proc->files_lock); - if (proc->files == NULL) { - ret = -ESRCH; - goto err; - } - if (!lock_task_sighand(proc->tsk, &irqs)) { - ret = -EMFILE; - goto err; - } - rlim_cur = task_rlimit(proc->tsk, RLIMIT_NOFILE); - unlock_task_sighand(proc->tsk, &irqs); - - ret = __alloc_fd(proc->files, 0, rlim_cur, flags); -err: - mutex_unlock(&proc->files_lock); - return ret; -} - -/* - * copied from fd_install - */ -static void task_fd_install( - struct binder_proc *proc, unsigned int fd, struct file *file) -{ - mutex_lock(&proc->files_lock); - if (proc->files) - __fd_install(proc->files, fd, file); - mutex_unlock(&proc->files_lock); -} - -/* - * copied from sys_close - */ -static long task_close_fd(struct binder_proc *proc, unsigned int fd) -{ - int retval; - - mutex_lock(&proc->files_lock); - if (proc->files == NULL) { - retval = -ESRCH; - goto err; - } - retval = __close_fd(proc->files, fd); - /* can't restart close syscall because file table entry was cleared */ - if (unlikely(retval == -ERESTARTSYS || - retval == -ERESTARTNOINTR || - retval == -ERESTARTNOHAND || - retval == -ERESTART_RESTARTBLOCK)) - retval = -EINTR; -err: - mutex_unlock(&proc->files_lock); - return retval; -} - static bool binder_has_work_ilocked(struct binder_thread *thread, bool do_proc_work) { @@ -1948,6 +1901,27 @@ static struct binder_thread *binder_get_txn_from_and_acq_inner( return NULL; } +/** + * binder_free_txn_fixups() - free unprocessed fd fixups + * @t: binder transaction for t->from + * + * If the transaction is being torn down prior to being + * processed by the target process, free all of the + * fd fixups and fput the file structs. It is safe to + * call this function after the fixups have been + * processed -- in that case, the list will be empty. + */ +static void binder_free_txn_fixups(struct binder_transaction *t) +{ + struct binder_txn_fd_fixup *fixup, *tmp; + + list_for_each_entry_safe(fixup, tmp, &t->fd_fixups, fixup_entry) { + fput(fixup->file); + list_del(&fixup->fixup_entry); + kfree(fixup); + } +} + static void binder_free_transaction(struct binder_transaction *t) { struct binder_proc *target_proc = t->to_proc; @@ -1962,6 +1936,7 @@ static void binder_free_transaction(struct binder_transaction *t) * If the transaction has no target_proc, then * t->buffer->transaction has already been cleared. */ + binder_free_txn_fixups(t); kfree(t); binder_stats_deleted(BINDER_STAT_TRANSACTION); } @@ -2262,12 +2237,17 @@ static void binder_transaction_buffer_release(struct binder_proc *proc, } break; case BINDER_TYPE_FD: { - struct binder_fd_object *fp = to_binder_fd_object(hdr); - - binder_debug(BINDER_DEBUG_TRANSACTION, - " fd %d\n", fp->fd); - if (failed_at) - task_close_fd(proc, fp->fd); + /* + * No need to close the file here since user-space + * closes it for for successfully delivered + * transactions. For transactions that weren't + * delivered, the new fd was never allocated so + * there is no need to close and the fput on the + * file is done when the transaction is torn + * down. + */ + WARN_ON(failed_at && + proc->tsk == current->group_leader); } break; case BINDER_TYPE_PTR: /* @@ -2283,6 +2263,15 @@ static void binder_transaction_buffer_release(struct binder_proc *proc, size_t fd_index; binder_size_t fd_buf_size; + if (proc->tsk != current->group_leader) { + /* + * Nothing to do if running in sender context + * The fd fixups have not been applied so no + * fds need to be closed. + */ + continue; + } + fda = to_binder_fd_array_object(hdr); parent = binder_validate_ptr(buffer, fda->parent, off_start, @@ -2315,7 +2304,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc, } fd_array = (u32 *)(parent_buffer + (uintptr_t)fda->parent_offset); for (fd_index = 0; fd_index < fda->num_fds; fd_index++) - task_close_fd(proc, fd_array[fd_index]); + ksys_close(fd_array[fd_index]); } break; default: pr_err("transaction release %d bad object type %x\n", @@ -2447,17 +2436,18 @@ static int binder_translate_handle(struct flat_binder_object *fp, return ret; } -static int binder_translate_fd(int fd, +static int binder_translate_fd(u32 *fdp, struct binder_transaction *t, struct binder_thread *thread, struct binder_transaction *in_reply_to) { struct binder_proc *proc = thread->proc; struct binder_proc *target_proc = t->to_proc; - int target_fd; + struct binder_txn_fd_fixup *fixup; struct file *file; - int ret; + int ret = 0; bool target_allows_fd; + int fd = *fdp; if (in_reply_to) target_allows_fd = !!(in_reply_to->flags & TF_ACCEPT_FDS); @@ -2485,19 +2475,24 @@ static int binder_translate_fd(int fd, goto err_security; } - target_fd = task_get_unused_fd_flags(target_proc, O_CLOEXEC); - if (target_fd < 0) { + /* + * Add fixup record for this transaction. The allocation + * of the fd in the target needs to be done from a + * target thread. + */ + fixup = kzalloc(sizeof(*fixup), GFP_KERNEL); + if (!fixup) { ret = -ENOMEM; - goto err_get_unused_fd; + goto err_alloc; } - task_fd_install(target_proc, target_fd, file); - trace_binder_transaction_fd(t, fd, target_fd); - binder_debug(BINDER_DEBUG_TRANSACTION, " fd %d -> %d\n", - fd, target_fd); + fixup->file = file; + fixup->offset = (uintptr_t)fdp - (uintptr_t)t->buffer->data; + trace_binder_transaction_fd_send(t, fd, fixup->offset); + list_add_tail(&fixup->fixup_entry, &t->fd_fixups); - return target_fd; + return ret; -err_get_unused_fd: +err_alloc: err_security: fput(file); err_fget: @@ -2511,8 +2506,7 @@ static int binder_translate_fd_array(struct binder_fd_array_object *fda, struct binder_thread *thread, struct binder_transaction *in_reply_to) { - binder_size_t fdi, fd_buf_size, num_installed_fds; - int target_fd; + binder_size_t fdi, fd_buf_size; uintptr_t parent_buffer; u32 *fd_array; struct binder_proc *proc = thread->proc; @@ -2544,23 +2538,12 @@ static int binder_translate_fd_array(struct binder_fd_array_object *fda, return -EINVAL; } for (fdi = 0; fdi < fda->num_fds; fdi++) { - target_fd = binder_translate_fd(fd_array[fdi], t, thread, + int ret = binder_translate_fd(&fd_array[fdi], t, thread, in_reply_to); - if (target_fd < 0) - goto err_translate_fd_failed; - fd_array[fdi] = target_fd; + if (ret < 0) + return ret; } return 0; - -err_translate_fd_failed: - /* - * Failed to allocate fd or security error, free fds - * installed so far. - */ - num_installed_fds = fdi; - for (fdi = 0; fdi < num_installed_fds; fdi++) - task_close_fd(target_proc, fd_array[fdi]); - return target_fd; } static int binder_fixup_parent(struct binder_transaction *t, @@ -2935,6 +2918,7 @@ static void binder_transaction(struct binder_proc *proc, return_error_line = __LINE__; goto err_alloc_t_failed; } + INIT_LIST_HEAD(&t->fd_fixups); binder_stats_created(BINDER_STAT_TRANSACTION); spin_lock_init(&t->lock); @@ -3089,17 +3073,16 @@ static void binder_transaction(struct binder_proc *proc, case BINDER_TYPE_FD: { struct binder_fd_object *fp = to_binder_fd_object(hdr); - int target_fd = binder_translate_fd(fp->fd, t, thread, - in_reply_to); + int ret = binder_translate_fd(&fp->fd, t, thread, + in_reply_to); - if (target_fd < 0) { + if (ret < 0) { return_error = BR_FAILED_REPLY; - return_error_param = target_fd; + return_error_param = ret; return_error_line = __LINE__; goto err_translate_failed; } fp->pad_binder = 0; - fp->fd = target_fd; } break; case BINDER_TYPE_FDA: { struct binder_fd_array_object *fda = @@ -3256,6 +3239,7 @@ static void binder_transaction(struct binder_proc *proc, err_bad_offset: err_bad_parent: err_copy_data_failed: + binder_free_txn_fixups(t); trace_binder_transaction_failed_buffer_release(t->buffer); binder_transaction_buffer_release(target_proc, t->buffer, offp); if (target_node) @@ -3318,6 +3302,49 @@ static void binder_transaction(struct binder_proc *proc, } } +/** + * binder_free_buf() - free the specified buffer + * @proc: binder proc that owns buffer + * @buffer: buffer to be freed + * + * If buffer for an async transaction, enqueue the next async + * transaction from the node. + * + * Cleanup buffer and free it. + */ +void +binder_free_buf(struct binder_proc *proc, struct binder_buffer *buffer) +{ + binder_inner_proc_lock(proc); + if (buffer->transaction) { + buffer->transaction->buffer = NULL; + buffer->transaction = NULL; + } + binder_inner_proc_unlock(proc); + if (buffer->async_transaction && buffer->target_node) { + struct binder_node *buf_node; + struct binder_work *w; + + buf_node = buffer->target_node; + binder_node_inner_lock(buf_node); + BUG_ON(!buf_node->has_async_transaction); + BUG_ON(buf_node->proc != proc); + w = binder_dequeue_work_head_ilocked( + &buf_node->async_todo); + if (!w) { + buf_node->has_async_transaction = false; + } else { + binder_enqueue_work_ilocked( + w, &proc->todo); + binder_wakeup_proc_ilocked(proc); + } + binder_node_inner_unlock(buf_node); + } + trace_binder_transaction_buffer_release(buffer); + binder_transaction_buffer_release(proc, buffer, NULL); + binder_alloc_free_buf(&proc->alloc, buffer); +} + static int binder_thread_write(struct binder_proc *proc, struct binder_thread *thread, binder_uintptr_t binder_buffer, size_t size, @@ -3508,35 +3535,7 @@ static int binder_thread_write(struct binder_proc *proc, proc->pid, thread->pid, (u64)data_ptr, buffer->debug_id, buffer->transaction ? "active" : "finished"); - - binder_inner_proc_lock(proc); - if (buffer->transaction) { - buffer->transaction->buffer = NULL; - buffer->transaction = NULL; - } - binder_inner_proc_unlock(proc); - if (buffer->async_transaction && buffer->target_node) { - struct binder_node *buf_node; - struct binder_work *w; - - buf_node = buffer->target_node; - binder_node_inner_lock(buf_node); - BUG_ON(!buf_node->has_async_transaction); - BUG_ON(buf_node->proc != proc); - w = binder_dequeue_work_head_ilocked( - &buf_node->async_todo); - if (!w) { - buf_node->has_async_transaction = false; - } else { - binder_enqueue_work_ilocked( - w, &proc->todo); - binder_wakeup_proc_ilocked(proc); - } - binder_node_inner_unlock(buf_node); - } - trace_binder_transaction_buffer_release(buffer); - binder_transaction_buffer_release(proc, buffer, NULL); - binder_alloc_free_buf(&proc->alloc, buffer); + binder_free_buf(proc, buffer); break; } @@ -3859,6 +3858,76 @@ static int binder_wait_for_work(struct binder_thread *thread, return ret; } +/** + * binder_apply_fd_fixups() - finish fd translation + * @t: binder transaction with list of fd fixups + * + * Now that we are in the context of the transaction target + * process, we can allocate and install fds. Process the + * list of fds to translate and fixup the buffer with the + * new fds. + * + * If we fail to allocate an fd, then free the resources by + * fput'ing files that have not been processed and ksys_close'ing + * any fds that have already been allocated. + */ +static int binder_apply_fd_fixups(struct binder_transaction *t) +{ + struct binder_txn_fd_fixup *fixup, *tmp; + int ret = 0; + + list_for_each_entry(fixup, &t->fd_fixups, fixup_entry) { + int fd = get_unused_fd_flags(O_CLOEXEC); + u32 *fdp; + + if (fd < 0) { + binder_debug(BINDER_DEBUG_TRANSACTION, + "failed fd fixup txn %d fd %d\n", + t->debug_id, fd); + ret = -ENOMEM; + break; + } + binder_debug(BINDER_DEBUG_TRANSACTION, + "fd fixup txn %d fd %d\n", + t->debug_id, fd); + trace_binder_transaction_fd_recv(t, fd, fixup->offset); + fd_install(fd, fixup->file); + fixup->file = NULL; + fdp = (u32 *)(t->buffer->data + fixup->offset); + /* + * This store can cause problems for CPUs with a + * VIVT cache (eg ARMv5) since the cache cannot + * detect virtual aliases to the same physical cacheline. + * To support VIVT, this address and the user-space VA + * would both need to be flushed. Since this kernel + * VA is not constructed via page_to_virt(), we can't + * use flush_dcache_page() on it, so we'd have to use + * an internal function. If devices with VIVT ever + * need to run Android, we'll either need to go back + * to patching the translated fd from the sender side + * (using the non-standard kernel functions), or rework + * how the kernel uses the buffer to use page_to_virt() + * addresses instead of allocating in our own vm area. + * + * For now, we disable compilation if CONFIG_CPU_CACHE_VIVT. + */ + *fdp = fd; + } + list_for_each_entry_safe(fixup, tmp, &t->fd_fixups, fixup_entry) { + if (fixup->file) { + fput(fixup->file); + } else if (ret) { + u32 *fdp = (u32 *)(t->buffer->data + fixup->offset); + + ksys_close(*fdp); + } + list_del(&fixup->fixup_entry); + kfree(fixup); + } + + return ret; +} + static int binder_thread_read(struct binder_proc *proc, struct binder_thread *thread, binder_uintptr_t binder_buffer, size_t size, @@ -4140,6 +4209,34 @@ static int binder_thread_read(struct binder_proc *proc, tr.sender_pid = 0; } + ret = binder_apply_fd_fixups(t); + if (ret) { + struct binder_buffer *buffer = t->buffer; + bool oneway = !!(t->flags & TF_ONE_WAY); + int tid = t->debug_id; + + if (t_from) + binder_thread_dec_tmpref(t_from); + buffer->transaction = NULL; + binder_cleanup_transaction(t, "fd fixups failed", + BR_FAILED_REPLY); + binder_free_buf(proc, buffer); + binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, + "%d:%d %stransaction %d fd fixups failed %d/%d, line %d\n", + proc->pid, thread->pid, + oneway ? "async " : + (cmd == BR_REPLY ? "reply " : ""), + tid, BR_FAILED_REPLY, ret, __LINE__); + if (cmd == BR_REPLY) { + cmd = BR_FAILED_REPLY; + if (put_user(cmd, (uint32_t __user *)ptr)) + return -EFAULT; + ptr += sizeof(uint32_t); + binder_stat_br(proc, thread, cmd); + break; + } + continue; + } tr.data_size = t->buffer->data_size; tr.offsets_size = t->buffer->offsets_size; tr.data.ptr.buffer = (binder_uintptr_t) @@ -4730,7 +4827,6 @@ static void binder_vma_close(struct vm_area_struct *vma) (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, (unsigned long)pgprot_val(vma->vm_page_prot)); binder_alloc_vma_close(&proc->alloc); - binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES); } static vm_fault_t binder_vm_fault(struct vm_fault *vmf) @@ -4776,9 +4872,6 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma) ret = binder_alloc_mmap_handler(&proc->alloc, vma); if (ret) return ret; - mutex_lock(&proc->files_lock); - proc->files = get_files_struct(current); - mutex_unlock(&proc->files_lock); return 0; err_bad_arg: @@ -4802,7 +4895,6 @@ static int binder_open(struct inode *nodp, struct file *filp) spin_lock_init(&proc->outer_lock); get_task_struct(current->group_leader); proc->tsk = current->group_leader; - mutex_init(&proc->files_lock); proc->cred = get_cred(filp->f_cred); INIT_LIST_HEAD(&proc->todo); proc->default_priority = task_nice(current); @@ -4953,8 +5045,6 @@ static void binder_deferred_release(struct binder_proc *proc) struct rb_node *n; int threads, nodes, incoming_refs, outgoing_refs, active_transactions; - BUG_ON(proc->files); - mutex_lock(&binder_procs_lock); hlist_del(&proc->proc_node); mutex_unlock(&binder_procs_lock); @@ -5036,7 +5126,6 @@ static void binder_deferred_release(struct binder_proc *proc) static void binder_deferred_func(struct work_struct *work) { struct binder_proc *proc; - struct files_struct *files; int defer; @@ -5054,23 +5143,11 @@ static void binder_deferred_func(struct work_struct *work) } mutex_unlock(&binder_deferred_lock); - files = NULL; - if (defer & BINDER_DEFERRED_PUT_FILES) { - mutex_lock(&proc->files_lock); - files = proc->files; - if (files) - proc->files = NULL; - mutex_unlock(&proc->files_lock); - } - if (defer & BINDER_DEFERRED_FLUSH) binder_deferred_flush(proc); if (defer & BINDER_DEFERRED_RELEASE) binder_deferred_release(proc); /* frees proc */ - - if (files) - put_files_struct(files); } while (proc); } static DECLARE_WORK(binder_deferred_work, binder_deferred_func); diff --git a/drivers/android/binder_trace.h b/drivers/android/binder_trace.h index 588eb3ec3507..14de7ac57a34 100644 --- a/drivers/android/binder_trace.h +++ b/drivers/android/binder_trace.h @@ -223,22 +223,40 @@ TRACE_EVENT(binder_transaction_ref_to_ref, __entry->dest_ref_debug_id, __entry->dest_ref_desc) ); -TRACE_EVENT(binder_transaction_fd, - TP_PROTO(struct binder_transaction *t, int src_fd, int dest_fd), - TP_ARGS(t, src_fd, dest_fd), +TRACE_EVENT(binder_transaction_fd_send, + TP_PROTO(struct binder_transaction *t, int fd, size_t offset), + TP_ARGS(t, fd, offset), TP_STRUCT__entry( __field(int, debug_id) - __field(int, src_fd) - __field(int, dest_fd) + __field(int, fd) + __field(size_t, offset) + ), + TP_fast_assign( + __entry->debug_id = t->debug_id; + __entry->fd = fd; + __entry->offset = offset; + ), + TP_printk("transaction=%d src_fd=%d offset=%zu", + __entry->debug_id, __entry->fd, __entry->offset) +); + +TRACE_EVENT(binder_transaction_fd_recv, + TP_PROTO(struct binder_transaction *t, int fd, size_t offset), + TP_ARGS(t, fd, offset), + + TP_STRUCT__entry( + __field(int, debug_id) + __field(int, fd) + __field(size_t, offset) ), TP_fast_assign( __entry->debug_id = t->debug_id; - __entry->src_fd = src_fd; - __entry->dest_fd = dest_fd; + __entry->fd = fd; + __entry->offset = offset; ), - TP_printk("transaction=%d src_fd=%d ==> dest_fd=%d", - __entry->debug_id, __entry->src_fd, __entry->dest_fd) + TP_printk("transaction=%d dest_fd=%d offset=%zu", + __entry->debug_id, __entry->fd, __entry->offset) ); DECLARE_EVENT_CLASS(binder_buffer_class, -- 2.25.1

1 30

[PATCH openEuler-1.0-LTS 1/7] sctp: fail if no bound addresses can be used for a given scope
by Yongqiang Liu 08 Mar '23

08 Mar '23

From: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> stable inclusion from stable-v4.19.271 commit 26436553aabfd9b40e1daa537a099bf5bb13fb55 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6I7U3 CVE: CVE-2023-1074 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 458e279f861d3f61796894cd158b780765a1569f ] Currently, if you bind the socket to something like: servaddr.sin6_family = AF_INET6; servaddr.sin6_port = htons(0); servaddr.sin6_scope_id = 0; inet_pton(AF_INET6, "::1", &servaddr.sin6_addr); And then request a connect to: connaddr.sin6_family = AF_INET6; connaddr.sin6_port = htons(20000); connaddr.sin6_scope_id = if_nametoindex("lo"); inet_pton(AF_INET6, "fe88::1", &connaddr.sin6_addr); What the stack does is: - bind the socket - create a new asoc - to handle the connect - copy the addresses that can be used for the given scope - try to connect But the copy returns 0 addresses, and the effect is that it ends up trying to connect as if the socket wasn't bound, which is not the desired behavior. This unexpected behavior also allows KASLR leaks through SCTP diag interface. The fix here then is, if when trying to copy the addresses that can be used for the scope used in connect() it returns 0 addresses, bail out. This is what TCP does with a similar reproducer. Reported-by: Pietro Borrello <borrello(a)diag.uniroma1.it> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> Reviewed-by: Xin Long <lucien.xin(a)gmail.com> Link: https://lore.kernel.org/r/9fcd182f1099f86c6661f3717f63712ddd1c676c.16744967… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/sctp/bind_addr.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c index f8a283245672..d723942e5e65 100644 --- a/net/sctp/bind_addr.c +++ b/net/sctp/bind_addr.c @@ -88,6 +88,12 @@ int sctp_bind_addr_copy(struct net *net, struct sctp_bind_addr *dest, } } + /* If somehow no addresses were found that can be used with this + * scope, it's an error. + */ + if (list_empty(&dest->address_list)) + error = -ENETUNREACH; + out: if (error) sctp_bind_addr_clean(dest); -- 2.25.1

1 6

[PATCH openEuler-1.0-LTS] sctp: fail if no bound addresses can be used for a given scope
by Yongqiang Liu 08 Mar '23

08 Mar '23

From: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> stable inclusion from stable-v4.19.271 commit 26436553aabfd9b40e1daa537a099bf5bb13fb55 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6I7U3 CVE: CVE-2023-1074 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 458e279f861d3f61796894cd158b780765a1569f ] Currently, if you bind the socket to something like: servaddr.sin6_family = AF_INET6; servaddr.sin6_port = htons(0); servaddr.sin6_scope_id = 0; inet_pton(AF_INET6, "::1", &servaddr.sin6_addr); And then request a connect to: connaddr.sin6_family = AF_INET6; connaddr.sin6_port = htons(20000); connaddr.sin6_scope_id = if_nametoindex("lo"); inet_pton(AF_INET6, "fe88::1", &connaddr.sin6_addr); What the stack does is: - bind the socket - create a new asoc - to handle the connect - copy the addresses that can be used for the given scope - try to connect But the copy returns 0 addresses, and the effect is that it ends up trying to connect as if the socket wasn't bound, which is not the desired behavior. This unexpected behavior also allows KASLR leaks through SCTP diag interface. The fix here then is, if when trying to copy the addresses that can be used for the scope used in connect() it returns 0 addresses, bail out. This is what TCP does with a similar reproducer. Reported-by: Pietro Borrello <borrello(a)diag.uniroma1.it> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> Reviewed-by: Xin Long <lucien.xin(a)gmail.com> Link: https://lore.kernel.org/r/9fcd182f1099f86c6661f3717f63712ddd1c676c.16744967… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/sctp/bind_addr.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c index f8a283245672..d723942e5e65 100644 --- a/net/sctp/bind_addr.c +++ b/net/sctp/bind_addr.c @@ -88,6 +88,12 @@ int sctp_bind_addr_copy(struct net *net, struct sctp_bind_addr *dest, } } + /* If somehow no addresses were found that can be used with this + * scope, it's an error. + */ + if (list_empty(&dest->address_list)) + error = -ENETUNREACH; + out: if (error) sctp_bind_addr_clean(dest); -- 2.25.1

1 0

[PATCH openEuler-5.10-LTS-SP1 01/30] ovl: fix use inode directly in rcu-walk mode
by Zheng Zengkai 08 Mar '23

08 Mar '23

From: Chen Zhongjin <chenzhongjin(a)huawei.com> stable inclusion from stable-v5.10.163 commit 740c537f52c1f54aff9094744483d1515c7c8b7b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6GCCV Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 672e4268b2863d7e4978dfed29552b31c2f9bd4e upstream. ovl_dentry_revalidate_common() can be called in rcu-walk mode. As document said, "in rcu-walk mode, d_parent and d_inode should not be used without care". Check inode here to protect access under rcu-walk mode. Fixes: bccece1ead36 ("ovl: allow remote upper") Reported-and-tested-by: syzbot+a4055c78774bbf3498bb(a)syzkaller.appspotmail.com Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> Cc: <stable(a)vger.kernel.org> # v5.7 Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- fs/overlayfs/super.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c index 45c596dfe3a3..e3cd5a00f880 100644 --- a/fs/overlayfs/super.c +++ b/fs/overlayfs/super.c @@ -138,11 +138,16 @@ static int ovl_dentry_revalidate_common(struct dentry *dentry, unsigned int flags, bool weak) { struct ovl_entry *oe = dentry->d_fsdata; + struct inode *inode = d_inode_rcu(dentry); struct dentry *upper; unsigned int i; int ret = 1; - upper = ovl_dentry_upper(dentry); + /* Careful in RCU mode */ + if (!inode) + return -ECHILD; + + upper = ovl_i_dentry_upper(inode); if (upper) ret = ovl_revalidate_real(upper, flags, weak); -- 2.25.1

1 29

[PATCH openEuler-5.10-LTS 01/30] ovl: fix use inode directly in rcu-walk mode
by Zheng Zengkai 08 Mar '23

08 Mar '23

From: Chen Zhongjin <chenzhongjin(a)huawei.com> stable inclusion from stable-v5.10.163 commit 740c537f52c1f54aff9094744483d1515c7c8b7b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6GCCV Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 672e4268b2863d7e4978dfed29552b31c2f9bd4e upstream. ovl_dentry_revalidate_common() can be called in rcu-walk mode. As document said, "in rcu-walk mode, d_parent and d_inode should not be used without care". Check inode here to protect access under rcu-walk mode. Fixes: bccece1ead36 ("ovl: allow remote upper") Reported-and-tested-by: syzbot+a4055c78774bbf3498bb(a)syzkaller.appspotmail.com Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> Cc: <stable(a)vger.kernel.org> # v5.7 Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- fs/overlayfs/super.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c index 45c596dfe3a3..e3cd5a00f880 100644 --- a/fs/overlayfs/super.c +++ b/fs/overlayfs/super.c @@ -138,11 +138,16 @@ static int ovl_dentry_revalidate_common(struct dentry *dentry, unsigned int flags, bool weak) { struct ovl_entry *oe = dentry->d_fsdata; + struct inode *inode = d_inode_rcu(dentry); struct dentry *upper; unsigned int i; int ret = 1; - upper = ovl_dentry_upper(dentry); + /* Careful in RCU mode */ + if (!inode) + return -ECHILD; + + upper = ovl_i_dentry_upper(inode); if (upper) ret = ovl_revalidate_real(upper, flags, weak); -- 2.25.1

1 28

[PATCH openEuler-1.0-LTS 1/2] dhugetlb: use mutex lock in update_reserve_pages()
by Yongqiang Liu 07 Mar '23

07 Mar '23

From: Liu Shixin <liushixin2(a)huawei.com> hulk inclusion category: bugfix bugzilla: 46904, https://gitee.com/openeuler/kernel/issues/I6KOXL CVE: NA -------------------------------- When memory is fragmented, update_reserve_pages() may call migrate_pages() to collect continuous memory. This function can sleep, so we should use mutex lock instead of spin lock. Fixes: 3eb69101b5e6 ("mm: Add two interface for dhugetlb") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Reviewed-by: Nanyong Sun <sunnanyong(a)huawei.com> Reviewed-by: tong tiangen <tongtiangen(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- include/linux/hugetlb.h | 2 +- mm/hugetlb.c | 2 +- mm/memcontrol.c | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h index d44eea25c0d6..dfd9a8c945e1 100644 --- a/include/linux/hugetlb.h +++ b/include/linux/hugetlb.h @@ -696,7 +696,7 @@ struct small_page_pool { struct dhugetlb_pool { int nid; spinlock_t lock; - spinlock_t reserved_lock; + struct mutex reserved_lock; atomic_t refcnt; struct mem_cgroup *attach_memcg; diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 9f974270c84d..a468d94bc16a 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -3327,7 +3327,7 @@ struct dhugetlb_pool *hpool_alloc(unsigned long nid) return NULL; spin_lock_init(&hpool->lock); - spin_lock_init(&hpool->reserved_lock); + mutex_init(&hpool->reserved_lock); hpool->nid = nid; atomic_set(&hpool->refcnt, 1); INIT_LIST_HEAD(&hpool->dhugetlb_1G_freelists); diff --git a/mm/memcontrol.c b/mm/memcontrol.c index fd40fef49e45..886d6b0a4fce 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -4950,9 +4950,9 @@ static int update_reserve_pages(struct kernfs_open_file *of, hpool = get_dhugetlb_pool_from_memcg(memcg); if (!hpool) return -EINVAL; - spin_lock(&hpool->reserved_lock); + mutex_lock(&hpool->reserved_lock); dhugetlb_reserve_hugepages(hpool, size, gigantic); - spin_unlock(&hpool->reserved_lock); + mutex_unlock(&hpool->reserved_lock); dhugetlb_pool_put(hpool); return 0; } -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/2] ntfs: fix use-after-free in ntfs_ucsncmp()
by Yongqiang Liu 07 Mar '23

07 Mar '23

From: ChenXiaoSong <chenxiaosong2(a)huawei.com> stable inclusion from stable-v4.19.254 commit 6c0355ca7ac434d84d8b93336462b698573ca3b3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6HWOS CVE: CVE-2023-26607 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 38c9c22a85aeed28d0831f230136e9cf6fa2ed44 upstream. Syzkaller reported use-after-free bug as follows: ================================================================== BUG: KASAN: use-after-free in ntfs_ucsncmp+0x123/0x130 Read of size 2 at addr ffff8880751acee8 by task a.out/879 CPU: 7 PID: 879 Comm: a.out Not tainted 5.19.0-rc4-next-20220630-00001-gcc5218c8bd2c-dirty #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x1c0/0x2b0 print_address_description.constprop.0.cold+0xd4/0x484 print_report.cold+0x55/0x232 kasan_report+0xbf/0xf0 ntfs_ucsncmp+0x123/0x130 ntfs_are_names_equal.cold+0x2b/0x41 ntfs_attr_find+0x43b/0xb90 ntfs_attr_lookup+0x16d/0x1e0 ntfs_read_locked_attr_inode+0x4aa/0x2360 ntfs_attr_iget+0x1af/0x220 ntfs_read_locked_inode+0x246c/0x5120 ntfs_iget+0x132/0x180 load_system_files+0x1cc6/0x3480 ntfs_fill_super+0xa66/0x1cf0 mount_bdev+0x38d/0x460 legacy_get_tree+0x10d/0x220 vfs_get_tree+0x93/0x300 do_new_mount+0x2da/0x6d0 path_mount+0x496/0x19d0 __x64_sys_mount+0x284/0x300 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7f3f2118d9ea Code: 48 8b 0d a9 f4 0b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 76 f4 0b 00 f7 d8 64 89 01 48 RSP: 002b:00007ffc269deac8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f3f2118d9ea RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffc269dec00 RBP: 00007ffc269dec80 R08: 00007ffc269deb00 R09: 00007ffc269dec44 R10: 0000000000000000 R11: 0000000000000202 R12: 000055f81ab1d220 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK> The buggy address belongs to the physical page: page:0000000085430378 refcount:1 mapcount:1 mapping:0000000000000000 index:0x555c6a81d pfn:0x751ac memcg:ffff888101f7e180 anon flags: 0xfffffc00a0014(uptodate|lru|mappedtodisk|swapbacked|node=0|zone=1|lastcpupid=0x1fffff) raw: 000fffffc00a0014 ffffea0001bf2988 ffffea0001de2448 ffff88801712e201 raw: 0000000555c6a81d 0000000000000000 0000000100000000 ffff888101f7e180 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880751acd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880751ace00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8880751ace80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffff8880751acf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880751acf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== The reason is that struct ATTR_RECORD->name_offset is 6485, end address of name string is out of bounds. Fix this by adding sanity check on end address of attribute name string. [akpm(a)linux-foundation.org: coding-style cleanups] [chenxiaosong2(a)huawei.com: cleanup suggested by Hawkins Jiawei] Link: https://lkml.kernel.org/r/20220709064511.3304299-1-chenxiaosong2@huawei.com Link: https://lkml.kernel.org/r/20220707105329.4020708-1-chenxiaosong2@huawei.com Signed-off-by: ChenXiaoSong <chenxiaosong2(a)huawei.com> Signed-off-by: Hawkins Jiawei <yin31149(a)gmail.com> Cc: Anton Altaparmakov <anton(a)tuxera.com> Cc: ChenXiaoSong <chenxiaosong2(a)huawei.com> Cc: Yongqiang Liu <liuyongqiang13(a)huawei.com> Cc: Zhang Yi <yi.zhang(a)huawei.com> Cc: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/ntfs/attrib.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/fs/ntfs/attrib.c b/fs/ntfs/attrib.c index 44a39a099b54..62b49197e5f6 100644 --- a/fs/ntfs/attrib.c +++ b/fs/ntfs/attrib.c @@ -606,8 +606,12 @@ static int ntfs_attr_find(const ATTR_TYPE type, const ntfschar *name, a = (ATTR_RECORD*)((u8*)ctx->attr + le32_to_cpu(ctx->attr->length)); for (;; a = (ATTR_RECORD*)((u8*)a + le32_to_cpu(a->length))) { - if ((u8*)a < (u8*)ctx->mrec || (u8*)a > (u8*)ctx->mrec + - le32_to_cpu(ctx->mrec->bytes_allocated)) + u8 *mrec_end = (u8 *)ctx->mrec + + le32_to_cpu(ctx->mrec->bytes_allocated); + u8 *name_end = (u8 *)a + le16_to_cpu(a->name_offset) + + a->name_length * sizeof(ntfschar); + if ((u8*)a < (u8*)ctx->mrec || (u8*)a > mrec_end || + name_end > mrec_end) break; ctx->attr = a; if (unlikely(le32_to_cpu(a->type) > le32_to_cpu(type) || -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/4] tcp: Fix listen() regression in 5.15.88.
by Yongqiang Liu 07 Mar '23

07 Mar '23

From: Kuniyuki Iwashima <kuniyu(a)amazon.com> stable inclusion from stable-v5.15.95 commit fdaf88531cfd17b2a710cceb3141ef6f9085ff40 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6H3MB CVE: CVE-2023-0461 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- When we backport dadd0dcaa67d ("net/ulp: prevent ULP without clone op from entering the LISTEN status"), we have accidentally backported a part of 7a7160edf1bf ("net: Return errno in sk->sk_prot->get_port().") and removed err = -EADDRINUSE in inet_csk_listen_start(). Thus, listen() no longer returns -EADDRINUSE even if ->get_port() failed as reported in [0]. We set -EADDRINUSE to err just before ->get_port() to fix the regression. [0]: https://lore.kernel.org/stable/EF8A45D0-768A-4CD5-9A8A-0FA6E610ABF7@winter.… Reported-by: Winter <winter(a)winter.cafe> Signed-off-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/ipv4/inet_connection_sock.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c index f1f3dc6a7d63..0d85871b5cda 100644 --- a/net/ipv4/inet_connection_sock.c +++ b/net/ipv4/inet_connection_sock.c @@ -941,6 +941,7 @@ int inet_csk_listen_start(struct sock *sk, int backlog) * It is OK, because this socket enters to hash table only * after validation is complete. */ + err = -EADDRINUSE; inet_sk_state_store(sk, TCP_LISTEN); if (!sk->sk_prot->get_port(sk, inet->inet_num)) { inet->inet_sport = htons(inet->inet_num); -- 2.25.1

1 3

openEuler Kernel SIG双周例会
by openEuler conference 07 Mar '23

07 Mar '23

您好！ Kernel SIG 邀请您参加 2023-03-10 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容：欢迎您参加 Kernel SIG 双周例会，当前议题： 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板）会议链接：https://us06web.zoom.us/j/87191608489?pwd=eG96T0p2Y0NDRUdHOW9SYys5SElTQT09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2023-03-10 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 欢迎您参加 Kernel SIG 双周例会，当前议题： 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板） You can join the meeting at https://us06web.zoom.us/j/87191608489?pwd=eG96T0p2Y0NDRUdHOW9SYys5SElTQT09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[OLK-5.10] phy: tegra: xusb: Fix return value of tegra_xusb_find_port_node function
by Wang Yufen 06 Mar '23

06 Mar '23

From: Miaoqian Lin <linmq006(a)gmail.com> mainline inclusion from mainline-v5.17-rc1 commit 045a31b95509c8f25f5f04ec5e0dec5cd09f2c5f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6IXQP CVE: CVE-2023-23000 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- callers of tegra_xusb_find_port_node() function only do NULL checking for the return value. return NULL instead of ERR_PTR(-ENOMEM) to keep consistent. Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Acked-by: Thierry Reding <treding(a)nvidia.com> Link: https://lore.kernel.org/r/20211213020507.1458-1-linmq006@gmail.com Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Wang Yufen <wangyufen(a)huawei.com> --- drivers/phy/tegra/xusb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c index 181a1be..02da8c0 100644 --- a/drivers/phy/tegra/xusb.c +++ b/drivers/phy/tegra/xusb.c @@ -449,7 +449,7 @@ struct tegra_xusb_lane * name = kasprintf(GFP_KERNEL, "%s-%u", type, index); if (!name) { of_node_put(ports); - return ERR_PTR(-ENOMEM); + return NULL; } np = of_get_child_by_name(ports, name); kfree(name); -- 1.8.3.1

1 0

[openEuler-22.03-LTS] phy: tegra: xusb: Fix return value of tegra_xusb_find_port_node function
by Wang Yufen 06 Mar '23

06 Mar '23

From: Miaoqian Lin <linmq006(a)gmail.com> mainline inclusion from mainline-v5.17-rc1 commit 045a31b95509c8f25f5f04ec5e0dec5cd09f2c5f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6IXQP CVE: CVE-2023-23000 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- callers of tegra_xusb_find_port_node() function only do NULL checking for the return value. return NULL instead of ERR_PTR(-ENOMEM) to keep consistent. Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Acked-by: Thierry Reding <treding(a)nvidia.com> Link: https://lore.kernel.org/r/20211213020507.1458-1-linmq006@gmail.com Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Wang Yufen <wangyufen(a)huawei.com> --- drivers/phy/tegra/xusb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c index 181a1be..02da8c0 100644 --- a/drivers/phy/tegra/xusb.c +++ b/drivers/phy/tegra/xusb.c @@ -449,7 +449,7 @@ struct tegra_xusb_lane * name = kasprintf(GFP_KERNEL, "%s-%u", type, index); if (!name) { of_node_put(ports); - return ERR_PTR(-ENOMEM); + return NULL; } np = of_get_child_by_name(ports, name); kfree(name); -- 1.8.3.1

1 0

[openEuler-1.0-LTS] phy: tegra: xusb: Fix return value of tegra_xusb_find_port_node function
by Wang Yufen 06 Mar '23

06 Mar '23

From: Miaoqian Lin <linmq006(a)gmail.com> mainline inclusion from mainline-v5.17-rc1 commit 045a31b95509c8f25f5f04ec5e0dec5cd09f2c5f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6IXQP CVE: CVE-2023-23000 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- callers of tegra_xusb_find_port_node() function only do NULL checking for the return value. return NULL instead of ERR_PTR(-ENOMEM) to keep consistent. Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Acked-by: Thierry Reding <treding(a)nvidia.com> Link: https://lore.kernel.org/r/20211213020507.1458-1-linmq006@gmail.com Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Wang Yufen <wangyufen(a)huawei.com> --- drivers/phy/tegra/xusb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c index de1b4eb..9e8fa18 100644 --- a/drivers/phy/tegra/xusb.c +++ b/drivers/phy/tegra/xusb.c @@ -441,7 +441,7 @@ struct tegra_xusb_lane * name = kasprintf(GFP_KERNEL, "%s-%u", type, index); if (!name) { of_node_put(ports); - return ERR_PTR(-ENOMEM); + return NULL; } np = of_get_child_by_name(ports, name); kfree(name); -- 1.8.3.1

1 0

[PATCH openEuler-1.0-LTS 1/4] rds: rds_rm_zerocopy_callback() use list_first_entry()
by Yongqiang Liu 06 Mar '23

06 Mar '23

From: Pietro Borrello <borrello(a)diag.uniroma1.it> stable inclusion from stable-v4.19.273 commit 909d5eef5ce792bb76d7b5a9b7a6852b813d8cac category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6I7UF CVE: CVE-2023-1078 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit f753a68980cf4b59a80fe677619da2b1804f526d ] rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Use list_first_entry() to actually access the first element of the rs_zcookie_queue list. Fixes: 9426bbc6de99 ("rds: use list structure to track information for zerocopy completion notification") Reviewed-by: Willem de Bruijn <willemb(a)google.com> Signed-off-by: Pietro Borrello <borrello(a)diag.uniroma1.it> Link: https://lore.kernel.org/r/20230202-rds-zerocopy-v3-1-83b0df974f9a@diag.unir… Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/rds/message.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/rds/message.c b/net/rds/message.c index 4b00b1152a5f..309b54cc62ae 100644 --- a/net/rds/message.c +++ b/net/rds/message.c @@ -104,9 +104,9 @@ static void rds_rm_zerocopy_callback(struct rds_sock *rs, spin_lock_irqsave(&q->lock, flags); head = &q->zcookie_head; if (!list_empty(head)) { - info = list_entry(head, struct rds_msg_zcopy_info, - rs_zcookie_next); - if (info && rds_zcookie_add(info, cookie)) { + info = list_first_entry(head, struct rds_msg_zcopy_info, + rs_zcookie_next); + if (rds_zcookie_add(info, cookie)) { spin_unlock_irqrestore(&q->lock, flags); kfree(rds_info_from_znotifier(znotif)); /* caller invokes rds_wake_sk_sleep() */ -- 2.25.1

1 3

[PATCH v7 OLK-5.10 0/8] Add support for hbm memory device and hbm cache
by Zhang Zekun 04 Mar '23

04 Mar '23

v7: - change there is a container(PNP0A06) has a memory device (PNP0C80) before create device attributes under container subsys v6: - get container device form container_subsys v5: - check the container have PNP0C80 before create attribute files v4: - prettify the code v3: - prettify the code - add a hisi_internal.h to hold common code v2: - remove the !adev judge in patch 9, as it will always be true. patch 1-3: Add support for iterate through the child devices in the acpi device. patch 4-9: Add support for hbm memory device and hbm cache support Rafael J. Wysocki (3): ACPI: bus: Introduce acpi_dev_for_each_child() ACPI: bus: Avoid non-ACPI device objects in walks over children ACPI: bus: Export acpi_dev_for_each_child() to modules Zhang Zekun (5): ACPI: OSL: Export the symbol of acpi_hotplug_schedule soc: hisilicon: hisi_hbmdev: Add power domain control methods ACPI: memhotplug: export the state of each hotplug device soc: hisilicon: hisi_hbmdev: Provide extra memory topology information soc: hbmcache: Add support for online and offline the hbm cache drivers/acpi/acpi_memhotplug.c | 6 + drivers/acpi/bus.c | 27 +++ drivers/acpi/internal.h | 1 - drivers/acpi/osl.c | 1 + drivers/base/container.c | 1 + drivers/soc/Kconfig | 1 + drivers/soc/Makefile | 1 + drivers/soc/hisilicon/Kconfig | 33 +++ drivers/soc/hisilicon/Makefile | 4 + drivers/soc/hisilicon/hisi_hbmcache.c | 147 +++++++++++++ drivers/soc/hisilicon/hisi_hbmdev.c | 301 ++++++++++++++++++++++++++ drivers/soc/hisilicon/hisi_internal.h | 31 +++ include/acpi/acpi_bus.h | 2 + include/linux/acpi.h | 1 + include/linux/memory_hotplug.h | 2 + 15 files changed, 558 insertions(+), 1 deletion(-) create mode 100644 drivers/soc/hisilicon/Kconfig create mode 100644 drivers/soc/hisilicon/Makefile create mode 100644 drivers/soc/hisilicon/hisi_hbmcache.c create mode 100644 drivers/soc/hisilicon/hisi_hbmdev.c create mode 100644 drivers/soc/hisilicon/hisi_internal.h -- 2.17.1

1 8

[PATCH v2 OLK-5.10 00/37] backport patches of share_pool and
by Zhang Zekun 04 Mar '23

04 Mar '23

v2: - remove patch "mm/sharepool: Add mg_sp_alloc_nodemask" Chen Jun (3): mm/sharepool: Fix a double free problem caused by init_local_group mm/sharepool: extract group_add_task mm/sharepool: use delete_spg_node to replace some repetitive code Guo Mengqi (1): mm: sharepool: add static modifier to find_spg_node_by_spg() Wang Wensheng (8): mm/sharepool: Fix NULL pointer dereference in mg_sp_group_del_task mm/sharepool: Reorganize create_spg() mm/sharepool: Simplify sp_make_share_k2u() mm/sharepool: Rename sp_group operations mm/sharepool: Simplify sp_unshare_uva() mm/sharepool: Fix null-pointer-deference in sp_free_area mm/sharepool: Modify error message in mg_sp_group_del_task mm/sharepool: Fix double delete list in sp_group_exit Xu Qiang (17): mm/sharepool: Refactoring proc file interface similar code mm/sharepool: Add helper for master_list mm/sharepool: Delete unused spg_id and hugepage_failures. mm/sharepool: Delete unused mm in sp_proc_stat. mm/sharepool: Move spa_num field to sp_group. mm/sharepool: Rename sp_spg_stat to sp_meminfo. mm/sharepool: Split meminfo_update into meminfo_inc_usage and meminfo_dec_usage. mm/sharepool: split meminfo_update_k2u into meminfo_inc_k2u and meminfo_dec_k2u. mm/sharepool: Delete redundant tgid in sp_proc_stat. mm/sharepool: Move comm from sp_proc_stat to sp_group_master. mm/sharepool: replace sp_proc_stat with sp_meminfo. mm/sharepool: Delete unused tgid and spg_id in spg_proc_stat. mm/sharepool: Replace spg_proc_stat with sp_meminfo. mm/sharepool: Add meminfo_alloc_sum_byKB and meminfo_alloc_sum. mm/sharepool: Add meminfo_k2u_size. mm/sharepool: Delete unused kthread_stat. mm/sharepool: Delete redundant size and alloc_size in sp_meminfo. Zhang Zekun (6): perf: hisi: Add configs for PMU isolation driver: Add CONFIG_ACPI_APEI_GHES_TS_CORE for code isolation ACPI / APEI: Add config to isolate Notify all ras err vmalloc: Add config for Extend for hugepages mapping iommu/arm-smmu-v3: Add config to Add support for suspend and resume hugetlbfs: Add config to isolate the code of share_pool Zhou Guanghui (2): mm/sharepool: Don't display sharepool statistics in the container mm: sharepool: Charge Buddy hugepage to memcg arch/arm64/Kconfig | 2 +- arch/arm64/configs/openeuler_defconfig | 6 + drivers/acpi/apei/Kconfig | 14 + drivers/acpi/apei/ghes.c | 10 +- drivers/iommu/Kconfig | 7 + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 9 +- drivers/perf/hisilicon/Kconfig | 19 + drivers/perf/hisilicon/Makefile | 6 +- fs/hugetlbfs/inode.c | 21 +- include/acpi/ghes.h | 2 + include/linux/cper.h | 3 + include/linux/mm.h | 2 + include/linux/vmalloc.h | 7 + mm/Kconfig | 6 + mm/hugetlb.c | 2 + mm/share_pool.c | 1027 ++++++++----------- mm/share_pool_internal.h | 22 + mm/vmalloc.c | 16 + 18 files changed, 569 insertions(+), 612 deletions(-) create mode 100644 mm/share_pool_internal.h -- 2.17.1

1 37

Re: [PATCH v5 OLK-5.10 5/8] soc: hisilicon: hisi_hbmdev: Add power domain control methods
by zhangzekun (A) 03 Mar '23

03 Mar '23

在 2023/3/3 14:19, Kefeng Wang 写道: > > > On 2023/3/3 11:49, Zhang Zekun wrote: >> Offering: HULK >> hulk inclusion >> category: feature >> bugzilla: https://gitee.com/openeuler/kernel/issues/I67QNJ >> CVE: NA >> >> ------------------------------------------------------------------ >> >> Platform devices which supports power control are often required to be >> power off/on together with the devices in the same power domain. >> However, >> there isn't a generic driver that support the power control logic of >> these devices. >> >> ACPI container seems to be a good place to hold these control logic. Add >> platform devices in the same power domain in a ACPI container, we can >> easily get the locality information about these devices and can moniter >> the power of these devices in the same power domain together. >> >> This patch provide three userspace control interface to control the >> power >> of devices together in the container: >> - state: Echo online to state to power up the devices in the >> container and >> then online these devices which will be triggered by BIOS. Echo >> offline >> to the state to offline and eject the child devices in the container >> which are ejectable. >> - pxms: show the pxms of devices which are present in the container. >> >> In our scenario, we need to control the power of HBM memory devices >> which >> can be power consuming and will only be used in some specialized >> scenarios, >> such as HPC. HBM memory devices in a socket are in the same power >> domain, >> and should be power off/on together. We have come up with an idea >> that put >> these power control logic in a specialized driver, but ACPI container >> seems >> to be a more generic place to hold these control logic. >> >> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> >> --- >> v6: >> - get container dev form container_subsys >> >> v5: >> - check containers have PNP0C80 before create attibute >> files >> >> v4: >> - prettify the code >> >> v3: >> - move the common code to hisi_internal.h >> >> drivers/base/container.c | 1 + >> drivers/soc/Kconfig | 1 + >> drivers/soc/Makefile | 1 + >> drivers/soc/hisilicon/Kconfig | 19 +++ >> drivers/soc/hisilicon/Makefile | 3 + >> drivers/soc/hisilicon/hisi_hbmdev.c | 196 ++++++++++++++++++++++++++ >> drivers/soc/hisilicon/hisi_internal.h | 31 ++++ >> 7 files changed, 252 insertions(+) >> create mode 100644 drivers/soc/hisilicon/Kconfig >> create mode 100644 drivers/soc/hisilicon/Makefile >> create mode 100644 drivers/soc/hisilicon/hisi_hbmdev.c >> create mode 100644 drivers/soc/hisilicon/hisi_internal.h >> >> diff --git a/drivers/base/container.c b/drivers/base/container.c >> index 1ba42d2d3532..12e572d0c69b 100644 >> --- a/drivers/base/container.c >> +++ b/drivers/base/container.c >> @@ -30,6 +30,7 @@ struct bus_type container_subsys = { >> .online = trivial_online, >> .offline = container_offline, >> }; >> +EXPORT_SYMBOL_GPL(container_subsys); >> void __init container_dev_init(void) >> { >> diff --git a/drivers/soc/Kconfig b/drivers/soc/Kconfig >> index 425ab6f7e375..f7c59b063321 100644 >> --- a/drivers/soc/Kconfig >> +++ b/drivers/soc/Kconfig >> @@ -23,5 +23,6 @@ source "drivers/soc/versatile/Kconfig" >> source "drivers/soc/xilinx/Kconfig" >> source "drivers/soc/zte/Kconfig" >> source "drivers/soc/kendryte/Kconfig" >> +source "drivers/soc/hisilicon/Kconfig" >> endmenu >> diff --git a/drivers/soc/Makefile b/drivers/soc/Makefile >> index 36452bed86ef..68f186e00e44 100644 >> --- a/drivers/soc/Makefile >> +++ b/drivers/soc/Makefile >> @@ -29,3 +29,4 @@ obj-$(CONFIG_PLAT_VERSATILE) += versatile/ >> obj-y += xilinx/ >> obj-$(CONFIG_ARCH_ZX) += zte/ >> obj-$(CONFIG_SOC_KENDRYTE) += kendryte/ >> +obj-y += hisilicon/ >> diff --git a/drivers/soc/hisilicon/Kconfig >> b/drivers/soc/hisilicon/Kconfig >> new file mode 100644 >> index 000000000000..497787af004e >> --- /dev/null >> +++ b/drivers/soc/hisilicon/Kconfig >> @@ -0,0 +1,19 @@ >> +# SPDX-License-Identifier: GPL-2.0 >> +# >> +# Hisilicon SoC drivers >> +# >> +menu "Hisilicon SoC driver support" >> + >> +config HISI_HBMDEV >> + tristate "add extra support for hbm memory device" >> + depends on ACPI_HOTPLUG_MEMORY >> + select ACPI_CONTAINER >> + help >> + This driver add extra supports for memory devices. The driver >> + provides methods for userpace to control the power of memory >> + devices in a container. >> + >> + To compile this driver as a module, choose M here: >> + the module will be called hisi_hbmdev. >> + >> +endmenu >> diff --git a/drivers/soc/hisilicon/Makefile >> b/drivers/soc/hisilicon/Makefile >> new file mode 100644 >> index 000000000000..22e87acb1ab3 >> --- /dev/null >> +++ b/drivers/soc/hisilicon/Makefile >> @@ -0,0 +1,3 @@ >> +# SPDX-License-Identifier: GPL-2.0 >> + >> +obj-$(CONFIG_HISI_HBMDEV) += hisi_hbmdev.o >> diff --git a/drivers/soc/hisilicon/hisi_hbmdev.c >> b/drivers/soc/hisilicon/hisi_hbmdev.c >> new file mode 100644 >> index 000000000000..8485efc00684 >> --- /dev/null >> +++ b/drivers/soc/hisilicon/hisi_hbmdev.c >> @@ -0,0 +1,196 @@ >> +// SPDX-License-Identifier: GPL-2.0 >> +/* >> + * Copyright (C) Huawei Technologies Co., Ltd. 2023. All rights >> reserved. >> + */ >> + >> +#include <linux/kobject.h> >> +#include <linux/module.h> >> +#include <linux/nodemask.h> >> +#include <linux/acpi.h> >> +#include <linux/container.h> >> + >> +#include "hisi_internal.h" >> + >> +#define ACPI_MEMORY_DEVICE_HID "PNP0C80" >> +#define ACPI_GENERIC_CONTAINER_DEVICE_HID "PNP0A06" >> + >> +struct memory_dev { >> + struct kobject *memdev_kobj; >> +}; >> + >> +static struct memory_dev *mdev; >> + >> +static int hbmdev_find(struct acpi_device *adev, void *arg) >> +{ >> + const char *hid = acpi_device_hid(adev); >> + bool *found = arg; >> + >> + if (!strcmp(hid, ACPI_MEMORY_DEVICE_HID)) { >> + *found = true; >> + return -1; >> + } >> + >> + return 0; >> +} >> + >> +static bool has_hbmdev(struct device *dev) >> +{ >> + struct acpi_device *adev = ACPI_COMPANION(dev); >> + const char *hid = acpi_device_hid(adev); >> + bool found = false; >> + >> + if (strcmp(hid, ACPI_GENERIC_CONTAINER_DEVICE_HID)) >> + return found; >> + >> + acpi_dev_for_each_child(adev, hbmdev_find, &found); >> + >> + return found; >> +} >> + >> +static int get_pxm(struct acpi_device *acpi_device, void *arg) >> +{ >> + acpi_handle handle = acpi_device->handle; >> + nodemask_t *mask = arg; >> + unsigned long long sta; >> + acpi_status status; >> + int nid; >> + >> + status = acpi_evaluate_integer(handle, "_STA", NULL, &sta); >> + if (ACPI_SUCCESS(status) && (sta & ACPI_STA_DEVICE_ENABLED)) { >> + nid = acpi_get_node(handle); >> + if (nid >= 0) >> + node_set(nid, *mask); >> + } >> + >> + return 0; >> +} >> + >> +static ssize_t pxms_show(struct device *dev, >> + struct device_attribute *attr, >> + char *buf) >> +{ >> + struct acpi_device *adev = ACPI_COMPANION(dev); >> + nodemask_t mask; >> + >> + nodes_clear(mask); >> + acpi_dev_for_each_child(adev, get_pxm, &mask); >> + >> + return sysfs_emit(buf, "%*pbl\n", >> + nodemask_pr_args(&mask)); >> +} >> +static DEVICE_ATTR_RO(pxms); >> + >> +static int memdev_power_on(struct acpi_device *adev) >> +{ >> + acpi_handle handle = adev->handle; >> + acpi_status status; >> + >> + status = acpi_evaluate_object(handle, "_ON", NULL, NULL); >> + if (ACPI_FAILURE(status)) { >> + acpi_handle_warn(handle, "Power on failed (0x%x)\n", status); >> + return -ENODEV; >> + } >> + >> + return 0; >> +} >> + >> +static int eject_device(struct acpi_device *acpi_device, void >> *not_used) >> +{ >> + acpi_object_type unused; >> + acpi_status status; >> + >> + status = acpi_get_type(acpi_device->handle, &unused); >> + if (ACPI_FAILURE(status) || !acpi_device->flags.ejectable) >> + return -ENODEV; >> + >> + get_device(&acpi_device->dev); >> + status = acpi_hotplug_schedule(acpi_device, >> ACPI_OST_EC_OSPM_EJECT); >> + if (ACPI_SUCCESS(status)) >> + return 0; >> + >> + put_device(&acpi_device->dev); >> + acpi_evaluate_ost(acpi_device->handle, ACPI_OST_EC_OSPM_EJECT, >> + ACPI_OST_SC_NON_SPECIFIC_FAILURE, NULL); >> + >> + return status == AE_NO_MEMORY ? -ENOMEM : -EAGAIN; >> +} >> + >> +static int memdev_power_off(struct acpi_device *adev) >> +{ >> + return acpi_dev_for_each_child(adev, eject_device, NULL); >> +} >> + >> +static ssize_t state_store(struct device *dev, struct >> device_attribute *attr, >> + const char *buf, size_t count) >> +{ >> + struct acpi_device *adev = ACPI_COMPANION(dev); >> + const int type = online_type_from_str(buf); >> + int ret = -EINVAL; >> + >> + switch (type) { >> + case STATE_ONLINE: >> + ret = memdev_power_on(adev); >> + break; >> + case STATE_OFFLINE: >> + ret = memdev_power_off(adev); >> + break; >> + default: >> + break; >> + } >> + >> + if (ret) >> + return ret; >> + >> + return count; >> +} >> +static DEVICE_ATTR_WO(state); >> + >> +static int container_add(struct device *dev, void *data) >> +{ >> + if (!has_hbmdev(dev)) >> + return 0; >> + >> + device_create_file(dev, &dev_attr_state); >> + device_create_file(dev, &dev_attr_pxms); >> + >> + return 0; >> +} >> + >> +static int container_remove(struct device *dev, void *data) >> +{ >> + if (!has_hbmdev(dev)) >> + return 0; >> + >> + device_remove_file(dev, &dev_attr_state); >> + device_remove_file(dev, &dev_attr_pxms); >> + >> + return 0; >> +} >> + >> +static int __init mdev_init(void) >> +{ >> + mdev = kzalloc(sizeof(struct memory_dev), GFP_KERNEL); >> + if (!mdev) >> + return -ENOMEM; >> + >> + mdev->memdev_kobj = kobject_create_and_add("hbm_memory", >> kernel_kobj); >> + if (!mdev->memdev_kobj) { >> + kfree(mdev); >> + return -ENOMEM; >> + } >> + >> + bus_for_each_dev(&container_subsys, NULL, NULL, container_add); >> + return 0; >> +} > > 这个还是没有解决是否加载的问题； > 1）通过遍历，你已经拿到了所有的container device， > 后面移除的时候就不需要再次遍历了；这里可以搞个链表； > 2）另外判断是否有hbm，搞个全局变量，如果有了，才继续执行后面的初始化，否则就直接返回了； > 按照这个思路这里可以改成这样： module_init 1. 首先判断所有容器中是否有hbm device，构建链表 2. 如果链表不为空那么执行模块的初始化，创建hbm_memory目录如果链表为空直接返回，释放链表 module_exit 释放链表中的资源，释放链表 >> +module_init(mdev_init); >> + >> +static void __exit mdev_exit(void) >> +{ >> + bus_for_each_dev(&container_subsys, NULL, NULL, container_remove); >> + kobject_put(mdev->memdev_kobj); >> + kfree(mdev); >> +} >> +module_exit(mdev_exit); >> + >> +MODULE_LICENSE("GPL v2"); >> +MODULE_AUTHOR("Zhang Zekun <zhangzekun11(a)huawei.com>"); >> diff --git a/drivers/soc/hisilicon/hisi_internal.h >> b/drivers/soc/hisilicon/hisi_internal.h >> new file mode 100644 >> index 000000000000..5345174f6b84 >> --- /dev/null >> +++ b/drivers/soc/hisilicon/hisi_internal.h >> @@ -0,0 +1,31 @@ >> +/* SPDX-License-Identifier: GPL-2.0 */ >> +/* >> + * Copyright (C) Huawei Technologies Co., Ltd. 2023. All rights >> reserved. >> + */ >> + >> +#ifndef _HISI_INTERNAL_H >> +#define _HISI_INTERNAL_H >> + >> +enum { >> + STATE_ONLINE, >> + STATE_OFFLINE, >> +}; >> + >> +static const char *const online_type_to_str[] = { >> + [STATE_ONLINE] = "online", >> + [STATE_OFFLINE] = "offline", >> +}; >> + >> +static inline int online_type_from_str(const char *str) >> +{ >> + int i; >> + >> + for (i = 0; i < ARRAY_SIZE(online_type_to_str); i++) { >> + if (sysfs_streq(str, online_type_to_str[i])) >> + return i; >> + } >> + >> + return -EINVAL; >> +} >> + >> +#endif

1 0

[PATCH v5 OLK-5.10 0/8] Add support for hbm memory device and hbm cache
by Zhang Zekun 03 Mar '23

03 Mar '23

v6: - get container device form container_subsys v5: - check the container have PNP0C80 before create attribute files v4: - prettify the code v3: - prettify the code - add a hisi_internal.h to hold common code v2: - remove the !adev judge in patch 9, as it will always be true. patch 1-3: Add support for iterate through the child devices in the acpi device. patch 4-9: Add support for hbm memory device and hbm cache support Rafael J. Wysocki (3): ACPI: bus: Introduce acpi_dev_for_each_child() ACPI: bus: Avoid non-ACPI device objects in walks over children ACPI: bus: Export acpi_dev_for_each_child() to modules Zhang Zekun (5): ACPI: OSL: Export the symbol of acpi_hotplug_schedule soc: hisilicon: hisi_hbmdev: Add power domain control methods ACPI: memhotplug: export the state of each hotplug device soc: hisilicon: hisi_hbmdev: Provide extra memory topology information ACPI: hbmcache: Add support for online and offline the hbm cache drivers/acpi/acpi_memhotplug.c | 6 + drivers/acpi/bus.c | 27 +++ drivers/acpi/internal.h | 1 - drivers/acpi/osl.c | 1 + drivers/base/container.c | 1 + drivers/soc/Kconfig | 1 + drivers/soc/Makefile | 1 + drivers/soc/hisilicon/Kconfig | 33 ++++ drivers/soc/hisilicon/Makefile | 4 + drivers/soc/hisilicon/hisi_hbmcache.c | 147 +++++++++++++++ drivers/soc/hisilicon/hisi_hbmdev.c | 257 ++++++++++++++++++++++++++ drivers/soc/hisilicon/hisi_internal.h | 31 ++++ include/acpi/acpi_bus.h | 2 + include/linux/acpi.h | 1 + include/linux/memory_hotplug.h | 2 + 15 files changed, 514 insertions(+), 1 deletion(-) create mode 100644 drivers/soc/hisilicon/Kconfig create mode 100644 drivers/soc/hisilicon/Makefile create mode 100644 drivers/soc/hisilicon/hisi_hbmcache.c create mode 100644 drivers/soc/hisilicon/hisi_hbmdev.c create mode 100644 drivers/soc/hisilicon/hisi_internal.h -- 2.17.1

1 8

[PATCH v5 OLK-5.10 0/9] Add support for hbm memory device and hbm cache
by Zhang Zekun 02 Mar '23

02 Mar '23

v5: - check the container have PNP0C80 before create attribute files v4: - prettify the code v3: - prettify the code - add a hisi_internal.h to hold common code v2: - remove the !adev judge in patch 9, as it will always be true. patch 1-3: Add support for iterate through the child devices in the acpi device. patch 4-9: Add support for hbm memory device and hbm cache support Rafael J. Wysocki (3): ACPI: bus: Introduce acpi_dev_for_each_child() ACPI: bus: Avoid non-ACPI device objects in walks over children ACPI: bus: Export acpi_dev_for_each_child() to modules Zhang Zekun (6): ACPI: container: export the container list in the system ACPI: OSL: Export the symbol of acpi_hotplug_schedule soc: hisilicon: hisi_hbmdev: Add power domain control methods ACPI: memhotplug: export the state of each hotplug device soc: hisilicon: hisi_hbmdev: Provide extra memory topology information ACPI: hbmcache: Add support for online and offline the hbm cache drivers/acpi/acpi_memhotplug.c | 6 + drivers/acpi/bus.c | 27 +++ drivers/acpi/container.c | 51 ++++++ drivers/acpi/internal.h | 1 - drivers/acpi/osl.c | 1 + drivers/soc/Kconfig | 1 + drivers/soc/Makefile | 1 + drivers/soc/hisilicon/Kconfig | 33 ++++ drivers/soc/hisilicon/Makefile | 4 + drivers/soc/hisilicon/hisi_hbmcache.c | 147 ++++++++++++++++ drivers/soc/hisilicon/hisi_hbmdev.c | 245 ++++++++++++++++++++++++++ drivers/soc/hisilicon/hisi_internal.h | 33 ++++ include/acpi/acpi_bus.h | 2 + include/linux/acpi.h | 1 + include/linux/container.h | 8 + include/linux/memory_hotplug.h | 2 + 16 files changed, 562 insertions(+), 1 deletion(-) create mode 100644 drivers/soc/hisilicon/Kconfig create mode 100644 drivers/soc/hisilicon/Makefile create mode 100644 drivers/soc/hisilicon/hisi_hbmcache.c create mode 100644 drivers/soc/hisilicon/hisi_hbmdev.c create mode 100644 drivers/soc/hisilicon/hisi_internal.h -- 2.17.1

1 9

[PATCH v4 OLK-5.10 0/9] Add support for hbm memory device and
by Zhang Zekun 02 Mar '23

02 Mar '23

v4: - prettify the code v3: - prettify the code - add a hisi_internal.h to hold common code v2: - remove the !adev judge in patch 9, as it will always be true. patch 1-3: Add support for iterate through the child devices in the acpi device. patch 4-9: Add support for hbm memory device and hbm cache support Rafael J. Wysocki (3): ACPI: bus: Introduce acpi_dev_for_each_child() ACPI: bus: Avoid non-ACPI device objects in walks over children ACPI: bus: Export acpi_dev_for_each_child() to modules Zhang Zekun (6): ACPI: container: export the container list in the system ACPI: OSL: Export the symbol of acpi_hotplug_schedule soc: hisilicon: hisi_hbmdev: Add power domain control methods ACPI: memhotplug: export the state of each hotplug device soc: hisilicon: hisi_hbmdev: Provide extra memory topology information ACPI: hbmcache: Add support for online and offline the hbm cache drivers/acpi/acpi_memhotplug.c | 6 + drivers/acpi/bus.c | 27 ++++ drivers/acpi/container.c | 51 ++++++ drivers/acpi/internal.h | 1 - drivers/acpi/osl.c | 1 + drivers/soc/Kconfig | 1 + drivers/soc/Makefile | 1 + drivers/soc/hisilicon/Kconfig | 33 ++++ drivers/soc/hisilicon/Makefile | 4 + drivers/soc/hisilicon/hisi_hbmcache.c | 147 +++++++++++++++++ drivers/soc/hisilicon/hisi_hbmdev.c | 218 ++++++++++++++++++++++++++ drivers/soc/hisilicon/hisi_internal.h | 31 ++++ include/acpi/acpi_bus.h | 2 + include/linux/acpi.h | 1 + include/linux/container.h | 8 + include/linux/memory_hotplug.h | 2 + 16 files changed, 533 insertions(+), 1 deletion(-) create mode 100644 drivers/soc/hisilicon/Kconfig create mode 100644 drivers/soc/hisilicon/Makefile create mode 100644 drivers/soc/hisilicon/hisi_hbmcache.c create mode 100644 drivers/soc/hisilicon/hisi_hbmdev.c create mode 100644 drivers/soc/hisilicon/hisi_internal.h -- 2.17.1

1 9

Re: [PATCH v3 OLK-5.10 6/9] soc: hisilicon: hisi_hbmdev: Add power domain control methods
by zhangzekun (A) 02 Mar '23

02 Mar '23

在 2023/3/2 15:12, Kefeng Wang 写道: > > > On 2023/3/2 14:51, Zhang Zekun wrote: >> Offering: HULK >> hulk inclusion >> category: feature >> bugzilla: https://gitee.com/openeuler/kernel/issues/I67QNJ >> CVE: NA >> >> ------------------------------------------------------------------ >> >> Platform devices which supports power control are often required to be >> power off/on together with the devices in the same power domain. >> However, >> there isn't a generic driver that support the power control logic of >> these devices. >> >> ACPI container seems to be a good place to hold these control logic. Add >> platform devices in the same power domain in a ACPI container, we can >> easily get the locality information about these devices and can moniter >> the power of these devices in the same power domain together. >> >> This patch provide three userspace control interface to control the >> power >> of devices together in the container: >> - state: Echo online to state to power up the devices in the >> container and >> then online these devices which will be triggered by BIOS. Echo >> offline >> to the state to offline and eject the child devices in the container >> which are ejectable. >> - pxms: show the pxms of devices which are present in the container. >> >> In our scenario, we need to control the power of HBM memory devices >> which >> can be power consuming and will only be used in some specialized >> scenarios, >> such as HPC. HBM memory devices in a socket are in the same power >> domain, >> and should be power off/on together. We have come up with an idea >> that put >> these power control logic in a specialized driver, but ACPI container >> seems >> to be a more generic place to hold these control logic. >> >> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> >> --- >> v3: >> - move the common code to hisi_internal.h >> >> drivers/soc/Kconfig | 1 + >> drivers/soc/Makefile | 1 + >> drivers/soc/hisilicon/Kconfig | 19 +++ >> drivers/soc/hisilicon/Makefile | 3 + >> drivers/soc/hisilicon/hisi_hbmdev.c | 166 ++++++++++++++++++++++++++ >> drivers/soc/hisilicon/hisi_internal.h | 31 +++++ >> 6 files changed, 221 insertions(+) >> create mode 100644 drivers/soc/hisilicon/Kconfig >> create mode 100644 drivers/soc/hisilicon/Makefile >> create mode 100644 drivers/soc/hisilicon/hisi_hbmdev.c >> create mode 100644 drivers/soc/hisilicon/hisi_internal.h >> >> diff --git a/drivers/soc/Kconfig b/drivers/soc/Kconfig >> index 425ab6f7e375..f7c59b063321 100644 >> --- a/drivers/soc/Kconfig >> +++ b/drivers/soc/Kconfig >> @@ -23,5 +23,6 @@ source "drivers/soc/versatile/Kconfig" >> source "drivers/soc/xilinx/Kconfig" >> source "drivers/soc/zte/Kconfig" >> source "drivers/soc/kendryte/Kconfig" >> +source "drivers/soc/hisilicon/Kconfig" >> endmenu >> diff --git a/drivers/soc/Makefile b/drivers/soc/Makefile >> index 36452bed86ef..68f186e00e44 100644 >> --- a/drivers/soc/Makefile >> +++ b/drivers/soc/Makefile >> @@ -29,3 +29,4 @@ obj-$(CONFIG_PLAT_VERSATILE) += versatile/ >> obj-y += xilinx/ >> obj-$(CONFIG_ARCH_ZX) += zte/ >> obj-$(CONFIG_SOC_KENDRYTE) += kendryte/ >> +obj-y += hisilicon/ >> diff --git a/drivers/soc/hisilicon/Kconfig >> b/drivers/soc/hisilicon/Kconfig >> new file mode 100644 >> index 000000000000..497787af004e >> --- /dev/null >> +++ b/drivers/soc/hisilicon/Kconfig >> @@ -0,0 +1,19 @@ >> +# SPDX-License-Identifier: GPL-2.0 >> +# >> +# Hisilicon SoC drivers >> +# >> +menu "Hisilicon SoC driver support" >> + >> +config HISI_HBMDEV >> + tristate "add extra support for hbm memory device" >> + depends on ACPI_HOTPLUG_MEMORY >> + select ACPI_CONTAINER >> + help >> + This driver add extra supports for memory devices. The driver >> + provides methods for userpace to control the power of memory >> + devices in a container. >> + >> + To compile this driver as a module, choose M here: >> + the module will be called hisi_hbmdev. >> + >> +endmenu >> diff --git a/drivers/soc/hisilicon/Makefile >> b/drivers/soc/hisilicon/Makefile >> new file mode 100644 >> index 000000000000..22e87acb1ab3 >> --- /dev/null >> +++ b/drivers/soc/hisilicon/Makefile >> @@ -0,0 +1,3 @@ >> +# SPDX-License-Identifier: GPL-2.0 >> + >> +obj-$(CONFIG_HISI_HBMDEV) += hisi_hbmdev.o >> diff --git a/drivers/soc/hisilicon/hisi_hbmdev.c >> b/drivers/soc/hisilicon/hisi_hbmdev.c >> new file mode 100644 >> index 000000000000..82943cd35fa2 >> --- /dev/null >> +++ b/drivers/soc/hisilicon/hisi_hbmdev.c >> @@ -0,0 +1,166 @@ >> +// SPDX-License-Identifier: GPL-2.0 >> +/* >> + * Copyright (C) Huawei Technologies Co., Ltd. 2023. All rights >> reserved. >> + */ >> + >> +#include <linux/kobject.h> >> +#include <linux/module.h> >> +#include <linux/nodemask.h> >> +#include <linux/acpi.h> >> +#include <linux/container.h> >> + >> +#include "hisi_internal.h" >> + >> +struct memory_dev { >> + struct kobject *memdev_kobj; >> +}; >> + >> +static struct memory_dev *mdev; >> + >> +static int get_pxm(struct acpi_device *acpi_device, void *arg) >> +{ >> + int nid; >> + unsigned long long sta; >> + acpi_handle handle; >> + nodemask_t *mask; >> + acpi_status status; >> + >> + mask = arg; >> + handle = acpi_device->handle; > > 按照倒金字塔， > acpi_handle handle = acpi_device->handle; > nodemask_t *mask = arg; > unsigned long long sta; > acpi_status status; > int nid; >> + >> + status = acpi_evaluate_integer(handle, "_STA", NULL, &sta); >> + if (ACPI_SUCCESS(status) && (sta & ACPI_STA_DEVICE_ENABLED)) { >> + nid = acpi_get_node(handle); >> + if (nid >= 0) >> + node_set(nid, *mask); >> + } >> + >> + return 0; >> +} >> + >> +static ssize_t pxms_show(struct device *dev, >> + struct device_attribute *attr, >> + char *buf) >> +{ >> + nodemask_t mask; >> + struct acpi_device *adev; >> + >> + adev = to_acpi_device(dev); > 同上 > >> + nodes_clear(mask); >> + acpi_dev_for_each_child(adev, get_pxm, &mask); >> + >> + return sysfs_emit(buf, "%*pbl\n", >> + nodemask_pr_args(&mask)); >> +} >> +static DEVICE_ATTR_RO(pxms); >> + >> +static int memdev_power_on(struct acpi_device *adev) >> +{ >> + acpi_status status; >> + acpi_handle handle; >> + >> + handle = adev->handle; > ... >> + status = acpi_evaluate_object(handle, "_ON", NULL, NULL); >> + if (ACPI_FAILURE(status)) { >> + acpi_handle_warn(handle, "Power on failed (0x%x)\n", status); >> + return -ENODEV; >> + } >> + >> + return 0; >> +} >> + >> +static int eject_device(struct acpi_device *acpi_device, void >> *not_used) >> +{ >> + acpi_object_type unused; >> + acpi_status status; >> + >> + status = acpi_get_type(acpi_device->handle, &unused); >> + if (ACPI_FAILURE(status) || !acpi_device->flags.ejectable) >> + return -ENODEV; >> + >> + get_device(&acpi_device->dev); >> + status = acpi_hotplug_schedule(acpi_device, >> ACPI_OST_EC_OSPM_EJECT); >> + if (ACPI_SUCCESS(status)) >> + return 0; >> + >> + put_device(&acpi_device->dev); >> + acpi_evaluate_ost(acpi_device->handle, ACPI_OST_EC_OSPM_EJECT, >> + ACPI_OST_SC_NON_SPECIFIC_FAILURE, NULL); >> + >> + return status == AE_NO_MEMORY ? -ENOMEM : -EAGAIN; >> +} >> + >> +static int memdev_power_off(struct acpi_device *adev) >> +{ >> + return acpi_dev_for_each_child(adev, eject_device, NULL); >> +} >> + >> +static ssize_t state_store(struct device *d, struct device_attribute >> *attr, >> + const char *buf, size_t count) >> +{ >> + int ret; >> + struct acpi_device *adev; >> + const int online_type = online_type_from_str(buf); >> + >> + if (online_type < 0) >> + return -EINVAL; >> + >> + adev = to_acpi_device(d); > > > const int online_type = online_type_from_str(buf); > struct acpi_device *adev = to_acpi_device(d); > int ret; > ... > > >> + switch (online_type) { >> + case STATE_ONLINE: >> + ret = memdev_power_on(adev); >> + if (!ret) >> + return count; >> + break; >> + case STATE_OFFLINE: >> + ret = memdev_power_off(adev); >> + if (!ret) >> + return count; >> + break; >> + default: >> + return -EINVAL; >> + } > 这个有点奇怪，hbm cache和mem的热插拔的函数不能搞成类似的逻辑吗这里改成这样吧 { struct acpi_device *adev = to_acpi_device(d); const int type = online_type_from_str(buf); int ret = -EINVAL; switch (type) { case STATE_ONLINE: ret = memdev_power_on(adev); break; case STATE_OFFLINE: ret = memdev_power_off(adev); break; default: break; } if (ret) return ret; return count; } >> + >> + return ret; >> +} >> +static DEVICE_ATTR_WO(state); >> + >> +static int __init mdev_init(void) >> +{ >> + struct cdev_node *cnode; >> + >> + mdev = kzalloc(sizeof(struct memory_dev), GFP_KERNEL); >> + if (!mdev) >> + return -ENOMEM; >> + >> + mdev->memdev_kobj = kobject_create_and_add("hbm_memory", >> kernel_kobj); >> + if (!mdev->memdev_kobj) { >> + kfree(mdev); >> + return -ENOMEM; >> + } >> + >> + list_for_each_entry(cnode, &cdev_list->clist, clist) { >> + device_create_file(cnode->dev, &dev_attr_state); >> + device_create_file(cnode->dev, &dev_attr_pxms); >> + } >> + >> + return 0; >> +} >> +module_init(mdev_init); >> + >> +static void __exit mdev_exit(void) >> +{ >> + struct cdev_node *cnode; >> + >> + list_for_each_entry(cnode, &cdev_list->clist, clist) { >> + device_remove_file(cnode->dev, &dev_attr_state); >> + device_remove_file(cnode->dev, &dev_attr_pxms); >> + } >> + >> + kobject_put(mdev->memdev_kobj); >> + kfree(mdev); >> +} >> +module_exit(mdev_exit); >> + >> +MODULE_LICENSE("GPL v2"); >> +MODULE_AUTHOR("Zhang Zekun <zhangzekun11(a)huawei.com>"); >> diff --git a/drivers/soc/hisilicon/hisi_internal.h >> b/drivers/soc/hisilicon/hisi_internal.h >> new file mode 100644 >> index 000000000000..f14596f58a05 >> --- /dev/null >> +++ b/drivers/soc/hisilicon/hisi_internal.h >> @@ -0,0 +1,31 @@ >> +/* SPDX-License-Identifier: GPL-2.0 */ >> +/* >> + * Copyright (C) Huawei Technologies Co., Ltd. 2023. All rights >> reserved. >> + */ >> + >> +#ifndef _HISI_INTERNAL_H >> +#define _HISI_INTERNAL_H >> + >> +enum { >> + STATE_ONLINE, >> + STATE_OFFLINE, >> +}; >> + >> +static const char *const online_type_to_str[] = { >> + [STATE_ONLINE] = "online", >> + [STATE_OFFLINE] = "offline", >> +}; >> + >> +static int online_type_from_str(const char *str) > 不需要inline吗 >> +{ >> + int i; >> + >> + for (i = 0; i < ARRAY_SIZE(online_type_to_str); i++) { >> + if (sysfs_streq(str, online_type_to_str[i])) >> + return i; >> + } >> + >> + return -EINVAL; >> +} >> + >> +#endif

1 0

[PATCH v3 OLK-5.10 0/9] Add support for hbm memory device and
by Zhang Zekun 02 Mar '23

02 Mar '23

v3: - prettify the code - add a hisi_internal.h to hold common code v2: - remove the !adev judge in patch 9, as it will always be true. patch 1-3: Add support for iterate through the child devices in the acpi device. patch 4-9: Add support for hbm memory device and hbm cache support Rafael J. Wysocki (3): ACPI: bus: Introduce acpi_dev_for_each_child() ACPI: bus: Avoid non-ACPI device objects in walks over children ACPI: bus: Export acpi_dev_for_each_child() to modules Zhang Zekun (6): ACPI: container: export the container list in the system ACPI: OSL: Export the symbol of acpi_hotplug_schedule soc: hisilicon: hisi_hbmdev: Add power domain control methods ACPI: memhotplug: export the state of each hotplug device soc: hisilicon: hisi_hbmdev: Provide extra memory topology information ACPI: hbmcache: Add support for online and offline the hbm cache drivers/acpi/acpi_memhotplug.c | 6 + drivers/acpi/bus.c | 27 +++ drivers/acpi/container.c | 51 ++++++ drivers/acpi/internal.h | 1 - drivers/acpi/osl.c | 1 + drivers/soc/Kconfig | 1 + drivers/soc/Makefile | 1 + drivers/soc/hisilicon/Kconfig | 33 ++++ drivers/soc/hisilicon/Makefile | 4 + drivers/soc/hisilicon/hisi_hbmcache.c | 147 +++++++++++++++++ drivers/soc/hisilicon/hisi_hbmdev.c | 229 ++++++++++++++++++++++++++ drivers/soc/hisilicon/hisi_internal.h | 31 ++++ include/acpi/acpi_bus.h | 2 + include/linux/acpi.h | 1 + include/linux/container.h | 8 + include/linux/memory_hotplug.h | 2 + 16 files changed, 544 insertions(+), 1 deletion(-) create mode 100644 drivers/soc/hisilicon/Kconfig create mode 100644 drivers/soc/hisilicon/Makefile create mode 100644 drivers/soc/hisilicon/hisi_hbmcache.c create mode 100644 drivers/soc/hisilicon/hisi_hbmdev.c create mode 100644 drivers/soc/hisilicon/hisi_internal.h -- 2.17.1

1 9

[PATCH] Revert "scsi: fix iscsi rescan fails to create block"
by Zhong Jinghua 02 Mar '23

02 Mar '23

hulk inclusion category: bugfix bugzilla: 188150, https://gitee.com/openeuler/kernel/issues/I643OL ---------------------------------------- This reverts commit 7f10ea522db56188ae46c5bbee7052a2b2797515. This commit has a soft lock problem: watchdog: BUG: soft lockup - CPU#22 stuck for 67s! [iscsid:16369] Call Trace: scsi_remove_target+0x548/0x7b0 ? sdev_store_delete+0x90/0x90 ? __mutex_lock_slowpath+0x10/0x10 ? device_remove_class_symlinks+0x1b0/0x1b0 __iscsi_unbind_session+0x16b/0x250 [scsi_transport_iscsi] iscsi_remove_session+0x1d3/0x2f0 [scsi_transport_iscsi] iscsi_session_remove+0x5c/0x80 [libiscsi] iscsi_sw_tcp_session_destroy+0xd3/0x160 [iscsi_tcp] iscsi_if_rx+0x2369/0x5060 [scsi_transport_iscsi] The reason is that if other threads hold the reference count of the kobject while waiting for the device to be released, it will keep waiting in a loop. Fixes: 7f10ea522db5 ("scsi: fix iscsi rescan fails to create block") Signed-off-by: Zhong Jinghua <zhongjinghua(a)huawei.com> --- drivers/scsi/scsi_sysfs.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c index 4468b92bf83b..6433476d3e67 100644 --- a/drivers/scsi/scsi_sysfs.c +++ b/drivers/scsi/scsi_sysfs.c @@ -1507,13 +1507,6 @@ void scsi_remove_device(struct scsi_device *sdev) } EXPORT_SYMBOL(scsi_remove_device); -static int scsi_device_try_get(struct scsi_device *sdev) -{ - if (!kobject_get_unless_zero(&sdev->sdev_gendev.kobj)) - return -ENXIO; - return 0; -} - static void __scsi_remove_target(struct scsi_target *starget) { struct Scsi_Host *shost = dev_to_shost(starget->dev.parent); @@ -1532,7 +1525,9 @@ static void __scsi_remove_target(struct scsi_target *starget) if (sdev->channel != starget->channel || sdev->id != starget->id) continue; - if (scsi_device_try_get(sdev)) + if (sdev->sdev_state == SDEV_DEL || + sdev->sdev_state == SDEV_CANCEL || + !get_device(&sdev->sdev_gendev)) continue; spin_unlock_irqrestore(shost->host_lock, flags); scsi_remove_device(sdev); -- 2.31.1

1 0

[OLK-5.10 0/2] Supports the feature of querying stats
by Chengchang Tang 01 Mar '23

01 Mar '23

From: Juan Zhou <zhoujuan51(a)h-partners.com> 1.Support hns HW stats 2.Add dfx cnt stats Chengchang Tang (2): RDMA/hns: Support hns HW stats RDMA/hns: Add dfx cnt stats drivers/infiniband/hw/hns/hns_roce_ah.c | 8 +- drivers/infiniband/hw/hns/hns_roce_cmd.c | 17 ++- drivers/infiniband/hw/hns/hns_roce_cq.c | 17 ++- drivers/infiniband/hw/hns/hns_roce_device.h | 50 +++++++ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 59 ++++++++ drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 1 + drivers/infiniband/hw/hns/hns_roce_main.c | 146 +++++++++++++++++++- drivers/infiniband/hw/hns/hns_roce_mr.c | 22 ++- drivers/infiniband/hw/hns/hns_roce_pd.c | 10 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 16 ++- drivers/infiniband/hw/hns/hns_roce_srq.c | 7 +- 11 files changed, 320 insertions(+), 33 deletions(-) -- 2.30.0

1 2

[PATCH openEuler-1.0-LTS 1/2] scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress
by Yongqiang Liu 28 Feb '23

28 Feb '23

From: Mike Christie <michael.christie(a)oracle.com> mainline inclusion from mainline-v6.2-rc6~31 commit 6f1d64b13097e85abda0f91b5638000afc5f9a06 category: bugfix bugzilla: 188443, https://gitee.com/openeuler/kernel/issues/I6I8YD CVE: NA ---------------------------------------- Bug report and analysis from Ding Hui. During iSCSI session logout, if another task accesses the shost ipaddress attr, we can get a KASAN UAF report like this: [ 276.942144] BUG: KASAN: use-after-free in _raw_spin_lock_bh+0x78/0xe0 [ 276.942535] Write of size 4 at addr ffff8881053b45b8 by task cat/4088 [ 276.943511] CPU: 2 PID: 4088 Comm: cat Tainted: G E 6.1.0-rc8+ #3 [ 276.943997] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 [ 276.944470] Call Trace: [ 276.944943] <TASK> [ 276.945397] dump_stack_lvl+0x34/0x48 [ 276.945887] print_address_description.constprop.0+0x86/0x1e7 [ 276.946421] print_report+0x36/0x4f [ 276.947358] kasan_report+0xad/0x130 [ 276.948234] kasan_check_range+0x35/0x1c0 [ 276.948674] _raw_spin_lock_bh+0x78/0xe0 [ 276.949989] iscsi_sw_tcp_host_get_param+0xad/0x2e0 [iscsi_tcp] [ 276.951765] show_host_param_ISCSI_HOST_PARAM_IPADDRESS+0xe9/0x130 [scsi_transport_iscsi] [ 276.952185] dev_attr_show+0x3f/0x80 [ 276.953005] sysfs_kf_seq_show+0x1fb/0x3e0 [ 276.953401] seq_read_iter+0x402/0x1020 [ 276.954260] vfs_read+0x532/0x7b0 [ 276.955113] ksys_read+0xed/0x1c0 [ 276.955952] do_syscall_64+0x38/0x90 [ 276.956347] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 276.956769] RIP: 0033:0x7f5d3a679222 [ 276.957161] Code: c0 e9 b2 fe ff ff 50 48 8d 3d 32 c0 0b 00 e8 a5 fe 01 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24 [ 276.958009] RSP: 002b:00007ffc864d16a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 276.958431] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f5d3a679222 [ 276.958857] RDX: 0000000000020000 RSI: 00007f5d3a4fe000 RDI: 0000000000000003 [ 276.959281] RBP: 00007f5d3a4fe000 R08: 00000000ffffffff R09: 0000000000000000 [ 276.959682] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000020000 [ 276.960126] R13: 0000000000000003 R14: 0000000000000000 R15: 0000557a26dada58 [ 276.960536] </TASK> [ 276.961357] Allocated by task 2209: [ 276.961756] kasan_save_stack+0x1e/0x40 [ 276.962170] kasan_set_track+0x21/0x30 [ 276.962557] __kasan_kmalloc+0x7e/0x90 [ 276.962923] __kmalloc+0x5b/0x140 [ 276.963308] iscsi_alloc_session+0x28/0x840 [scsi_transport_iscsi] [ 276.963712] iscsi_session_setup+0xda/0xba0 [libiscsi] [ 276.964078] iscsi_sw_tcp_session_create+0x1fd/0x330 [iscsi_tcp] [ 276.964431] iscsi_if_create_session.isra.0+0x50/0x260 [scsi_transport_iscsi] [ 276.964793] iscsi_if_recv_msg+0xc5a/0x2660 [scsi_transport_iscsi] [ 276.965153] iscsi_if_rx+0x198/0x4b0 [scsi_transport_iscsi] [ 276.965546] netlink_unicast+0x4d5/0x7b0 [ 276.965905] netlink_sendmsg+0x78d/0xc30 [ 276.966236] sock_sendmsg+0xe5/0x120 [ 276.966576] ____sys_sendmsg+0x5fe/0x860 [ 276.966923] ___sys_sendmsg+0xe0/0x170 [ 276.967300] __sys_sendmsg+0xc8/0x170 [ 276.967666] do_syscall_64+0x38/0x90 [ 276.968028] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 276.968773] Freed by task 2209: [ 276.969111] kasan_save_stack+0x1e/0x40 [ 276.969449] kasan_set_track+0x21/0x30 [ 276.969789] kasan_save_free_info+0x2a/0x50 [ 276.970146] __kasan_slab_free+0x106/0x190 [ 276.970470] __kmem_cache_free+0x133/0x270 [ 276.970816] device_release+0x98/0x210 [ 276.971145] kobject_cleanup+0x101/0x360 [ 276.971462] iscsi_session_teardown+0x3fb/0x530 [libiscsi] [ 276.971775] iscsi_sw_tcp_session_destroy+0xd8/0x130 [iscsi_tcp] [ 276.972143] iscsi_if_recv_msg+0x1bf1/0x2660 [scsi_transport_iscsi] [ 276.972485] iscsi_if_rx+0x198/0x4b0 [scsi_transport_iscsi] [ 276.972808] netlink_unicast+0x4d5/0x7b0 [ 276.973201] netlink_sendmsg+0x78d/0xc30 [ 276.973544] sock_sendmsg+0xe5/0x120 [ 276.973864] ____sys_sendmsg+0x5fe/0x860 [ 276.974248] ___sys_sendmsg+0xe0/0x170 [ 276.974583] __sys_sendmsg+0xc8/0x170 [ 276.974891] do_syscall_64+0x38/0x90 [ 276.975216] entry_SYSCALL_64_after_hwframe+0x63/0xcd We can easily reproduce by two tasks: 1. while :; do iscsiadm -m node --login; iscsiadm -m node --logout; done 2. while :; do cat \ /sys/devices/platform/host*/iscsi_host/host*/ipaddress; done iscsid | cat --------------------------------+--------------------------------------- |- iscsi_sw_tcp_session_destroy | |- iscsi_session_teardown | |- device_release | |- iscsi_session_release ||- dev_attr_show |- kfree | |- show_host_param_ | ISCSI_HOST_PARAM_IPADDRESS | |- iscsi_sw_tcp_host_get_param | |- r/w tcp_sw_host->session (UAF) |- iscsi_host_remove | |- iscsi_host_free | Fix the above bug by splitting the session removal into 2 parts: 1. removal from iSCSI class which includes sysfs and removal from host tracking. 2. freeing of session. During iscsi_tcp host and session removal we can remove the session from sysfs then remove the host from sysfs. At this point we know userspace is not accessing the kernel via sysfs so we can free the session and host. Link: https://lore.kernel.org/r/20230117193937.21244-2-michael.christie@oracle.com Signed-off-by: Mike Christie <michael.christie(a)oracle.com> Reviewed-by: Lee Duncan <lduncan(a)suse.com> Acked-by: Ding Hui <dinghui(a)sangfor.com.cn> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Wenchao Hao <haowenchao2(a)huawei.com> Signed-off-by: Zhong Jinghua <zhongjinghua(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/scsi/iscsi_tcp.c | 11 +++++++++-- drivers/scsi/libiscsi.c | 39 +++++++++++++++++++++++++++++++-------- include/scsi/libiscsi.h | 2 ++ 3 files changed, 42 insertions(+), 10 deletions(-) diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c index 241b1a310519..a5259fd39d6d 100644 --- a/drivers/scsi/iscsi_tcp.c +++ b/drivers/scsi/iscsi_tcp.c @@ -910,10 +910,17 @@ static void iscsi_sw_tcp_session_destroy(struct iscsi_cls_session *cls_session) if (WARN_ON_ONCE(session->leadconn)) return; + iscsi_session_remove(cls_session); + /* + * Our get_host_param needs to access the session, so remove the + * host from sysfs before freeing the session to make sure userspace + * is no longer accessing the callout. + */ + iscsi_host_remove(shost); + iscsi_tcp_r2tpool_free(cls_session->dd_data); - iscsi_session_teardown(cls_session); - iscsi_host_remove(shost); + iscsi_session_free(cls_session); iscsi_host_free(shost); } diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c index 9f625a4d53c0..72463874d7b4 100644 --- a/drivers/scsi/libiscsi.c +++ b/drivers/scsi/libiscsi.c @@ -3018,20 +3018,34 @@ iscsi_session_setup(struct iscsi_transport *iscsit, struct Scsi_Host *shost, } EXPORT_SYMBOL_GPL(iscsi_session_setup); +/* + * issi_session_remove - Remove session from iSCSI class. + */ +void iscsi_session_remove(struct iscsi_cls_session *cls_session) +{ + struct iscsi_session *session = cls_session->dd_data; + struct Scsi_Host *shost = session->host; + + iscsi_remove_session(cls_session); + /* + * host removal only has to wait for its children to be removed from + * sysfs, and iscsi_tcp needs to do iscsi_host_remove before freeing + * the session, so drop the session count here. + */ + iscsi_host_dec_session_cnt(shost); +} +EXPORT_SYMBOL_GPL(iscsi_session_remove); + /** - * iscsi_session_teardown - destroy session, host, and cls_session + * iscsi_session_free - Free iscsi session and it's resources * @cls_session: iscsi session */ -void iscsi_session_teardown(struct iscsi_cls_session *cls_session) +void iscsi_session_free(struct iscsi_cls_session *cls_session) { struct iscsi_session *session = cls_session->dd_data; struct module *owner = cls_session->transport->owner; - struct Scsi_Host *shost = session->host; iscsi_pool_free(&session->cmdpool); - - iscsi_remove_session(cls_session); - kfree(session->password); kfree(session->password_in); kfree(session->username); @@ -3047,10 +3061,19 @@ void iscsi_session_teardown(struct iscsi_cls_session *cls_session) kfree(session->discovery_parent_type); iscsi_free_session(cls_session); - - iscsi_host_dec_session_cnt(shost); module_put(owner); } +EXPORT_SYMBOL_GPL(iscsi_session_free); + +/** + * iscsi_session_teardown - destroy session and cls_session + * @cls_session: iscsi session + */ +void iscsi_session_teardown(struct iscsi_cls_session *cls_session) +{ + iscsi_session_remove(cls_session); + iscsi_session_free(cls_session); +} EXPORT_SYMBOL_GPL(iscsi_session_teardown); /** diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h index 254e72b46d10..2a8d1de70290 100644 --- a/include/scsi/libiscsi.h +++ b/include/scsi/libiscsi.h @@ -425,6 +425,8 @@ extern int iscsi_host_get_max_scsi_cmds(struct Scsi_Host *shost, extern struct iscsi_cls_session * iscsi_session_setup(struct iscsi_transport *, struct Scsi_Host *shost, uint16_t, int, int, uint32_t, unsigned int); +void iscsi_session_remove(struct iscsi_cls_session *cls_session); +void iscsi_session_free(struct iscsi_cls_session *cls_session); extern void iscsi_session_teardown(struct iscsi_cls_session *); extern void iscsi_session_recovery_timedout(struct iscsi_cls_session *); extern int iscsi_set_param(struct iscsi_cls_conn *cls_conn, -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS] pciehp: fix the problem that the slot is powered on again after being powered off
by jiazhenyuan＠uniontech.com 28 Feb '23

28 Feb '23

From: jiazhenyuan <jiazhenyuan(a)uniontech.com> mainline inclusion from mainline-4.19-lts commit 32a8cef274feacd00b748a4f13b84d60aa6d82ff category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6ICDL CVE: NA ---------------------------------------- The DISABLE_SLOT event is lost when the slot is powered off. Signed-off-by: jiazhenyuan <jiazhenyuan(a)uniontech.com> --- drivers/pci/hotplug/pciehp_ctrl.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c index 2d549c97ac42..dd67dc540279 100644 --- a/drivers/pci/hotplug/pciehp_ctrl.c +++ b/drivers/pci/hotplug/pciehp_ctrl.c @@ -463,6 +463,7 @@ int pciehp_sysfs_disable_slot(struct slot *p_slot) mutex_unlock(&p_slot->lock); pci_config_pm_runtime_get(pdev); down_read(&ctrl->reset_lock); + atomic_or(DISABLE_SLOT, &ctrl->pending_events); pciehp_handle_disable_request(p_slot); up_read(&ctrl->reset_lock); pci_config_pm_runtime_put(pdev); -- 2.27.0

1 0

[PATCH openEuler-1.0-LTS] net: mpls: fix stale pointer if allocation fails during device rename
by Yongqiang Liu 28 Feb '23

28 Feb '23

From: Jakub Kicinski <kuba(a)kernel.org> stable inclusion from stable-v4.19.273 commit aa07c86e43ed8780d610ecfb2ce13da326729201 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6HZHU CVE: CVE-2023-26545 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fda6c89fe3d9aca073495a664e1d5aea28cd4377 upstream. lianhui reports that when MPLS fails to register the sysctl table under new location (during device rename) the old pointers won't get overwritten and may be freed again (double free). Handle this gracefully. The best option would be unregistering the MPLS from the device completely on failure, but unfortunately mpls_ifdown() can fail. So failing fully is also unreliable. Another option is to register the new table first then only remove old one if the new one succeeds. That requires more code, changes order of notifications and two tables may be visible at the same time. sysctl point is not used in the rest of the code - set to NULL on failures and skip unregister if already NULL. Reported-by: lianhui tang <bluetlh(a)gmail.com> Fixes: 0fae3bf018d9 ("mpls: handle device renames for per-device sysctls") Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/mpls/af_mpls.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c index 7623d9aec636..c7fd387baa61 100644 --- a/net/mpls/af_mpls.c +++ b/net/mpls/af_mpls.c @@ -1375,6 +1375,7 @@ static int mpls_dev_sysctl_register(struct net_device *dev, free: kfree(table); out: + mdev->sysctl = NULL; return -ENOBUFS; } @@ -1384,6 +1385,9 @@ static void mpls_dev_sysctl_unregister(struct net_device *dev, struct net *net = dev_net(dev); struct ctl_table *table; + if (!mdev->sysctl) + return; + table = mdev->sysctl->ctl_table_arg; unregister_net_sysctl_table(mdev->sysctl); kfree(table); -- 2.25.1

1 0

[PATCH openEuler-5.10-LTS-SP1] net: mpls: fix stale pointer if allocation fails during device rename
by Jialin Zhang 28 Feb '23

28 Feb '23

From: Jakub Kicinski <kuba(a)kernel.org> stable inclusion from stable-v5.10.169 commit 7ff0fdba82298d1f456c685e24930da89703c0fb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6HZHU CVE: CVE-2023-26545 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fda6c89fe3d9aca073495a664e1d5aea28cd4377 upstream. lianhui reports that when MPLS fails to register the sysctl table under new location (during device rename) the old pointers won't get overwritten and may be freed again (double free). Handle this gracefully. The best option would be unregistering the MPLS from the device completely on failure, but unfortunately mpls_ifdown() can fail. So failing fully is also unreliable. Another option is to register the new table first then only remove old one if the new one succeeds. That requires more code, changes order of notifications and two tables may be visible at the same time. sysctl point is not used in the rest of the code - set to NULL on failures and skip unregister if already NULL. Reported-by: lianhui tang <bluetlh(a)gmail.com> Fixes: 0fae3bf018d9 ("mpls: handle device renames for per-device sysctls") Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- net/mpls/af_mpls.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c index 72398149e4d4..1dcbdab9319b 100644 --- a/net/mpls/af_mpls.c +++ b/net/mpls/af_mpls.c @@ -1427,6 +1427,7 @@ static int mpls_dev_sysctl_register(struct net_device *dev, free: kfree(table); out: + mdev->sysctl = NULL; return -ENOBUFS; } @@ -1436,6 +1437,9 @@ static void mpls_dev_sysctl_unregister(struct net_device *dev, struct net *net = dev_net(dev); struct ctl_table *table; + if (!mdev->sysctl) + return; + table = mdev->sysctl->ctl_table_arg; unregister_net_sysctl_table(mdev->sysctl); kfree(table); -- 2.25.1

1 0

[PATCH openEuler-5.10-LTS 01/50] Revert "[Huawei] io_uring:drop identity before creating a private one"
by Jialin Zhang 28 Feb '23

28 Feb '23

From: Li Lingfeng <lilingfeng3(a)huawei.com> Offering: HULK hulk inclusion category: feature bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6BTWC ------------------------------- This reverts commit ab45921343c63dc9d461740e23003098697e0333. We need to apply patch 788d0824269bef (io_uring: import 5.15-stable io_uring) to move io_uring to separate directory and solve the problem of CVE-2023-0240. This patch fix a uaf problem of io_identity, and it can be reverted since io_identity is removed in patch 788d0824269bef. Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- fs/io_uring.c | 42 ------------------------------------------ 1 file changed, 42 deletions(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index 4ace89ae4832..2397c2a1d919 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -1364,47 +1364,6 @@ static bool io_identity_cow(struct io_kiocb *req) return true; } -static void io_drop_identity(struct io_kiocb *req) -{ - struct io_identity *id = req->work.identity; - - if (req->work.flags & IO_WQ_WORK_MM) { - mmdrop(id->mm); - req->work.flags &= ~IO_WQ_WORK_MM; - } -#ifdef CONFIG_BLK_CGROUP - if (req->work.flags & IO_WQ_WORK_BLKCG) { - css_put(id->blkcg_css); - req->work.flags &= ~IO_WQ_WORK_BLKCG; - } -#endif - if (req->work.flags & IO_WQ_WORK_CREDS) { - put_cred(id->creds); - req->work.flags &= ~IO_WQ_WORK_CREDS; - } - if (req->work.flags & IO_WQ_WORK_FILES) { - put_files_struct(req->work.identity->files); - put_nsproxy(req->work.identity->nsproxy); - req->work.flags &= ~IO_WQ_WORK_FILES; - } - if (req->work.flags & IO_WQ_WORK_CANCEL) - req->work.flags &= ~IO_WQ_WORK_CANCEL; - if (req->work.flags & IO_WQ_WORK_FS) { - struct fs_struct *fs = id->fs; - - spin_lock(&id->fs->lock); - if (--fs->users) - fs = NULL; - spin_unlock(&id->fs->lock); - - if (fs) - free_fs_struct(fs); - req->work.flags &= ~IO_WQ_WORK_FS; - } - if (req->work.flags & IO_WQ_WORK_FSIZE) - req->work.flags &= ~IO_WQ_WORK_FSIZE; -} - static bool io_grab_identity(struct io_kiocb *req) { const struct io_op_def *def = &io_op_defs[req->opcode]; @@ -1510,7 +1469,6 @@ static void io_prep_async_work(struct io_kiocb *req) if (io_grab_identity(req)) return; - io_drop_identity(req); if (!io_identity_cow(req)) return; -- 2.25.1

1 49

[PATCH openEuler-5.10-LTS-SP1 01/52] Revert "[Huawei] io_uring:drop identity before creating a private one"
by Jialin Zhang 28 Feb '23

28 Feb '23

From: Li Lingfeng <lilingfeng3(a)huawei.com> Offering: HULK hulk inclusion category: feature bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6BTWC ------------------------------- This reverts commit 6d9aaec1edb197ca7e05873c1930c418b7ecaa1e. We need to apply patch 788d0824269bef (io_uring: import 5.15-stable io_uring) to move io_uring to separate directory and solve the problem of CVE-2023-0240. This patch fix a uaf problem of io_identity, and it can be reverted since io_identity is removed in patch 788d0824269bef. Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- fs/io_uring.c | 42 ------------------------------------------ 1 file changed, 42 deletions(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index 21adb7ff7b2e..adb8fcef738a 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -1364,47 +1364,6 @@ static bool io_identity_cow(struct io_kiocb *req) return true; } -static void io_drop_identity(struct io_kiocb *req) -{ - struct io_identity *id = req->work.identity; - - if (req->work.flags & IO_WQ_WORK_MM) { - mmdrop(id->mm); - req->work.flags &= ~IO_WQ_WORK_MM; - } -#ifdef CONFIG_BLK_CGROUP - if (req->work.flags & IO_WQ_WORK_BLKCG) { - css_put(id->blkcg_css); - req->work.flags &= ~IO_WQ_WORK_BLKCG; - } -#endif - if (req->work.flags & IO_WQ_WORK_CREDS) { - put_cred(id->creds); - req->work.flags &= ~IO_WQ_WORK_CREDS; - } - if (req->work.flags & IO_WQ_WORK_FILES) { - put_files_struct(req->work.identity->files); - put_nsproxy(req->work.identity->nsproxy); - req->work.flags &= ~IO_WQ_WORK_FILES; - } - if (req->work.flags & IO_WQ_WORK_CANCEL) - req->work.flags &= ~IO_WQ_WORK_CANCEL; - if (req->work.flags & IO_WQ_WORK_FS) { - struct fs_struct *fs = id->fs; - - spin_lock(&id->fs->lock); - if (--fs->users) - fs = NULL; - spin_unlock(&id->fs->lock); - - if (fs) - free_fs_struct(fs); - req->work.flags &= ~IO_WQ_WORK_FS; - } - if (req->work.flags & IO_WQ_WORK_FSIZE) - req->work.flags &= ~IO_WQ_WORK_FSIZE; -} - static bool io_grab_identity(struct io_kiocb *req) { const struct io_op_def *def = &io_op_defs[req->opcode]; @@ -1510,7 +1469,6 @@ static void io_prep_async_work(struct io_kiocb *req) if (io_grab_identity(req)) return; - io_drop_identity(req); if (!io_identity_cow(req)) return; -- 2.25.1

1 51

[PATCH openEuler-1.0-LTS 1/3] selinux: further adjust init order for file_alloc_security hook
by Yongqiang Liu 27 Feb '23

27 Feb '23

From: "GONG, Ruiqi" <gongruiqi1(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6DRJ1 CVE: NA ---------------------------------------- After backporting commit cfff75d8973a ("selinux: reorder hooks to make runtime disable less broken") to the 4.19 kernel of openEuler-1.0-LTS, another kernel panic was triggered by running the POC of the aforementioned commit: BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 PGD 800000001840b067 P4D 800000001840b067 PUD 1840c067 PMD 0 Oops: 0002 [#1] SMP PTI CPU: 7 PID: 273 Comm: exe Tainted: G OE 4.19.90+ #6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 RIP: 0010:selinux_file_open+0x49/0xf0 Code: 00 00 00 65 48 8b 04 25 28 00 00 00 48 89 44 24 20 31 c0 4c 89 e7 e8 a6 ec ff ff 49 8b 44 24 38 48 c7 c7 e0 a5 13 97 8b 40 1c <89> 45 08 e8 6f 80 ff ff ba 02 00 00 00 89 45 0c 8b 43 44 8b 73 40 RSP: 0018:ffffbb7300867ba0 EFLAGS: 00010246 RAX: 0000000000000003 RBX: ffff9dc301961400 RCX: 00000000000081ed RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffffff9713a5e0 RBP: 0000000000000000 R08: 0000000000000001 R09: ffff9dc301fedcb0 R10: 0000000000000007 R11: 7fffffffffffffff R12: ffff9dc30204fd70 R13: 0000000000000000 R14: ffff9dc301961410 R15: ffffbb7300867c70 FS: 0000000000d258c0(0000) GS:ffff9dc33e9c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 00000000022bc000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? generic_permission+0x10a/0x190 security_file_open+0x26/0x90 do_dentry_open+0xd9/0x380 do_last+0x197/0x8d0 path_openat+0x89/0x280 do_filp_open+0x91/0x100 do_open_execat+0x79/0x180 __do_execve_file.isra.0+0x6dd/0x8b0 __x64_sys_execve+0x35/0x40 do_syscall_64+0x63/0x250 ? async_page_fault+0x8/0x30 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x49a5db Code: 41 89 01 eb da 66 2e 0f 1f 84 00 00 00 00 00 f7 d8 64 41 89 01 eb d6 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 3b 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffe7b1cebd8 EFLAGS: 00000246 ORIG_RAX: 000000000000003b RAX: ffffffffffffffda RBX: 0000000000d27ee0 RCX: 000000000049a5db RDX: 0000000000d27f08 RSI: 0000000000d27ee0 RDI: 0000000000d27f48 RBP: 0000000000d27f48 R08: fefefefefefefeff R09: fefefeff666d686f R10: 0000000000d25b90 R11: 0000000000000246 R12: 0000000000d27f08 R13: 0000000000655894 R14: 0000000000d27f08 R15: 0000000000d26ed0 Modules linked in: e1000(OE) CR2: 0000000000000008 ---[ end trace e4eb884974c22e2d ]--- RIP: 0010:selinux_file_open+0x49/0xf0 Code: 00 00 00 65 48 8b 04 25 28 00 00 00 48 89 44 24 20 31 c0 4c 89 e7 e8 a6 ec ff ff 49 8b 44 24 38 48 c7 c7 e0 a5 13 97 8b 40 1c <89> 45 08 e8 6f 80 ff ff ba 02 00 00 00 89 45 0c 8b 43 44 8b 73 40 RSP: 0018:ffffbb7300867ba0 EFLAGS: 00010246 RAX: 0000000000000003 RBX: ffff9dc301961400 RCX: 00000000000081ed RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffffff9713a5e0 RBP: 0000000000000000 R08: 0000000000000001 R09: ffff9dc301fedcb0 R10: 0000000000000007 R11: 7fffffffffffffff R12: ffff9dc30204fd70 R13: 0000000000000000 R14: ffff9dc301961410 R15: ffffbb7300867c70 FS: 0000000000d258c0(0000) GS:ffff9dc33e9c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 00000000022bc000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Kernel panic - not syncing: Fatal exception Kernel Offset: 0x14400000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) ---[ end Kernel panic - not syncing: Fatal exception ]--- The problem was caused by selinux_file_open() accessing a file's fsec being NULL, which indicated that the file_alloc_security hook should be deleted later (at least after the file_open hook) when disabling SELinux at runtime. Here I put it into the "allocating" part. Signed-off-by: GONG, Ruiqi <gongruiqi1(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- security/selinux/hooks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index cd26c1199353..85ac12d6b2f4 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -7040,7 +7040,6 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr), LSM_HOOK_INIT(file_permission, selinux_file_permission), - LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security), LSM_HOOK_INIT(file_free_security, selinux_file_free_security), LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl), LSM_HOOK_INIT(mmap_file, selinux_mmap_file), @@ -7207,6 +7206,7 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security), LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security), LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security), + LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security), LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank), LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security), LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx), -- 2.25.1

1 2

[PATCH openEuler-1.0-LTS 1/1] nbd: fix assignment error for first_minor in nbd_dev_add
by Yongqiang Liu 25 Feb '23

25 Feb '23

From: Zhong Jinghua <zhongjinghua(a)huawei.com> hulk inclusion category: bugfix bugzilla: 188413, https://gitee.com/openeuler/kernel/issues/I6GWYG CVE: NA ---------------------------------------- A panic error is like below: nbd_genl_connect nbd_dev_add first_minor = index << part_shift; // index =-1 ... __device_add_disk blk_alloc_devt *devt = MKDEV(disk->major, disk->first_minor + part->partno); // part->partno = 0， first_minor = 11...110000 major is covered There, index < 0 will reassign an index, but here disk->first_minor is assigned -1 << part_shift. This causes to the creation of the device with the same major and minor device numbers each time the incoming index<0, and this will lead to creation of kobject failed: Warning: kobject_add_internal failed for 4095:1048544 with -EEXIST, don't try to register things with the same name in the same directory. Fix it by moving the first_minor assignment down to after getting the new index. Fixes: 01f7594e62e9 ("nbd: Fix use-after-free in blk_mq_free_rqs") Signed-off-by: Zhong Jinghua <zhongjinghua(a)huawei.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/block/nbd.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 8dbbd676d275..551b2f7da8ef 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -1706,7 +1706,6 @@ static int nbd_dev_add(int index) struct gendisk *disk; struct request_queue *q; int err = -ENOMEM; - int first_minor = index << part_shift; nbd = kzalloc(sizeof(struct nbd_device), GFP_KERNEL); if (!nbd) @@ -1770,7 +1769,7 @@ static int nbd_dev_add(int index) refcount_set(&nbd->refs, 1); INIT_LIST_HEAD(&nbd->list); disk->major = NBD_MAJOR; - disk->first_minor = first_minor; + disk->first_minor = index << part_shift; disk->fops = &nbd_fops; disk->private_data = nbd; sprintf(disk->disk_name, "nbd%d", index); -- 2.25.1

2 1

openEuler缺陷issue处理流程_修正
by zhangjialin (F) 23 Feb '23

23 Feb '23

1 0

openEuler缺陷issue处理流程图
by zhangjialin (F) 23 Feb '23

23 Feb '23

1 0

[PATCH openEuler-1.0-LTS 00/13] mainline bugfix backport
by Yongqiang Liu 23 Feb '23

23 Feb '23

*** BLURB HERE *** Andy Shevchenko (1): ipmi: use %*ph to print small buffer Dan Carpenter (1): evm: Fix a small race in init_desc() Eric Biggers (1): crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete() Greg Kroah-Hartman (1): iommu: Properly export iommu_group_get_for_dev() Herbert Xu (2): crypto: algif_skcipher - EBUSY on aio should be an error crypto: algif_skcipher - Use chunksize instead of blocksize Lubomir Rintel (1): component: do not dereference opaque pointer in debugfs Nishka Dasgupta (2): of: unittest: Add of_node_put() before return of: resolver: Add of_node_put() before return and break Ondrej Mosnacek (1): selinux: reorder hooks to make runtime disable less broken Roberto Sassu (1): evm: Check also if *tfm is an error pointer in init_desc() Will Deacon (2): drivers/iommu: Export core IOMMU API symbols to permit modular drivers drivers/iommu: Allow IOMMU bus ops to be unregistered crypto/algif_skcipher.c | 4 +- crypto/rsa-pkcs1pad.c | 2 + drivers/base/component.c | 8 +-- drivers/char/ipmi/ipmi_msghandler.c | 27 ++------- drivers/iommu/iommu-sysfs.c | 5 ++ drivers/iommu/iommu.c | 12 ++++ drivers/of/resolver.c | 12 +++- drivers/of/unittest.c | 4 +- security/integrity/evm/evm_crypto.c | 45 +++++++------- security/selinux/hooks.c | 93 ++++++++++++++++++++--------- 10 files changed, 129 insertions(+), 83 deletions(-) -- 2.25.1

1 13

openEuler缺陷issue处理流程
by zhangjialin (F) 23 Feb '23

23 Feb '23

1 0

议题征集//答复: openEuler Kernel SIG双周例会
by liaotao (C) 23 Feb '23

23 Feb '23

当前例会议题：议题一：进展update（10min） -- 张伽琳 & 郑增凯议题二：openeuler 实时内核（PREEMPT_RT）规划讨论 --丁翔欢迎大家继续申报~ -----原始约会----- 发件人: openEuler conference <public(a)openeuler.org> 发送时间: 2023年2月21日 10:06 收件人: dev@openeuler.org,kernel-discuss@openeuler.org,kernel@openeuler.org 主题: openEuler Kernel SIG双周例会时间: 2023年2月24日星期五 14:00-15:30(UTC+08:00) 北京，重庆，香港特别行政区，乌鲁木齐。地点: 您好！ Kernel SIG 邀请您参加 2023-02-24 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容：欢迎您参加Kernel SIG双周例会，当前议题： 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板）会议链接：https://us06web.zoom.us/j/82111503728?pwd=TWRGa2REc0V2ZmlGZ2ZreUF1OXA3dz09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2023-02-24 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 欢迎您参加Kernel SIG双周例会，当前议题： 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板） You can join the meeting at https://us06web.zoom.us/j/82111503728?pwd=TWRGa2REc0V2ZmlGZ2ZreUF1OXA3dz09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS] dhugetlb: isolate hwpoison hugepage when release
by Yongqiang Liu 23 Feb '23

23 Feb '23

From: Liu Shixin <liushixin2(a)huawei.com> hulk inclusion category: bugfix bugzilla: 46904, https://gitee.com/openeuler/kernel/issues/I6GSKP CVE: NA -------------------------------- For a hwpoison hugetlb page, the page will be freed firstly. If succeed, it will be dissolved and released to buddy system, then isolate the hwpoison page. For a hwpoison hugepage belong to dynamic hugetlb, we isolate the hugepage without dissolve it. Add a check in free_huge_page_to_dhugetlb_pool() to isolate the hwpoison hugepage directly. And keep HUGETLB_PAGE_DTOR after free to ensure the PageHuge() check return true in dissolve_free_huge_page(). Fixes: 0f0535e57da("dhugetlb: skip dissolve hugepage belonging to dynamic hugetlb") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- mm/hugetlb.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index ed89df6fc5de..9f974270c84d 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -1348,8 +1348,9 @@ static void free_huge_page_to_dhugetlb_pool(struct page *page, } spin_lock(&hpool->lock); + if (PageHWPoison(page)) + goto out; ClearPagePool(page); - set_compound_page_dtor(page, NULL_COMPOUND_DTOR); if (!hstate_is_gigantic(h)) { list_add(&page->lru, &hpool->dhugetlb_2M_freelists); hpool->free_reserved_2M++; @@ -1375,6 +1376,7 @@ static void free_huge_page_to_dhugetlb_pool(struct page *page, trace_dhugetlb_alloc_free(hpool, page, hpool->free_reserved_1G, DHUGETLB_FREE_1G); } +out: spin_unlock(&hpool->lock); dhugetlb_pool_put(hpool); } -- 2.25.1

1 0

[PATCH openEuler-5.10-LTS-SP1 01/29] media: vivid: fix compose size exceed boundary
by Jialin Zhang 22 Feb '23

22 Feb '23

From: Liu Shixin <liushixin2(a)huawei.com> stable inclusion from stable-v5.10.163 commit f9d19f3a044ca651b0be52a4bf951ffe74259b9f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6CIF8 CVE: CVE-2023-0615 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 94a7ad9283464b75b12516c5512541d467cefcf8 ] syzkaller found a bug: BUG: unable to handle page fault for address: ffffc9000a3b1000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 100000067 P4D 100000067 PUD 10015f067 PMD 1121ca067 PTE 0 Oops: 0002 [#1] PREEMPT SMP CPU: 0 PID: 23489 Comm: vivid-000-vid-c Not tainted 6.1.0-rc1+ #512 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:memcpy_erms+0x6/0x10 [...] Call Trace: <TASK> ? tpg_fill_plane_buffer+0x856/0x15b0 vivid_fillbuff+0x8ac/0x1110 vivid_thread_vid_cap_tick+0x361/0xc90 vivid_thread_vid_cap+0x21a/0x3a0 kthread+0x143/0x180 ret_from_fork+0x1f/0x30 </TASK> This is because we forget to check boundary after adjust compose->height int V4L2_SEL_TGT_CROP case. Add v4l2_rect_map_inside() to fix this problem for this case. Fixes: ef834f7836ec ("[media] vivid: add the video capture and output parts") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Longlong Xia <xialonglong1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/media/test-drivers/vivid/vivid-vid-cap.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/test-drivers/vivid/vivid-vid-cap.c b/drivers/media/test-drivers/vivid/vivid-vid-cap.c index eadf28ab1e39..eeb0aeb62f79 100644 --- a/drivers/media/test-drivers/vivid/vivid-vid-cap.c +++ b/drivers/media/test-drivers/vivid/vivid-vid-cap.c @@ -953,6 +953,7 @@ int vivid_vid_cap_s_selection(struct file *file, void *fh, struct v4l2_selection if (dev->has_compose_cap) { v4l2_rect_set_min_size(compose, &min_rect); v4l2_rect_set_max_size(compose, &max_rect); + v4l2_rect_map_inside(compose, &fmt); } dev->fmt_cap_rect = fmt; tpg_s_buf_height(&dev->tpg, fmt.height); -- 2.25.1

1 28

[PATCH openEuler-5.10-LTS 01/18] media: vivid: fix compose size exceed boundary
by Jialin Zhang 22 Feb '23

22 Feb '23

From: Liu Shixin <liushixin2(a)huawei.com> stable inclusion from stable-v5.10.163 commit f9d19f3a044ca651b0be52a4bf951ffe74259b9f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6CIF8 CVE: CVE-2023-0615 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 94a7ad9283464b75b12516c5512541d467cefcf8 ] syzkaller found a bug: BUG: unable to handle page fault for address: ffffc9000a3b1000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 100000067 P4D 100000067 PUD 10015f067 PMD 1121ca067 PTE 0 Oops: 0002 [#1] PREEMPT SMP CPU: 0 PID: 23489 Comm: vivid-000-vid-c Not tainted 6.1.0-rc1+ #512 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:memcpy_erms+0x6/0x10 [...] Call Trace: <TASK> ? tpg_fill_plane_buffer+0x856/0x15b0 vivid_fillbuff+0x8ac/0x1110 vivid_thread_vid_cap_tick+0x361/0xc90 vivid_thread_vid_cap+0x21a/0x3a0 kthread+0x143/0x180 ret_from_fork+0x1f/0x30 </TASK> This is because we forget to check boundary after adjust compose->height int V4L2_SEL_TGT_CROP case. Add v4l2_rect_map_inside() to fix this problem for this case. Fixes: ef834f7836ec ("[media] vivid: add the video capture and output parts") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Longlong Xia <xialonglong1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/media/test-drivers/vivid/vivid-vid-cap.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/test-drivers/vivid/vivid-vid-cap.c b/drivers/media/test-drivers/vivid/vivid-vid-cap.c index eadf28ab1e39..eeb0aeb62f79 100644 --- a/drivers/media/test-drivers/vivid/vivid-vid-cap.c +++ b/drivers/media/test-drivers/vivid/vivid-vid-cap.c @@ -953,6 +953,7 @@ int vivid_vid_cap_s_selection(struct file *file, void *fh, struct v4l2_selection if (dev->has_compose_cap) { v4l2_rect_set_min_size(compose, &min_rect); v4l2_rect_set_max_size(compose, &max_rect); + v4l2_rect_map_inside(compose, &fmt); } dev->fmt_cap_rect = fmt; tpg_s_buf_height(&dev->tpg, fmt.height); -- 2.25.1

1 17

[PATCH openEuler-5.10-LTS 01/18] media: vivid: fix compose size exceed boundary
by Jialin Zhang 22 Feb '23

22 Feb '23

From: Liu Shixin <liushixin2(a)huawei.com> stable inclusion from stable-v5.10.163 commit f9d19f3a044ca651b0be52a4bf951ffe74259b9f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6CIF8 CVE: CVE-2023-0615 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 94a7ad9283464b75b12516c5512541d467cefcf8 ] syzkaller found a bug: BUG: unable to handle page fault for address: ffffc9000a3b1000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 100000067 P4D 100000067 PUD 10015f067 PMD 1121ca067 PTE 0 Oops: 0002 [#1] PREEMPT SMP CPU: 0 PID: 23489 Comm: vivid-000-vid-c Not tainted 6.1.0-rc1+ #512 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:memcpy_erms+0x6/0x10 [...] Call Trace: <TASK> ? tpg_fill_plane_buffer+0x856/0x15b0 vivid_fillbuff+0x8ac/0x1110 vivid_thread_vid_cap_tick+0x361/0xc90 vivid_thread_vid_cap+0x21a/0x3a0 kthread+0x143/0x180 ret_from_fork+0x1f/0x30 </TASK> This is because we forget to check boundary after adjust compose->height int V4L2_SEL_TGT_CROP case. Add v4l2_rect_map_inside() to fix this problem for this case. Fixes: ef834f7836ec ("[media] vivid: add the video capture and output parts") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Longlong Xia <xialonglong1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/media/test-drivers/vivid/vivid-vid-cap.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/test-drivers/vivid/vivid-vid-cap.c b/drivers/media/test-drivers/vivid/vivid-vid-cap.c index eadf28ab1e39..eeb0aeb62f79 100644 --- a/drivers/media/test-drivers/vivid/vivid-vid-cap.c +++ b/drivers/media/test-drivers/vivid/vivid-vid-cap.c @@ -953,6 +953,7 @@ int vivid_vid_cap_s_selection(struct file *file, void *fh, struct v4l2_selection if (dev->has_compose_cap) { v4l2_rect_set_min_size(compose, &min_rect); v4l2_rect_set_max_size(compose, &max_rect); + v4l2_rect_map_inside(compose, &fmt); } dev->fmt_cap_rect = fmt; tpg_s_buf_height(&dev->tpg, fmt.height); -- 2.25.1

1 17

[PATCH openEuler-5.10-LTS-SP1 01/29] media: vivid: fix compose size exceed boundary
by Jialin Zhang 22 Feb '23

22 Feb '23

From: Liu Shixin <liushixin2(a)huawei.com> stable inclusion from stable-v5.10.163 commit f9d19f3a044ca651b0be52a4bf951ffe74259b9f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6CIF8 CVE: CVE-2023-0615 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 94a7ad9283464b75b12516c5512541d467cefcf8 ] syzkaller found a bug: BUG: unable to handle page fault for address: ffffc9000a3b1000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 100000067 P4D 100000067 PUD 10015f067 PMD 1121ca067 PTE 0 Oops: 0002 [#1] PREEMPT SMP CPU: 0 PID: 23489 Comm: vivid-000-vid-c Not tainted 6.1.0-rc1+ #512 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:memcpy_erms+0x6/0x10 [...] Call Trace: <TASK> ? tpg_fill_plane_buffer+0x856/0x15b0 vivid_fillbuff+0x8ac/0x1110 vivid_thread_vid_cap_tick+0x361/0xc90 vivid_thread_vid_cap+0x21a/0x3a0 kthread+0x143/0x180 ret_from_fork+0x1f/0x30 </TASK> This is because we forget to check boundary after adjust compose->height int V4L2_SEL_TGT_CROP case. Add v4l2_rect_map_inside() to fix this problem for this case. Fixes: ef834f7836ec ("[media] vivid: add the video capture and output parts") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Longlong Xia <xialonglong1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/media/test-drivers/vivid/vivid-vid-cap.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/test-drivers/vivid/vivid-vid-cap.c b/drivers/media/test-drivers/vivid/vivid-vid-cap.c index eadf28ab1e39..eeb0aeb62f79 100644 --- a/drivers/media/test-drivers/vivid/vivid-vid-cap.c +++ b/drivers/media/test-drivers/vivid/vivid-vid-cap.c @@ -953,6 +953,7 @@ int vivid_vid_cap_s_selection(struct file *file, void *fh, struct v4l2_selection if (dev->has_compose_cap) { v4l2_rect_set_min_size(compose, &min_rect); v4l2_rect_set_max_size(compose, &max_rect); + v4l2_rect_map_inside(compose, &fmt); } dev->fmt_cap_rect = fmt; tpg_s_buf_height(&dev->tpg, fmt.height); -- 2.25.1

1 28

[PATCH openEuler-1.0-LTS] mm/sharepool: Fix null-pointer-deference in sp_free_area
by Yongqiang Liu 22 Feb '23

22 Feb '23

From: Wang Wensheng <wangwensheng4(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6G76L CVE: NA ---------------------------------------------- When a process is deleted from a group, the process does not apply for memory from the shared group. Otherwise, the UAF problem occurs. We checked this, but it didn't do a good job of preventing sp_alloc and del_task concurrency. The process applies for memory after passing the check, which violates our requirements and causes problems. The solution is to place the checked code in the critical area to ensure that no memory can be allocated after the check is passed. [ T7596] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000098 [ T7596] Mem abort info: [ T7596] ESR = 0x96000004 [ T7596] EC = 0x25: DABT (current EL), IL = 32 bits [ T7596] SET = 0, FnV = 0 [ T7596] EA = 0, S1PTW = 0 [ T7596] Data abort info: [ T7596] ISV = 0, ISS = 0x00000004 [ T7596] CM = 0, WnR = 0 [ T7596] user pgtable: 4k pages, 48-bit VAs, pgdp=00000001040a3000 [ T7596] [0000000000000098] pgd=0000000000000000, p4d=0000000000000000 [ T7596] Internal error: Oops: 96000004 [#1] SMP [ T7596] Modules linked in: sharepool_dev(OE) [last unloaded: demo] [ T7596] CPU: 1 PID: 7596 Comm: test_sp_group_d Tainted: G OE 5.10.0+ #8 [ T7596] Hardware name: linux,dummy-virt (DT) [ T7596] pstate: 20000005 (nzCv daif -PAN -UAO -TCO BTYPE=--) [ T7596] pc : sp_free_area+0x34/0x120 [ T7596] lr : sp_free_area+0x30/0x120 [ T7596] sp : ffff80001c6a3b20 [ T7596] x29: ffff80001c6a3b20 x28: 0000000000000009 [ T7596] x27: 0000000000000000 x26: ffff800011c49d20 [ T7596] x25: ffff0000c227f6c0 x24: 0000000000000008 [ T7596] x23: ffff0000c0cf0ce8 x22: 0000000000000001 [ T7596] x21: ffff0000c4082b30 x20: 0000000000000000 [ T7596] x19: ffff0000c4082b00 x18: 0000000000000000 [ T7596] x17: 0000000000000000 x16: 0000000000000000 [ T7596] x15: 0000000000000000 x14: 0000000000000000 [ T7596] x13: 0000000000000000 x12: ffff0005fffe12c0 [ T7596] x11: 0000000000000008 x10: ffff0005fffe12c0 [ T7596] x9 : ffff8000103eb690 x8 : 0000000000000001 [ T7596] x7 : 0000000000210d00 x6 : 0000000000000000 [ T7596] x5 : ffff8000123edea0 x4 : 0000000000000030 [ T7596] x3 : ffffeff000000000 x2 : 0000eff000000000 [ T7596] x1 : 0000e80000000000 x0 : 0000000000000000 [ T7596] Call trace: [ T7596] sp_free_area+0x34/0x120 [ T7596] __sp_area_drop_locked+0x3c/0x60 [ T7596] sp_area_drop+0x80/0xbc [ T7596] remove_vma+0x54/0x70 [ T7596] exit_mmap+0x114/0x1d0 [ T7596] mmput+0x90/0x1ec [ T7596] exit_mm+0x1d0/0x2f0 [ T7596] do_exit+0x180/0x400 [ T7596] do_group_exit+0x40/0x114 [ T7596] get_signal+0x1e8/0x720 [ T7596] do_signal+0x11c/0x1e4 [ T7596] do_notify_resume+0x15c/0x250 [ T7596] work_pending+0xc/0x6d8 [ T7596] Code: f9400001 f9402c00 97fff0e5 aa0003f4 (f9404c00) [ T7596] ---[ end trace 3c8368d77e758ebd ]--- Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- mm/share_pool.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/mm/share_pool.c b/mm/share_pool.c index 5d8344fe805a..a136c70b7588 100644 --- a/mm/share_pool.c +++ b/mm/share_pool.c @@ -1712,14 +1712,6 @@ int mg_sp_group_del_task(int pid, int spg_id) ret = -EINVAL; goto out; } - - if (!list_empty(&spg->spa_list)) { - up_write(&sp_group_sem); - pr_err_ratelimited("spa is not empty"); - ret = -EINVAL; - goto out; - } - ret = get_task(pid, &tsk); if (ret) { up_write(&sp_group_sem); @@ -1743,6 +1735,15 @@ int mg_sp_group_del_task(int pid, int spg_id) } down_write(&spg->rw_lock); + + if (!list_empty(&spg->spa_list)) { + up_write(&spg->rw_lock); + up_write(&sp_group_sem); + pr_err_ratelimited("spa is not empty"); + ret = -EINVAL; + goto out_put_mm; + } + if (list_is_singular(&spg->procs)) is_alive = spg->is_alive = false; spg->proc_num--; -- 2.25.1

1 0

openEuler Kernel SIG双周例会
by openEuler conference 21 Feb '23

21 Feb '23

您好！ Kernel SIG 邀请您参加 2023-02-24 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容：欢迎您参加Kernel SIG双周例会，当前议题： 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板）会议链接：https://us06web.zoom.us/j/82111503728?pwd=TWRGa2REc0V2ZmlGZ2ZreUF1OXA3dz09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2023-02-24 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 欢迎您参加Kernel SIG双周例会，当前议题： 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板） You can join the meeting at https://us06web.zoom.us/j/82111503728?pwd=TWRGa2REc0V2ZmlGZ2ZreUF1OXA3dz09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0