- Kernel - mailweb.openeuler.org

[OLK-5.10] proc: allow pid_revalidate() during LOOKUP_RCU
by Li Nan 13 Jun '23

13 Jun '23

From: Stephen Brennan <stephen.s.brennan(a)oracle.com> mainline inclusion from mainline-v5.16-rc1 commit da4d6b9cf80ae5b0083f640133b85b68b53b6497 category: bugfix bugzilla: 188892, https://gitee.com/openeuler/kernel/issues/I7CWJ7 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?i… ---------------------------------------- Problem Description: When running running ~128 parallel instances of TZ=/etc/localtime ps -fe >/dev/null on a 128CPU machine, the %sys utilization reaches 97%, and perf shows the following code path as being responsible for heavy contention on the d_lockref spinlock: walk_component() lookup_fast() d_revalidate() pid_revalidate() // returns -ECHILD unlazy_child() lockref_get_not_dead(&nd->path.dentry->d_lockref) <-- contention The reason is that pid_revalidate() is triggering a drop from RCU to ref path walk mode. All concurrent path lookups thus try to grab a reference to the dentry for /proc/, before re-executing pid_revalidate() and then stepping into the /proc/$pid directory. Thus there is huge spinlock contention. This patch allows pid_revalidate() to execute in RCU mode, meaning that the path lookup can successfully enter the /proc/$pid directory while still in RCU mode. Later on, the path lookup may still drop into ref mode, but the contention will be much reduced at this point. By applying this patch, %sys utilization falls to around 85% under the same workload, and the number of ps processes executed per unit time increases by 3x-4x. Although this particular workload is a bit contrived, we have seen some large collections of eager monitoring scripts which produced similarly high %sys time due to contention in the /proc directory. As a result this patch, Al noted that several procfs methods which were only called in ref-walk mode could now be called from RCU mode. To ensure that this patch is safe, I audited all the inode get_link and permission() implementations, as well as dentry d_revalidate() implementations, in fs/proc. The purpose here is to ensure that they either are safe to call in RCU (i.e. don't sleep) or correctly bail out of RCU mode if they don't support it. My analysis shows that all at-risk procfs methods are safe to call under RCU, and thus this patch is safe. Procfs RCU-walk Analysis: This analysis is up-to-date with 5.15-rc3. When called under RCU mode, these functions have arguments as follows: * get_link() receives a NULL dentry pointer when called in RCU mode. * permission() receives MAY_NOT_BLOCK in the mode parameter when called from RCU. * d_revalidate() receives LOOKUP_RCU in flags. For the following functions, either they are trivially RCU safe, or they explicitly bail at the beginning of the function when they run: proc_ns_get_link (bails out) proc_get_link (RCU safe) proc_pid_get_link (bails out) map_files_d_revalidate (bails out) map_misc_d_revalidate (bails out) proc_net_d_revalidate (RCU safe) proc_sys_revalidate (bails out, also not under /proc/$pid) tid_fd_revalidate (bails out) proc_sys_permission (not under /proc/$pid) The remainder of the functions require a bit more detail: * proc_fd_permission: RCU safe. All of the body of this function is under rcu_read_lock(), except generic_permission() which declares itself RCU safe in its documentation string. * proc_self_get_link uses GFP_ATOMIC in the RCU case, so it is RCU aware and otherwise looks safe. The same is true of proc_thread_self_get_link. * proc_map_files_get_link: calls ns_capable, which calls capable(), and thus calls into the audit code (see note #1 below). The remainder is just a call to the trivially safe proc_pid_get_link(). * proc_pid_permission: calls ptrace_may_access(), which appears RCU safe, although it does call into the "security_ptrace_access_check()" hook, which looks safe under smack and selinux. Just the audit code is of concern. Also uses get_task_struct() and put_task_struct(), see note #2 below. * proc_tid_comm_permission: Appears safe, though calls put_task_struct (see note #2 below). Note #1: Most of the concern of RCU safety has centered around the audit code. However, since b17ec22fb339 ("selinux: slow_avc_audit has become non-blocking"), it's safe to call this code under RCU. So all of the above are safe by my estimation. Note #2: get_task_struct() and put_task_struct(): The majority of get_task_struct() is under RCU read lock, and in any case it is a simple increment. But put_task_struct() is complex, given that it could at some point free the task struct, and this process has many steps which I couldn't manually verify. However, several other places call put_task_struct() under RCU, so it appears safe to use here too (see kernel/hung_task.c:165 or rcu/tree-stall.h:296) Patch description: pid_revalidate() drops from RCU into REF lookup mode. When many threads are resolving paths within /proc in parallel, this can result in heavy spinlock contention on d_lockref as each thread tries to grab a reference to the /proc dentry (and drop it shortly thereafter). Investigation indicates that it is not necessary to drop RCU in pid_revalidate(), as no RCU data is modified and the function never sleeps. So, remove the LOOKUP_RCU check. Link: https://lkml.kernel.org/r/20211004175629.292270-2-stephen.s.brennan@oracle.… Signed-off-by: Stephen Brennan <stephen.s.brennan(a)oracle.com> Cc: Konrad Wilk <konrad.wilk(a)oracle.com> Cc: Alexander Viro <viro(a)zeniv.linux.org.uk> Cc: Matthew Wilcox <willy(a)infradead.org> Cc: Alexey Dobriyan <adobriyan(a)gmail.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Li Nan <linan122(a)huawei.com> --- fs/proc/base.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index 22c65289128e..24c70ff923b8 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -2101,19 +2101,21 @@ static int pid_revalidate(struct dentry *dentry, unsigned int flags) { struct inode *inode; struct task_struct *task; + int ret = 0; - if (flags & LOOKUP_RCU) - return -ECHILD; - - inode = d_inode(dentry); - task = get_proc_task(inode); + rcu_read_lock(); + inode = d_inode_rcu(dentry); + if (!inode) + goto out; + task = pid_task(proc_pid(inode), PIDTYPE_PID); if (task) { pid_update_inode(task, inode); - put_task_struct(task); - return 1; + ret = 1; } - return 0; +out: + rcu_read_unlock(); + return ret; } static inline bool proc_inode_is_dead(struct inode *inode) -- 2.39.2

1 0

[PATCH OLK-5.10 v2 0/2] Add vhost net polling to suppress kick ratio
by Xu Kuohai 13 Jun '23

13 Jun '23

During high-frequency packet transmission, if vhost immediately notifies virtio driver after reading the virtio_queue empty, virtio driver will perform a kick after sending the next packet. However, if vhost waits a little longer, it could get the next packet sent by virtio driver without the need for virtio to perform a kick. This patch optimizes for this issue. If the TX interval recently recorded by vhost-net is within 50us, it is considered a high-frequency packet sending. At this time, after detecting the virtio_queue is empty, vhost-net will wait for new packets to arrive before notifing the virtio driver. Xu Kuohai (2): vhost_net: Suppress kick ratio when high frequency TX detected vhost_net: Enable vhost net polling for openeuler arm64 and x86 arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + drivers/vhost/Kconfig | 9 ++++++ drivers/vhost/net.c | 45 ++++++++++++++++++++++++++ 4 files changed, 56 insertions(+) -- 2.30.2

2 3

[OLK-5.10 v2] irqchip/gicv3-its: Add workaround for hip09 ITS erratum 162100801
by chenxiang 12 Jun '23

12 Jun '23

From: Xiang Chen <chenxiang66(a)hisilicon.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7C103 ------------------------------------------------ When enabled GICv4.1 in hip09, there are some invalid vPE configurations in configuration table for some situations, which will cause some vSGI interrupts lost. To fix the issue, need to send vinvall command after vmovp. Signed-off-by: Nianyao Tang <tangnianyao(a)huawei.com> Signed-off-by: Xiang Chen <chenxiang66(a)hisilicon.com> Signed-off-by: caijian <caijian11(a)h-partners.com> --- Documentation/arm64/silicon-errata.rst | 2 ++ arch/arm64/Kconfig | 11 +++++++ arch/arm64/configs/openeuler_defconfig | 1 + drivers/irqchip/irq-gic-v3-its.c | 40 ++++++++++++++++++++------ 4 files changed, 46 insertions(+), 8 deletions(-) diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst index b72fbbfe3fcb..2305def38396 100644 --- a/Documentation/arm64/silicon-errata.rst +++ b/Documentation/arm64/silicon-errata.rst @@ -149,6 +149,8 @@ stable kernels. +----------------+-----------------+-----------------+-----------------------------+ | Hisilicon | TSV{110,200} | #1980005 | HISILICON_ERRATUM_1980005 | +----------------+-----------------+-----------------+-----------------------------+ +| Hisilicon | Hip09 | #162100801 | HISILICON_ERRATUM_162100801 | ++----------------+-----------------+-----------------+-----------------------------+ +----------------+-----------------+-----------------+-----------------------------+ | Qualcomm Tech. | Kryo/Falkor v1 | E1003 | QCOM_FALKOR_ERRATUM_1003 | +----------------+-----------------+-----------------+-----------------------------+ diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 3dcf96f37a3c..766356f04abc 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -802,6 +802,17 @@ config HISILICON_ERRATUM_1980005 If unsure, say N. +config HISILICON_ERRATUM_162100801 + bool "Hip09 162100801 erratum support" + default y + help + When enabled GICv4.1 in hip09, there are some invalid vPE config + in configuration tables for some situation, which will cause vSGI + interrupts lost. So fix it by sending vinvall commands after vmovp. + + If unsure, say Y. + + config QCOM_FALKOR_ERRATUM_1003 bool "Falkor E1003: Incorrect translation due to ASID change" default y diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 8261f11b54fd..1b633c835279 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -390,6 +390,7 @@ CONFIG_QCOM_FALKOR_ERRATUM_E1041=y CONFIG_SOCIONEXT_SYNQUACER_PREITS=y CONFIG_HISILICON_ERRATUM_HIP08_RU_PREFETCH=y # CONFIG_HISILICON_HIP08_RU_PREFETCH_DEFAULT_OFF is not set +CONFIG_HISILICON_ERRATUM_162100801=y # end of ARM errata workarounds via the alternatives framework CONFIG_ARM64_4K_PAGES=y diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index 99fcc5601ea4..db8219d65e7c 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -46,6 +46,7 @@ #define ITS_FLAGS_CMDQ_NEEDS_FLUSHING (1ULL << 0) #define ITS_FLAGS_WORKAROUND_CAVIUM_22375 (1ULL << 1) #define ITS_FLAGS_WORKAROUND_CAVIUM_23144 (1ULL << 2) +#define ITS_FLAGS_WORKAROUND_HISILICON_162100801 (1ULL << 3) #define RDIST_FLAGS_PROPBASE_NEEDS_FLUSHING (1 << 0) #define RDIST_FLAGS_RD_TABLES_PREALLOCATED (1 << 1) @@ -1294,6 +1295,14 @@ static void its_send_vmapp(struct its_node *its, its_send_single_vcommand(its, its_build_vmapp_cmd, &desc); } +static void its_send_vinvall(struct its_node *its, struct its_vpe *vpe) +{ + struct its_cmd_desc desc; + + desc.its_vinvall_cmd.vpe = vpe; + its_send_single_vcommand(its, its_build_vinvall_cmd, &desc); +} + static void its_send_vmovp(struct its_vpe *vpe) { struct its_cmd_desc desc = {}; @@ -1307,6 +1316,10 @@ static void its_send_vmovp(struct its_vpe *vpe) its = list_first_entry(&its_nodes, struct its_node, entry); desc.its_vmovp_cmd.col = &its->collections[col_id]; its_send_single_vcommand(its, its_build_vmovp_cmd, &desc); + if (is_v4_1(its) && (its->flags & + ITS_FLAGS_WORKAROUND_HISILICON_162100801)) + its_send_vinvall(its, vpe); + return; } @@ -1333,19 +1346,14 @@ static void its_send_vmovp(struct its_vpe *vpe) desc.its_vmovp_cmd.col = &its->collections[col_id]; its_send_single_vcommand(its, its_build_vmovp_cmd, &desc); + if (is_v4_1(its) && (its->flags & + ITS_FLAGS_WORKAROUND_HISILICON_162100801)) + its_send_vinvall(its, vpe); } raw_spin_unlock_irqrestore(&vmovp_lock, flags); } -static void its_send_vinvall(struct its_node *its, struct its_vpe *vpe) -{ - struct its_cmd_desc desc; - - desc.its_vinvall_cmd.vpe = vpe; - its_send_single_vcommand(its, its_build_vinvall_cmd, &desc); -} - static void its_send_vinv(struct its_device *dev, u32 event_id) { struct its_cmd_desc desc; @@ -4963,6 +4971,14 @@ static bool __maybe_unused its_enable_quirk_hip07_161600802(void *data) return true; } +static bool __maybe_unused its_enable_quirk_hip09_162100801(void *data) +{ + struct its_node *its = data; + + its->flags |= ITS_FLAGS_WORKAROUND_HISILICON_162100801; + return true; +} + static const struct gic_quirk its_quirks[] = { #ifdef CONFIG_CAVIUM_ERRATUM_22375 { @@ -5008,6 +5024,14 @@ static const struct gic_quirk its_quirks[] = { .mask = 0xffffffff, .init = its_enable_quirk_hip07_161600802, }, +#endif +#ifdef CONFIG_HISILICON_ERRATUM_162100801 + { + .desc = "ITS: Hip09 erratum 162100801", + .iidr = 0x00051736, + .mask = 0xffffffff, + .init = its_enable_quirk_hip09_162100801, + }, #endif { } -- 2.30.0

2 1

[PATCH openEuler-22.03-LTS-SP2 0/2] add two bpf helper function for redissockmap
by Liu Jian 12 Jun '23

12 Jun '23

add two bpf helper function for redissockmap Liu Jian (2): net: add bpf_is_local_ipaddr bpf helper function net: let sockops can use bpf_get_current_comm() arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + drivers/net/Kconfig | 8 ++ drivers/net/Makefile | 1 + drivers/net/localip/Makefile | 8 ++ drivers/net/localip/localip.c | 146 +++++++++++++++++++++++++ include/uapi/linux/bpf.h | 7 ++ net/core/filter.c | 22 ++++ tools/include/uapi/linux/bpf.h | 7 ++ 9 files changed, 201 insertions(+) create mode 100644 drivers/net/localip/Makefile create mode 100644 drivers/net/localip/localip.c -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP2] irqchip: gic-v3: Collection table support muti pages
by wangwudi 12 Jun '23

12 Jun '23

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7CX6S CVE: NA -------------------------------------------------------------------------- Only one page is allocated to the collection table. Recalculate the page number of collection table based on the number of CPUs. Signed-off-by: wangwudi <wangwudi(a)hisilicon.com> --- drivers/irqchip/irq-gic-v3-its.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index 99fcc5601ea4..fa45fd7ed173 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -2665,6 +2665,10 @@ static int its_alloc_tables(struct its_node *its) indirect = its_parse_indirect_baser(its, baser, &order, ITS_MAX_VPEID_BITS); break; + case GITS_BASER_TYPE_COLLECTION: + indirect = its_parse_indirect_baser(its, baser, &order, + order_base_2(num_possible_cpus())); + break; } err = its_setup_baser(its, baser, cache, shr, order, indirect); -- 2.31.0

2 1

[PATCH openEuler-22.03-LTS-SP2] irqchip: gic-v3: Collection table support muti pages
by wangwudi 12 Jun '23

12 Jun '23

From 89bf31ca572987247ae0cf147df7ff5a83ab45d3 Mon Sep 17 00:00:00 2001 From: wangwudi <wangwudi(a)hisilicon.com> Date: Mon, 12 Jun 2023 22:16:32 +0800 Subject: [PATCH openEuler-22.03-LTS-SP2] irqchip: gic-v3: Collection table support muti pages -------- Signed-off-by: wangwudi <wangwudi(a)hisilicon.com> --- drivers/irqchip/irq-gic-v3-its.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index 0e429fe9cfd8..111e86b1a99e 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -2624,6 +2624,10 @@ static int its_alloc_tables(struct its_node *its) indirect = its_parse_indirect_baser(its, baser, &order, ITS_MAX_VPEID_BITS); break; + case GITS_BASER_TYPE_COLLECTION: + indirect = its_parse_indirect_baser(its, baser, &order, + order_base_2(num_possible_cpus())); + break; } err = its_setup_baser(its, baser, cache, shr, order, indirect); -- 2.31.0

1 0

[PATCH openEuler-22.03-LTS-SP2 1/2] net: add bpf_is_local_ipaddr bpf helper function
by Liu Jian 12 Jun '23

12 Jun '23

hulk inclusion category: feature bugzilla: NA CVE: N/A ---------------------------------------------------- Some network acceleration solutions, such as sockmap, are valid only for internal packets of the local host. The bpf_is_local_ipaddr() bpf helper function is added so that the ebpf program can determine whether a packet is an internal packet of the local host. Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + drivers/net/Kconfig | 8 ++ drivers/net/Makefile | 1 + drivers/net/localip/Makefile | 8 ++ drivers/net/localip/localip.c | 146 +++++++++++++++++++++++++ include/uapi/linux/bpf.h | 7 ++ net/core/filter.c | 20 ++++ tools/include/uapi/linux/bpf.h | 7 ++ 9 files changed, 199 insertions(+) create mode 100644 drivers/net/localip/Makefile create mode 100644 drivers/net/localip/localip.c diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index f934557ff765..b2d06797c08a 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -3131,6 +3131,7 @@ CONFIG_DLCI_MAX=8 CONFIG_USB4_NET=m # CONFIG_NETDEVSIM is not set CONFIG_NET_FAILOVER=m +CONFIG_NET_LOCALIP_LST=m # CONFIG_ISDN is not set # diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 11323cdc3301..4f2682d4b71e 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -3206,6 +3206,7 @@ CONFIG_USB4_NET=m CONFIG_HYPERV_NET=m CONFIG_NETDEVSIM=m CONFIG_NET_FAILOVER=m +CONFIG_NET_LOCALIP_LST=m CONFIG_ISDN=y CONFIG_ISDN_CAPI=y CONFIG_CAPI_TRACE=y diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig index f20808024305..913acb7eed6f 100644 --- a/drivers/net/Kconfig +++ b/drivers/net/Kconfig @@ -592,4 +592,12 @@ config NET_FAILOVER a VM with direct attached VF by failing over to the paravirtual datapath when the VF is unplugged. +config NET_LOCALIP_LST + tristate "Collect local ipv4 address" + depends on INET + default n + help + Similar to inet_addr_lst, only the IP address is recorded, and + net_namespace is not concerned. + endif # NETDEVICES diff --git a/drivers/net/Makefile b/drivers/net/Makefile index 72e18d505d1a..b4ff8a310dcc 100644 --- a/drivers/net/Makefile +++ b/drivers/net/Makefile @@ -84,3 +84,4 @@ thunderbolt-net-y += thunderbolt.o obj-$(CONFIG_USB4_NET) += thunderbolt-net.o obj-$(CONFIG_NETDEVSIM) += netdevsim/ obj-$(CONFIG_NET_FAILOVER) += net_failover.o +obj-$(CONFIG_NET_LOCALIP_LST) += localip/ diff --git a/drivers/net/localip/Makefile b/drivers/net/localip/Makefile new file mode 100644 index 000000000000..03b535709271 --- /dev/null +++ b/drivers/net/localip/Makefile @@ -0,0 +1,8 @@ +# SPDX-License-Identifier: GPL-2.0-only +# +# Makefile for the linux kernel. +# + +# Object file lists. + +obj-$(CONFIG_NET_LOCALIP_LST) += localip.o diff --git a/drivers/net/localip/localip.c b/drivers/net/localip/localip.c new file mode 100644 index 000000000000..3756924553bf --- /dev/null +++ b/drivers/net/localip/localip.c @@ -0,0 +1,146 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright(c) 2023 Huawei Technologies Co., Ltd + */ + +#include <linux/kernel.h> +#include <linux/types.h> +#include <linux/mutex.h> +#include <linux/device.h> +#include <linux/inetdevice.h> +#include <linux/spinlock.h> + +#define IN4_ADDR_HSIZE_SHIFT 8 +#define IN4_ADDR_HSIZE (1U << IN4_ADDR_HSIZE_SHIFT) + +static struct hlist_head localip_lst[IN4_ADDR_HSIZE]; + +static DEFINE_SPINLOCK(localip_lock); + +struct localipaddr { + struct hlist_node node; + struct rcu_head rcu; + __u32 ipaddr; +}; + +static u32 localip_hash(__be32 addr) +{ + return hash_32(addr, IN4_ADDR_HSIZE_SHIFT); +} + +static void localip_hash_insert(struct localipaddr *ip) +{ + u32 hash = localip_hash(ip->ipaddr); + + hlist_add_head_rcu(&ip->node, &localip_lst[hash]); +} + +static void localip_hash_remove(struct localipaddr *ip) +{ + hlist_del_init_rcu(&ip->node); +} + +static int is_local_ipaddr(uint32_t ipaddr) +{ + u32 hash = localip_hash(ipaddr); + struct localipaddr *localip; + + rcu_read_lock(); + hlist_for_each_entry_rcu(localip, &localip_lst[hash], node) { + if (localip->ipaddr == ipaddr) { + rcu_read_unlock(); + return 1; + } + } + rcu_read_unlock(); + + return 0; +} + +static int localip_event(struct notifier_block *this, unsigned long event, + void *ptr) +{ + struct in_ifaddr *ifa = ptr; + struct net_device *event_netdev = ifa->ifa_dev->dev; + struct localipaddr *localip; + u32 hash; + + if (ipv4_is_loopback(ifa->ifa_local)) + return NOTIFY_DONE; + + switch (event) { + case NETDEV_UP: + pr_debug("UP, dev:%s, ip:0x%x, mask:0x%x\n", event_netdev->name, + ifa->ifa_local, ifa->ifa_mask); + localip = kzalloc(sizeof(struct localipaddr), GFP_KERNEL); + if (!localip) { + pr_err("kzalloc failed.\n"); + break; + } + localip->ipaddr = ifa->ifa_local; + spin_lock(&localip_lock); + localip_hash_insert(localip); + spin_unlock(&localip_lock); + break; + case NETDEV_DOWN: + pr_debug("DOWN, dev:%s, ip:0x%x, mask:0x%x\n", event_netdev->name, + ifa->ifa_local, ifa->ifa_mask); + hash = localip_hash(ifa->ifa_local); + spin_lock(&localip_lock); + hlist_for_each_entry(localip, &localip_lst[hash], node) { + if (localip->ipaddr == ifa->ifa_local) { + localip_hash_remove(localip); + kfree_rcu(localip, rcu); + break; + } + } + spin_unlock(&localip_lock); + break; + default: + break; + } + return NOTIFY_DONE; +} + +static struct notifier_block localip_notifier = { + .notifier_call = localip_event, +}; + +typedef int (*is_local_ipaddr_func)(uint32_t ipaddr); +extern is_local_ipaddr_func bpf_is_local_ipaddr_func; + +int localip_init(void) +{ + int i; + + for (i = 0; i < IN4_ADDR_HSIZE; i++) + INIT_HLIST_HEAD(&localip_lst[i]); + + register_inetaddr_notifier(&localip_notifier); + bpf_is_local_ipaddr_func = is_local_ipaddr; + return 0; +} + +void localip_cleanup(void) +{ + struct localipaddr *localip; + struct hlist_node *n; + int i; + + bpf_is_local_ipaddr_func = NULL; + unregister_inetaddr_notifier(&localip_notifier); + + spin_lock(&localip_lock); + for (i = 0; i < IN4_ADDR_HSIZE; i++) { + hlist_for_each_entry_safe(localip, n, &localip_lst[i], node) { + pr_debug("cleanup, hash:%i, ip:0x%x\n", i, localip->ipaddr); + localip_hash_remove(localip); + kfree_rcu(localip, rcu); + } + } + spin_unlock(&localip_lock); + synchronize_rcu(); +} + +module_init(localip_init); +module_exit(localip_cleanup); +MODULE_LICENSE("GPL"); diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 9e64dac44d60..9373abafcb91 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -3872,6 +3872,12 @@ union bpf_attr { * check src_cpu whether share cache with dst_cpu. * Return * yes 1, no 0. + * + * long bpf_is_local_ipaddr(u32 ipaddr) + * Description + * Check the ipaddr is local address or not. + * Return + * 1 is local address, 0 is not. */ #define __BPF_FUNC_MAPPER(FN) \ FN(unspec), \ @@ -4044,6 +4050,7 @@ union bpf_attr { FN(sched_entity_to_tg), \ FN(cpumask_op), \ FN(cpus_share_cache), \ + FN(is_local_ipaddr), \ /* */ /* integer value in 'imm' field of BPF_CALL instruction selects which helper diff --git a/net/core/filter.c b/net/core/filter.c index 012a5070a9e5..527b66921dd6 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -5084,6 +5084,24 @@ static const struct bpf_func_proto bpf_sk_original_addr_proto = { .arg4_type = ARG_CONST_SIZE, }; +typedef int (*is_local_ipaddr_func)(uint32_t ipaddr); +is_local_ipaddr_func bpf_is_local_ipaddr_func; +EXPORT_SYMBOL(bpf_is_local_ipaddr_func); + +BPF_CALL_1(bpf_is_local_ipaddr, uint32_t, ipaddr) +{ + if (!bpf_is_local_ipaddr_func) + return 0; + return bpf_is_local_ipaddr_func(ipaddr); +} + +static const struct bpf_func_proto bpf_is_local_ipaddr_proto = { + .func = bpf_is_local_ipaddr, + .gpl_only = false, + .ret_type = RET_INTEGER, + .arg1_type = ARG_ANYTHING, +}; + BPF_CALL_5(bpf_sock_addr_getsockopt, struct bpf_sock_addr_kern *, ctx, int, level, int, optname, char *, optval, int, optlen) { @@ -7398,6 +7416,8 @@ sock_ops_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) case BPF_FUNC_tcp_sock: return &bpf_tcp_sock_proto; #endif /* CONFIG_INET */ + case BPF_FUNC_is_local_ipaddr: + return &bpf_is_local_ipaddr_proto; default: return bpf_sk_base_func_proto(func_id); } diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index abf8023d606b..41bc2f496176 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -3872,6 +3872,12 @@ union bpf_attr { * check src_cpu whether share cache with dst_cpu. * Return * true yes, false no. + * + * long bpf_is_local_ipaddr(u32 ipaddr) + * Description + * Check the ipaddr is local address or not. + * Return + * 1 is local address, 0 is not. */ #define __BPF_FUNC_MAPPER(FN) \ FN(unspec), \ @@ -4044,6 +4050,7 @@ union bpf_attr { FN(sched_entity_to_tg), \ FN(cpumask_op), \ FN(cpus_share_cache), \ + FN(is_local_ipaddr), \ /* */ /* integer value in 'imm' field of BPF_CALL instruction selects which helper -- 2.34.1

1 1

[OLK-5.10 1/1] proc: allow pid_revalidate() during LOOKUP_RCU
by Li Nan 12 Jun '23

12 Jun '23

From: Stephen Brennan <stephen.s.brennan(a)oracle.com> mainline inclusion from mainline-v5.16-rc1 commit da4d6b9cf80ae5b0083f640133b85b68b53b6497 category: bugfix bugzilla: 188892, https://gitee.com/openeuler/kernel/issues/I7CWJ7 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?i… ---------------------------------------- Problem Description: When running running ~128 parallel instances of TZ=/etc/localtime ps -fe >/dev/null on a 128CPU machine, the %sys utilization reaches 97%, and perf shows the following code path as being responsible for heavy contention on the d_lockref spinlock: walk_component() lookup_fast() d_revalidate() pid_revalidate() // returns -ECHILD unlazy_child() lockref_get_not_dead(&nd->path.dentry->d_lockref) <-- contention The reason is that pid_revalidate() is triggering a drop from RCU to ref path walk mode. All concurrent path lookups thus try to grab a reference to the dentry for /proc/, before re-executing pid_revalidate() and then stepping into the /proc/$pid directory. Thus there is huge spinlock contention. This patch allows pid_revalidate() to execute in RCU mode, meaning that the path lookup can successfully enter the /proc/$pid directory while still in RCU mode. Later on, the path lookup may still drop into ref mode, but the contention will be much reduced at this point. By applying this patch, %sys utilization falls to around 85% under the same workload, and the number of ps processes executed per unit time increases by 3x-4x. Although this particular workload is a bit contrived, we have seen some large collections of eager monitoring scripts which produced similarly high %sys time due to contention in the /proc directory. As a result this patch, Al noted that several procfs methods which were only called in ref-walk mode could now be called from RCU mode. To ensure that this patch is safe, I audited all the inode get_link and permission() implementations, as well as dentry d_revalidate() implementations, in fs/proc. The purpose here is to ensure that they either are safe to call in RCU (i.e. don't sleep) or correctly bail out of RCU mode if they don't support it. My analysis shows that all at-risk procfs methods are safe to call under RCU, and thus this patch is safe. Procfs RCU-walk Analysis: This analysis is up-to-date with 5.15-rc3. When called under RCU mode, these functions have arguments as follows: * get_link() receives a NULL dentry pointer when called in RCU mode. * permission() receives MAY_NOT_BLOCK in the mode parameter when called from RCU. * d_revalidate() receives LOOKUP_RCU in flags. For the following functions, either they are trivially RCU safe, or they explicitly bail at the beginning of the function when they run: proc_ns_get_link (bails out) proc_get_link (RCU safe) proc_pid_get_link (bails out) map_files_d_revalidate (bails out) map_misc_d_revalidate (bails out) proc_net_d_revalidate (RCU safe) proc_sys_revalidate (bails out, also not under /proc/$pid) tid_fd_revalidate (bails out) proc_sys_permission (not under /proc/$pid) The remainder of the functions require a bit more detail: * proc_fd_permission: RCU safe. All of the body of this function is under rcu_read_lock(), except generic_permission() which declares itself RCU safe in its documentation string. * proc_self_get_link uses GFP_ATOMIC in the RCU case, so it is RCU aware and otherwise looks safe. The same is true of proc_thread_self_get_link. * proc_map_files_get_link: calls ns_capable, which calls capable(), and thus calls into the audit code (see note #1 below). The remainder is just a call to the trivially safe proc_pid_get_link(). * proc_pid_permission: calls ptrace_may_access(), which appears RCU safe, although it does call into the "security_ptrace_access_check()" hook, which looks safe under smack and selinux. Just the audit code is of concern. Also uses get_task_struct() and put_task_struct(), see note #2 below. * proc_tid_comm_permission: Appears safe, though calls put_task_struct (see note #2 below). Note #1: Most of the concern of RCU safety has centered around the audit code. However, since b17ec22fb339 ("selinux: slow_avc_audit has become non-blocking"), it's safe to call this code under RCU. So all of the above are safe by my estimation. Note #2: get_task_struct() and put_task_struct(): The majority of get_task_struct() is under RCU read lock, and in any case it is a simple increment. But put_task_struct() is complex, given that it could at some point free the task struct, and this process has many steps which I couldn't manually verify. However, several other places call put_task_struct() under RCU, so it appears safe to use here too (see kernel/hung_task.c:165 or rcu/tree-stall.h:296) Patch description: pid_revalidate() drops from RCU into REF lookup mode. When many threads are resolving paths within /proc in parallel, this can result in heavy spinlock contention on d_lockref as each thread tries to grab a reference to the /proc dentry (and drop it shortly thereafter). Investigation indicates that it is not necessary to drop RCU in pid_revalidate(), as no RCU data is modified and the function never sleeps. So, remove the LOOKUP_RCU check. Link: https://lkml.kernel.org/r/20211004175629.292270-2-stephen.s.brennan@oracle.… Signed-off-by: Stephen Brennan <stephen.s.brennan(a)oracle.com> Cc: Konrad Wilk <konrad.wilk(a)oracle.com> Cc: Alexander Viro <viro(a)zeniv.linux.org.uk> Cc: Matthew Wilcox <willy(a)infradead.org> Cc: Alexey Dobriyan <adobriyan(a)gmail.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Li Nan <linan122(a)huawei.com> --- fs/proc/base.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index 22c65289128e..24c70ff923b8 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -2101,19 +2101,21 @@ static int pid_revalidate(struct dentry *dentry, unsigned int flags) { struct inode *inode; struct task_struct *task; + int ret = 0; - if (flags & LOOKUP_RCU) - return -ECHILD; - - inode = d_inode(dentry); - task = get_proc_task(inode); + rcu_read_lock(); + inode = d_inode_rcu(dentry); + if (!inode) + goto out; + task = pid_task(proc_pid(inode), PIDTYPE_PID); if (task) { pid_update_inode(task, inode); - put_task_struct(task); - return 1; + ret = 1; } - return 0; +out: + rcu_read_unlock(); + return ret; } static inline bool proc_inode_is_dead(struct inode *inode) -- 2.39.2

1 0

[PATCH openEuler-1.0-LTS] arm64: Add AMPERE1 to the Spectre-BHB affected list
by Yongqiang Liu 12 Jun '23

12 Jun '23

From: D Scott Phillips <scott(a)os.amperecomputing.com> stable inclusion from stable-v5.10.153 commit 52a43b82006dc88f996bd06da5a3fcfef85220c8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I79V8S CVE: CVE-2023-3006 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Per AmpereOne erratum AC03_CPU_12, "Branch history may allow control of speculative execution across software contexts," the AMPERE1 core needs the bhb clearing loop to mitigate Spectre-BHB, with a loop iteration count of 11. Signed-off-by: D Scott Phillips <scott(a)os.amperecomputing.com> Link: https://lore.kernel.org/r/20221011022140.432370-1-scott@os.amperecomputing.… Reviewed-by: James Morse <james.morse(a)arm.com> Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> conflicts: arch/arm64/include/asm/cputype.h arch/arm64/kernel/proton-pack.c Signed-off-by: Lin Yujun <linyujun809(a)huawei.com> Reviewed-by: Zhang Jianhua <chris.zjh(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- arch/arm64/include/asm/cputype.h | 4 ++++ arch/arm64/kernel/cpu_errata.c | 6 ++++++ 2 files changed, 10 insertions(+) diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h index 852474568a9e..bdec50291017 100644 --- a/arch/arm64/include/asm/cputype.h +++ b/arch/arm64/include/asm/cputype.h @@ -69,6 +69,7 @@ #define ARM_CPU_IMP_QCOM 0x51 #define ARM_CPU_IMP_NVIDIA 0x4E #define ARM_CPU_IMP_HISI 0x48 +#define ARM_CPU_IMP_AMPERE 0xC0 #define ARM_CPU_IMP_PHYTIUM 0x70 #define ARM_CPU_PART_AEM_V8 0xD0F @@ -111,6 +112,8 @@ #define PHYTIUM_CPU_PART_2004 0X663 #define PHYTIUM_CPU_PART_2500 0X663 +#define AMPERE_CPU_PART_AMPERE1 0xAC3 + #define MIDR_CORTEX_A53 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A53) #define MIDR_CORTEX_A57 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A57) #define MIDR_CORTEX_A72 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A72) @@ -141,6 +144,7 @@ #define MIDR_FT_2000PLUS MIDR_CPU_MODEL(ARM_CPU_IMP_PHYTIUM, PHYTIUM_CPU_PART_2000PLUS) #define MIDR_FT_2004 MIDR_CPU_MODEL(ARM_CPU_IMP_PHYTIUM, PHYTIUM_CPU_PART_2004) #define MIDR_FT_2500 MIDR_CPU_MODEL(ARM_CPU_IMP_PHYTIUM, PHYTIUM_CPU_PART_2500) +#define MIDR_AMPERE1 MIDR_CPU_MODEL(ARM_CPU_IMP_AMPERE, AMPERE_CPU_PART_AMPERE1) #ifndef __ASSEMBLY__ diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c index bae255cf5ab5..3b911e8964a7 100644 --- a/arch/arm64/kernel/cpu_errata.c +++ b/arch/arm64/kernel/cpu_errata.c @@ -1106,6 +1106,10 @@ u8 spectre_bhb_loop_affected(int scope) MIDR_ALL_VERSIONS(MIDR_CORTEX_A76), {}, }; + static const struct midr_range spectre_bhb_k11_list[] = { + MIDR_ALL_VERSIONS(MIDR_AMPERE1), + {}, + }; static const struct midr_range spectre_bhb_k8_list[] = { MIDR_ALL_VERSIONS(MIDR_CORTEX_A72), MIDR_ALL_VERSIONS(MIDR_CORTEX_A57), @@ -1116,6 +1120,8 @@ u8 spectre_bhb_loop_affected(int scope) k = 32; else if (is_midr_in_range_list(read_cpuid_id(), spectre_bhb_k24_list)) k = 24; + else if (is_midr_in_range_list(read_cpuid_id(), spectre_bhb_k11_list)) + k = 11; else if (is_midr_in_range_list(read_cpuid_id(), spectre_bhb_k8_list)) k = 8; -- 2.25.1

1 0

[PATCH OLK-5.10] vhost_net: Suppress kick ratio when fast TX detected
by Xu Kuohai 12 Jun '23

12 Jun '23

hulk inclusion category: feature bugzilla: NA CVE: N/A ---------------------------------------------------- During high-frequency packet transmission, if vhost immediately notifies virtio driver after reading the virtio_queue empty, virtio driver will perform a kick after sending the next packet. However, if vhost waits a little longer, it could get the next packet sent by virtio driver without the need for virtio to perform a kick. This patch optimizes for this issue. If the TX interval recently recorded by vhost-net is within 50us, it is considered a high-frequency packet sending. At this time, after detecting the virtio_queue is empty, vhost-net will wait for new packets to arrive before notifing the virtio driver. Signed-off-by: Xu Kuohai <xukuohai(a)huawei.com> --- drivers/vhost/net.c | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c index a6a1a01319d8..7312d0bfa3c1 100644 --- a/drivers/vhost/net.c +++ b/drivers/vhost/net.c @@ -126,6 +126,8 @@ struct vhost_net_virtqueue { struct vhost_net_buf rxq; /* Batched XDP buffs */ struct xdp_buff *xdp; + u64 tx_time; + u64 tx_interval; }; struct vhost_net { @@ -311,6 +313,8 @@ static void vhost_net_vq_reset(struct vhost_net *n) n->vqs[i].ubufs = NULL; n->vqs[i].vhost_hlen = 0; n->vqs[i].sock_hlen = 0; + n->vqs[i].tx_time = 0; + n->vqs[i].tx_interval = 1000000; /* 1ms */ vhost_net_buf_init(&n->vqs[i].rxq); } @@ -456,6 +460,19 @@ static void vhost_net_signal_used(struct vhost_net_virtqueue *nvq) nvq->done_idx = 0; } +static void vhost_update_tx_interval(struct vhost_net_virtqueue *nvq) +{ + u64 time = ktime_get_mono_fast_ns(); + + if (likely(nvq->tx_time != 0)) { + u64 d = time - nvq->tx_time; + /* 0.25 * interval + 0.75 * delta */ + nvq->tx_interval = (nvq->tx_interval >> 2) + (d - (d >> 2)); + } + + nvq->tx_time = time; +} + static void vhost_tx_batch(struct vhost_net *net, struct vhost_net_virtqueue *nvq, struct socket *sock, @@ -489,6 +506,7 @@ static void vhost_tx_batch(struct vhost_net *net, } signal_used: + vhost_update_tx_interval(nvq); vhost_net_signal_used(nvq); nvq->batched_xdp = 0; } @@ -782,6 +800,7 @@ static void handle_tx_copy(struct vhost_net *net, struct socket *sock) int err; int sent_pkts = 0; bool sock_can_batch = (sock->sk->sk_sndbuf == INT_MAX); + int last_done_idx = 0; do { bool busyloop_intr = false; @@ -798,6 +817,13 @@ static void handle_tx_copy(struct vhost_net *net, struct socket *sock) if (head == vq->num) { if (unlikely(busyloop_intr)) { vhost_poll_queue(&vq->poll); + } else if (nvq->tx_interval < 50000 && + ktime_get_mono_fast_ns() - nvq->tx_time < 50000) { + /* Update TX interval if we get some packets */ + if (last_done_idx < nvq->done_idx) + vhost_update_tx_interval(nvq); + last_done_idx = nvq->done_idx; + continue; } else if (unlikely(vhost_enable_notify(&net->dev, vq))) { vhost_disable_notify(&net->dev, vq); -- 2.30.2

2 1

[PATCH OLK-5.10] fs/ntfs3: Check fields while reading
by ZhaoLong Wang 12 Jun '23

12 Jun '23

From: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> mainline inclusion from mainline-v6.2-rc1 commit 0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I79X84 CVE: CVE-2022-48502 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Added new functions index_hdr_check and index_buf_check. Now we check all stuff for correctness while reading from disk. Also fixed bug with stale nfs data. Reported-by: van fantasy <g1042620637(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> Conflicts: fs/ntfs3/inode.c fs/ntfs3/xattr.c --- fs/ntfs3/index.c | 84 ++++++++++++++++++++++++++++++---- fs/ntfs3/inode.c | 18 ++++---- fs/ntfs3/ntfs_fs.h | 4 +- fs/ntfs3/run.c | 7 ++- fs/ntfs3/xattr.c | 109 +++++++++++++++++++++++++++++---------------- 5 files changed, 164 insertions(+), 58 deletions(-) diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c index 6f81e3a49abf..ba56b24ca9db 100644 --- a/fs/ntfs3/index.c +++ b/fs/ntfs3/index.c @@ -605,11 +605,58 @@ static const struct NTFS_DE *hdr_insert_head(struct INDEX_HDR *hdr, return e; } +/* + * index_hdr_check + * + * return true if INDEX_HDR is valid + */ +static bool index_hdr_check(const struct INDEX_HDR *hdr, u32 bytes) +{ + u32 end = le32_to_cpu(hdr->used); + u32 tot = le32_to_cpu(hdr->total); + u32 off = le32_to_cpu(hdr->de_off); + + if (!IS_ALIGNED(off, 8) || tot > bytes || end > tot || + off + sizeof(struct NTFS_DE) > end) { + /* incorrect index buffer. */ + return false; + } + + return true; +} + +/* + * index_buf_check + * + * return true if INDEX_BUFFER seems is valid + */ +static bool index_buf_check(const struct INDEX_BUFFER *ib, u32 bytes, + const CLST *vbn) +{ + const struct NTFS_RECORD_HEADER *rhdr = &ib->rhdr; + u16 fo = le16_to_cpu(rhdr->fix_off); + u16 fn = le16_to_cpu(rhdr->fix_num); + + if (bytes <= offsetof(struct INDEX_BUFFER, ihdr) || + rhdr->sign != NTFS_INDX_SIGNATURE || + fo < sizeof(struct INDEX_BUFFER) + /* Check index buffer vbn. */ + || (vbn && *vbn != le64_to_cpu(ib->vbn)) || (fo % sizeof(short)) || + fo + fn * sizeof(short) >= bytes || + fn != ((bytes >> SECTOR_SHIFT) + 1)) { + /* incorrect index buffer. */ + return false; + } + + return index_hdr_check(&ib->ihdr, + bytes - offsetof(struct INDEX_BUFFER, ihdr)); +} + void fnd_clear(struct ntfs_fnd *fnd) { int i; - for (i = 0; i < fnd->level; i++) { + for (i = fnd->level - 1; i >= 0; i--) { struct indx_node *n = fnd->nodes[i]; if (!n) @@ -820,9 +867,16 @@ int indx_init(struct ntfs_index *indx, struct ntfs_sb_info *sbi, u32 t32; const struct INDEX_ROOT *root = resident_data(attr); + t32 = le32_to_cpu(attr->res.data_size); + if (t32 <= offsetof(struct INDEX_ROOT, ihdr) || + !index_hdr_check(&root->ihdr, + t32 - offsetof(struct INDEX_ROOT, ihdr))) { + goto out; + } + /* Check root fields. */ if (!root->index_block_clst) - return -EINVAL; + goto out; indx->type = type; indx->idx2vbn_bits = __ffs(root->index_block_clst); @@ -834,19 +888,19 @@ int indx_init(struct ntfs_index *indx, struct ntfs_sb_info *sbi, if (t32 < sbi->cluster_size) { /* Index record is smaller than a cluster, use 512 blocks. */ if (t32 != root->index_block_clst * SECTOR_SIZE) - return -EINVAL; + goto out; /* Check alignment to a cluster. */ if ((sbi->cluster_size >> SECTOR_SHIFT) & (root->index_block_clst - 1)) { - return -EINVAL; + goto out; } indx->vbn2vbo_bits = SECTOR_SHIFT; } else { /* Index record must be a multiple of cluster size. */ if (t32 != root->index_block_clst << sbi->cluster_bits) - return -EINVAL; + goto out; indx->vbn2vbo_bits = sbi->cluster_bits; } @@ -854,7 +908,14 @@ int indx_init(struct ntfs_index *indx, struct ntfs_sb_info *sbi, init_rwsem(&indx->run_lock); indx->cmp = get_cmp_func(root); - return indx->cmp ? 0 : -EINVAL; + if (!indx->cmp) + goto out; + + return 0; + +out: + ntfs_set_state(sbi, NTFS_DIRTY_DIRTY); + return -EINVAL; } static struct indx_node *indx_new(struct ntfs_index *indx, @@ -1012,6 +1073,13 @@ int indx_read(struct ntfs_index *indx, struct ntfs_inode *ni, CLST vbn, goto out; ok: + if (!index_buf_check(ib, bytes, &vbn)) { + ntfs_inode_err(&ni->vfs_inode, "directory corrupted"); + ntfs_set_state(ni->mi.sbi, NTFS_DIRTY_ERROR); + err = -EINVAL; + goto out; + } + if (err == -E_NTFS_FIXUP) { ntfs_write_bh(ni->mi.sbi, &ib->rhdr, &in->nb, 0); err = 0; @@ -1600,9 +1668,9 @@ static int indx_insert_into_root(struct ntfs_index *indx, struct ntfs_inode *ni, if (err) { /* Restore root. */ - if (mi_resize_attr(mi, attr, -ds_root)) + if (mi_resize_attr(mi, attr, -ds_root)) { memcpy(attr, a_root, asize); - else { + } else { /* Bug? */ ntfs_set_state(sbi, NTFS_DIRTY_ERROR); } diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c index 870f235bf226..9bafa3c7a5ff 100644 --- a/fs/ntfs3/inode.c +++ b/fs/ntfs3/inode.c @@ -81,7 +81,7 @@ static struct inode *ntfs_read_mft(struct inode *inode, le16_to_cpu(ref->seq), le16_to_cpu(rec->seq)); goto out; } else if (!is_rec_inuse(rec)) { - err = -EINVAL; + err = -ESTALE; ntfs_err(sb, "Inode r=%x is not in use!", (u32)ino); goto out; } @@ -92,8 +92,10 @@ static struct inode *ntfs_read_mft(struct inode *inode, goto out; } - if (!is_rec_base(rec)) - goto Ok; + if (!is_rec_base(rec)) { + err = -EINVAL; + goto out; + } /* Record should contain $I30 root. */ is_dir = rec->flags & RECORD_FLAG_DIR; @@ -464,7 +466,6 @@ static struct inode *ntfs_read_mft(struct inode *inode, inode->i_flags |= S_NOSEC; } -Ok: if (ino == MFT_REC_MFT && !sb->s_root) sbi->mft.ni = NULL; @@ -518,6 +519,9 @@ struct inode *ntfs_iget5(struct super_block *sb, const struct MFT_REF *ref, make_bad_inode(inode); } + if (IS_ERR(inode) && name) + ntfs_set_state(sb->s_fs_info, NTFS_DIRTY_ERROR); + return inode; } @@ -1632,10 +1636,8 @@ struct inode *ntfs_create_inode(struct user_namespace *mnt_userns, ntfs_remove_reparse(sbi, IO_REPARSE_TAG_SYMLINK, &new_de->ref); out5: - if (S_ISDIR(mode) || run_is_empty(&ni->file.run)) - goto out4; - - run_deallocate(sbi, &ni->file.run, false); + if (!S_ISDIR(mode)) + run_deallocate(sbi, &ni->file.run, false); out4: clear_rec_inuse(rec); diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h index b71075c21973..7e84f0060133 100644 --- a/fs/ntfs3/ntfs_fs.h +++ b/fs/ntfs3/ntfs_fs.h @@ -788,12 +788,12 @@ int run_pack(const struct runs_tree *run, CLST svcn, CLST len, u8 *run_buf, u32 run_buf_size, CLST *packed_vcns); int run_unpack(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino, CLST svcn, CLST evcn, CLST vcn, const u8 *run_buf, - u32 run_buf_size); + int run_buf_size); #ifdef NTFS3_CHECK_FREE_CLST int run_unpack_ex(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino, CLST svcn, CLST evcn, CLST vcn, const u8 *run_buf, - u32 run_buf_size); + int run_buf_size); #else #define run_unpack_ex run_unpack #endif diff --git a/fs/ntfs3/run.c b/fs/ntfs3/run.c index a8fec651f973..6940ee5432ba 100644 --- a/fs/ntfs3/run.c +++ b/fs/ntfs3/run.c @@ -872,12 +872,15 @@ int run_pack(const struct runs_tree *run, CLST svcn, CLST len, u8 *run_buf, */ int run_unpack(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino, CLST svcn, CLST evcn, CLST vcn, const u8 *run_buf, - u32 run_buf_size) + int run_buf_size) { u64 prev_lcn, vcn64, lcn, next_vcn; const u8 *run_last, *run_0; bool is_mft = ino == MFT_REC_MFT; + if (run_buf_size < 0) + return -EINVAL; + /* Check for empty. */ if (evcn + 1 == svcn) return 0; @@ -999,7 +1002,7 @@ int run_unpack(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino, */ int run_unpack_ex(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino, CLST svcn, CLST evcn, CLST vcn, const u8 *run_buf, - u32 run_buf_size) + int run_buf_size) { int ret, err; CLST next_vcn, lcn, len; diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c index cb33e2421ae3..a56d6a01d0a5 100644 --- a/fs/ntfs3/xattr.c +++ b/fs/ntfs3/xattr.c @@ -42,28 +42,26 @@ static inline size_t packed_ea_size(const struct EA_FULL *ea) * Assume there is at least one xattr in the list. */ static inline bool find_ea(const struct EA_FULL *ea_all, u32 bytes, - const char *name, u8 name_len, u32 *off) + const char *name, u8 name_len, u32 *off, u32 *ea_sz) { - *off = 0; + u32 ea_size; - if (!ea_all || !bytes) + *off = 0; + if (!ea_all) return false; - for (;;) { + for (; *off < bytes; *off += ea_size) { const struct EA_FULL *ea = Add2Ptr(ea_all, *off); - u32 next_off = *off + unpacked_ea_size(ea); - - if (next_off > bytes) - return false; - + ea_size = unpacked_ea_size(ea); if (ea->name_len == name_len && - !memcmp(ea->name, name, name_len)) + !memcmp(ea->name, name, name_len)) { + if (ea_sz) + *ea_sz = ea_size; return true; - - *off = next_off; - if (next_off >= bytes) - return false; + } } + + return false; } /* @@ -74,12 +72,12 @@ static inline bool find_ea(const struct EA_FULL *ea_all, u32 bytes, static int ntfs_read_ea(struct ntfs_inode *ni, struct EA_FULL **ea, size_t add_bytes, const struct EA_INFO **info) { - int err; + int err = -EINVAL; struct ntfs_sb_info *sbi = ni->mi.sbi; struct ATTR_LIST_ENTRY *le = NULL; struct ATTRIB *attr_info, *attr_ea; void *ea_p; - u32 size; + u32 size, off, ea_size; static_assert(le32_to_cpu(ATTR_EA_INFO) < le32_to_cpu(ATTR_EA)); @@ -96,24 +94,31 @@ static int ntfs_read_ea(struct ntfs_inode *ni, struct EA_FULL **ea, *info = resident_data_ex(attr_info, sizeof(struct EA_INFO)); if (!*info) - return -EINVAL; + goto out; /* Check Ea limit. */ size = le32_to_cpu((*info)->size); - if (size > sbi->ea_max_size) - return -EFBIG; + if (size > sbi->ea_max_size) { + err = -EFBIG; + goto out; + } + + if (attr_size(attr_ea) > sbi->ea_max_size) { + err = -EFBIG; + goto out; + } - if (attr_size(attr_ea) > sbi->ea_max_size) - return -EFBIG; + if (!size) { + /* EA info persists, but xattr is empty. Looks like EA problem. */ + goto out; + } /* Allocate memory for packed Ea. */ ea_p = kmalloc(size + add_bytes, GFP_NOFS); if (!ea_p) return -ENOMEM; - if (!size) { - ; - } else if (attr_ea->non_res) { + if (attr_ea->non_res) { struct runs_tree run; run_init(&run); @@ -124,24 +129,52 @@ static int ntfs_read_ea(struct ntfs_inode *ni, struct EA_FULL **ea, run_close(&run); if (err) - goto out; + goto out1; } else { void *p = resident_data_ex(attr_ea, size); - if (!p) { - err = -EINVAL; - goto out; - } + if (!p) + goto out1; memcpy(ea_p, p, size); } memset(Add2Ptr(ea_p, size), 0, add_bytes); + + /* Check all attributes for consistency. */ + for (off = 0; off < size; off += ea_size) { + const struct EA_FULL *ef = Add2Ptr(ea_p, off); + u32 bytes = size - off; + + /* Check if we can use field ea->size. */ + if (bytes < sizeof(ef->size)) + goto out1; + + if (ef->size) { + ea_size = le32_to_cpu(ef->size); + if (ea_size > bytes) + goto out1; + continue; + } + + /* Check if we can use fields ef->name_len and ef->elength. */ + if (bytes < offsetof(struct EA_FULL, name)) + goto out1; + + ea_size = ALIGN(struct_size(ef, name, + 1 + ef->name_len + + le16_to_cpu(ef->elength)), + 4); + if (ea_size > bytes) + goto out1; + } + *ea = ea_p; return 0; -out: +out1: kfree(ea_p); - *ea = NULL; +out: + ntfs_set_state(sbi, NTFS_DIRTY_DIRTY); return err; } @@ -163,6 +196,7 @@ static ssize_t ntfs_list_ea(struct ntfs_inode *ni, char *buffer, const struct EA_FULL *ea; u32 off, size; int err; + int ea_size; size_t ret; err = ntfs_read_ea(ni, &ea_all, 0, &info); @@ -175,8 +209,9 @@ static ssize_t ntfs_list_ea(struct ntfs_inode *ni, char *buffer, size = le32_to_cpu(info->size); /* Enumerate all xattrs. */ - for (ret = 0, off = 0; off < size; off += unpacked_ea_size(ea)) { + for (ret = 0, off = 0; off < size; off += ea_size) { ea = Add2Ptr(ea_all, off); + ea_size = unpacked_ea_size(ea); if (buffer) { if (ret + ea->name_len + 1 > bytes_per_buffer) { @@ -227,7 +262,8 @@ static int ntfs_get_ea(struct inode *inode, const char *name, size_t name_len, goto out; /* Enumerate all xattrs. */ - if (!find_ea(ea_all, le32_to_cpu(info->size), name, name_len, &off)) { + if (!find_ea(ea_all, le32_to_cpu(info->size), name, name_len, &off, + NULL)) { err = -ENODATA; goto out; } @@ -269,7 +305,7 @@ static noinline int ntfs_set_ea(struct inode *inode, const char *name, struct EA_FULL *new_ea; struct EA_FULL *ea_all = NULL; size_t add, new_pack; - u32 off, size; + u32 off, size, ea_sz; __le16 size_pack; struct ATTRIB *attr; struct ATTR_LIST_ENTRY *le; @@ -303,9 +339,8 @@ static noinline int ntfs_set_ea(struct inode *inode, const char *name, size_pack = ea_info.size_pack; } - if (info && find_ea(ea_all, size, name, name_len, &off)) { + if (info && find_ea(ea_all, size, name, name_len, &off, &ea_sz)) { struct EA_FULL *ea; - size_t ea_sz; if (flags & XATTR_CREATE) { err = -EEXIST; @@ -328,8 +363,6 @@ static noinline int ntfs_set_ea(struct inode *inode, const char *name, if (ea->flags & FILE_NEED_EA) le16_add_cpu(&ea_info.count, -1); - ea_sz = unpacked_ea_size(ea); - le16_add_cpu(&ea_info.size_pack, 0 - packed_ea_size(ea)); memmove(ea, Add2Ptr(ea, ea_sz), size - off - ea_sz); -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS 1/3] dccp/tcp: Avoid negative sk_forward_alloc by ipv6_pinfo.pktoptions.
by Yongqiang Liu 12 Jun '23

12 Jun '23

From: Kuniyuki Iwashima <kuniyu(a)amazon.com> stable inclusion from stable-v4.19.273 commit 28a1742fcc1d8692e9090864373aa77fb3a0c8fd category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6TPN9 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit ca43ccf41224b023fc290073d5603a755fd12eed upstream. Eric Dumazet pointed out [0] that when we call skb_set_owner_r() for ipv6_pinfo.pktoptions, sk_rmem_schedule() has not been called, resulting in a negative sk_forward_alloc. We add a new helper which clones a skb and sets its owner only when sk_rmem_schedule() succeeds. Note that we move skb_set_owner_r() forward in (dccp|tcp)_v6_do_rcv() because tcp_send_synack() can make sk_forward_alloc negative before ipv6_opt_accepted() in the crossed SYN-ACK or self-connect() cases. [0]: https://lore.kernel.org/netdev/CANn89iK9oc20Jdi_41jb9URdF210r7d1Y-+uypbMSbO… Fixes: 323fbd0edf3f ("net: dccp: Add handling of IPV6_PKTOPTIONS to dccp_v6_do_rcv()") Fixes: 3df80d9320bc ("[DCCP]: Introduce DCCPv6") Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- include/net/sock.h | 13 +++++++++++++ net/dccp/ipv6.c | 7 ++----- net/ipv6/tcp_ipv6.c | 10 +++------- 3 files changed, 18 insertions(+), 12 deletions(-) diff --git a/include/net/sock.h b/include/net/sock.h index 2eea1f5fc674..bac4ae940a89 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -2188,6 +2188,19 @@ static inline void skb_set_owner_r(struct sk_buff *skb, struct sock *sk) sk_mem_charge(sk, skb->truesize); } +static inline struct sk_buff *skb_clone_and_charge_r(struct sk_buff *skb, struct sock *sk) +{ + skb = skb_clone(skb, sk_gfp_mask(sk, GFP_ATOMIC)); + if (skb) { + if (sk_rmem_schedule(sk, skb, skb->truesize)) { + skb_set_owner_r(skb, sk); + return skb; + } + __kfree_skb(skb); + } + return NULL; +} + void sk_reset_timer(struct sock *sk, struct timer_list *timer, unsigned long expires); diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c index 9973a808b688..89dbe7330b4a 100644 --- a/net/dccp/ipv6.c +++ b/net/dccp/ipv6.c @@ -541,11 +541,9 @@ static struct sock *dccp_v6_request_recv_sock(const struct sock *sk, *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash)); /* Clone pktoptions received with SYN, if we own the req */ if (*own_req && ireq->pktopts) { - newnp->pktoptions = skb_clone(ireq->pktopts, GFP_ATOMIC); + newnp->pktoptions = skb_clone_and_charge_r(ireq->pktopts, newsk); consume_skb(ireq->pktopts); ireq->pktopts = NULL; - if (newnp->pktoptions) - skb_set_owner_r(newnp->pktoptions, newsk); } return newsk; @@ -605,7 +603,7 @@ static int dccp_v6_do_rcv(struct sock *sk, struct sk_buff *skb) --ANK (980728) */ if (np->rxopt.all) - opt_skb = skb_clone(skb, GFP_ATOMIC); + opt_skb = skb_clone_and_charge_r(skb, sk); if (sk->sk_state == DCCP_OPEN) { /* Fast path */ if (dccp_rcv_established(sk, skb, dccp_hdr(skb), skb->len)) @@ -669,7 +667,6 @@ static int dccp_v6_do_rcv(struct sock *sk, struct sk_buff *skb) np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb)); if (ipv6_opt_accepted(sk, opt_skb, &DCCP_SKB_CB(opt_skb)->header.h6)) { - skb_set_owner_r(opt_skb, sk); memmove(IP6CB(opt_skb), &DCCP_SKB_CB(opt_skb)->header.h6, sizeof(struct inet6_skb_parm)); diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index 63b0784cbdea..e3878cf00dd4 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -1267,14 +1267,11 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff * /* Clone pktoptions received with SYN, if we own the req */ if (ireq->pktopts) { - newnp->pktoptions = skb_clone(ireq->pktopts, - sk_gfp_mask(sk, GFP_ATOMIC)); + newnp->pktoptions = skb_clone_and_charge_r(ireq->pktopts, newsk); consume_skb(ireq->pktopts); ireq->pktopts = NULL; - if (newnp->pktoptions) { + if (newnp->pktoptions) tcp_v6_restore_cb(newnp->pktoptions); - skb_set_owner_r(newnp->pktoptions, newsk); - } } } @@ -1333,7 +1330,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb) --ANK (980728) */ if (np->rxopt.all) - opt_skb = skb_clone(skb, sk_gfp_mask(sk, GFP_ATOMIC)); + opt_skb = skb_clone_and_charge_r(skb, sk); if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */ struct dst_entry *dst; @@ -1415,7 +1412,6 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb) if (np->repflow) np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb)); if (ipv6_opt_accepted(sk, opt_skb, &TCP_SKB_CB(opt_skb)->header.h6)) { - skb_set_owner_r(opt_skb, sk); tcp_v6_restore_cb(opt_skb); opt_skb = xchg(&np->pktoptions, opt_skb); } else { -- 2.25.1

1 2

[PATCH OLK-5.10] power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition
by Zhao Wenhui 12 Jun '23

12 Jun '23

From: Zheng Wang <zyytlz.wz(a)163.com> stable inclusion from stable-v5.10.177 commit 2b346876b93168541a45551d5f9abd1d26102e89 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7781Q CVE: CVE-2023-33288 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 47c29d69212911f50bdcdd0564b5999a559010d4 ] In bq24190_probe, &bdi->input_current_limit_work is bound with bq24190_input_current_limit_work. When external power changed, it will call bq24190_charger_external_power_changed to start the work. If we remove the module which will call bq24190_remove to make cleanup, there may be a unfinished work. The possible sequence is as follows: CPU0 CPUc1 |bq24190_input_current_limit_work bq24190_remove | power_supply_unregister | device_unregister | power_supply_dev_release| kfree(psy) | | | power_supply_get_property_from_supplier | //use Fix it by finishing the work before cleanup in the bq24190_remove Fixes: 97774672573a ("power_supply: Initialize changed_work before calling device_add") Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Signed-off-by: Sebastian Reichel <sebastian.reichel(a)collabora.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/power/supply/bq24190_charger.c Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- drivers/power/supply/bq24190_charger.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/power/supply/bq24190_charger.c b/drivers/power/supply/bq24190_charger.c index 8c3c378dce0d..9a93060e5b5f 100644 --- a/drivers/power/supply/bq24190_charger.c +++ b/drivers/power/supply/bq24190_charger.c @@ -1849,6 +1849,7 @@ static int bq24190_remove(struct i2c_client *client) struct bq24190_dev_info *bdi = i2c_get_clientdata(client); int error; + cancel_delayed_work_sync(&bdi->input_current_limit_work); error = pm_runtime_get_sync(bdi->dev); if (error < 0) { dev_warn(bdi->dev, "pm_runtime_get failed: %i\n", error); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] genirq: Increase the number of IRQ descriptors
by Kunkun Jiang 12 Jun '23

12 Jun '23

virt inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7BQMW CVE: NA ----------------------------------------------------------------- The deafault value of NR_IRQS is not sufficient to support GICv4.1 features and ~56K LPIs. This parameter would be too small for certain server platforms where it has many IO devices and is capable of direct injection of vSGI and vLPI features. Currently, maximum of 64 + 8192 (IRQ_BITMAP_BITS) IRQ descriptors are allowed. The vCPU creation fails after reaching count ~400 with kvm-arm.vgic_v4_enable=1. This patch increases NR_IRQS to 1^19 to cover 56K LPIs and 262144 vSGIs (16vPEs x 16). ------------------------------------------------------------------ Tips: This is a temporary fix[1], but it has been able to solve the problem. The latest upstream version[2] depends on the 'maple tree', which is inappropriately introduced to the current kernel. ------------------------------------------------------------------- Another Tips: According to Chao Liu and Chang Liao's suggestion, modifying IRQ_BITMAP_BITS can achieve the same effect with less impact. Compared with solution[2], solution[1] has a disadvantage: the memory foot print increases as the number of VMs increases. Link: https://lore.kernel.org/linux-arm-kernel/20230104023738.1258925-1-sdonthine… [1] Link: https://lore.kernel.org/all/20230519134902.1495562-1-sdonthineni@nvidia.com… [2] Signed-off-by: Shanker Donthineni <sdonthineni(a)nvidia.com> Signed-off-by: Chao Liu <liuchao173(a)huawei.com> Signed-off-by: Chang Liao <liaochang1(a)huawei.com> Signed-off-by: Kunkun Jiang <jiangkunkun(a)huawei.com> --- kernel/irq/internals.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h index e58342ace11f..79f22b018c6b 100644 --- a/kernel/irq/internals.h +++ b/kernel/irq/internals.h @@ -12,7 +12,7 @@ #include <linux/sched/clock.h> #ifdef CONFIG_SPARSE_IRQ -# define IRQ_BITMAP_BITS (NR_IRQS + 8196) +# define IRQ_BITMAP_BITS (1 << 19) #else # define IRQ_BITMAP_BITS NR_IRQS #endif -- 2.33.0

2 1

[RESEND OLK-5.10] irqchip/gicv3-its: Add workaround for hip09 ITS erratum 162100801
by chenxiang 12 Jun '23

12 Jun '23

From: Xiang Chen <chenxiang66(a)hisilicon.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7C103 ------------------------------------------------ When enabled GICv4.1 in hip09, there are some invalid vPE configurations in configuration table for some situations, which will cause some vSGI interrupts lost. To fix the issue, need to send vinvall command after vmovp. Signed-off-by: t00358190 <tangnianyao(a)huawei.com> Signed-off-by: Xiang Chen <chenxiang66(a)hisilicon.com> Signed-off-by: caijian <caijian11(a)h-partners.com> --- Documentation/arm64/silicon-errata.rst | 2 ++ arch/arm64/Kconfig | 11 +++++++ arch/arm64/configs/openeuler_defconfig | 1 + drivers/irqchip/irq-gic-v3-its.c | 40 ++++++++++++++++++++------ 4 files changed, 46 insertions(+), 8 deletions(-) diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst index b72fbbfe3fcb..2305def38396 100644 --- a/Documentation/arm64/silicon-errata.rst +++ b/Documentation/arm64/silicon-errata.rst @@ -149,6 +149,8 @@ stable kernels. +----------------+-----------------+-----------------+-----------------------------+ | Hisilicon | TSV{110,200} | #1980005 | HISILICON_ERRATUM_1980005 | +----------------+-----------------+-----------------+-----------------------------+ +| Hisilicon | Hip09 | #162100801 | HISILICON_ERRATUM_162100801 | ++----------------+-----------------+-----------------+-----------------------------+ +----------------+-----------------+-----------------+-----------------------------+ | Qualcomm Tech. | Kryo/Falkor v1 | E1003 | QCOM_FALKOR_ERRATUM_1003 | +----------------+-----------------+-----------------+-----------------------------+ diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 3dcf96f37a3c..766356f04abc 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -802,6 +802,17 @@ config HISILICON_ERRATUM_1980005 If unsure, say N. +config HISILICON_ERRATUM_162100801 + bool "Hip09 162100801 erratum support" + default y + help + When enabled GICv4.1 in hip09, there are some invalid vPE config + in configuration tables for some situation, which will cause vSGI + interrupts lost. So fix it by sending vinvall commands after vmovp. + + If unsure, say Y. + + config QCOM_FALKOR_ERRATUM_1003 bool "Falkor E1003: Incorrect translation due to ASID change" default y diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 8261f11b54fd..1b633c835279 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -390,6 +390,7 @@ CONFIG_QCOM_FALKOR_ERRATUM_E1041=y CONFIG_SOCIONEXT_SYNQUACER_PREITS=y CONFIG_HISILICON_ERRATUM_HIP08_RU_PREFETCH=y # CONFIG_HISILICON_HIP08_RU_PREFETCH_DEFAULT_OFF is not set +CONFIG_HISILICON_ERRATUM_162100801=y # end of ARM errata workarounds via the alternatives framework CONFIG_ARM64_4K_PAGES=y diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index 99fcc5601ea4..db8219d65e7c 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -46,6 +46,7 @@ #define ITS_FLAGS_CMDQ_NEEDS_FLUSHING (1ULL << 0) #define ITS_FLAGS_WORKAROUND_CAVIUM_22375 (1ULL << 1) #define ITS_FLAGS_WORKAROUND_CAVIUM_23144 (1ULL << 2) +#define ITS_FLAGS_WORKAROUND_HISILICON_162100801 (1ULL << 3) #define RDIST_FLAGS_PROPBASE_NEEDS_FLUSHING (1 << 0) #define RDIST_FLAGS_RD_TABLES_PREALLOCATED (1 << 1) @@ -1294,6 +1295,14 @@ static void its_send_vmapp(struct its_node *its, its_send_single_vcommand(its, its_build_vmapp_cmd, &desc); } +static void its_send_vinvall(struct its_node *its, struct its_vpe *vpe) +{ + struct its_cmd_desc desc; + + desc.its_vinvall_cmd.vpe = vpe; + its_send_single_vcommand(its, its_build_vinvall_cmd, &desc); +} + static void its_send_vmovp(struct its_vpe *vpe) { struct its_cmd_desc desc = {}; @@ -1307,6 +1316,10 @@ static void its_send_vmovp(struct its_vpe *vpe) its = list_first_entry(&its_nodes, struct its_node, entry); desc.its_vmovp_cmd.col = &its->collections[col_id]; its_send_single_vcommand(its, its_build_vmovp_cmd, &desc); + if (is_v4_1(its) && (its->flags & + ITS_FLAGS_WORKAROUND_HISILICON_162100801)) + its_send_vinvall(its, vpe); + return; } @@ -1333,19 +1346,14 @@ static void its_send_vmovp(struct its_vpe *vpe) desc.its_vmovp_cmd.col = &its->collections[col_id]; its_send_single_vcommand(its, its_build_vmovp_cmd, &desc); + if (is_v4_1(its) && (its->flags & + ITS_FLAGS_WORKAROUND_HISILICON_162100801)) + its_send_vinvall(its, vpe); } raw_spin_unlock_irqrestore(&vmovp_lock, flags); } -static void its_send_vinvall(struct its_node *its, struct its_vpe *vpe) -{ - struct its_cmd_desc desc; - - desc.its_vinvall_cmd.vpe = vpe; - its_send_single_vcommand(its, its_build_vinvall_cmd, &desc); -} - static void its_send_vinv(struct its_device *dev, u32 event_id) { struct its_cmd_desc desc; @@ -4963,6 +4971,14 @@ static bool __maybe_unused its_enable_quirk_hip07_161600802(void *data) return true; } +static bool __maybe_unused its_enable_quirk_hip09_162100801(void *data) +{ + struct its_node *its = data; + + its->flags |= ITS_FLAGS_WORKAROUND_HISILICON_162100801; + return true; +} + static const struct gic_quirk its_quirks[] = { #ifdef CONFIG_CAVIUM_ERRATUM_22375 { @@ -5008,6 +5024,14 @@ static const struct gic_quirk its_quirks[] = { .mask = 0xffffffff, .init = its_enable_quirk_hip07_161600802, }, +#endif +#ifdef CONFIG_HISILICON_ERRATUM_162100801 + { + .desc = "ITS: Hip09 erratum 162100801", + .iidr = 0x00051736, + .mask = 0xffffffff, + .init = its_enable_quirk_hip09_162100801, + }, #endif { } -- 2.30.0

1 0

Re: [PATCH v2 OLK-5.10 4/6] mm: swap_slots: add per-type slot cache
by Liu Shixin 12 Jun '23

12 Jun '23

On 2023/6/12 9:58, Kefeng Wang wrote: > 之前的问题，底噪增加了多少静态和运行态 > > On 2023/6/10 18:07, Liu Shixin wrote: >> +static DEFINE_PER_CPU(struct swap_slots_cache [MAX_SWAPFILES], swp_type_slots); > . > 一个swap_slots_cache是80字节，MAX_SWAPFILES是32，按128核算，增长就是320K(80*32*128)。每个swap_slots_cache里会挂128个swp_entry，每个8字节，MAX_SWAPFILES是32，按128核算，增长就是4M(128*8*32*128)。这个swp_entry如果动态申请，每增加一个swap设备，就增长128K。

1 0

[PATCH openEuler-1.0-LTS] media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
by Yongqiang Liu 12 Jun '23

12 Jun '23

From: Takashi Iwai <tiwai(a)suse.de> mainline inclusion from mainline-v6.4-rc3 commit b8c75e4a1b325ea0a9433fa8834be97b5836b946 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6YKXB CVE: CVE-2023-31084 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Using a semaphore in the wait_event*() condition is no good idea. It hits a kernel WARN_ON() at prepare_to_wait_event() like: do not call blocking ops when !TASK_RUNNING; state=1 set at prepare_to_wait_event+0x6d/0x690 For avoiding the potential deadlock, rewrite to an open-coded loop instead. Unlike the loop in wait_event*(), this uses wait_woken() after the condition check, hence the task state stays consistent. CVE-2023-31084 was assigned to this bug. Link: https://lore.kernel.org/r/CA+UBctCu7fXn4q41O_3=id1+OdyQ85tZY1x+TkT-6OVBL6KA… Link: https://lore.kernel.org/linux-media/20230512151800.1874-1-tiwai@suse.de Reported-by: Yu Hao <yhao016(a)ucr.edu> Closes: https://nvd.nist.gov/vuln/detail/CVE-2023-31084 Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Chen Jiahao <chenjiahao16(a)huawei.com> Reviewed-by: Zhang Jianhua <chris.zjh(a)huawei.com> Reviewed-by: Liao Chang <liaochang1(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/media/dvb-core/dvb_frontend.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c index 8a61150ee249..3a0c794f7b80 100644 --- a/drivers/media/dvb-core/dvb_frontend.c +++ b/drivers/media/dvb-core/dvb_frontend.c @@ -304,14 +304,22 @@ static int dvb_frontend_get_event(struct dvb_frontend *fe, } if (events->eventw == events->eventr) { - int ret; + struct wait_queue_entry wait; + int ret = 0; if (flags & O_NONBLOCK) return -EWOULDBLOCK; - ret = wait_event_interruptible(events->wait_queue, - dvb_frontend_test_event(fepriv, events)); - + init_waitqueue_entry(&wait, current); + add_wait_queue(&events->wait_queue, &wait); + while (!dvb_frontend_test_event(fepriv, events)) { + wait_woken(&wait, TASK_INTERRUPTIBLE, 0); + if (signal_pending(current)) { + ret = -ERESTARTSYS; + break; + } + } + remove_wait_queue(&events->wait_queue, &wait); if (ret < 0) return ret; } -- 2.25.1

1 0

[PATCH openEuler-22.03-LTS-SP2 0/9] some backport bugfix for sockmap
by Liu Jian 11 Jun '23

11 Jun '23

some backport bugfix for sockmap Cong Wang (1): bpf, sock_map: Move cancel_work_sync() out of sock lock Eric Dumazet (1): net: deal with most data-races in sk_wait_event() Jakub Sitnicki (2): bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself Pengcheng Yang (3): bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data bpf, sockmap: Fix missing BPF_F_INGRESS flag when using apply_bytes bpf, sockmap: Fix data loss caused by using apply_bytes on ingress redirect Wang Yufen (1): bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_stream_kill_queues zhangmingyi (1): bpf: fix bpf_tcp_ingress addr use after free include/linux/skmsg.h | 3 +- include/linux/util_macros.h | 12 ++++++++ include/net/tcp.h | 4 +-- net/core/skmsg.c | 16 +++++----- net/core/sock_map.c | 60 +++++++++++++++++++++---------------- net/core/stream.c | 12 ++++---- net/ipv4/tcp_bpf.c | 36 +++++++++++++--------- net/llc/af_llc.c | 8 +++-- net/smc/smc_close.c | 4 +-- net/smc/smc_rx.c | 4 +-- net/smc/smc_tx.c | 4 +-- net/tipc/socket.c | 4 +-- net/tls/tls_main.c | 3 +- net/tls/tls_sw.c | 6 ++-- 14 files changed, 105 insertions(+), 71 deletions(-) -- 2.34.1

1 9

[PATCH OLK-5.10 0/6] Per-memcg swap control
by Liu Shixin 10 Jun '23

10 Jun '23

This series patches add swap control for memory cgroup. Patch[1] add page type in memory.reclaim interface to support reclaim anon pages. Patch[2] add memory.force_swapin interface to support swap back pages proactively. Patch[3-5] add memory.swapfile interface to limit available swap device for memory cgroup. Patch[6] add memory.swap.max interface to limit usage of swap for memory cgroup. Liu Shixin (6): memcg: add page type to memory.reclaim interface memcg: introduce per-memcg swapin interface mm/swapfile: introduce per-memcg swapfile control mm: swap_slots: add per-type slot cache mm: swap_slots: allocate per-type slot cache when online swap device memcg: add restrict to swap to cgroup1 .../admin-guide/cgroup-v1/memory.rst | 2 + Documentation/admin-guide/cgroup-v2.rst | 9 +- include/linux/memcontrol.h | 27 ++ include/linux/mm.h | 1 + include/linux/swap.h | 10 +- include/linux/swap_slots.h | 2 +- mm/Kconfig | 8 + mm/madvise.c | 19 ++ mm/memcontrol.c | 297 +++++++++++++++++- mm/swap_slots.c | 136 +++++++- mm/swapfile.c | 88 +++++- mm/vmscan.c | 17 + 12 files changed, 590 insertions(+), 26 deletions(-) -- 2.25.1

2 7

[PATCH OLK-5.10 1/6] memcg: add page type to memory.reclaim interface
by Liu Shixin 10 Jun '23

10 Jun '23

Add anon/file to memory.reclaim interface to limit only reclaim one type pages. The lru algorithm can reclaim cold pages and balance between file and anon. But it didn't consider the speed of backend device. For example, if there is zram device, reclaim anon pages might has less impact on performance. So extend memory.reclaim interface to reclaim one type pages. Usage: "echo <size> type=anon > memory.reclaim" "echo <size> type=file > memory.reclaim" Also compatible with the previous format. Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- Documentation/admin-guide/cgroup-v2.rst | 9 ++++--- include/linux/swap.h | 4 +++ mm/memcontrol.c | 36 ++++++++++++++++++++++--- mm/vmscan.c | 17 ++++++++++++ 4 files changed, 59 insertions(+), 7 deletions(-) diff --git a/Documentation/admin-guide/cgroup-v2.rst b/Documentation/admin-guide/cgroup-v2.rst index 5d9b7e552fb0..a04ca490f58c 100644 --- a/Documentation/admin-guide/cgroup-v2.rst +++ b/Documentation/admin-guide/cgroup-v2.rst @@ -1196,15 +1196,16 @@ PAGE_SIZE multiple when read back. target cgroup. This file accepts a single key, the number of bytes to reclaim. - No nested keys are currently supported. Example:: echo "1G" > memory.reclaim - The interface can be later extended with nested keys to - configure the reclaim behavior. For example, specify the - type of memory to reclaim from (anon, file, ..). + This file also accepts nested keys, the number of bytes to reclaim + with the type of memory to reclaim. + + Example:: + echo "1G type=file" > memory.reclaim Please note that the kernel can over or under reclaim from the target cgroup. If less bytes are reclaimed than the diff --git a/include/linux/swap.h b/include/linux/swap.h index 7f49964f27d2..b98b4c9df622 100644 --- a/include/linux/swap.h +++ b/include/linux/swap.h @@ -380,6 +380,10 @@ extern unsigned long try_to_free_mem_cgroup_pages(struct mem_cgroup *memcg, unsigned long nr_pages, gfp_t gfp_mask, bool may_swap); +extern unsigned long __try_to_free_mem_cgroup_pages(struct mem_cgroup *memcg, + unsigned long nr_pages, + gfp_t gfp_mask, + bool may_swap, bool only_swap); extern unsigned long mem_cgroup_shrink_node(struct mem_cgroup *mem, gfp_t gfp_mask, bool noswap, pg_data_t *pgdat, diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 662c7859b7f1..8f796b651baa 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -5263,16 +5263,46 @@ static int memcg_events_local_show(struct seq_file *m, void *v) return 0; } +static int reclaim_param_parse(char *buf, unsigned long *nr_pages, + bool *anon, bool *file) +{ + char *endp; + u64 bytes; + + if (!strcmp(buf, "")) { + *nr_pages = PAGE_COUNTER_MAX; + return 0; + } + + bytes = memparse(buf, &endp); + if (*endp == ' ') { + buf = endp + 1; + buf = strim(buf); + if (!strcmp(buf, "type=anon")) + *file = false; + else if (!strcmp(buf, "type=file")) + *anon = false; + else + return -EINVAL; + } else if (*endp != '\0') + return -EINVAL; + + *nr_pages = min(bytes / PAGE_SIZE, (u64)PAGE_COUNTER_MAX); + + return 0; +} + static ssize_t memory_reclaim(struct kernfs_open_file *of, char *buf, size_t nbytes, loff_t off) { struct mem_cgroup *memcg = mem_cgroup_from_css(of_css(of)); unsigned int nr_retries = MAX_RECLAIM_RETRIES; unsigned long nr_to_reclaim, nr_reclaimed = 0; + bool anon = true, file = true; int err; buf = strstrip(buf); - err = page_counter_memparse(buf, "", &nr_to_reclaim); + err = reclaim_param_parse(buf, &nr_to_reclaim, &anon, &file); if (err) return err; @@ -5293,9 +5323,9 @@ static ssize_t memory_reclaim(struct kernfs_open_file *of, char *buf, if (!nr_retries) lru_add_drain_all(); - reclaimed = try_to_free_mem_cgroup_pages(memcg, + reclaimed = __try_to_free_mem_cgroup_pages(memcg, nr_to_reclaim - nr_reclaimed, - GFP_KERNEL, true); + GFP_KERNEL, anon, !file); if (!reclaimed && !nr_retries--) return -EAGAIN; diff --git a/mm/vmscan.c b/mm/vmscan.c index a8412c5d4eda..2fce47af0e83 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -102,6 +102,8 @@ struct scan_control { /* Can pages be swapped as part of reclaim? */ unsigned int may_swap:1; + /* Only swap anon pages */ + unsigned int only_swap:1; /* * Cgroup memory below memory.low is protected as long as we @@ -2461,6 +2463,11 @@ static void get_scan_count(struct lruvec *lruvec, struct scan_control *sc, unsigned long ap, fp; enum lru_list lru; + if (sc->only_swap) { + scan_balance = SCAN_ANON; + goto out; + } + /* If we have no swap space, do not bother scanning anon pages. */ if (!sc->may_swap || mem_cgroup_get_nr_swap_pages(memcg) <= 0) { scan_balance = SCAN_FILE; @@ -3563,6 +3570,15 @@ unsigned long try_to_free_mem_cgroup_pages(struct mem_cgroup *memcg, unsigned long nr_pages, gfp_t gfp_mask, bool may_swap) +{ + return __try_to_free_mem_cgroup_pages(memcg, nr_pages, gfp_mask, + may_swap, false); +} + +unsigned long __try_to_free_mem_cgroup_pages(struct mem_cgroup *memcg, + unsigned long nr_pages, + gfp_t gfp_mask, + bool may_swap, bool only_swap) { unsigned long nr_reclaimed; unsigned int noreclaim_flag; @@ -3576,6 +3592,7 @@ unsigned long try_to_free_mem_cgroup_pages(struct mem_cgroup *memcg, .may_writepage = !laptop_mode, .may_unmap = 1, .may_swap = may_swap, + .only_swap = only_swap, }; /* * Traverse the ZONELIST_FALLBACK zonelist of the current node to put -- 2.25.1

1 5

[PATCH OLK-5.10 0/6] Per-memcg swap control
by Liu Shixin 10 Jun '23

10 Jun '23

This series patches add swap control for memory cgroup. Patch[1] add page type in memory.reclaim interface to support reclaim anon pages. Patch[2] add memory.force_swapin interface to support swap back pages proactively. Patch[3-5] add memory.swapfile interface to limit available swap device for memory cgroup. Patch[6] add memory.swap.max interface to limit usage of swap for memory cgroup. Liu Shixin (6): memcg: add page type to memory.reclaim interface memcg: introduce per-memcg swapin interface mm/swapfile: introduce per-memcg swapfile control mm: swap_slots: add per-type slot cache mm: swap_slots: allocate per-type slot cache when online swap device memcg: add restrict to swap to cgroup1 .../admin-guide/cgroup-v1/memory.rst | 2 + Documentation/admin-guide/cgroup-v2.rst | 9 +- include/linux/memcontrol.h | 27 ++ include/linux/mm.h | 1 + include/linux/swap.h | 10 +- include/linux/swap_slots.h | 2 +- mm/Kconfig | 8 + mm/madvise.c | 19 ++ mm/memcontrol.c | 297 +++++++++++++++++- mm/swap_slots.c | 136 +++++++- mm/swapfile.c | 88 +++++- mm/vmscan.c | 17 + 12 files changed, 590 insertions(+), 26 deletions(-) -- 2.25.1

2 7

[PATCH OLK-5.10 00/18] A series of CVE fix patches and related
by ZhaoLong Wang 10 Jun '23

10 Jun '23

CVE fixes: CVE-2023-32255 CVE-2023-32248 CVE-2023-32250 CVE-2023-32252 CVE-2023-32257 CVE-2023-32247 CVE-2023-32251 CVE-2023-32253 CVE-2023-32249 CVE-2023-32254 CVE-2023-32246 CVE-2023-32256 CVE-2023-32258 Chih-Yen Chang (3): ksmbd: fix wrong UserName check in session_user ksmbd: allocate one more byte for implied bcc[0] ksmbd: fix global-out-of-bounds in smb2_find_context_vals Colin Ian King (1): ksmbd: Fix spelling mistake "excceed" -> "exceeded" Dawei Li (1): ksmbd: Implements sess->ksmbd_chann_list as xarray Gustav Johansson (1): ksmbd: smb2: Allow messages padded to 8byte boundary Namjae Jeon (12): ksmbd: fix memleak in session setup ksmbd: fix NULL pointer dereference in smb2_get_info_filesystem() ksmbd: limit pdu length size according to connection status ksmbd: fix racy issue from session setup and logoff ksmbd: destroy expired sessions ksmbd: block asynchronous requests when making a delay on session setup ksmbd: fix deadlock in ksmbd_find_crypto_ctx() ksmbd: not allow guest user on multichannel ksmbd: fix racy issue under cocurrent smb2 tree disconnect ksmbd: call rcu_barrier() in ksmbd_server_exit() ksmbd: fix racy issue from smb2 close and logoff with multichannel ksmbd: do not allow the actual frame length to be smaller than the rfc1002 length fs/ksmbd/auth.c | 19 ++-- fs/ksmbd/connection.c | 84 +++++++++++++----- fs/ksmbd/connection.h | 58 +++++++++---- fs/ksmbd/mgmt/tree_connect.c | 13 ++- fs/ksmbd/mgmt/tree_connect.h | 3 + fs/ksmbd/mgmt/user_session.c | 138 ++++++++++++++++------------- fs/ksmbd/mgmt/user_session.h | 5 +- fs/ksmbd/oplock.c | 5 +- fs/ksmbd/oplock.h | 2 +- fs/ksmbd/server.c | 4 +- fs/ksmbd/smb2misc.c | 24 +++--- fs/ksmbd/smb2pdu.c | 162 +++++++++++++++++++---------------- fs/ksmbd/smb2pdu.h | 7 +- fs/ksmbd/transport_tcp.c | 2 +- 14 files changed, 322 insertions(+), 204 deletions(-) -- 2.31.1

2 19

[PATCH 00/18] kambd: A series of CVE fix patches and related
by ZhaoLong Wang 10 Jun '23

10 Jun '23

CVE fixes: CVE-2023-32255 CVE-2023-32248 CVE-2023-32250 CVE-2023-32252 CVE-2023-32257 CVE-2023-32247 CVE-2023-32251 CVE-2023-32253 CVE-2023-32249 CVE-2023-32254 CVE-2023-32246 CVE-2023-32256 CVE-2023-32258 CVE-2023-2593 Chih-Yen Chang (3): ksmbd: fix wrong UserName check in session_user ksmbd: allocate one more byte for implied bcc[0] ksmbd: fix global-out-of-bounds in smb2_find_context_vals Colin Ian King (1): ksmbd: Fix spelling mistake "excceed" -> "exceeded" Dawei Li (1): ksmbd: Implements sess->ksmbd_chann_list as xarray Gustav Johansson (1): ksmbd: smb2: Allow messages padded to 8byte boundary Namjae Jeon (12): ksmbd: fix memleak in session setup ksmbd: fix NULL pointer dereference in smb2_get_info_filesystem() ksmbd: limit pdu length size according to connection status ksmbd: fix racy issue from session setup and logoff ksmbd: destroy expired sessions ksmbd: block asynchronous requests when making a delay on session setup ksmbd: fix deadlock in ksmbd_find_crypto_ctx() ksmbd: not allow guest user on multichannel ksmbd: fix racy issue under cocurrent smb2 tree disconnect ksmbd: call rcu_barrier() in ksmbd_server_exit() ksmbd: fix racy issue from smb2 close and logoff with multichannel ksmbd: do not allow the actual frame length to be smaller than the rfc1002 length fs/ksmbd/auth.c | 19 ++-- fs/ksmbd/connection.c | 84 +++++++++++++----- fs/ksmbd/connection.h | 58 +++++++++---- fs/ksmbd/mgmt/tree_connect.c | 13 ++- fs/ksmbd/mgmt/tree_connect.h | 3 + fs/ksmbd/mgmt/user_session.c | 138 ++++++++++++++++------------- fs/ksmbd/mgmt/user_session.h | 5 +- fs/ksmbd/oplock.c | 5 +- fs/ksmbd/oplock.h | 2 +- fs/ksmbd/server.c | 4 +- fs/ksmbd/smb2misc.c | 24 +++--- fs/ksmbd/smb2pdu.c | 162 +++++++++++++++++++---------------- fs/ksmbd/smb2pdu.h | 7 +- fs/ksmbd/transport_tcp.c | 2 +- 14 files changed, 322 insertions(+), 204 deletions(-) -- 2.31.1

1 18

[PATCH 00/18] kambd: A series of CVE fix patches and related
by ZhaoLong Wang 10 Jun '23

10 Jun '23

CVE fixes: CVE-2023-32255 CVE-2023-32248 CVE-2023-32250 CVE-2023-32252 CVE-2023-32257 CVE-2023-32247 CVE-2023-32251 CVE-2023-32253 CVE-2023-32249 CVE-2023-32254 CVE-2023-32246 CVE-2023-32256 CVE-2023-32258 CVE-2023-2593 Chih-Yen Chang (3): ksmbd: fix wrong UserName check in session_user ksmbd: allocate one more byte for implied bcc[0] ksmbd: fix global-out-of-bounds in smb2_find_context_vals Colin Ian King (1): ksmbd: Fix spelling mistake "excceed" -> "exceeded" Dawei Li (1): ksmbd: Implements sess->ksmbd_chann_list as xarray Gustav Johansson (1): ksmbd: smb2: Allow messages padded to 8byte boundary Namjae Jeon (12): ksmbd: fix memleak in session setup ksmbd: fix NULL pointer dereference in smb2_get_info_filesystem() ksmbd: limit pdu length size according to connection status ksmbd: fix racy issue from session setup and logoff ksmbd: destroy expired sessions ksmbd: block asynchronous requests when making a delay on session setup ksmbd: fix deadlock in ksmbd_find_crypto_ctx() ksmbd: not allow guest user on multichannel ksmbd: fix racy issue under cocurrent smb2 tree disconnect ksmbd: call rcu_barrier() in ksmbd_server_exit() ksmbd: fix racy issue from smb2 close and logoff with multichannel ksmbd: do not allow the actual frame length to be smaller than the rfc1002 length fs/ksmbd/auth.c | 19 ++-- fs/ksmbd/connection.c | 84 +++++++++++++----- fs/ksmbd/connection.h | 58 +++++++++---- fs/ksmbd/mgmt/tree_connect.c | 13 ++- fs/ksmbd/mgmt/tree_connect.h | 3 + fs/ksmbd/mgmt/user_session.c | 138 ++++++++++++++++------------- fs/ksmbd/mgmt/user_session.h | 5 +- fs/ksmbd/oplock.c | 5 +- fs/ksmbd/oplock.h | 2 +- fs/ksmbd/server.c | 4 +- fs/ksmbd/smb2misc.c | 24 +++--- fs/ksmbd/smb2pdu.c | 162 +++++++++++++++++++---------------- fs/ksmbd/smb2pdu.h | 7 +- fs/ksmbd/transport_tcp.c | 2 +- 14 files changed, 322 insertions(+), 204 deletions(-) -- 2.31.1

1 18

[PATCH OLK-5.10 0/6] A set of patch for uploading openEuler
by Yihang Li 09 Jun '23

09 Jun '23

From: xiabing <xiabing12(a)h-partners.com> This series contain some fixes including: -Add slave_destroy interface for v3 hw -Try more retries of START_STOP when resuming scsi device -Enable force phy when SATA disk directly connected -Set value of device_id increases from 0 by default -Block requests before take debugfs snapshot -Check usage count only when the runtime PM status is RPM_SUSPENDING Qi Liu (1): scsi: hisi_sas: Add slave_destroy interface for v3 hw Xiang Chen (1): scsi: sd: try more retries of START_STOP when resuming scsi device Xingui Yang (1): scsi: hisi_sas: Enable force phy when SATA disk directly connected Yihang Li (3): scsi: hisi_sas: Set value of device_id increases from 0 by default scsi: hisi_sas: Block requests before take debugfs snapshot scsi: hisi_sas: Check usage count only when the runtime PM status is RPM_SUSPENDING drivers/scsi/hisi_sas/hisi_sas_main.c | 22 +++++++------- drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 9 ++++-- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 41 +++++++++++++++++++++----- drivers/scsi/sd.c | 24 +++++++++++---- 4 files changed, 70 insertions(+), 26 deletions(-) -- 2.30.0

3 8

[PATCH openEuler-1.0-LTS 0/2] smart grid scheduler
by Zhang Changzhong 09 Jun '23

09 Jun '23

Hui Tang (1): sched: Introduce smart grid scheduling strategy for cfs Wang ShaoBo (1): sched: smart grid: init sched_grid_qos structure on QOS purpose fs/proc/array.c | 13 ++ include/linux/sched.h | 22 +++ include/linux/sched/grid_qos.h | 92 +++++++++ include/linux/sched/sysctl.h | 4 + init/Kconfig | 13 ++ kernel/fork.c | 9 + kernel/sched/Makefile | 1 + kernel/sched/core.c | 147 ++++++++++++++ kernel/sched/fair.c | 432 ++++++++++++++++++++++++++++++++++++++++- kernel/sched/grid/Makefile | 2 + kernel/sched/grid/internal.h | 6 + kernel/sched/grid/power.c | 27 +++ kernel/sched/grid/qos.c | 144 ++++++++++++++ kernel/sched/grid/stat.c | 32 +++ kernel/sched/sched.h | 48 +++++ kernel/sysctl.c | 9 + mm/mempolicy.c | 12 +- 17 files changed, 1010 insertions(+), 3 deletions(-) create mode 100644 include/linux/sched/grid_qos.h create mode 100644 kernel/sched/grid/Makefile create mode 100644 kernel/sched/grid/internal.h create mode 100644 kernel/sched/grid/power.c create mode 100644 kernel/sched/grid/qos.c create mode 100644 kernel/sched/grid/stat.c -- 2.9.5

1 2

[PATCH openEuler-22.03-LTS-SP2] drm/qxl: Fix missing free_irq
by Wei Li 09 Jun '23

09 Jun '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5Q4S3 -------------------------------- When doing "cat /proc/interrupts" after qxl.ko is unloaded, an oops occurs: BUG: unable to handle page fault for address: ffffffffc0274769 PGD 2a0d067 P4D 2a0d067 PUD 2a0f067 PMD 103f39067 PTE 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 6 PID: 246 Comm: cat Not tainted 6.1.0-rc2 #24 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:string_nocheck+0x34/0x50 Code: 66 85 c0 74 3c 83 e8 01 4c 8d 5c 07 01 31 c0 eb 19 49 39 fa 76 03 44 88 07 48 83 c7 RSP: 0018:ffffc90000893bb8 EFLAGS: 00010046 RAX: 0000000000000000 RBX: ffffc90000893c50 RCX: ffff0a00ffffff04 RDX: ffffffffc0274769 RSI: ffff888102812000 RDI: ffff88810281133e RBP: ffff888102812000 R08: ffffffff823fa5e6 R09: 0000000000000007 R10: ffff888102812000 R11: ffff88820281133d R12: ffffffffc0274769 R13: ffff0a00ffffff04 R14: 0000000000000cc4 R15: ffffffff823276b4 FS: 000000000214f8c0(0000) GS:ffff88842fd80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffc0274769 CR3: 00000001025c4005 CR4: 0000000000770ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> string+0x46/0x60 vsnprintf+0x27a/0x4f0 seq_vprintf+0x34/0x50 seq_printf+0x53/0x70 ? seq_read_iter+0x365/0x450 show_interrupts+0x259/0x330 seq_read_iter+0x2a3/0x450 proc_reg_read_iter+0x47/0x70 generic_file_splice_read+0x94/0x160 splice_direct_to_actor+0xb0/0x230 ? do_splice_direct+0xd0/0xd0 do_splice_direct+0x8b/0xd0 do_sendfile+0x345/0x4f0 __x64_sys_sendfile64+0xa1/0xc0 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x4bb0ce Code: c3 0f 1f 00 4c 89 d2 4c 89 c6 e9 bd fd ff ff 0f 1f 44 00 00 31 c0 c3 0f 1f 44 00 00 RSP: 002b:00007ffd99dc3fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 RAX: ffffffffffffffda RBX: 0000000001000000 RCX: 00000000004bb0ce RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000001 RBP: 0000000000000001 R08: 000000000068f240 R09: 0000000001000000 R10: 0000000001000000 R11: 0000000000000246 R12: 0000000000000003 R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000 </TASK> It seems that qxl doesn't free the interrupt it requests during unload, fix this by adding the missing free_irq(). Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)") Signed-off-by: Wei Li <liwei391(a)huawei.com> --- drivers/gpu/drm/qxl/qxl_kms.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/drm/qxl/qxl_kms.c b/drivers/gpu/drm/qxl/qxl_kms.c index dc5b3850a4d4..d8a4873ceb82 100644 --- a/drivers/gpu/drm/qxl/qxl_kms.c +++ b/drivers/gpu/drm/qxl/qxl_kms.c @@ -287,10 +287,14 @@ int qxl_device_init(struct qxl_device *qdev, void qxl_device_fini(struct qxl_device *qdev) { + struct drm_device *ddev = &qdev->ddev; + struct pci_dev *pdev = to_pci_dev(ddev->dev); + qxl_bo_unref(&qdev->current_release_bo[0]); qxl_bo_unref(&qdev->current_release_bo[1]); qxl_gem_fini(qdev); qxl_bo_fini(qdev); + free_irq(pdev->irq, ddev); flush_work(&qdev->gc_work); qxl_ring_free(qdev->command_ring); qxl_ring_free(qdev->cursor_ring); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP2] drm/qxl: Fix missing free_irq
by Wei Li 09 Jun '23

09 Jun '23

When doing "cat /proc/interrupts" after qxl.ko is unloaded, an oops occurs: BUG: unable to handle page fault for address: ffffffffc0274769 PGD 2a0d067 P4D 2a0d067 PUD 2a0f067 PMD 103f39067 PTE 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 6 PID: 246 Comm: cat Not tainted 6.1.0-rc2 #24 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:string_nocheck+0x34/0x50 Code: 66 85 c0 74 3c 83 e8 01 4c 8d 5c 07 01 31 c0 eb 19 49 39 fa 76 03 44 88 07 48 83 c7 RSP: 0018:ffffc90000893bb8 EFLAGS: 00010046 RAX: 0000000000000000 RBX: ffffc90000893c50 RCX: ffff0a00ffffff04 RDX: ffffffffc0274769 RSI: ffff888102812000 RDI: ffff88810281133e RBP: ffff888102812000 R08: ffffffff823fa5e6 R09: 0000000000000007 R10: ffff888102812000 R11: ffff88820281133d R12: ffffffffc0274769 R13: ffff0a00ffffff04 R14: 0000000000000cc4 R15: ffffffff823276b4 FS: 000000000214f8c0(0000) GS:ffff88842fd80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffc0274769 CR3: 00000001025c4005 CR4: 0000000000770ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> string+0x46/0x60 vsnprintf+0x27a/0x4f0 seq_vprintf+0x34/0x50 seq_printf+0x53/0x70 ? seq_read_iter+0x365/0x450 show_interrupts+0x259/0x330 seq_read_iter+0x2a3/0x450 proc_reg_read_iter+0x47/0x70 generic_file_splice_read+0x94/0x160 splice_direct_to_actor+0xb0/0x230 ? do_splice_direct+0xd0/0xd0 do_splice_direct+0x8b/0xd0 do_sendfile+0x345/0x4f0 __x64_sys_sendfile64+0xa1/0xc0 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x4bb0ce Code: c3 0f 1f 00 4c 89 d2 4c 89 c6 e9 bd fd ff ff 0f 1f 44 00 00 31 c0 c3 0f 1f 44 00 00 RSP: 002b:00007ffd99dc3fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 RAX: ffffffffffffffda RBX: 0000000001000000 RCX: 00000000004bb0ce RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000001 RBP: 0000000000000001 R08: 000000000068f240 R09: 0000000001000000 R10: 0000000001000000 R11: 0000000000000246 R12: 0000000000000003 R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000 </TASK> It seems that qxl doesn't free the interrupt it requests during unload, fix this by adding the missing free_irq(). Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)") Signed-off-by: Wei Li <liwei391(a)huawei.com> --- drivers/gpu/drm/qxl/qxl_kms.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/drm/qxl/qxl_kms.c b/drivers/gpu/drm/qxl/qxl_kms.c index dc5b3850a4d4..d8a4873ceb82 100644 --- a/drivers/gpu/drm/qxl/qxl_kms.c +++ b/drivers/gpu/drm/qxl/qxl_kms.c @@ -287,10 +287,14 @@ int qxl_device_init(struct qxl_device *qdev, void qxl_device_fini(struct qxl_device *qdev) { + struct drm_device *ddev = &qdev->ddev; + struct pci_dev *pdev = to_pci_dev(ddev->dev); + qxl_bo_unref(&qdev->current_release_bo[0]); qxl_bo_unref(&qdev->current_release_bo[1]); qxl_gem_fini(qdev); qxl_bo_fini(qdev); + free_irq(pdev->irq, ddev); flush_work(&qdev->gc_work); qxl_ring_free(qdev->command_ring); qxl_ring_free(qdev->cursor_ring); -- 2.25.1

2 1

[PATCH v8 openEuler-22.03-LTS-SP2 0/4] support ACPI for MPAM 2.0
by Yu Liao 09 Jun '23

09 Jun '23

This patch series support ACPI for MPAM 2.0. v5: fix unused variable warning. v4: add PPTT null check to prevent NULL pointer deference. Erik Kaneda (1): ACPICA: ACPI 6.4: PPTT: add new version of subtable type 1 Hesham Almatary (1): ACPICA: Add support for Arm's MPAM ACPI table version 2 Yu Liao (2): ACPI / PPTT: Find PPTT processor node by cache id ACPI/MPAM: Adapt to Arm's MPAM ACPI table version 2 arch/arm64/kernel/mpam/mpam_device.c | 2 +- drivers/acpi/arm64/Makefile | 2 +- drivers/acpi/arm64/mpam.c | 23 +++- drivers/acpi/arm64/mpam_v2.c | 175 +++++++++++++++++++++++++++ drivers/acpi/pptt.c | 55 +++++++++ include/acpi/actbl2.h | 118 ++++++++++++++++++ include/linux/acpi.h | 5 + include/linux/arm_mpam.h | 2 +- 8 files changed, 374 insertions(+), 8 deletions(-) create mode 100644 drivers/acpi/arm64/mpam_v2.c -- 2.25.1

2 5

[PATCH v7 openEuler-22.03-LTS-SP2 0/4] support ACPI for MPAM 2.0
by Yu Liao 09 Jun '23

09 Jun '23

This patch series support ACPI for MPAM 2.0. v5: fix unused variable warning. v4: add PPTT null check to prevent NULL pointer deference. Erik Kaneda (1): ACPICA: ACPI 6.4: PPTT: add new version of subtable type 1 Hesham Almatary (1): ACPICA: Add support for Arm's MPAM ACPI table version 2 Yu Liao (2): ACPI / PPTT: Find PPTT processor node by cache id ACPI/MPAM: Adapt to Arm's MPAM ACPI table version 2 arch/arm64/kernel/mpam/mpam_device.c | 2 +- drivers/acpi/arm64/Makefile | 2 +- drivers/acpi/arm64/mpam.c | 23 +++- drivers/acpi/arm64/mpam_v2.c | 175 +++++++++++++++++++++++++++ drivers/acpi/pptt.c | 55 +++++++++ include/acpi/actbl2.h | 118 ++++++++++++++++++ include/linux/acpi.h | 5 + include/linux/arm_mpam.h | 2 +- 8 files changed, 374 insertions(+), 8 deletions(-) create mode 100644 drivers/acpi/arm64/mpam_v2.c -- 2.25.1

2 5

[PATCH v6 openEuler-22.03-LTS-SP2 0/4] support ACPI for MPAM 2.0
by Yu Liao 09 Jun '23

09 Jun '23

This patch series support ACPI for MPAM 2.0. v5: fix unused variable warning. v4: add PPTT null check to prevent NULL pointer deference. Erik Kaneda (1): ACPICA: ACPI 6.4: PPTT: add new version of subtable type 1 Hesham Almatary (1): ACPICA: Add support for Arm's MPAM ACPI table version 2 Yu Liao (2): ACPI / PPTT: Find PPTT processor node by cache id ACPI/MPAM: Adapt to Arm's MPAM ACPI table version 2 arch/arm64/kernel/mpam/mpam_device.c | 2 +- drivers/acpi/arm64/Makefile | 2 +- drivers/acpi/arm64/mpam.c | 23 +++- drivers/acpi/arm64/mpam_v2.c | 175 +++++++++++++++++++++++++++ drivers/acpi/pptt.c | 55 +++++++++ include/acpi/actbl2.h | 118 ++++++++++++++++++ include/linux/acpi.h | 5 + include/linux/arm_mpam.h | 2 +- 8 files changed, 374 insertions(+), 8 deletions(-) create mode 100644 drivers/acpi/arm64/mpam_v2.c -- 2.25.1

2 5

[PATCH v5 openEuler-22.03-LTS-SP2 0/4] ] support ACPI for MPAM 2.0
by Yu Liao 09 Jun '23

09 Jun '23

This patch series support ACPI for MPAM 2.0. v5: fix unused variable warning. v4: add PPTT null check to prevent NULL pointer deference. Erik Kaneda (1): ACPICA: ACPI 6.4: PPTT: add new version of subtable type 1 Hesham Almatary (1): ACPICA: Add support for Arm's MPAM ACPI table version 2 Yu Liao (2): ACPI / PPTT: Find PPTT processor node by cache id ACPI/MPAM: Adapt to Arm's MPAM ACPI table version 2 arch/arm64/kernel/mpam/mpam_device.c | 2 +- drivers/acpi/arm64/Makefile | 2 +- drivers/acpi/arm64/mpam.c | 23 +++- drivers/acpi/arm64/mpam_v2.c | 175 +++++++++++++++++++++++++++ drivers/acpi/pptt.c | 55 +++++++++ include/acpi/actbl2.h | 118 ++++++++++++++++++ include/linux/acpi.h | 5 + include/linux/arm_mpam.h | 2 +- 8 files changed, 374 insertions(+), 8 deletions(-) create mode 100644 drivers/acpi/arm64/mpam_v2.c -- 2.25.1

1 4

[PATCH openEuler-22.03-LTS-SP2 0/5] crypto: hisilicon - fix some reset problem
by Weili Qian 09 Jun '23

09 Jun '23

From: JiangShui Yang <yangjiangshui(a)h-partners.com> Fix some reset problem for accelerator drivers. Weili Qian (5): crypto: hisilicon/qm - flush all work before driver removed. crypto: hisilicon/hpre - enable sva error interrupt event crypto: hisilicon/qm - remove duplicate assignment and release crypto: hisilicon/qm - disable same error report before resetting crypto: hisilicon/qm - disable error report before flr drivers/crypto/hisilicon/hpre/hpre_main.c | 30 ++++- drivers/crypto/hisilicon/qm.c | 134 ++++++++++++++-------- drivers/crypto/hisilicon/sec2/sec_main.c | 24 +++- drivers/crypto/hisilicon/zip/zip_main.c | 24 +++- include/linux/hisi_acc_qm.h | 4 + 5 files changed, 157 insertions(+), 59 deletions(-) -- 2.30.0

1 5

[PATCH openEuler-22.03-LTS-SP1 0/6] Support dynamic_hugetlb on arm64 and fix some bug
by Liu Shixin 09 Jun '23

09 Jun '23

Support dynamic_hugetlb on arm64 and fix some bug. Liu Shixin (6): mm/dynamic_hugetlb: fix kabi broken when enable CONFIG_DYNAMIC_HUGETLB on arm64 mm/dynamic_hugetlb: support dynamic hugetlb on arm64 mm/dynamic_hugetlb: isolate hugepage without dissolve mm/dynamic_hugetlb: replace spin_lock with mutex_lock and fix kabi broken mm/dynamic_hugetlb: set PagePool to bad page mm/dynamic_hugetlb: fix type error of pfn in __hpool_split_gigantic_page() fs/Kconfig | 2 +- fs/hugetlbfs/inode.c | 2 +- include/linux/dynamic_hugetlb.h | 24 +++++++++++++-- include/linux/memcontrol.h | 6 +++- mm/dynamic_hugetlb.c | 54 +++++++++++++++++++++++++++------ mm/hugetlb.c | 7 +++++ 6 files changed, 80 insertions(+), 15 deletions(-) -- 2.25.1

2 7

Re: [PATCH openEuler-22.03-LTS-SP1 0/6] Support dynamic_hugetlb on arm64 and fix some bug
by Liu Shixin 09 Jun '23

09 Jun '23

On 2023/6/9 11:14, Kefeng Wang wrote: > 跟上一版本有啥区别第一个补丁上下文有差异，其他没差别 > > > On 2023/6/9 11:59, Liu Shixin wrote: >> Support dynamic_hugetlb on arm64 and fix some bug. >> >> Liu Shixin (6): >> mm/dynamic_hugetlb: fix kabi broken when enable CONFIG_DYNAMIC_HUGETLB >> on arm64 >> mm/dynamic_hugetlb: support dynamic hugetlb on arm64 >> mm/dynamic_hugetlb: isolate hugepage without dissolve >> mm/dynamic_hugetlb: replace spin_lock with mutex_lock and fix kabi >> broken >> mm/dynamic_hugetlb: set PagePool to bad page >> mm/dynamic_hugetlb: fix type error of pfn in >> __hpool_split_gigantic_page() >> >> fs/Kconfig | 2 +- >> fs/hugetlbfs/inode.c | 2 +- >> include/linux/dynamic_hugetlb.h | 24 +++++++++++++-- >> include/linux/memcontrol.h | 6 +++- >> mm/dynamic_hugetlb.c | 54 +++++++++++++++++++++++++++------ >> mm/hugetlb.c | 7 +++++ >> 6 files changed, 80 insertions(+), 15 deletions(-) >> > . >

1 0

[openEuler/rdma-core v4] libhns: Support user to choose using UD sl or pktype to adapt MPI APP
by Chengchang Tang 09 Jun '23

09 Jun '23

From: Junxian Huang <huangjunxian6(a)hisilicon.com> driver inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/rdma-core/issues/I7A5YM --------------------------------------------------------------- According to Annex17_RoCEv2 (A17.4.5.2), for RoCEv2 UD, a CQE should carry a flag that indicates if the received frame is an IPv4, IPv6 or RoCE packet. But currently, the values of the flag corresponding to these packet types haven't been defined yet in WC. In UCX, 'sl' in ibv_wc for UD is used as the packet type flag, and the packet type values have already been defined in the UCX patch of https://github.com/openucx/ucx/commit/ed28845b88633e65d64fce8ec880060aa61bd… Therefore, to adapt UCX, add a create flag to hnsdv_create_qp() to allow users to choose whether they use 'sl' in ibv_wc as service level or packet type for UD. For the latter, obtain and translate the packet type from CQE and fill it to 'sl' in ibv_wc. Signed-off-by: Junxian Huang <huangjunxian6(a)hisilicon.com> Signed-off-by: Haoyue Xu <xuhaoyue1(a)hisilicon.com> --- providers/hns/hns_roce_u.h | 11 +++++++++++ providers/hns/hns_roce_u_hw_v2.c | 32 +++++++++++++++++++++++++++++--- providers/hns/hns_roce_u_verbs.c | 16 ++++++++++++++++ providers/hns/hnsdv.h | 1 + 4 files changed, 57 insertions(+), 3 deletions(-) diff --git a/providers/hns/hns_roce_u.h b/providers/hns/hns_roce_u.h index 41e9599..e3012e1 100644 --- a/providers/hns/hns_roce_u.h +++ b/providers/hns/hns_roce_u.h @@ -195,6 +195,12 @@ enum hns_roce_tc_map_mode { HNS_ROCE_TC_MAP_MODE_DSCP, }; +enum hns_roce_pktype { + HNS_ROCE_PKTYPE_ROCE_V1, + HNS_ROCE_PKTYPE_ROCE_V2_IPV6, + HNS_ROCE_PKTYPE_ROCE_V2_IPV4, +}; + struct hns_roce_db_page { struct hns_roce_db_page *prev, *next; struct hns_roce_buf buf; @@ -406,6 +412,11 @@ struct hns_roce_qp { void *cur_wqe; unsigned int rb_sq_head; /* roll back sq head */ struct hns_roce_sge_info sge_info; + + /* Just for UD. If not enabled, 'sl' in ibv_wc + * will be filled with 'port_type' in cqe. + */ + bool enable_ud_sl; }; struct hns_roce_av { diff --git a/providers/hns/hns_roce_u_hw_v2.c b/providers/hns/hns_roce_u_hw_v2.c index 4b0ec5c..ee2fffe 100644 --- a/providers/hns/hns_roce_u_hw_v2.c +++ b/providers/hns/hns_roce_u_hw_v2.c @@ -522,9 +522,24 @@ static void handle_recv_rq_inl(struct hns_roce_v2_cqe *cqe, handle_recv_inl_data(cqe, &(cur_qp->rq_rinl_buf), wr_num, wqe_buf); } -static void parse_for_ud_qp(struct hns_roce_v2_cqe *cqe, struct ibv_wc *wc) +static const uint8_t pktype_for_ud[] = { + HNS_ROCE_PKTYPE_ROCE_V1, + HNS_ROCE_PKTYPE_ROCE_V2_IPV4, + HNS_ROCE_PKTYPE_ROCE_V2_IPV6 +}; + +static void parse_for_ud_qp(struct hns_roce_v2_cqe *cqe, struct ibv_wc *wc, + bool enable_ud_sl) { - wc->sl = hr_reg_read(cqe, CQE_SL); + uint8_t port_type; + + if (enable_ud_sl) { + wc->sl = hr_reg_read(cqe, CQE_SL); + } else { + port_type = hr_reg_read(cqe, CQE_PORT_TYPE); + wc->sl = pktype_for_ud[port_type]; + } + wc->src_qp = hr_reg_read(cqe, CQE_RMT_QPN); wc->slid = 0; wc->wc_flags |= hr_reg_read(cqe, CQE_GRH) ? IBV_WC_GRH : 0; @@ -554,7 +569,7 @@ static int parse_cqe_for_resp(struct hns_roce_v2_cqe *cqe, struct ibv_wc *wc, ++wq->tail; if (hr_qp->verbs_qp.qp.qp_type == IBV_QPT_UD) - parse_for_ud_qp(cqe, wc); + parse_for_ud_qp(cqe, wc, hr_qp->enable_ud_sl); if (hr_reg_read(cqe, CQE_CQE_INLINE)) handle_recv_cqe_inl_from_rq(cqe, hr_qp); @@ -2126,6 +2141,17 @@ static uint32_t wc_read_slid(struct ibv_cq_ex *current) static uint8_t wc_read_sl(struct ibv_cq_ex *current) { struct hns_roce_cq *cq = to_hr_cq(ibv_cq_ex_to_cq(current)); + struct hns_roce_context *ctx = to_hr_ctx(current->context); + struct hns_roce_qp *hr_qp; + uint8_t port_type; + uint32_t qpn; + + qpn = hr_reg_read(cq->cqe, CQE_LCL_QPN); + hr_qp = hns_roce_v2_find_qp(ctx, qpn); + if (hr_qp->verbs_qp.qp.qp_type == IBV_QPT_UD && !hr_qp->enable_ud_sl) { + port_type = hr_reg_read(cq->cqe, CQE_PORT_TYPE); + return pktype_for_ud[port_type]; + } return (uint8_t)hr_reg_read(cq->cqe, CQE_SL); } diff --git a/providers/hns/hns_roce_u_verbs.c b/providers/hns/hns_roce_u_verbs.c index fa27fc1..4b641ea 100644 --- a/providers/hns/hns_roce_u_verbs.c +++ b/providers/hns/hns_roce_u_verbs.c @@ -1019,6 +1019,11 @@ static int check_qp_congest_type(struct hns_roce_context *ctx, return 0; } +enum { + HNSDV_QP_SUP_CREATE_FLAGS = HNSDV_QP_CREATE_ENABLE_DCA_MODE | + HNSDV_QP_CREATE_ENABLE_UD_SL, +}; + static int check_hnsdv_qp_attr(struct hns_roce_context *ctx, struct hnsdv_qp_init_attr *hns_attr, struct hns_roce_cmd_flag *cmd_flag) @@ -1034,6 +1039,14 @@ static int check_hnsdv_qp_attr(struct hns_roce_context *ctx, return -EINVAL; } + if (hns_attr->comp_mask & HNSDV_QP_INIT_ATTR_MASK_QP_CREATE_FLAGS && + !check_comp_mask(hns_attr->create_flags, + HNSDV_QP_SUP_CREATE_FLAGS)) { + verbs_err(&ctx->ibv_ctx, "invalid create_flags 0x%x.\n", + hns_attr->create_flags); + return -EOPNOTSUPP; + } + ret = check_qp_congest_type(ctx, hns_attr, cmd_flag); if (ret) return ret; @@ -1685,6 +1698,9 @@ static struct ibv_qp *create_qp(struct ibv_context *ibv_ctx, qp_setup_config(attr, qp, context); + if (hns_attr && hns_attr->create_flags & HNSDV_QP_CREATE_ENABLE_UD_SL) + qp->enable_ud_sl = true; + return &qp->verbs_qp.qp; err_dwqe: diff --git a/providers/hns/hnsdv.h b/providers/hns/hnsdv.h index e15b428..365c314 100644 --- a/providers/hns/hnsdv.h +++ b/providers/hns/hnsdv.h @@ -43,6 +43,7 @@ struct ibv_context *hnsdv_open_device(struct ibv_device *device, enum hnsdv_qp_create_flags { HNSDV_QP_CREATE_ENABLE_DCA_MODE = 1 << 0, + HNSDV_QP_CREATE_ENABLE_UD_SL = 1 << 1, }; enum hnsdv_qp_congest_ctrl_type { -- 2.30.0

1 0

[PATCH v4 openEuler-22.03-LTS-SP2 0/4] support ACPI for MPAM 2.0
by Yu Liao 09 Jun '23

09 Jun '23

This patch series support ACPI for MPAM 2.0. v4: add PPTT null check to prevent NULL pointer deference. Erik Kaneda (1): ACPICA: ACPI 6.4: PPTT: add new version of subtable type 1 Hesham Almatary (1): ACPICA: Add support for Arm's MPAM ACPI table version 2 Yu Liao (2): ACPI / PPTT: Find PPTT processor node by cache id ACPI/MPAM: Adapt to Arm's MPAM ACPI table version 2 arch/arm64/kernel/mpam/mpam_device.c | 2 +- drivers/acpi/arm64/Makefile | 2 +- drivers/acpi/arm64/mpam.c | 19 ++- drivers/acpi/arm64/mpam_v2.c | 181 +++++++++++++++++++++++++++ drivers/acpi/pptt.c | 55 ++++++++ include/acpi/actbl2.h | 118 +++++++++++++++++ include/linux/acpi.h | 5 + include/linux/arm_mpam.h | 2 +- 8 files changed, 378 insertions(+), 6 deletions(-) create mode 100644 drivers/acpi/arm64/mpam_v2.c -- 2.25.1

2 5

[PATCH openEuler-22.03-LTS 0/6] Support dynamic_hugetlb on arm64 and fix some bug
by Liu Shixin 09 Jun '23

09 Jun '23

Support dynamic_hugetlb on arm64 and fix some bug. Liu Shixin (6): mm/dynamic_hugetlb: fix kabi broken when enable CONFIG_DYNAMIC_HUGETLB on arm64 mm/dynamic_hugetlb: support dynamic hugetlb on arm64 mm/dynamic_hugetlb: isolate hugepage without dissolve mm/dynamic_hugetlb: replace spin_lock with mutex_lock and fix kabi broken mm/dynamic_hugetlb: set PagePool to bad page mm/dynamic_hugetlb: fix type error of pfn in __hpool_split_gigantic_page() fs/Kconfig | 2 +- fs/hugetlbfs/inode.c | 2 +- include/linux/dynamic_hugetlb.h | 24 +++++++++++++-- include/linux/memcontrol.h | 6 +++- mm/dynamic_hugetlb.c | 54 +++++++++++++++++++++++++++------ mm/hugetlb.c | 7 +++++ 6 files changed, 80 insertions(+), 15 deletions(-) -- 2.25.1

2 7

[PATCH v3 openEuler-22.03-LTS-SP2 0/4] support ACPI for MPAM 2.0
by Yu Liao 08 Jun '23

08 Jun '23

This patch series support ACPI for MPAM 2.0. Erik Kaneda (1): ACPICA: ACPI 6.4: PPTT: add new version of subtable type 1 Hesham Almatary (1): ACPICA: Add support for Arm's MPAM ACPI table version 2 Yu Liao (2): ACPI / PPTT: Find PPTT processor node by cache id ACPI/MPAM: Adapt to Arm's MPAM ACPI table version 2 arch/arm64/kernel/mpam/mpam_device.c | 2 +- drivers/acpi/arm64/Makefile | 2 +- drivers/acpi/arm64/mpam.c | 19 ++- drivers/acpi/arm64/mpam_v2.c | 176 +++++++++++++++++++++++++++ drivers/acpi/pptt.c | 55 +++++++++ include/acpi/actbl2.h | 118 ++++++++++++++++++ include/linux/acpi.h | 5 + include/linux/arm_mpam.h | 2 +- 8 files changed, 373 insertions(+), 6 deletions(-) create mode 100644 drivers/acpi/arm64/mpam_v2.c -- 2.25.1

3 9

[PATCH v4 openEuler-22.03-LTS-SP2 0/4] support ACPI for MPAM 2.0
by Yu Liao 08 Jun '23

08 Jun '23

This patch series support ACPI for MPAM 2.0. Erik Kaneda (1): ACPICA: ACPI 6.4: PPTT: add new version of subtable type 1 Hesham Almatary (1): ACPICA: Add support for Arm's MPAM ACPI table version 2 Yu Liao (2): ACPI / PPTT: Find PPTT processor node by cache id ACPI/MPAM: Adapt to Arm's MPAM ACPI table version 2 arch/arm64/kernel/mpam/mpam_device.c | 2 +- drivers/acpi/arm64/Makefile | 2 +- drivers/acpi/arm64/mpam.c | 19 ++- drivers/acpi/arm64/mpam_v2.c | 176 +++++++++++++++++++++++++++ drivers/acpi/pptt.c | 55 +++++++++ include/acpi/actbl2.h | 118 ++++++++++++++++++ include/linux/acpi.h | 5 + include/linux/arm_mpam.h | 2 +- 8 files changed, 373 insertions(+), 6 deletions(-) create mode 100644 drivers/acpi/arm64/mpam_v2.c -- 2.25.1

2 5

[PATCH openEuler-1.0-LTS 01/21] udp: Call inet6_destroy_sock() in setsockopt(IPV6_ADDRFORM).
by Yongqiang Liu 08 Jun '23

08 Jun '23

From: Kuniyuki Iwashima <kuniyu(a)amazon.com> stable inclusion from stable-v4.19.282 commit 9577d9f0fbf1eea95f61b02627572c401499aa32 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7BZ5U CVE: NA -------------------------------- commit 21985f43376cee092702d6cb963ff97a9d2ede68 upstream. Commit 4b340ae20d0e ("IPv6: Complete IPV6_DONTFRAG support") forgot to add a change to free inet6_sk(sk)->rxpmtu while converting an IPv6 socket into IPv4 with IPV6_ADDRFORM. After conversion, sk_prot is changed to udp_prot and ->destroy() never cleans it up, resulting in a memory leak. This is due to the discrepancy between inet6_destroy_sock() and IPV6_ADDRFORM, so let's call inet6_destroy_sock() from IPV6_ADDRFORM to remove the difference. However, this is not enough for now because rxpmtu can be changed without lock_sock() after commit 03485f2adcde ("udpv6: Add lockless sendmsg() support"). We will fix this case in the following patch. Note we will rename inet6_destroy_sock() to inet6_cleanup_sock() and remove unnecessary inet6_destroy_sock() calls in sk_prot->destroy() in the future. Fixes: 4b340ae20d0e ("IPv6: Complete IPV6_DONTFRAG support") Signed-off-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- include/net/ipv6.h | 1 + net/ipv6/af_inet6.c | 6 ++++++ net/ipv6/ipv6_sockglue.c | 20 ++++++++------------ 3 files changed, 15 insertions(+), 12 deletions(-) diff --git a/include/net/ipv6.h b/include/net/ipv6.h index 4c2e40882e88..f33be9653aaa 100644 --- a/include/net/ipv6.h +++ b/include/net/ipv6.h @@ -1040,6 +1040,7 @@ void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err, __be16 port, void ipv6_local_error(struct sock *sk, int err, struct flowi6 *fl6, u32 info); void ipv6_local_rxpmtu(struct sock *sk, struct flowi6 *fl6, u32 mtu); +void inet6_cleanup_sock(struct sock *sk); int inet6_release(struct socket *sock); int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len); int inet6_getname(struct socket *sock, struct sockaddr *uaddr, diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c index a6be1ad6994a..d285db413ceb 100644 --- a/net/ipv6/af_inet6.c +++ b/net/ipv6/af_inet6.c @@ -505,6 +505,12 @@ void inet6_destroy_sock(struct sock *sk) } EXPORT_SYMBOL_GPL(inet6_destroy_sock); +void inet6_cleanup_sock(struct sock *sk) +{ + inet6_destroy_sock(sk); +} +EXPORT_SYMBOL_GPL(inet6_cleanup_sock); + /* * This does both peername and sockname. */ diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index dccbc71d7f8e..441febd19674 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -180,9 +180,6 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, if (optlen < sizeof(int)) goto e_inval; if (val == PF_INET) { - struct ipv6_txoptions *opt; - struct sk_buff *pktopt; - if (sk->sk_type == SOCK_RAW) break; @@ -213,7 +210,6 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, break; } - fl6_free_socklist(sk); __ipv6_sock_mc_close(sk); __ipv6_sock_ac_close(sk); @@ -251,14 +247,14 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, sk->sk_socket->ops = &inet_dgram_ops; sk->sk_family = PF_INET; } - opt = xchg((__force struct ipv6_txoptions **)&np->opt, - NULL); - if (opt) { - atomic_sub(opt->tot_len, &sk->sk_omem_alloc); - txopt_put(opt); - } - pktopt = xchg(&np->pktoptions, NULL); - kfree_skb(pktopt); + + /* Disable all options not to allocate memory anymore, + * but there is still a race. See the lockless path + * in udpv6_sendmsg() and ipv6_local_rxpmtu(). + */ + np->rxopt.all = 0; + + inet6_cleanup_sock(sk); /* * ... and add it to the refcnt debug socks count -- 2.25.1

1 20

[PATCH openEuler-22.03-LTS-SP2] perf: hisi: delete global enable pmu from xxx_write_counter()
by Junhao He 08 Jun '23

08 Jun '23

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7C2U9 CVE: NA ---------------------------------------------------------------------- UC PMU global enable register be setup in pmu callback pmu::enable(), which also be wiil setup in pmu::start()->xxx_write_counter(). And it will start statistical information when callback pmu:start() return, not is pmu:enable() return. Therefore the driver counter counts more data than normal. Fixes: 5ed05cb ("drivers/perf: hisi: Add support for HiSilicon UC PMU driver") Signed-off-by: Junhao He <hejunhao3(a)huawei.com> --- drivers/perf/hisilicon/hisi_uncore_uc_pmu.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c b/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c index b7b7d3d9d8be..ff9c63f66abc 100644 --- a/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c +++ b/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c @@ -292,7 +292,6 @@ static u64 hisi_uc_pmu_read_counter(struct hisi_pmu *uc_pmu, static void hisi_uc_pmu_write_counter(struct hisi_pmu *uc_pmu, struct hw_perf_event *hwc, u64 val) { - hisi_uc_pmu_start_counters(uc_pmu); writeq(val, uc_pmu->base + HISI_UC_CNTR_REG(hwc->idx)); } -- 2.33.0

2 1

[PATCH openEuler-22.03-LTS-SP2] xfrm: Reinject transport-mode packets through workqueue
by Liu Jian 08 Jun '23

08 Jun '23

mainline inclusion from mainline-v6.1-rc1 commit 4f4920669d21e1060b7243e5118dc3b71ced1276 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5K0NK CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The following warning is displayed when the tcp6-multi-diffip11 stress test case of the LTP test suite is tested: watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [ns-tcpserver:48198] CPU: 0 PID: 48198 Comm: ns-tcpserver Kdump: loaded Not tainted 6.0.0-rc6+ #39 Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : des3_ede_encrypt+0x27c/0x460 [libdes] lr : 0x3f sp : ffff80000ceaa1b0 x29: ffff80000ceaa1b0 x28: ffff0000df056100 x27: ffff0000e51e5280 x26: ffff80004df75030 x25: ffff0000e51e4600 x24: 000000000000003b x23: 0000000000802080 x22: 000000000000003d x21: 0000000000000038 x20: 0000000080000020 x19: 000000000000000a x18: 0000000000000033 x17: ffff0000e51e4780 x16: ffff80004e2d1448 x15: ffff80004e2d1248 x14: ffff0000e51e4680 x13: ffff80004e2d1348 x12: ffff80004e2d1548 x11: ffff80004e2d1848 x10: ffff80004e2d1648 x9 : ffff80004e2d1748 x8 : ffff80004e2d1948 x7 : 000000000bcaf83d x6 : 000000000000001b x5 : ffff80004e2d1048 x4 : 00000000761bf3bf x3 : 000000007f1dd0a3 x2 : ffff0000e51e4780 x1 : ffff0000e3b9a2f8 x0 : 00000000db44e872 Call trace: des3_ede_encrypt+0x27c/0x460 [libdes] crypto_des3_ede_encrypt+0x1c/0x30 [des_generic] crypto_cbc_encrypt+0x148/0x190 crypto_skcipher_encrypt+0x2c/0x40 crypto_authenc_encrypt+0xc8/0xfc [authenc] crypto_aead_encrypt+0x2c/0x40 echainiv_encrypt+0x144/0x1a0 [echainiv] crypto_aead_encrypt+0x2c/0x40 esp6_output_tail+0x1c8/0x5d0 [esp6] esp6_output+0x120/0x278 [esp6] xfrm_output_one+0x458/0x4ec xfrm_output_resume+0x6c/0x1f0 xfrm_output+0xac/0x4ac __xfrm6_output+0x130/0x270 xfrm6_output+0x60/0xec ip6_xmit+0x2ec/0x5bc inet6_csk_xmit+0xbc/0x10c __tcp_transmit_skb+0x460/0x8c0 tcp_write_xmit+0x348/0x890 __tcp_push_pending_frames+0x44/0x110 tcp_rcv_established+0x3c8/0x720 tcp_v6_do_rcv+0xdc/0x4a0 tcp_v6_rcv+0xc24/0xcb0 ip6_protocol_deliver_rcu+0xf0/0x574 ip6_input_finish+0x48/0x7c ip6_input+0x48/0xc0 ip6_rcv_finish+0x80/0x9c xfrm_trans_reinject+0xb0/0xf4 tasklet_action_common.constprop.0+0xf8/0x134 tasklet_action+0x30/0x3c __do_softirq+0x128/0x368 do_softirq+0xb4/0xc0 __local_bh_enable_ip+0xb0/0xb4 put_cpu_fpsimd_context+0x40/0x70 kernel_neon_end+0x20/0x40 sha1_base_do_update.constprop.0.isra.0+0x11c/0x140 [sha1_ce] sha1_ce_finup+0x94/0x110 [sha1_ce] crypto_shash_finup+0x34/0xc0 hmac_finup+0x48/0xe0 crypto_shash_finup+0x34/0xc0 shash_digest_unaligned+0x74/0x90 crypto_shash_digest+0x4c/0x9c shash_ahash_digest+0xc8/0xf0 shash_async_digest+0x28/0x34 crypto_ahash_digest+0x48/0xcc crypto_authenc_genicv+0x88/0xcc [authenc] crypto_authenc_encrypt+0xd8/0xfc [authenc] crypto_aead_encrypt+0x2c/0x40 echainiv_encrypt+0x144/0x1a0 [echainiv] crypto_aead_encrypt+0x2c/0x40 esp6_output_tail+0x1c8/0x5d0 [esp6] esp6_output+0x120/0x278 [esp6] xfrm_output_one+0x458/0x4ec xfrm_output_resume+0x6c/0x1f0 xfrm_output+0xac/0x4ac __xfrm6_output+0x130/0x270 xfrm6_output+0x60/0xec ip6_xmit+0x2ec/0x5bc inet6_csk_xmit+0xbc/0x10c __tcp_transmit_skb+0x460/0x8c0 tcp_write_xmit+0x348/0x890 __tcp_push_pending_frames+0x44/0x110 tcp_push+0xb4/0x14c tcp_sendmsg_locked+0x71c/0xb64 tcp_sendmsg+0x40/0x6c inet6_sendmsg+0x4c/0x80 sock_sendmsg+0x5c/0x6c __sys_sendto+0x128/0x15c __arm64_sys_sendto+0x30/0x40 invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0x170/0x194 do_el0_svc+0x38/0x4c el0_svc+0x28/0xe0 el0t_64_sync_handler+0xbc/0x13c el0t_64_sync+0x180/0x184 Get softirq info by bcc tool: ./softirqs -NT 10 Tracing soft irq event time... Hit Ctrl-C to end. 15:34:34 SOFTIRQ TOTAL_nsecs block 158990 timer 20030920 sched 46577080 net_rx 676746820 tasklet 9906067650 15:34:45 SOFTIRQ TOTAL_nsecs block 86100 sched 38849790 net_rx 676532470 timer 1163848790 tasklet 9409019620 15:34:55 SOFTIRQ TOTAL_nsecs sched 58078450 net_rx 475156720 timer 533832410 tasklet 9431333300 The tasklet software interrupt takes too much time. Therefore, the xfrm_trans_reinject executor is changed from tasklet to workqueue. Add add spin lock to protect the queue. This reduces the processing flow of the tcp_sendmsg function in this scenario. Fixes: acf568ee859f0 ("xfrm: Reinject transport-mode packets through tasklet") Signed-off-by: Liu Jian <liujian56(a)huawei.com> Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com> Conflicts: net/xfrm/xfrm_input.c Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/xfrm/xfrm_input.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c index 77e82033ad70..90af125aa770 100644 --- a/net/xfrm/xfrm_input.c +++ b/net/xfrm/xfrm_input.c @@ -24,7 +24,8 @@ #include "xfrm_inout.h" struct xfrm_trans_tasklet { - struct tasklet_struct tasklet; + struct work_struct work; + spinlock_t queue_lock; struct sk_buff_head queue; }; @@ -760,18 +761,22 @@ int xfrm_input_resume(struct sk_buff *skb, int nexthdr) } EXPORT_SYMBOL(xfrm_input_resume); -static void xfrm_trans_reinject(unsigned long data) +static void xfrm_trans_reinject(struct work_struct *work) { - struct xfrm_trans_tasklet *trans = (void *)data; + struct xfrm_trans_tasklet *trans = container_of(work, struct xfrm_trans_tasklet, work); struct sk_buff_head queue; struct sk_buff *skb; __skb_queue_head_init(&queue); + spin_lock_bh(&trans->queue_lock); skb_queue_splice_init(&trans->queue, &queue); + spin_unlock_bh(&trans->queue_lock); + local_bh_disable(); while ((skb = __skb_dequeue(&queue))) XFRM_TRANS_SKB_CB(skb)->finish(XFRM_TRANS_SKB_CB(skb)->net, NULL, skb); + local_bh_enable(); } int xfrm_trans_queue_net(struct net *net, struct sk_buff *skb, @@ -789,8 +794,10 @@ int xfrm_trans_queue_net(struct net *net, struct sk_buff *skb, XFRM_TRANS_SKB_CB(skb)->finish = finish; XFRM_TRANS_SKB_CB(skb)->net = net; + spin_lock_bh(&trans->queue_lock); __skb_queue_tail(&trans->queue, skb); - tasklet_schedule(&trans->tasklet); + spin_unlock_bh(&trans->queue_lock); + schedule_work(&trans->work); return 0; } EXPORT_SYMBOL(xfrm_trans_queue_net); @@ -817,8 +824,8 @@ void __init xfrm_input_init(void) struct xfrm_trans_tasklet *trans; trans = &per_cpu(xfrm_trans_tasklet, i); + spin_lock_init(&trans->queue_lock); __skb_queue_head_init(&trans->queue); - tasklet_init(&trans->tasklet, xfrm_trans_reinject, - (unsigned long)trans); + INIT_WORK(&trans->work, xfrm_trans_reinject); } } -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS 1/2] of: overlay: fix for_each_child.cocci warnings
by Yongqiang Liu 08 Jun '23

08 Jun '23

From: kernel test robot <lkp(a)intel.com> mainline inclusion from mainline-v5.13-rc1 commit c4d74f0f978ed5ceee62cd3f6708081042e582a1 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I73DDA CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------ Function "for_each_child_of_node" should have of_node_put() before goto. Generated by: scripts/coccinelle/iterators/for_each_child.cocci Fixes: 82c2d81361ec ("coccinelle: iterators: Add for_each_child.cocci script") CC: Sumera Priyadarsini <sylphrenadin(a)gmail.com> Reported-by: kernel test robot <lkp(a)intel.com> Signed-off-by: kernel test robot <lkp(a)intel.com> Signed-off-by: Julia Lawall <julia.lawall(a)inria.fr> Reviewed-by: Frank Rowand <frank.rowand(a)sony.com> Tested-by: Frank Rowand <frank.rowand(a)sony.com> Link: https://lore.kernel.org/r/alpine.DEB.2.22.394.2103221918450.2918@hadrien Signed-off-by: Rob Herring <robh(a)kernel.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> Reviewed-by: xuqiang <xuqiang36(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/of/overlay.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c index a77bfeac867d..b0a765fcef2f 100644 --- a/drivers/of/overlay.c +++ b/drivers/of/overlay.c @@ -713,6 +713,7 @@ static int init_overlay_changeset(struct overlay_changeset *ovcs, if (!fragment->target) { of_node_put(fragment->overlay); ret = -EINVAL; + of_node_put(node); goto err_free_fragments; } -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/2] fs: hfsplus: fix UAF issue in hfsplus_put_super
by Yongqiang Liu 08 Jun '23

08 Jun '23

From: Dongliang Mu <mudongliangabcd(a)gmail.com> stable inclusion from stable-v4.19.273 commit e226f1fdcee1ca6e68233b132718deb578a84e38 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I79LIO CVE: CVE-2023-2985 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 07db5e247ab5858439b14dd7cc1fe538b9efcf32 upstream. The current hfsplus_put_super first calls hfs_btree_close on sbi->ext_tree, then invokes iput on sbi->hidden_dir, resulting in an use-after-free issue in hfsplus_release_folio. As shown in hfsplus_fill_super, the error handling code also calls iput before hfs_btree_close. To fix this error, we move all iput calls before hfsplus_btree_close. Note that this patch is tested on Syzbot. Link: https://lkml.kernel.org/r/20230226124948.3175736-1-mudongliangabcd@gmail.com Reported-by: syzbot+57e3e98f7e3b80f64d56(a)syzkaller.appspotmail.com Tested-by: Dongliang Mu <mudongliangabcd(a)gmail.com> Signed-off-by: Dongliang Mu <mudongliangabcd(a)gmail.com> Cc: Bart Van Assche <bvanassche(a)acm.org> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: Muchun Song <songmuchun(a)bytedance.com> Cc: Roman Gushchin <roman.gushchin(a)linux.dev> Cc: "Theodore Ts'o" <tytso(a)mit.edu> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/hfsplus/super.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c index eb4535eba95d..3b1356b10a47 100644 --- a/fs/hfsplus/super.c +++ b/fs/hfsplus/super.c @@ -294,11 +294,11 @@ static void hfsplus_put_super(struct super_block *sb) hfsplus_sync_fs(sb, 1); } + iput(sbi->alloc_file); + iput(sbi->hidden_dir); hfs_btree_close(sbi->attr_tree); hfs_btree_close(sbi->cat_tree); hfs_btree_close(sbi->ext_tree); - iput(sbi->alloc_file); - iput(sbi->hidden_dir); kfree(sbi->s_vhdr_buf); kfree(sbi->s_backup_vhdr_buf); unload_nls(sbi->nls); -- 2.25.1

1 1

[PATCH openEuler-22.03-LTS-SP2 00/35] xfs: fixes patchs and backport patchs
by Long Li 08 Jun '23

08 Jun '23

Allison Henderson (1): xfs: increase rename inode reservation ChenXiaoSong (1): xfs: fix NULL pointer dereference in xfs_getbmap() Darrick J. Wong (6): xfs: check return codes when flushing block devices xfs: fix maxlevels comparisons in the btree staging code xfs: shut down filesystem if we xfs_trans_cancel with deferred work items xfs: don't expose internal symlink metadata buffers to the vfs xfs: fix negative array access in xfs_getbmap iomap: iomap: fix memory corruption when recording errors during writeback Dave Chinner (13): xfs: remove xfs_blkdev_issue_flush xfs: AIL should be log centric xfs: shutdown in intent recovery has non-intent items in the AIL xfs: log shutdown triggers should only shut down the log xfs: xfs_do_force_shutdown needs to block racing shutdowns xfs: xfs_trans_commit() path must check for log shutdown xfs: shutdown during log recovery needs to mark the log shutdown xfs: remove XFS_PREALLOC_SYNC xfs: fallocate() should call file_modified() xfs: sb verifier doesn't handle uncached sb buffer xfs: write page faults in iomap are not buffered writes iomap: write iomap validity checks xfs: use iomap_valid method to detect stale cached iomaps Gao Xiang (1): xfs: account extra freespace btree splits for multiple allocations Guo Xuenan (3): Revert "[Huawei] xfs: fix uaf when leaf dir bestcount not match with dir data blocks" xfs: fix exception caused by unexpected illegal bestcount in leaf dir xfs: force shutdown xfs when xfs_attr_inactive fails Long Li (4): xfs: fix ag count overflow during growfs xfs: fix hung when transaction commit fail in xfs_inactive_ifree xfs: fix a UAF when inode item push xfs: fix a UAF in xfs_iflush_abort_clean Shida Zhang (1): xfs: trim the mapp array accordingly in xfs_da_grow_inode_int Wu Guanghao (1): xfs: fix the problem of mount failure caused by not refreshing mp->m_sb Ye Bin (2): xfs: fix BUG_ON in xfs_getbmap() xfs: fix dead loop when do mount with IO fault injection Zhang Yi (2): xfs: factor out __xfs_da3_node_read() xfs: atomic drop extent entries when inactiving attr fs/iomap/apply.c | 14 +++- fs/iomap/buffered-io.c | 29 ++++++++- fs/xfs/libxfs/xfs_alloc.c | 9 ++- fs/xfs/libxfs/xfs_alloc.h | 1 + fs/xfs/libxfs/xfs_bmap.c | 7 +- fs/xfs/libxfs/xfs_btree_staging.c | 4 +- fs/xfs/libxfs/xfs_da_btree.c | 7 +- fs/xfs/libxfs/xfs_da_btree.h | 15 ++++- fs/xfs/libxfs/xfs_dir2_leaf.c | 21 ++---- fs/xfs/libxfs/xfs_ialloc.c | 1 + fs/xfs/libxfs/xfs_sb.c | 2 +- fs/xfs/libxfs/xfs_trans_resv.c | 4 +- fs/xfs/xfs_aops.c | 2 +- fs/xfs/xfs_attr_inactive.c | 66 ++++++++++++++----- fs/xfs/xfs_bmap_util.c | 34 +++++----- fs/xfs/xfs_buf.c | 7 +- fs/xfs/xfs_buf.h | 7 +- fs/xfs/xfs_buf_item.c | 20 ++++++ fs/xfs/xfs_buf_item_recover.c | 24 +++++++ fs/xfs/xfs_file.c | 49 ++++++++------ fs/xfs/xfs_fsops.c | 9 ++- fs/xfs/xfs_inode.c | 5 +- fs/xfs/xfs_inode_item.c | 11 +++- fs/xfs/xfs_iomap.c | 105 ++++++++++++++++++++++++------ fs/xfs/xfs_iomap.h | 7 +- fs/xfs/xfs_iops.c | 34 +--------- fs/xfs/xfs_log.c | 68 +++++++++++++------ fs/xfs/xfs_log_cil.c | 4 +- fs/xfs/xfs_log_priv.h | 11 ++++ fs/xfs/xfs_log_recover.c | 56 ++++++---------- fs/xfs/xfs_mount.c | 1 + fs/xfs/xfs_pnfs.c | 12 ++-- fs/xfs/xfs_super.c | 7 -- fs/xfs/xfs_super.h | 1 - fs/xfs/xfs_symlink.c | 27 +++++--- fs/xfs/xfs_trans.c | 61 ++++++++++++----- fs/xfs/xfs_trans_ail.c | 30 ++++----- fs/xfs/xfs_trans_priv.h | 3 +- include/linux/iomap.h | 39 +++++++++-- 39 files changed, 549 insertions(+), 265 deletions(-) -- 2.31.1

2 36

[PATCH OLK-5.10 0/5] A set of patch for uploading openEuler
by Yihang Li 08 Jun '23

08 Jun '23

From: xiabing <xiabing12(a)h-partners.com> Arnd Bergmann (1): scsi: hisi_sas: Work around build failure in suspend function Qi Liu (1): scsi: hisi_sas: Add slave_destroy interface for v3 hw Xiang Chen (1): scsi: sd: try more retries of START_STOP when resuming scsi device Yihang Li (2): scsi: hisi_sas: Block requests before take debugfs snapshot scsi: hisi_sas: Check usage count only when the runtime PM status is RPM_SUSPENDING drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 31 +++++++++++++++++++++----- drivers/scsi/sd.c | 24 +++++++++++++++----- 2 files changed, 43 insertions(+), 12 deletions(-) -- 2.30.0

2 6

[PATCH openEuler-22.03-LTS 0/4] io_uring: fix the problem of
by Li Lingfeng 08 Jun '23

08 Jun '23

patch1: arch: setup PF_IO_WORKER threads like PF_KTHREAD pre patch of patch4 patch2: arch: ensure parisc/powerpc handle PF_IO_WORKER in copy_thread() fix patch of patch1 patch3: kernel: don't call do_exit() for PF_IO_WORKER threads fix the segfault patch4: x86/process: setup io_threads more like normal user space threads allow io worker to exit Jens Axboe (3): arch: setup PF_IO_WORKER threads like PF_KTHREAD arch: ensure parisc/powerpc handle PF_IO_WORKER in copy_thread() kernel: don't call do_exit() for PF_IO_WORKER threads Stefan Metzmacher (1): x86/process: setup io_threads more like normal user space threads arch/alpha/kernel/process.c | 2 +- arch/arc/kernel/process.c | 2 +- arch/arm/kernel/process.c | 2 +- arch/arm64/kernel/process.c | 2 +- arch/csky/kernel/process.c | 2 +- arch/h8300/kernel/process.c | 2 +- arch/hexagon/kernel/process.c | 2 +- arch/ia64/kernel/process.c | 2 +- arch/m68k/kernel/process.c | 2 +- arch/microblaze/kernel/process.c | 2 +- arch/mips/kernel/process.c | 2 +- arch/nds32/kernel/process.c | 2 +- arch/nios2/kernel/process.c | 2 +- arch/openrisc/kernel/process.c | 2 +- arch/parisc/kernel/process.c | 2 +- arch/powerpc/kernel/process.c | 2 +- arch/riscv/kernel/process.c | 2 +- arch/s390/kernel/process.c | 2 +- arch/sh/kernel/process_32.c | 2 +- arch/sparc/kernel/process_32.c | 2 +- arch/sparc/kernel/process_64.c | 2 +- arch/um/kernel/process.c | 2 +- arch/x86/kernel/process.c | 17 +++++++++++++++++ arch/xtensa/kernel/process.c | 2 +- kernel/signal.c | 10 +++++++++- 25 files changed, 49 insertions(+), 24 deletions(-) -- 2.31.1

2 5

[PATCH openEuler-22.03-LTS v2] nbd: get config_lock before sock_shutdown
by Zhong Jinghua 08 Jun '23

08 Jun '23

From: Zhong Jinghua <zhongjinghua(a)huaweicloud.com> Offering: HULK hulk inclusion category: bugfix bugzilla: 188799, https://gitee.com/openeuler/kernel/issues/I79QWO CVE: NA ---------------------------------------- Config->socks in sock_shutdown may trigger a UAF problem. The reason is that sock_shutdown does not hold the config_lock, so that nbd_ioctl can release config->socks at this time. T0: NBD_SET_SOCK T1: NBD_DO_IT T0 T1 nbd_ioctl mutex_lock(&nbd->config_lock) // get lock __nbd_ioctl nbd_start_device_ioctl nbd_start_device mutex_unlock(&nbd->config_lock) // relase lock wait_event_interruptible (kill, enter sock_shutdown) sock_shutdown nbd_ioctl mutex_lock(&nbd->config_lock) // get lock __nbd_ioctl nbd_add_socket krealloc kfree(p) //config->socks is NULL nbd_sock *nsock = config->socks // error Fix it by moving config_lock up before sock_shutdown. Signed-off-by: Zhong Jinghua <zhongjinghua(a)huawei.com> --- v2: adapt drivers/block/nbd.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index ebcdb6025be3..ba98fdaaa35a 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -1406,11 +1406,16 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd, struct block_device *b mutex_unlock(&nbd->config_lock); ret = wait_event_interruptible(config->recv_wq, atomic_read(&config->recv_threads) == 0); + + /* + * recv_work in flush_workqueue will not get this lock, because nbd_open + * will hold nbd->config_refs + */ + mutex_lock(&nbd->config_lock); if (ret) sock_shutdown(nbd); flush_workqueue(nbd->recv_workq); - mutex_lock(&nbd->config_lock); nbd_bdev_reset(bdev); /* user requested, ignore socket errors */ if (test_bit(NBD_RT_DISCONNECT_REQUESTED, &config->runtime_flags)) -- 2.31.1

2 1

[PATCH v3 OLK-5.10 0/4] support ACPI for MPAM 2.0
by Yu Liao 08 Jun '23

08 Jun '23

This patch series support ACPI for MPAM 2.0. Erik Kaneda (1): ACPICA: ACPI 6.4: PPTT: add new version of subtable type 1 Hesham Almatary (1): ACPICA: Add support for Arm's MPAM ACPI table version 2 Yu Liao (2): ACPI / PPTT: Find PPTT processor node by cache id ACPI/MPAM: Adapt to Arm's MPAM ACPI table version 2 arch/arm64/kernel/mpam/mpam_device.c | 2 +- drivers/acpi/arm64/Makefile | 2 +- drivers/acpi/arm64/mpam.c | 19 ++- drivers/acpi/arm64/mpam_v2.c | 176 +++++++++++++++++++++++++++ drivers/acpi/pptt.c | 55 +++++++++ include/acpi/actbl2.h | 118 ++++++++++++++++++ include/linux/acpi.h | 5 + include/linux/arm_mpam.h | 2 +- 8 files changed, 373 insertions(+), 6 deletions(-) create mode 100644 drivers/acpi/arm64/mpam_v2.c -- 2.25.1

2 5