- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 0/2] Balance initial LPI affinity across CPUs
by Zhang Changzhong 05 Jun '23

05 Jun '23

Marc Zyngier (2): irqchip/gic-v3-its: Track LPI distribution on a per CPU basis irqchip/gic-v3-its: Balance initial LPI affinity across CPUs drivers/irqchip/irq-gic-v3-its.c | 173 ++++++++++++++++++++++++++++++++------- 1 file changed, 145 insertions(+), 28 deletions(-) -- 2.9.5

1 2

[PATCH OLK-5.10] ipv6: Add lwtunnel encap size of all siblings in nexthop calculation
by Lu Wei 05 Jun '23

05 Jun '23

stable inclusion from stable-v5.10.173 commit da26369377f0b671c14692e2d65ceb38131053e1 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6GT9T Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4cc59f386991ec9374cb4bc83dbe1c0b5a95033f ] In function rt6_nlmsg_size(), the length of nexthop is calculated by multipling the nexthop length of fib6_info and the number of siblings. However if the fib6_info has no lwtunnel but the siblings have lwtunnels, the nexthop length is less than it should be, and it will trigger a warning in inet6_rt_notify() as follows: WARNING: CPU: 0 PID: 6082 at net/ipv6/route.c:6180 inet6_rt_notify+0x120/0x130 ...... Call Trace: <TASK> fib6_add_rt2node+0x685/0xa30 fib6_add+0x96/0x1b0 ip6_route_add+0x50/0xd0 inet6_rtm_newroute+0x97/0xa0 rtnetlink_rcv_msg+0x156/0x3d0 netlink_rcv_skb+0x5a/0x110 netlink_unicast+0x246/0x350 netlink_sendmsg+0x250/0x4c0 sock_sendmsg+0x66/0x70 ___sys_sendmsg+0x7c/0xd0 __sys_sendmsg+0x5d/0xb0 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc This bug can be reproduced by script: ip -6 addr add 2002::2/64 dev ens2 ip -6 route add 100::/64 via 2002::1 dev ens2 metric 100 for i in 10 20 30 40 50 60 70; do ip link add link ens2 name ipv_$i type ipvlan ip -6 addr add 2002::$i/64 dev ipv_$i ifconfig ipv_$i up done for i in 10 20 30 40 50 60; do ip -6 route append 100::/64 encap ip6 dst 2002::$i via 2002::1 dev ipv_$i metric 100 done ip -6 route append 100::/64 via 2002::1 dev ipv_70 metric 100 This patch fixes it by adding nexthop_len of every siblings using rt6_nh_nlmsg_size(). Fixes: beb1afac518d ("net: ipv6: Add support to dump multipath routes via RTA_MULTIPATH attribute") Signed-off-by: Lu Wei <luwei32(a)huawei.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://lore.kernel.org/r/20230222083629.335683-2-luwei32@huawei.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/ipv6/route.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/net/ipv6/route.c b/net/ipv6/route.c index c18a6c17ce09..b5e7ce4909d5 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -5439,16 +5439,17 @@ static size_t rt6_nlmsg_size(struct fib6_info *f6i) nexthop_for_each_fib6_nh(f6i->nh, rt6_nh_nlmsg_size, &nexthop_len); } else { + struct fib6_info *sibling, *next_sibling; struct fib6_nh *nh = f6i->fib6_nh; nexthop_len = 0; if (f6i->fib6_nsiblings) { - nexthop_len = nla_total_size(0) /* RTA_MULTIPATH */ - + NLA_ALIGN(sizeof(struct rtnexthop)) - + nla_total_size(16) /* RTA_GATEWAY */ - + lwtunnel_get_encap_size(nh->fib_nh_lws); + rt6_nh_nlmsg_size(nh, &nexthop_len); - nexthop_len *= f6i->fib6_nsiblings; + list_for_each_entry_safe(sibling, next_sibling, + &f6i->fib6_siblings, fib6_siblings) { + rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len); + } } nexthop_len += lwtunnel_get_encap_size(nh->fib_nh_lws); } -- 2.31.1

1 0

[PATCH OLK-5.10 0/4] Accelerator some bugs round
by Weili Qian 05 Jun '23

05 Jun '23

From: JiangShui Yang <yangjiangshui(a)h-partners.com> Misc fixes for Kunpeng accelerator drivers. Bjorn Helgaas (1): crypto: hisilicon/qm - remove unnecessary aer.h include Weili Qian (3): crypto: hisilicon/qm - prevent soft lockup in qm_poll_req_cb()'s loop crypto: hisilicon/hpre - ensure private key less than n crypto: hisilicon/qm - stop function and write data to memory drivers/crypto/hisilicon/hpre/hpre_crypto.c | 10 ++++++++-- drivers/crypto/hisilicon/qm.c | 16 +++++++++------- include/linux/hisi_acc_qm.h | 2 +- 3 files changed, 18 insertions(+), 10 deletions(-) -- 2.30.0

1 4

[PATCH OLK-5.10] tcp/dccp: Add another way to allocate local ports in connect()
by Liu Jian 05 Jun '23

05 Jun '23

From: Lu Wei <luwei32(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I7AO8G CVE: NA -------------------------------- Commit 07f4c90062f8 ("tcp/dccp: try to not exhaust ip_local_port_range in connect()") allocates even ports for connect() first while leaving odd ports for bind() and this works well in busy servers. But this strategy causes severe performance degradation in busy clients. when a client has used more than half of the local ports setted in proc/sys/net/ipv4/ip_local_port_range, if this client trys to connect to a server again, the connect time increases rapidly since it will traverse all the even ports though they are exhausted. So this path provides another strategy by introducing a system option: local_port_allocation. If it is a busy client, users should set it to 1 to use sequential allocation while it should be set to 0 in other situations. Its default value is 0. Signed-off-by: Lu Wei <luwei32(a)huawei.com> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- include/net/tcp.h | 1 + net/ipv4/inet_hashtables.c | 11 ++++++++--- net/ipv4/sysctl_net_ipv4.c | 8 ++++++++ 3 files changed, 17 insertions(+), 3 deletions(-) diff --git a/include/net/tcp.h b/include/net/tcp.h index 9c86ff1e3ed1..1b832683ccf8 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -258,6 +258,7 @@ extern long sysctl_tcp_mem[3]; extern atomic_long_t tcp_memory_allocated; extern struct percpu_counter tcp_sockets_allocated; extern unsigned long tcp_memory_pressure; +extern int sysctl_local_port_allocation; /* optimized version of sk_under_memory_pressure() for TCP sockets */ static inline bool tcp_under_memory_pressure(const struct sock *sk) diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c index ed8324ee4b1b..396a58d9708c 100644 --- a/net/ipv4/inet_hashtables.c +++ b/net/ipv4/inet_hashtables.c @@ -742,7 +742,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row, struct net *net = sock_net(sk); struct inet_bind_bucket *tb; u32 remaining, offset; - int ret, i, low, high; + int ret, i, low, high, span_size; int l3mdev; u32 index; @@ -762,6 +762,11 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row, local_bh_enable(); return ret; } + /* local_port_allocation 0 means even and odd port allocation strategy + * will be applied, so span size is 2; otherwise sequential allocation + * will be used and span size is 1. Default value is 0. + */ + span_size = sysctl_local_port_allocation ? 1 : 2; l3mdev = inet_sk_bound_l3mdev(sk); @@ -783,7 +788,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row, offset &= ~1U; other_parity_scan: port = low + offset; - for (i = 0; i < remaining; i += 2, port += 2) { + for (i = 0; i < remaining; i += span_size, port += span_size) { if (unlikely(port >= high)) port -= remaining; if (inet_is_local_reserved_port(net, port)) @@ -824,7 +829,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row, } offset++; - if ((offset & 1) && remaining > 1) + if ((offset & 1) && remaining > 1 && span_size == 2) goto other_parity_scan; return -EADDRNOTAVAIL; diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c index dee47ef05655..d82c0eceec91 100644 --- a/net/ipv4/sysctl_net_ipv4.c +++ b/net/ipv4/sysctl_net_ipv4.c @@ -51,6 +51,7 @@ static int comp_sack_nr_max = 255; static u32 u32_max_div_HZ = UINT_MAX / HZ; static int one_day_secs = 24 * 3600; +int sysctl_local_port_allocation; /* obsolete */ static int sysctl_tcp_low_latency __read_mostly; @@ -575,6 +576,13 @@ static struct ctl_table ipv4_table[] = { .extra2 = SYSCTL_ONE, }, #endif + { + .procname = "local_port_allocation", + .data = &sysctl_local_port_allocation, + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_dointvec, + }, { } }; -- 2.34.1

1 0

[patch OLK-5.10 0/2] support ACPI for MPAM 2.0
by Yu Liao 03 Jun '23

03 Jun '23

This patch series support ACPI for MPAM 2.0 Hesham Almatary (1): ACPICA: Add support for Arm's MPAM ACPI table version 2 Yu Liao (1): ACPI/MPAM: Adapt to Arm's MPAM ACPI table version 2 arch/arm64/kernel/mpam/mpam_device.c | 2 +- drivers/acpi/arm64/Makefile | 2 +- drivers/acpi/arm64/mpam.c | 19 ++- drivers/acpi/arm64/mpam_v2.c | 188 +++++++++++++++++++++++++++ include/acpi/actbl2.h | 111 ++++++++++++++++ include/linux/arm_mpam.h | 2 +- 6 files changed, 318 insertions(+), 6 deletions(-) create mode 100644 drivers/acpi/arm64/mpam_v2.c -- 2.25.1

1 2

[PATCH OLK-5.10 00/25] block bugfix
by linan666＠huaweicloud.com 03 Jun '23

03 Jun '23

From: Li Nan <linan122(a)huawei.com> This patch series fix block layer bug. 3 patchs fix iocost bug. Other patchs fix raid10 and badblocks bug. David Sloan (1): md: Flush workqueue md_rdev_misc_wq in md_alloc() Jiang Li (1): md/raid1: stop mdx_raid1 thread when raid1 array run failed Jinke Han (1): block: don't allow the same type rq_qos add more than once Li Nan (20): blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost md: replace invalid function flush_rdev_wq() with flush_workqueue() md: fix sysfs duplicate file while adding rdev md/raid10: fix softlockup in raid10_unplug md/raid10: fix taks hung in raid10d md/raid10: fix a race between removing rdev and access conf->mirrors[i].rdev md: fix io loss when remove rdev fail md/raid10: prioritize adding disk to 'removed' mirror md/raid10: fix io loss while replacement replace rdev md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request md/raid10: fix uaf if replacement replaces rdev md/raid10: remove WANR_ON_ONCE in raid10_end_write_request md/raid10: fix incorrect counting of rdev->nr_pending block: Only set bb->changed when badblocks changes md/raid10: fix io hung in md_wait_for_blocked_rdev() md: fix unexpected changes of return value in rdev_set_badblocks block/badblocks: fix the bug of reverse order block/badblocks: fix badblocks loss when badblocks combine md/raid10: fix null-ptr-deref in raid10_sync_request md/raid10: fix incorrect done of recovery Yu Kuai (2): blk-iocost: don't allow to configure bio based device md/raid10: factor out code from wait_barrier() to stop_waiting_barrier() block/badblocks.c | 29 +++-- block/blk-iocost.c | 35 ++++-- block/blk-iolatency.c | 18 +-- block/blk-rq-qos.h | 11 +- block/blk-wbt.c | 12 +- drivers/md/md.c | 45 ++++--- drivers/md/raid1.c | 1 + drivers/md/raid10.c | 286 ++++++++++++++++++++++++------------------ drivers/md/raid10.h | 12 +- 9 files changed, 268 insertions(+), 181 deletions(-) -- 2.39.2

1 25

[PATCH] hikptool: fix compiling specifications check problem
by veega 03 Jun '23

03 Jun '23

delete -g option for release vesion and add compile option: -Wextra -fno-common -std=gnu11 -Wfloat-equal Signed-off-by: veega <zhuweijia(a)huawei.com> --- CMakeLists.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 6a396e7..174dd8f 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -11,7 +11,8 @@ project(hikptool C) -set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -g -O2 -fPIC -fPIE -Wall") +set(CMAKE_C_FLAGS + "${CMAKE_C_FLAGS} -O2 -fPIC -fPIE -Wall -Wextra -fno-common -std=gnu11 -Wfloat-equal") set(CMAKE_SKIP_RPATH TRUE) macro(get_header_dir_recurse HEADER_DIR_LIST) -- 2.36.1.windows.1

1 0

[PATCH OLK-5.10] config: enable CONFIG_BPF_STREAM_PARSER=y on arm64
by Liu Jian 02 Jun '23

02 Jun '23

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I79J3X CVE: N/A ---------------------------------------------------- It is already enabled by default on the x86 and loongarch platforms, so let's enable it on the arm64 platform. Signed-off-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawe.com> --- arch/arm64/configs/openeuler_defconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 76de734953fc..2c4d0524487c 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -1796,7 +1796,7 @@ CONFIG_CGROUP_NET_CLASSID=y CONFIG_NET_RX_BUSY_POLL=y CONFIG_BQL=y CONFIG_BPF_JIT=y -# CONFIG_BPF_STREAM_PARSER is not set +CONFIG_BPF_STREAM_PARSER=y CONFIG_NET_FLOW_LIMIT=y # -- 2.34.1

1 0

[PATCH openEuler-22.03-LTS-SP2 0/2] mitigatin cacheline false
by Yang Yingliang 02 Jun '23

02 Jun '23

In the test of execl, shell1 and shell8 of UnixBench, L3 false sharing occurs between rwsem_try_write_lock_unqueued() and filemap_map_pages(). The offset between address_space.host and address_space.i_mmap_rwsem is 48. It may occur L3 false sharing. Their offsets in struct ext4_inode_info is 696 and 744, so when the address of ext4_inode_info after L3 aligned, it may occur L3 false sharing in the following condition: [0x00 ~ 0x10] false sharing [0x18 ~ 0x40] no false sharing [0x48 ~ 0x80] false sharing Change the offset of 'vfs_inode' from 320 to 360 in ext4_inode_info and make the address of ext4_inode_info L3 aligned, so the offset of host and i_mmap_rwsem in ext4_inode_info is changed to 736 and 784, it can make them in different L3 to avoid false sharing. ./Run -c 96 -i 3 execl Before this patch: System Benchmarks Partial Index BASELINE RESULT INDEX Execl Throughput 43.0 24238.0 5636.8 ======== System Benchmarks Index Score (Partial Only) 5636.8 After this patch: System Benchmarks Partial Index BASELINE RESULT INDEX Execl Throughput 43.0 29363.7 6828.8 ======== System Benchmarks Index Score (Partial Only) 6828.8 Yang Yingliang (2): ext4: mitigatin cacheline false sharing in struct ext4_inode_info enable MITIGATION_FALSE_SHARING by default arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/ext4/Kconfig | 9 +++++++++ fs/ext4/ext4.h | 5 +++++ fs/ext4/super.c | 4 ++++ 5 files changed, 20 insertions(+) -- 2.33.0

1 2

[PATCH OLK-5.10] ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()
by Zhengchao Shao 02 Jun '23

02 Jun '23

From: Julian Wiedmann <jwi(a)linux.ibm.com> mainline inclusion from mainline-v5.16-rc3 commit 0276af2176c78771da7f311621a25d7608045827 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7A2A0 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ethtool_set_coalesce() now uses both the .get_coalesce() and .set_coalesce() callbacks. But the check for their availability is buggy, so changing the coalesce settings on a device where the driver provides only _one_ of the callbacks results in a NULL pointer dereference instead of an -EOPNOTSUPP. Fix the condition so that the availability of both callbacks is ensured. This also matches the netlink code. Note that reproducing this requires some effort - it only affects the legacy ioctl path, and needs a specific combination of driver options: - have .get_coalesce() and .coalesce_supported but no .set_coalesce(), or - have .set_coalesce() but no .get_coalesce(). Here eg. ethtool doesn't cause the crash as it first attempts to call ethtool_get_coalesce() and bails out on error. Fixes: f3ccfda19319 ("ethtool: extend coalesce setting uAPI with CQE mode") Cc: Yufeng Mo <moyufeng(a)huawei.com> Cc: Huazhong Tan <tanhuazhong(a)huawei.com> Cc: Andrew Lunn <andrew(a)lunn.ch> Cc: Heiner Kallweit <hkallweit1(a)gmail.com> Signed-off-by: Julian Wiedmann <jwi(a)linux.ibm.com> Link: https://lore.kernel.org/r/20211126175543.28000-1-jwi@linux.ibm.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/ethtool/ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c index ab056feb44a8..63a88b3e861d 100644 --- a/net/ethtool/ioctl.c +++ b/net/ethtool/ioctl.c @@ -1696,7 +1696,7 @@ static noinline_for_stack int ethtool_set_coalesce(struct net_device *dev, struct ethtool_coalesce coalesce; int ret; - if (!dev->ethtool_ops->set_coalesce && !dev->ethtool_ops->get_coalesce) + if (!dev->ethtool_ops->set_coalesce || !dev->ethtool_ops->get_coalesce) return -EOPNOTSUPP; ret = dev->ethtool_ops->get_coalesce(dev, &coalesce, &kernel_coalesce, -- 2.34.1

2 1

[PATCH v2 OLK-5.10] config: enable CONFIG_BPF_STREAM_PARSER=y on arm64
by Liu Jian 02 Jun '23

02 Jun '23

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I79J3X CVE: N/A ---------------------------------------------------- It is already enabled by default on the x86 and loongarch platforms, so let's enable it on the arm64 platform. Signed-off-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawe.com> --- arch/arm64/configs/openeuler_defconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 76de734953fc..2c4d0524487c 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -1796,7 +1796,7 @@ CONFIG_CGROUP_NET_CLASSID=y CONFIG_NET_RX_BUSY_POLL=y CONFIG_BQL=y CONFIG_BPF_JIT=y -# CONFIG_BPF_STREAM_PARSER is not set +CONFIG_BPF_STREAM_PARSER=y CONFIG_NET_FLOW_LIMIT=y # -- 2.34.1

1 0

[PATCH openEuler-22.03-LTS-SP2 0/2] mitigatin cacheline false
by Yang Yingliang 02 Jun '23

02 Jun '23

In the test of execl, shell1 and shell8 of UnixBench, L3 false sharing occurs between rwsem_try_write_lock_unqueued() and filemap_map_pages(). The offset between address_space.host and address_space.i_mmap_rwsem is 48. It may occur L3 false sharing. Their offsets in struct ext4_inode_info is 696 and 744, so when the address of ext4_inode_info after L3 aligned, it may occur L3 false sharing in the following condition: [0x00 ~ 0x10] false sharing [0x18 ~ 0x40] no false sharing [0x48 ~ 0x80] false sharing Change the offset of 'vfs_inode' from 320 to 360 in ext4_inode_info and make the address of ext4_inode_info L3 aligned, so the offset of host and i_mmap_rwsem in ext4_inode_info is changed to 736 and 784, it can make them in different L3 to avoid false sharing. ./Run -c 96 -i 3 execl Before this patch: System Benchmarks Partial Index BASELINE RESULT INDEX Execl Throughput 43.0 24238.0 5636.8 ======== System Benchmarks Index Score (Partial Only) 5636.8 After this patch: System Benchmarks Partial Index BASELINE RESULT INDEX Execl Throughput 43.0 29363.7 6828.8 ======== System Benchmarks Index Score (Partial Only) 6828.8 Yang Yingliang (2): ext4: mitigatin cacheline false sharing in struct ext4_inode_info enable MITIGATION_FALSE_SHARING by default arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/ext4/Kconfig | 9 +++++++++ fs/ext4/ext4.h | 5 +++++ fs/ext4/super.c | 4 ++++ 5 files changed, 20 insertions(+) -- 2.33.0

1 2

[PATCH OLK-5.10 0/2] Fixed two accelerator bugfixes.
by liulongfang 02 Jun '23

02 Jun '23

From: JiangShui Yang <yangjiangshui(a)h-partners.com> Longfang Liu (1): crypto:hisilicon/qm: bugfix queue parameter issue Zhangfei Gao (1): uacce: use filep->f_mapping to replace inode->i_mapping drivers/crypto/hisilicon/hpre/hpre_main.c | 5 +++++ drivers/crypto/hisilicon/qm.c | 14 ++++++++++---- drivers/crypto/hisilicon/qm_common.h | 1 - drivers/crypto/hisilicon/sec2/sec_main.c | 5 +++++ drivers/crypto/hisilicon/zip/zip_main.c | 5 +++++ drivers/misc/uacce/uacce.c | 16 +++++++++------- include/linux/hisi_acc_qm.h | 8 ++++++++ include/linux/uacce.h | 4 ++-- 8 files changed, 44 insertions(+), 14 deletions(-) -- 2.30.0

1 2

[PATCH OLK-5.10] net: sched: fix NULL pointer dereference in mq_attach
by Zhengchao Shao 02 Jun '23

02 Jun '23

mainline inclusion from mainline-v6.4-rc5 commit 36eec020fab668719b541f34d97f44e232ffa165 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I79V6E CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When use the following command to test: 1)ip link add bond0 type bond 2)ip link set bond0 up 3)tc qdisc add dev bond0 root handle ffff: mq 4)tc qdisc replace dev bond0 parent ffff:fff1 handle ffff: mq The kernel reports NULL pointer dereference issue. The stack information is as follows: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Internal error: Oops: 0000000096000006 [#1] SMP Modules linked in: pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mq_attach+0x44/0xa0 lr : qdisc_graft+0x20c/0x5cc sp : ffff80000e2236a0 x29: ffff80000e2236a0 x28: ffff0000c0e59d80 x27: ffff0000c0be19c0 x26: ffff0000cae3e800 x25: 0000000000000010 x24: 00000000fffffff1 x23: 0000000000000000 x22: ffff0000cae3e800 x21: ffff0000c9df4000 x20: ffff0000c9df4000 x19: 0000000000000000 x18: ffff80000a934000 x17: ffff8000f5b56000 x16: ffff80000bb08000 x15: 0000000000000000 x14: 0000000000000000 x13: 6b6b6b6b6b6b6b6b x12: 6b6b6b6b00000001 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : ffff0000c0be0730 x7 : bbbbbbbbbbbbbbbb x6 : 0000000000000008 x5 : ffff0000cae3e864 x4 : 0000000000000000 x3 : 0000000000000001 x2 : 0000000000000001 x1 : ffff8000090bc23c x0 : 0000000000000000 Call trace: mq_attach+0x44/0xa0 qdisc_graft+0x20c/0x5cc tc_modify_qdisc+0x1c4/0x664 rtnetlink_rcv_msg+0x354/0x440 netlink_rcv_skb+0x64/0x144 rtnetlink_rcv+0x28/0x34 netlink_unicast+0x1e8/0x2a4 netlink_sendmsg+0x308/0x4a0 sock_sendmsg+0x64/0xac ____sys_sendmsg+0x29c/0x358 ___sys_sendmsg+0x90/0xd0 __sys_sendmsg+0x7c/0xd0 __arm64_sys_sendmsg+0x2c/0x38 invoke_syscall+0x54/0x114 el0_svc_common.constprop.1+0x90/0x174 do_el0_svc+0x3c/0xb0 el0_svc+0x24/0xec el0t_64_sync_handler+0x90/0xb4 el0t_64_sync+0x174/0x178 This is because when mq is added for the first time, qdiscs in mq is set to NULL in mq_attach(). Therefore, when replacing mq after adding mq, we need to initialize qdiscs in the mq before continuing to graft. Otherwise, it will couse NULL pointer dereference issue in mq_attach(). And the same issue will occur in the attach functions of mqprio, taprio and htb. ffff:fff1 means that the repalce qdisc is ingress. Ingress does not allow any qdisc to be attached. Therefore, ffff:fff1 is incorrectly used, and the command should be dropped. Fixes: 6ec1c69a8f64 ("net_sched: add classful multiqueue dummy scheduler") Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Tested-by: Peilin Ye <peilin.ye(a)bytedance.com> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Link: https://lore.kernel.org/r/20230527093747.3583502-1-shaozhengchao@huawei.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> --- net/sched/sch_api.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index b12a3502fca5..b8eecd6704cb 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -1590,6 +1590,10 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n, NL_SET_ERR_MSG(extack, "Qdisc parent/child loop detected"); return -ELOOP; } + if (clid == TC_H_INGRESS) { + NL_SET_ERR_MSG(extack, "Ingress cannot graft directly"); + return -EINVAL; + } qdisc_refcount_inc(q); goto graft; } else { -- 2.34.1

2 1

[openeuler/rdma-core v2 0/4] src-openeuler/rdma-core:bugfixes
by Chengchang Tang 02 Jun '23

02 Jun '23

From: Juan Zhou <zhoujuan51(a)h-partners.com> Chengchang Tang (1): libhns: Add a judgment to the congestion control algorithm Haoyue Xu (1): libhns: Fix arrangement in SL to adapt MPI APP Junxian Huang (1): libhns: Fix incorrect post-send with direct wqe of wr-list in user space Luoyouming (1): libhns: Fix the owner bit error of sq in new io libibverbs/man/ibv_poll_cq.3 | 5 +++++ libibverbs/verbs.h | 15 ++++++++++++++- providers/hns/hns_roce_u_hw_v2.c | 33 ++++++++++++++++++++++++++------ providers/hns/hns_roce_u_verbs.c | 3 +++ 4 files changed, 49 insertions(+), 7 deletions(-) -- 2.30.0

1 4

Re: [PATCH OLK-5.10] config: enable CONFIG_BPF_STREAM_PARSER=y on arm64
by Wei Yongjun 02 Jun '23

02 Jun '23

On 2023/6/1 23:22, Liu Jian wrote: > hulk inclusion > category: feature > bugzilla: https://gitee.com/openeuler/kernel/issues/I79J3X > CVE: N/A > > ---------------------------------------------------- > > It is already enabled by default on the x86 and loongarch platforms, so > let's enable it on the arm64 platform. > > Signed-off-by: Liu Jian <liujian56(a)huawei.com> > --- > arch/arm64/configs/openeuler_defconfig | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > Reviewed-by: Wei Yongjun <weiyongjun1(a)huawe.com>

1 0

[PATCH openEuler-1.0-LTS] power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition
by Yongqiang Liu 02 Jun '23

02 Jun '23

From: Zhao Wenhui <zhaowenhui8(a)huawei.com> mainline inclusion from mainline-v6.3-rc4 commit 47c29d69212911f50bdcdd0564b5999a559010d4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7781Q CVE: CVE-2023-33288 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------- In bq24190_probe, &bdi->input_current_limit_work is bound with bq24190_input_current_limit_work. When external power changed, it will call bq24190_charger_external_power_changed to start the work. If we remove the module which will call bq24190_remove to make cleanup, there may be a unfinished work. The possible sequence is as follows: CPU0 CPUc1 |bq24190_input_current_limit_work bq24190_remove | power_supply_unregister | device_unregister | power_supply_dev_release| kfree(psy) | | | power_supply_get_property_from_supplier | //use Fix it by finishing the work before cleanup in the bq24190_remove Fixes: 97774672573a ("power_supply: Initialize changed_work before calling device_add") Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Signed-off-by: Sebastian Reichel <sebastian.reichel(a)collabora.com> Conflicts: drivers/power/supply/bq24190_charger.c Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> Reviewed-by: Zhang Qiao <zhangqiao22(a)huawei.com> Reviewed-by: Chen Hui <judy.chenhui(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/power/supply/bq24190_charger.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/power/supply/bq24190_charger.c b/drivers/power/supply/bq24190_charger.c index b58df04d03b3..760feee2cad9 100644 --- a/drivers/power/supply/bq24190_charger.c +++ b/drivers/power/supply/bq24190_charger.c @@ -1821,6 +1821,7 @@ static int bq24190_remove(struct i2c_client *client) struct bq24190_dev_info *bdi = i2c_get_clientdata(client); int error; + cancel_delayed_work_sync(&bdi->input_current_limit_work); error = pm_runtime_get_sync(bdi->dev); if (error < 0) { dev_warn(bdi->dev, "pm_runtime_get failed: %i\n", error); -- 2.25.1

1 0

[PATCH OLK-5.10] sched: fix performance degradation on lmbench
by Hui Tang 01 Jun '23

01 Jun '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7A718 -------------------------------- There are worse performance with the 'Fixes' when running "./lat_ctx -P $SYNC_MAX -s 64 16". The 'Fixes' which allocates memory for p->prefer_cpus even if "prefer_cpus" not be set. Before the 'Fixes', only test "p->prefer_cpus", after, add test "!cpumask_empty(p->prefer_cpus)" which causing performance degradation. select_task_rq_fair ->set_task_select_cpus ->prefer_cpus_valid ---- test cpumask_empty(p->prefer_cpus) Fixes: ebeb84ad373d ("cpuset: Introduce new interface for scheduler ...") Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- fs/proc/base.c | 6 ++++++ include/linux/sched.h | 1 + kernel/cgroup/cpuset.c | 3 +++ kernel/sched/fair.c | 24 ++++++++++++++++++++++++ 4 files changed, 34 insertions(+) diff --git a/fs/proc/base.c b/fs/proc/base.c index 5836b4b25052..22c65289128e 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -3298,6 +3298,12 @@ static ssize_t preferred_cpuset_write(struct file *file, const char __user *buf, if (retval < 0) goto out_free_cpumask; + if (!cpumask_empty(new_mask)) { + cpus_read_lock(); + dynamic_affinity_enable(); + cpus_read_unlock(); + } + retval = count; out_free_cpumask: diff --git a/include/linux/sched.h b/include/linux/sched.h index 3b8f72bf0c6b..3aae225f98a7 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -2227,6 +2227,7 @@ int set_prefer_cpus_ptr(struct task_struct *p, const struct cpumask *new_mask); int sched_prefer_cpus_fork(struct task_struct *p, struct cpumask *mask); void sched_prefer_cpus_free(struct task_struct *p); +void dynamic_affinity_enable(void); #endif #ifdef CONFIG_BPF_SCHED diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 2529a807599b..90de01cc6827 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -734,6 +734,9 @@ static int update_prefer_cpumask(struct cpuset *cs, struct cpuset *trialcs, update_tasks_prefer_cpumask(trialcs); + if (!cpumask_empty(trialcs->prefer_cpus)) + dynamic_affinity_enable(); + spin_lock_irq(&callback_lock); cpumask_copy(cs->prefer_cpus, trialcs->prefer_cpus); spin_unlock_irq(&callback_lock); diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index c7b560ffb75e..ff209d25c21c 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -7067,6 +7067,27 @@ static int find_energy_efficient_cpu(struct task_struct *p, int prev_cpu) } #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY + +#ifdef CONFIG_JUMP_LABEL +static DEFINE_STATIC_KEY_FALSE(__dynamic_affinity_used); + +static inline bool dynamic_affinity_used(void) +{ + return static_branch_unlikely(&__dynamic_affinity_used); +} + +void dynamic_affinity_enable(void) +{ + static_branch_enable_cpuslocked(&__dynamic_affinity_used); +} + +#else /* CONFIG_JUMP_LABEL */ +static bool dynamic_affinity_used(void) +{ + return true; +} +#endif + /* * Low utilization threshold for CPU * @@ -7076,6 +7097,9 @@ int sysctl_sched_util_low_pct = 85; static inline bool prefer_cpus_valid(struct task_struct *p) { + if (!dynamic_affinity_used()) + return false; + return p->prefer_cpus && !cpumask_empty(p->prefer_cpus) && !cpumask_equal(p->prefer_cpus, p->cpus_ptr) && -- 2.17.1

2 1

[OLK-5.10 v2 0/7] A group of bugfixes for openeuler
by Chengchang Tang 01 Jun '23

01 Jun '23

From: Juan Zhou <zhoujuan51(a)h-partners.com> Chengchang Tang (2): RDMA/hns: fix iommu_map_sg() failed when MR bigger than 4G RDMA/hns: Fix sleeping in atomic context during DCA unloading Junxian Huang (5): RDMA/hns: Remove VF extend configuration RDMA/hns: Fix a missing check of atomic wr length RDMA/hns: Fix incorrect post-send with direct wqe of wr-list in kernel space RDMA/hns: Fix inaccurate error label name in init instance RDMA/hns: Fix a missing kfree() to hr_dev->priv drivers/infiniband/hw/hns/hns_roce_dca.c | 2 - drivers/infiniband/hw/hns/hns_roce_device.h | 3 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 115 ++++++-------------- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 10 -- drivers/infiniband/hw/hns/hns_roce_main.c | 2 +- 5 files changed, 34 insertions(+), 98 deletions(-) -- 2.30.0

1 7

[PATCH openEuler-1.0-LTS] net: sched: fix NULL pointer dereference in mq_attach
by Yongqiang Liu 01 Jun '23

01 Jun '23

From: Zhengchao Shao <shaozhengchao(a)huawei.com> mainline inclusion from mainline-v6.4-rc5 commit 36eec020fab668719b541f34d97f44e232ffa165 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I79V6E CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When use the following command to test: 1)ip link add bond0 type bond 2)ip link set bond0 up 3)tc qdisc add dev bond0 root handle ffff: mq 4)tc qdisc replace dev bond0 parent ffff:fff1 handle ffff: mq The kernel reports NULL pointer dereference issue. The stack information is as follows: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Internal error: Oops: 0000000096000006 [#1] SMP Modules linked in: pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mq_attach+0x44/0xa0 lr : qdisc_graft+0x20c/0x5cc sp : ffff80000e2236a0 x29: ffff80000e2236a0 x28: ffff0000c0e59d80 x27: ffff0000c0be19c0 x26: ffff0000cae3e800 x25: 0000000000000010 x24: 00000000fffffff1 x23: 0000000000000000 x22: ffff0000cae3e800 x21: ffff0000c9df4000 x20: ffff0000c9df4000 x19: 0000000000000000 x18: ffff80000a934000 x17: ffff8000f5b56000 x16: ffff80000bb08000 x15: 0000000000000000 x14: 0000000000000000 x13: 6b6b6b6b6b6b6b6b x12: 6b6b6b6b00000001 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : ffff0000c0be0730 x7 : bbbbbbbbbbbbbbbb x6 : 0000000000000008 x5 : ffff0000cae3e864 x4 : 0000000000000000 x3 : 0000000000000001 x2 : 0000000000000001 x1 : ffff8000090bc23c x0 : 0000000000000000 Call trace: mq_attach+0x44/0xa0 qdisc_graft+0x20c/0x5cc tc_modify_qdisc+0x1c4/0x664 rtnetlink_rcv_msg+0x354/0x440 netlink_rcv_skb+0x64/0x144 rtnetlink_rcv+0x28/0x34 netlink_unicast+0x1e8/0x2a4 netlink_sendmsg+0x308/0x4a0 sock_sendmsg+0x64/0xac ____sys_sendmsg+0x29c/0x358 ___sys_sendmsg+0x90/0xd0 __sys_sendmsg+0x7c/0xd0 __arm64_sys_sendmsg+0x2c/0x38 invoke_syscall+0x54/0x114 el0_svc_common.constprop.1+0x90/0x174 do_el0_svc+0x3c/0xb0 el0_svc+0x24/0xec el0t_64_sync_handler+0x90/0xb4 el0t_64_sync+0x174/0x178 This is because when mq is added for the first time, qdiscs in mq is set to NULL in mq_attach(). Therefore, when replacing mq after adding mq, we need to initialize qdiscs in the mq before continuing to graft. Otherwise, it will couse NULL pointer dereference issue in mq_attach(). And the same issue will occur in the attach functions of mqprio, taprio and htb. ffff:fff1 means that the repalce qdisc is ingress. Ingress does not allow any qdisc to be attached. Therefore, ffff:fff1 is incorrectly used, and the command should be dropped. Fixes: 6ec1c69a8f64 ("net_sched: add classful multiqueue dummy scheduler") Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Tested-by: Peilin Ye <peilin.ye(a)bytedance.com> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Link: https://lore.kernel.org/r/20230527093747.3583502-1-shaozhengchao@huawei.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/sched/sch_api.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index c927d511bb65..448bfcdeab25 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -1514,6 +1514,10 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n, NL_SET_ERR_MSG(extack, "Qdisc parent/child loop detected"); return -ELOOP; } + if (clid == TC_H_INGRESS) { + NL_SET_ERR_MSG(extack, "Ingress cannot graft directly"); + return -EINVAL; + } qdisc_refcount_inc(q); goto graft; } else { -- 2.25.1

1 0

[PATCH OLK-5.10] sched: fix performance degradation on lmbench
by Hui Tang 01 Jun '23

01 Jun '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7A718 -------------------------------- There are worse performance with the 'Fixes' when running "./lat_ctx -P $SYNC_MAX -s 64 16". The 'Fixes' which allocates memory for p->prefer_cpus even if "prefer_cpus" not be set. Before the 'Fixes', only test "p->prefer_cpus", after, add test "!cpumask_empty(p->prefer_cpus)" which causing performance degradation. select_task_rq_fair ->set_task_select_cpus ->prefer_cpus_valid ---- test cpumask_empty(p->prefer_cpus) Fixes: b48594bf6206 ("[Huawei] sched: Fix hardlockup on 'set_prefer_cpus_ptr'") Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- fs/proc/base.c | 3 +++ include/linux/sched.h | 1 + kernel/cgroup/cpuset.c | 3 +++ kernel/sched/fair.c | 24 ++++++++++++++++++++++++ 4 files changed, 31 insertions(+) diff --git a/fs/proc/base.c b/fs/proc/base.c index 5836b4b25052..03320373207f 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -3298,6 +3298,9 @@ static ssize_t preferred_cpuset_write(struct file *file, const char __user *buf, if (retval < 0) goto out_free_cpumask; + if (!cpumask_empty(new_mask)) + dynamic_affinity_enable(); + retval = count; out_free_cpumask: diff --git a/include/linux/sched.h b/include/linux/sched.h index 3b8f72bf0c6b..3aae225f98a7 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -2227,6 +2227,7 @@ int set_prefer_cpus_ptr(struct task_struct *p, const struct cpumask *new_mask); int sched_prefer_cpus_fork(struct task_struct *p, struct cpumask *mask); void sched_prefer_cpus_free(struct task_struct *p); +void dynamic_affinity_enable(void); #endif #ifdef CONFIG_BPF_SCHED diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 2529a807599b..90de01cc6827 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -734,6 +734,9 @@ static int update_prefer_cpumask(struct cpuset *cs, struct cpuset *trialcs, update_tasks_prefer_cpumask(trialcs); + if (!cpumask_empty(trialcs->prefer_cpus)) + dynamic_affinity_enable(); + spin_lock_irq(&callback_lock); cpumask_copy(cs->prefer_cpus, trialcs->prefer_cpus); spin_unlock_irq(&callback_lock); diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index c7b560ffb75e..34b344557e38 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -7067,6 +7067,27 @@ static int find_energy_efficient_cpu(struct task_struct *p, int prev_cpu) } #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY + +#ifdef CONFIG_JUMP_LABEL +static DEFINE_STATIC_KEY_FALSE(__dynamic_affinity_used); + +static inline bool dynamic_affinity_used(void) +{ + return static_branch_unlikely(&__dynamic_affinity_used); +} + +void dynamic_affinity_enable(void) +{ + static_branch_enable(&__dynamic_affinity_used); +} + +#else /* CONFIG_JUMP_LABEL */ +static bool dynamic_affinity_used(void) +{ + return true; +} +#endif + /* * Low utilization threshold for CPU * @@ -7076,6 +7097,9 @@ int sysctl_sched_util_low_pct = 85; static inline bool prefer_cpus_valid(struct task_struct *p) { + if (!dynamic_affinity_used()) + return false; + return p->prefer_cpus && !cpumask_empty(p->prefer_cpus) && !cpumask_equal(p->prefer_cpus, p->cpus_ptr) && -- 2.17.1

2 1

[PATCH OLK-5.10] sched: fix performance degradation on lmbench
by Hui Tang 01 Jun '23

01 Jun '23

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7A718 -------------------------------- There are worse performance with the 'Fixes' when running "./lat_ctx -P $SYNC_MAX -s 64 16". The 'Fixes' which allocates memory for p->prefer_cpus even if "prefer_cpus" not be set. Before the 'Fixes', only test "p->prefer_cpus", after, add test "!cpumask_empty(p->prefer_cpus)" which causing performance degradation. select_task_rq_fair ->set_task_select_cpus ->prefer_cpus_valid ---- test cpumask_empty(p->prefer_cpus) Fixes: b48594bf6206 ("[Huawei] sched: Fix hardlockup on 'set_prefer_cpus_ptr'") Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- fs/proc/base.c | 3 +++ include/linux/sched.h | 1 + kernel/cgroup/cpuset.c | 3 +++ kernel/sched/fair.c | 24 ++++++++++++++++++++++++ 4 files changed, 31 insertions(+) diff --git a/fs/proc/base.c b/fs/proc/base.c index 5836b4b25052..03320373207f 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -3298,6 +3298,9 @@ static ssize_t preferred_cpuset_write(struct file *file, const char __user *buf, if (retval < 0) goto out_free_cpumask; + if (!cpumask_empty(new_mask)) + dynamic_affinity_enable(); + retval = count; out_free_cpumask: diff --git a/include/linux/sched.h b/include/linux/sched.h index 3b8f72bf0c6b..3aae225f98a7 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -2227,6 +2227,7 @@ int set_prefer_cpus_ptr(struct task_struct *p, const struct cpumask *new_mask); int sched_prefer_cpus_fork(struct task_struct *p, struct cpumask *mask); void sched_prefer_cpus_free(struct task_struct *p); +void dynamic_affinity_enable(void); #endif #ifdef CONFIG_BPF_SCHED diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 2529a807599b..90de01cc6827 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -734,6 +734,9 @@ static int update_prefer_cpumask(struct cpuset *cs, struct cpuset *trialcs, update_tasks_prefer_cpumask(trialcs); + if (!cpumask_empty(trialcs->prefer_cpus)) + dynamic_affinity_enable(); + spin_lock_irq(&callback_lock); cpumask_copy(cs->prefer_cpus, trialcs->prefer_cpus); spin_unlock_irq(&callback_lock); diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index c7b560ffb75e..34b344557e38 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -7067,6 +7067,27 @@ static int find_energy_efficient_cpu(struct task_struct *p, int prev_cpu) } #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY + +#ifdef CONFIG_JUMP_LABEL +static DEFINE_STATIC_KEY_FALSE(__dynamic_affinity_used); + +static inline bool dynamic_affinity_used(void) +{ + return static_branch_unlikely(&__dynamic_affinity_used); +} + +void dynamic_affinity_enable(void) +{ + static_branch_enable(&__dynamic_affinity_used); +} + +#else /* CONFIG_JUMP_LABEL */ +static bool dynamic_affinity_used(void) +{ + return true; +} +#endif + /* * Low utilization threshold for CPU * @@ -7076,6 +7097,9 @@ int sysctl_sched_util_low_pct = 85; static inline bool prefer_cpus_valid(struct task_struct *p) { + if (!dynamic_affinity_used()) + return false; + return p->prefer_cpus && !cpumask_empty(p->prefer_cpus) && !cpumask_equal(p->prefer_cpus, p->cpus_ptr) && -- 2.17.1

2 1

[PATCH] sched: fix performance degradation on lmbench
by Hui Tang 01 Jun '23

01 Jun '23

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7A718 -------------------------------- There are worse performance with the 'Fixes' when running "./lat_ctx -P $SYNC_MAX -s 64 16". The 'Fixes' which allocates memory for p->prefer_cpus even if "prefer_cpus" not be set. Before the 'Fixes', only test "p->prefer_cpus", after, add test "!cpumask_empty(p->prefer_cpus)" which causing performance degradation. select_task_rq_fair ->set_task_select_cpus ->prefer_cpus_valid ---- test cpumask_empty(p->prefer_cpus) Fixes: b48594bf6206 ("[Huawei] sched: Fix hardlockup on 'set_prefer_cpus_ptr'") Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- fs/proc/base.c | 3 +++ include/linux/sched.h | 1 + kernel/cgroup/cpuset.c | 3 +++ kernel/sched/fair.c | 24 ++++++++++++++++++++++++ 4 files changed, 31 insertions(+) diff --git a/fs/proc/base.c b/fs/proc/base.c index 5836b4b25052..03320373207f 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -3298,6 +3298,9 @@ static ssize_t preferred_cpuset_write(struct file *file, const char __user *buf, if (retval < 0) goto out_free_cpumask; + if (!cpumask_empty(new_mask)) + dynamic_affinity_enable(); + retval = count; out_free_cpumask: diff --git a/include/linux/sched.h b/include/linux/sched.h index 3b8f72bf0c6b..3aae225f98a7 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -2227,6 +2227,7 @@ int set_prefer_cpus_ptr(struct task_struct *p, const struct cpumask *new_mask); int sched_prefer_cpus_fork(struct task_struct *p, struct cpumask *mask); void sched_prefer_cpus_free(struct task_struct *p); +void dynamic_affinity_enable(void); #endif #ifdef CONFIG_BPF_SCHED diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 2529a807599b..90de01cc6827 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -734,6 +734,9 @@ static int update_prefer_cpumask(struct cpuset *cs, struct cpuset *trialcs, update_tasks_prefer_cpumask(trialcs); + if (!cpumask_empty(trialcs->prefer_cpus)) + dynamic_affinity_enable(); + spin_lock_irq(&callback_lock); cpumask_copy(cs->prefer_cpus, trialcs->prefer_cpus); spin_unlock_irq(&callback_lock); diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index c7b560ffb75e..34b344557e38 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -7067,6 +7067,27 @@ static int find_energy_efficient_cpu(struct task_struct *p, int prev_cpu) } #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY + +#ifdef CONFIG_JUMP_LABEL +static DEFINE_STATIC_KEY_FALSE(__dynamic_affinity_used); + +static inline bool dynamic_affinity_used(void) +{ + return static_branch_unlikely(&__dynamic_affinity_used); +} + +void dynamic_affinity_enable(void) +{ + static_branch_enable(&__dynamic_affinity_used); +} + +#else /* CONFIG_JUMP_LABEL */ +static bool dynamic_affinity_used(void) +{ + return true; +} +#endif + /* * Low utilization threshold for CPU * @@ -7076,6 +7097,9 @@ int sysctl_sched_util_low_pct = 85; static inline bool prefer_cpus_valid(struct task_struct *p) { + if (!dynamic_affinity_used()) + return false; + return p->prefer_cpus && !cpumask_empty(p->prefer_cpus) && !cpumask_equal(p->prefer_cpus, p->cpus_ptr) && -- 2.17.1

1 0

[PATCH openEuler-22.03-LTS] arm64: kdump: Avoid reserving low memory repeatedly
by Li Huafei 31 May '23

31 May '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6Y5Y1 ------------------------------- We call reserve_crashkernel_high() before map_mem() to reserve high memory in advance, which in turn can avoid using page level mapping for all memory above 4G to optimize performance. And after reserve_crashkernel_high(), reserve_crashkernel_low() is also needed to reserve low memory. But when the system RAM is less than 4G, the memory reserved by reserve_crashkernel_high() is already low memory (less than 4G), reserve_crashkernel_low() may reserve low memory again and the memory it reserves may be higher than that reserved by reserve_crashkernel_high(). Looking at /proc/iomem would have: # cat /proc/iomem | grep -i crash 65400000-953fffff : Crash kernel ==> crashk_res a7800000-b77fffff : Crash kernel ==> crashk_res_low At this point kexec-tools will incorrectly use the second memory segment for the kdump kernel image load, causing the kernel load address check to fail during kexec load (see sanity_check_segment_list()). When the memory reserved by reserve_crashkernel_high() meets the low memory requirement, reserve_crashkernel_low() is no longer called to reserve memory and avoid introducing problems with duplicate reservations. Fixes: baac34dd89ca ("arm64: kdump: Use page-level mapping for the high memory of crashkernel") Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> Reviewed-by: Yang Jihong <yangjihong1(a)huawei.com> --- kernel/crash_core.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/kernel/crash_core.c b/kernel/crash_core.c index 0865f816b57a..d1402585bf84 100644 --- a/kernel/crash_core.c +++ b/kernel/crash_core.c @@ -440,6 +440,13 @@ static void __init free_reserved_high_mem(void) memblock_free(crashk_res_high.start, resource_size(&crashk_res_high)); } +static bool __init within_low_mem(unsigned long long crash_base, + unsigned long long crash_size) +{ + return crash_base < CRASH_ADDR_LOW_MAX && + CRASH_ADDR_LOW_MAX - crash_base >= crash_size; +} + /* * reserve_crashkernel() - reserves memory for crash kernel * @@ -469,6 +476,8 @@ void __init reserve_crashkernel(void) if (crash_high_mem_reserved) { take_reserved_high_mem(&crash_base, &crash_size); + if (within_low_mem(crash_base, crash_size)) + goto reserve_ok; goto reserve_low; } } @@ -490,6 +499,8 @@ void __init reserve_crashkernel(void) CRASH_ALIGN); if (!crash_base && crash_high_mem_reserved) { take_reserved_high_mem(&crash_base, &crash_size); + if (within_low_mem(crash_base, crash_size)) + goto reserve_ok; goto reserve_low; } } @@ -539,6 +550,7 @@ void __init reserve_crashkernel(void) free_reserved_high_mem(); } +reserve_ok: pr_info("Reserving %ldMB of memory at %ldMB for crashkernel (System RAM: %ldMB)\n", (unsigned long)(crash_size >> 20), (unsigned long)(crash_base >> 20), -- 2.17.1

2 1

[PATCH OLK-5.10] arm64: kdump: Avoid reserving low memory repeatedly
by Li Huafei 31 May '23

31 May '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6Y5Y1 ------------------------------- We call reserve_crashkernel_high() before map_mem() to reserve high memory in advance, which in turn can avoid using page level mapping for all memory above 4G to optimize performance. And after reserve_crashkernel_high(), reserve_crashkernel_low() is also needed to reserve low memory. But when the system RAM is less than 4G, the memory reserved by reserve_crashkernel_high() is already low memory (less than 4G), reserve_crashkernel_low() may reserve low memory again and the memory it reserves may be higher than that reserved by reserve_crashkernel_high(). Looking at /proc/iomem would have: # cat /proc/iomem | grep -i crash 65400000-953fffff : Crash kernel ==> crashk_res a7800000-b77fffff : Crash kernel ==> crashk_res_low At this point kexec-tools will incorrectly use the second memory segment for the kdump kernel image load, causing the kernel load address check to fail during kexec load (see sanity_check_segment_list()). When the memory reserved by reserve_crashkernel_high() meets the low memory requirement, reserve_crashkernel_low() is no longer called to reserve memory and avoid introducing problems with duplicate reservations. Fixes: baac34dd89ca ("arm64: kdump: Use page-level mapping for the high memory of crashkernel") Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> Reviewed-by: Yang Jihong <yangjihong1(a)huawei.com> --- kernel/crash_core.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/kernel/crash_core.c b/kernel/crash_core.c index 0865f816b57a..d1402585bf84 100644 --- a/kernel/crash_core.c +++ b/kernel/crash_core.c @@ -440,6 +440,13 @@ static void __init free_reserved_high_mem(void) memblock_free(crashk_res_high.start, resource_size(&crashk_res_high)); } +static bool __init within_low_mem(unsigned long long crash_base, + unsigned long long crash_size) +{ + return crash_base < CRASH_ADDR_LOW_MAX && + CRASH_ADDR_LOW_MAX - crash_base >= crash_size; +} + /* * reserve_crashkernel() - reserves memory for crash kernel * @@ -469,6 +476,8 @@ void __init reserve_crashkernel(void) if (crash_high_mem_reserved) { take_reserved_high_mem(&crash_base, &crash_size); + if (within_low_mem(crash_base, crash_size)) + goto reserve_ok; goto reserve_low; } } @@ -490,6 +499,8 @@ void __init reserve_crashkernel(void) CRASH_ALIGN); if (!crash_base && crash_high_mem_reserved) { take_reserved_high_mem(&crash_base, &crash_size); + if (within_low_mem(crash_base, crash_size)) + goto reserve_ok; goto reserve_low; } } @@ -539,6 +550,7 @@ void __init reserve_crashkernel(void) free_reserved_high_mem(); } +reserve_ok: pr_info("Reserving %ldMB of memory at %ldMB for crashkernel (System RAM: %ldMB)\n", (unsigned long)(crash_size >> 20), (unsigned long)(crash_base >> 20), -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1 00/22] Backport CVEs and bugfixes
by Jialin Zhang 31 May '23

31 May '23

Pull new CVEs: CVE-2023-22998 cgroup bugfix from Gaosheng Cui sched bugfix from Xia Fukun block bugfixes from Zhong Jinghua and Yu Kuai iomap and ext4 bugfixes from Baokun Li md bugfixes from Yu Kuai -- 2.25.1

2 23

[PATCH OLK-5.10 00/24] Backport CVEs and bugfixes
by Jialin Zhang 31 May '23

31 May '23

Pull new CVEs: CVE-2023-22998 cgroup bugfix from Gaosheng Cui sched bugfix from Xia Fukun block bugfixes from Zhong Jinghua and Yu Kuai iomap and ext4 bugfixes from Baokun Li md and eulerfs bugfixes from Yu Kuai -- 2.25.1

2 25

[PATCH openEuler-22.03-LTS 00/22] Backport CVEs and bugfixes
by Jialin Zhang 31 May '23

31 May '23

Pull new CVEs: CVE-2023-22998 cgroup bugfix from Gaosheng Cui sched bugfix from Xia Fukun block bugfixes from Zhong Jinghua and Yu Kuai iomap and ext4 bugfixes from Baokun Li md bugfixes from Yu Kuai -- 2.25.1

1 22

[PATCH openEuler-1.0-LTS 0/2] introduce smart grid scheduler
by Wang ShaoBo 31 May '23

31 May '23

introduce smart grid scheduler Hui Tang (1): sched: introduce smart grid scheduling strategy for cfs scheduler Wang ShaoBo (1): sched: smart grid: init sched_grid_qos structure on QOS purpose fs/proc/array.c | 13 + fs/proc/stat.c | 4 + include/linux/sched.h | 11 + include/linux/sched/cputime.h | 3 + include/linux/sched/grid_qos.h | 77 ++++++ include/linux/sched/sysctl.h | 8 + init/Kconfig | 10 + kernel/fork.c | 9 + kernel/sched/Makefile | 1 + kernel/sched/core.c | 178 +++++++++++- kernel/sched/fair.c | 491 ++++++++++++++++++++++++++++++++- kernel/sched/grid/Makefile | 2 + kernel/sched/grid/power.c | 8 + kernel/sched/grid/qos.c | 46 +++ kernel/sched/grid/stat.c | 11 + kernel/sched/sched.h | 39 +++ kernel/sched/topology.c | 3 + kernel/sysctl.c | 27 ++ mm/mempolicy.c | 25 ++ 19 files changed, 958 insertions(+), 8 deletions(-) create mode 100644 include/linux/sched/grid_qos.h create mode 100644 kernel/sched/grid/Makefile create mode 100644 kernel/sched/grid/power.c create mode 100644 kernel/sched/grid/qos.c create mode 100644 kernel/sched/grid/stat.c -- 2.25.1

1 2

openEuler Kernel SIG 双周例会
by openEuler conference 31 May '23

31 May '23

您好！ Kernel SIG 邀请您参加 2023-06-02 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG 双周例会会议内容： 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板）会议链接：https://us06web.zoom.us/j/89684516659?pwd=QWwyVURRUlhpVjY1RmhTVFFqeit3Zz09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2023-06-02 14:00, The subject of the conference is openEuler Kernel SIG 双周例会, Summary: 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板） You can join the meeting at https://us06web.zoom.us/j/89684516659?pwd=QWwyVURRUlhpVjY1RmhTVFFqeit3Zz09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH] hikptool: delete redundant copyright notices
by veega 30 May '23

30 May '23

Delete redundant copyright notices in hikp_ub_link.h Signed-off-by: veega <zhuweijia(a)huawei.com> --- net/ub/ub_link/hikp_ub_link.h | 13 ------------- tool_lib/tool_lib.h | 2 +- 2 files changed, 1 insertion(+), 14 deletions(-) diff --git a/net/ub/ub_link/hikp_ub_link.h b/net/ub/ub_link/hikp_ub_link.h index 14ee912..7c71cb2 100644 --- a/net/ub/ub_link/hikp_ub_link.h +++ b/net/ub/ub_link/hikp_ub_link.h @@ -11,19 +11,6 @@ * See the Mulan PSL v2 for more details. */ -/* - * Copyright (c) 2023 Hisilicon Technologies Co., Ltd. - * Hikptool is licensed under Mulan PSL v2. - * You can use this software according to the terms and conditions of the Mulan PSL v2. - * You may obtain a copy of Mulan PSL v2 at: - * http://license.coscl.org.cn/MulanPSL2 - * THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND, - * EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT, - * MERCHANTABILITY OR FIT FOR A PARTICULAR PURPOSE. - * - * See the Mulan PSL v2 for more details. - */ - #ifndef HIKP_UB_LINK_H #define HIKP_UB_LINK_H diff --git a/tool_lib/tool_lib.h b/tool_lib/tool_lib.h index 9766a7e..6548b57 100644 --- a/tool_lib/tool_lib.h +++ b/tool_lib/tool_lib.h @@ -18,7 +18,7 @@ #define TOOL_NAME "hikptool" -#define TOOL_VER "1.0.15" +#define TOOL_VER "1.0.16" #define HI_GET_BITFIELD(value, start, mask) (((value) >> (start)) & (mask)) #define HI_SET_FIELD(origin, shift, val) ((origin) |= (val) << (shift)) -- 2.36.1.windows.1

1 0

[PATCH 10/15] Complete the developing of hikptool ub_bp function
by veega 30 May '23

30 May '23

From: veega2022 <zhuweijia(a)huawei.com> The hikptool ub_bp command is submitted for the first time. This command can be used to query the back pressure status of the VL in the UB-N. Signed-off-by: Jianqiang Li <lijianqiang16(a)huawei.com> --- net/ub/ub_bp/hikp_ub_bp.c | 102 ++++++++++++++++++++++++++++++++++++++ net/ub/ub_bp/hikp_ub_bp.h | 39 +++++++++++++++ 2 files changed, 141 insertions(+) create mode 100644 net/ub/ub_bp/hikp_ub_bp.c create mode 100644 net/ub/ub_bp/hikp_ub_bp.h diff --git a/net/ub/ub_bp/hikp_ub_bp.c b/net/ub/ub_bp/hikp_ub_bp.c new file mode 100644 index 0000000..70a9a4b --- /dev/null +++ b/net/ub/ub_bp/hikp_ub_bp.c @@ -0,0 +1,102 @@ +/* + * Copyright (c) 2023 Hisilicon Technologies Co., Ltd. + * Hikptool is licensed under Mulan PSL v2. + * You can use this software according to the terms and conditions of the Mulan PSL v2. + * You may obtain a copy of Mulan PSL v2 at: + * http://license.coscl.org.cn/MulanPSL2 + * THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND, + * EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT, + * MERCHANTABILITY OR FIT FOR A PARTICULAR PURPOSE. + * + * See the Mulan PSL v2 for more details. + */ + +#include "hikp_ub_bp.h" + +static struct ub_bp_param g_ub_bp_param = { 0 }; + +static int hikp_ub_bp_help(struct major_cmd_ctrl *self, const char *argv) +{ + printf("\n Usage: %s %s\n", self->cmd_ptr->name, "-i <interface>\n"); + printf("\n %s\n", self->cmd_ptr->help_info); + printf(" Options:\n\n"); + printf(" %s, %-25s %s\n", "-h", "--help", "display this help and exit"); + printf(" %s, %-25s %s\n", "-i", "--interface=<interface>", + "device target or bdf id, e.g. ubn0 or 0000:35:00.0"); + printf("\n"); + return 0; +} + +static int hikp_ub_bp_target(struct major_cmd_ctrl *self, const char *argv) +{ + self->err_no = tool_check_and_get_valid_bdf_id(argv, &(g_ub_bp_param.target)); + if (self->err_no) { + snprintf(self->err_str, sizeof(self->err_str), "Unknown device %s.", argv); + return self->err_no; + } + return 0; +} + +static void hikp_ub_bp_info_show(const struct ub_bp_rsp *info) +{ + int bp_val_offset; + + printf("%-28s : %u\n", "mac id", info->mac_id); + printf("%-28s : ", "back pressure status"); + + for (bp_val_offset = MAX_VL_NUM; bp_val_offset >= 0; bp_val_offset--) { + printf("%d", HI_GETBIT(info->bp_val, bp_val_offset) ? 1 : 0); + } + printf("\n"); +} + + +static int hikp_ub_query_bp(const struct bdf_t *bdf) +{ + struct hikp_cmd_header header = { 0 }; + struct ub_bp_req_para req = { 0 }; + struct hikp_cmd_ret *cmd_ret; + struct ub_bp_rsp *rsp; + + req.bdf = *bdf; + hikp_cmd_init(&header, UB_MOD, GET_UB_BP_INFO_CMD, UB_BP_INFO_DUMP); + cmd_ret = hikp_cmd_alloc(&header, &req, sizeof(req)); + if (cmd_ret == NULL || cmd_ret->status != 0) { + free(cmd_ret); + cmd_ret = NULL; + return -EIO; + } + + rsp = (struct ub_bp_rsp *)cmd_ret->rsp_data; + hikp_ub_bp_info_show(rsp); + + free(cmd_ret); + cmd_ret = NULL; + return 0; +} + +static void hikp_ub_bp_cmd_execute(struct major_cmd_ctrl *self) +{ + struct bdf_t *bdf = &g_ub_bp_param.target.bdf; + int ret; + + ret = hikp_ub_query_bp(bdf); + if (ret != 0) { + snprintf(self->err_str, sizeof(self->err_str), "fail to get ub bp info."); + self->err_no = ret; + return; + } +} + +static void cmd_ub_bp_init(void) +{ + struct major_cmd_ctrl *major_cmd = get_major_cmd(); + + major_cmd->option_count = 0; + major_cmd->execute = hikp_ub_bp_cmd_execute; + + cmd_option_register("-h", "--help", false, hikp_ub_bp_help); + cmd_option_register("-i", "--interface", true, hikp_ub_bp_target); +} + +HIKP_CMD_DECLARE("ub_bp", "get ub bp information", cmd_ub_bp_init); diff --git a/net/ub/ub_bp/hikp_ub_bp.h b/net/ub/ub_bp/hikp_ub_bp.h new file mode 100644 index 0000000..0bd4740 --- /dev/null +++ b/net/ub/ub_bp/hikp_ub_bp.h @@ -0,0 +1,39 @@ +/* + * Copyright (c) 2023 Hisilicon Technologies Co., Ltd. + * Hikptool is licensed under Mulan PSL v2. + * You can use this software according to the terms and conditions of the Mulan PSL v2. + * You may obtain a copy of Mulan PSL v2 at: + * http://license.coscl.org.cn/MulanPSL2 + * THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND, + * EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT, + * MERCHANTABILITY OR FIT FOR A PARTICULAR PURPOSE. + * + * See the Mulan PSL v2 for more details. + */ + +#ifndef HIKP_UB_BP_H +#define HIKP_UB_BP_H + +#include "hikp_net_lib.h" + +#define MAX_VL_NUM 17 + +enum ub_bp_sub_cmd_type { + UB_BP_INFO_DUMP = 0, +}; + +struct ub_bp_param { + struct tool_target target; +}; + +struct ub_bp_req_para { + struct bdf_t bdf; +}; + +struct ub_bp_rsp { + uint8_t mac_id; + uint8_t rsvd[3]; + uint32_t bp_val; +}; + +#endif /* HIKP_UB_BP_H */ -- 2.36.1.windows.1

1 0

[PATCH openEuler-1.0-LTS] x86/pm: Fix false positive kmemleak report in msr_build_context()
by Yongqiang Liu 30 May '23

30 May '23

From: Matthieu Baerts <matthieu.baerts(a)tessares.net> mainline inclusion from mainline-v5.19-rc1 commit b0b592cf08367719e1d1ef07c9f136e8c17f7ec3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I78RHX CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Since e2a1256b17b1 ("x86/speculation: Restore speculation related MSRs during S3 resume") kmemleak reports this issue: unreferenced object 0xffff888009cedc00 (size 256): comm "swapper/0", pid 1, jiffies 4294693823 (age 73.764s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 48 00 00 00 00 00 00 00 ........H....... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: msr_build_context (include/linux/slab.h:621) pm_check_save_msr (arch/x86/power/cpu.c:520) do_one_initcall (init/main.c:1298) kernel_init_freeable (init/main.c:1370) kernel_init (init/main.c:1504) ret_from_fork (arch/x86/entry/entry_64.S:304) Reproducer: - boot the VM with a debug kernel config (see https://github.com/multipath-tcp/mptcp_net-next/issues/268) - wait ~1 minute - start a kmemleak scan The root cause here is alignment within the packed struct saved_context (from suspend_64.h). Kmemleak only searches for pointers that are aligned (see how pointers are scanned in kmemleak.c), but pahole shows that the saved_msrs struct member and all members after it in the structure are unaligned: struct saved_context { struct pt_regs regs; /* 0 168 */ /* --- cacheline 2 boundary (128 bytes) was 40 bytes ago --- */ u16 ds; /* 168 2 */ ... u64 misc_enable; /* 232 8 */ bool misc_enable_saved; /* 240 1 */ /* Note below odd offset values for the remainder of this struct */ struct saved_msrs saved_msrs; /* 241 16 */ /* --- cacheline 4 boundary (256 bytes) was 1 bytes ago --- */ long unsigned int efer; /* 257 8 */ u16 gdt_pad; /* 265 2 */ struct desc_ptr gdt_desc; /* 267 10 */ u16 idt_pad; /* 277 2 */ struct desc_ptr idt; /* 279 10 */ u16 ldt; /* 289 2 */ u16 tss; /* 291 2 */ long unsigned int tr; /* 293 8 */ long unsigned int safety; /* 301 8 */ long unsigned int return_address; /* 309 8 */ /* size: 317, cachelines: 5, members: 25 */ /* last cacheline: 61 bytes */ } __attribute__((__packed__)); Move misc_enable_saved to the end of the struct declaration so that saved_msrs fits in before the cacheline 4 boundary. The comment above the saved_context declaration says to fix wakeup_64.S file and __save/__restore_processor_state() if the struct is modified: it looks like all the accesses in wakeup_64.S are done through offsets which are computed at build-time. Update that comment accordingly. At the end, the false positive kmemleak report is due to a limitation from kmemleak but it is always good to avoid unaligned members for optimisation purposes. Please note that it looks like this issue is not new, e.g. https://lore.kernel.org/all/9f1bb619-c4ee-21c4-a251-870bd4db04fa@lwfinger.n… https://lore.kernel.org/all/94e48fcd-1dbd-ebd2-4c91-f39941735909@molgen.mpg… [ bp: Massage + cleanup commit message. ] Fixes: 7a9c2dd08ead ("x86/pm: Introduce quirk framework to save/restore extra MSR registers around suspend/resume") Suggested-by: Mat Martineau <mathew.j.martineau(a)linux.intel.com> Signed-off-by: Matthieu Baerts <matthieu.baerts(a)tessares.net> Signed-off-by: Borislav Petkov <bp(a)suse.de> Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Link: https://lore.kernel.org/r/20220426202138.498310-1-matthieu.baerts@tessares.… Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Reviewed-by: Wei Li <liwei391(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- arch/x86/include/asm/suspend_32.h | 2 +- arch/x86/include/asm/suspend_64.h | 12 ++++++++---- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/arch/x86/include/asm/suspend_32.h b/arch/x86/include/asm/suspend_32.h index 8be6afb58471..32662cbaa27e 100644 --- a/arch/x86/include/asm/suspend_32.h +++ b/arch/x86/include/asm/suspend_32.h @@ -21,7 +21,6 @@ struct saved_context { #endif unsigned long cr0, cr2, cr3, cr4; u64 misc_enable; - bool misc_enable_saved; struct saved_msrs saved_msrs; struct desc_ptr gdt_desc; struct desc_ptr idt; @@ -30,6 +29,7 @@ struct saved_context { unsigned long tr; unsigned long safety; unsigned long return_address; + bool misc_enable_saved; } __attribute__((packed)); #endif /* _ASM_X86_SUSPEND_32_H */ diff --git a/arch/x86/include/asm/suspend_64.h b/arch/x86/include/asm/suspend_64.h index a7af9f53c0cb..b2861400c6a2 100644 --- a/arch/x86/include/asm/suspend_64.h +++ b/arch/x86/include/asm/suspend_64.h @@ -14,9 +14,13 @@ * Image of the saved processor state, used by the low level ACPI suspend to * RAM code and by the low level hibernation code. * - * If you modify it, fix arch/x86/kernel/acpi/wakeup_64.S and make sure that - * __save/__restore_processor_state(), defined in arch/x86/kernel/suspend_64.c, - * still work as required. + * If you modify it, check how it is used in arch/x86/kernel/acpi/wakeup_64.S + * and make sure that __save/__restore_processor_state(), defined in + * arch/x86/power/cpu.c, still work as required. + * + * Because the structure is packed, make sure to avoid unaligned members. For + * optimisation purposes but also because tools like kmemleak only search for + * pointers that are aligned. */ struct saved_context { struct pt_regs regs; @@ -36,7 +40,6 @@ struct saved_context { unsigned long cr0, cr2, cr3, cr4, cr8; u64 misc_enable; - bool misc_enable_saved; struct saved_msrs saved_msrs; unsigned long efer; u16 gdt_pad; /* Unused */ @@ -48,6 +51,7 @@ struct saved_context { unsigned long tr; unsigned long safety; unsigned long return_address; + bool misc_enable_saved; } __attribute__((packed)); #define loaddebug(thread,register) \ -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/2] drm: Fix use-after-free read in drm_getunique()
by Yongqiang Liu 30 May '23

30 May '23

From: Desmond Cheong Zhi Xi <desmondcheongzx(a)gmail.com> stable inclusion from stable-v4.19.195 commit 7d233ba700ceb593905ea82b42dadb4ec8ef85e9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I52XND CVE: CVE-2022-1280 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b436acd1cf7fac0ba987abd22955d98025c80c2b upstream. There is a time-of-check-to-time-of-use error in drm_getunique() due to retrieving file_priv->master prior to locking the device's master mutex. An example can be seen in the crash report of the use-after-free error found by Syzbot: https://syzkaller.appspot.com/bug?id=148d2f1dfac64af52ffd27b661981a540724f8… In the report, the master pointer was used after being freed. This is because another process had acquired the device's master mutex in drm_setmaster_ioctl(), then overwrote fpriv->master in drm_new_set_master(). The old value of fpriv->master was subsequently freed before the mutex was unlocked. To fix this, we lock the device's master mutex before retrieving the pointer from from fpriv->master. This patch passes the Syzbot reproducer test. Reported-by: syzbot+c3a706cec1ea99e1c693(a)syzkaller.appspotmail.com Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx(a)gmail.com> Cc: stable(a)vger.kernel.org Signed-off-by: Daniel Vetter <daniel.vetter(a)ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/20210608110436.239583-1-desmo… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> Reviewed-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/gpu/drm/drm_ioctl.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c index 3fe512b8a488..d15d95e3bbf4 100644 --- a/drivers/gpu/drm/drm_ioctl.c +++ b/drivers/gpu/drm/drm_ioctl.c @@ -112,17 +112,18 @@ int drm_getunique(struct drm_device *dev, void *data, struct drm_file *file_priv) { struct drm_unique *u = data; - struct drm_master *master = file_priv->master; + struct drm_master *master; - mutex_lock(&master->dev->master_mutex); + mutex_lock(&dev->master_mutex); + master = file_priv->master; if (u->unique_len >= master->unique_len) { if (copy_to_user(u->unique, master->unique, master->unique_len)) { - mutex_unlock(&master->dev->master_mutex); + mutex_unlock(&dev->master_mutex); return -EFAULT; } } u->unique_len = master->unique_len; - mutex_unlock(&master->dev->master_mutex); + mutex_unlock(&dev->master_mutex); return 0; } -- 2.25.1

1 1

[PATCH 01/15] fix hikptool rciep rsp filed error problem
by veega 30 May '23

30 May '23

From: veega2022 <zhuweijia(a)huawei.com> union hikp_space_rsp 0xF8h is reserved and 0xFCh is cpl_status Signed-off-by: hesiyuan <hesiyuan4(a)huawei.com> --- libhikptdev/src/rciep/hikpt_rciep.c | 2 +- libhikptdev/src/rciep/hikpt_rciep.h | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/libhikptdev/src/rciep/hikpt_rciep.c b/libhikptdev/src/rciep/hikpt_rciep.c index 9b7a82a..5c7e82f 100644 --- a/libhikptdev/src/rciep/hikpt_rciep.c +++ b/libhikptdev/src/rciep/hikpt_rciep.c @@ -97,7 +97,7 @@ static uint32_t hikp_wait_for_cpl_status(void) uint32_t status; do { - status = g_hikp_req->field.cpl_status; + status = g_hikp_rsp->field.cpl_status; if (status != HIKP_INIT_STAT) return status; count--; diff --git a/libhikptdev/src/rciep/hikpt_rciep.h b/libhikptdev/src/rciep/hikpt_rciep.h index 093724a..8fbb3c0 100644 --- a/libhikptdev/src/rciep/hikpt_rciep.h +++ b/libhikptdev/src/rciep/hikpt_rciep.h @@ -75,8 +75,8 @@ union hikp_space_rsp { uint32_t version; /* 000h */ uint32_t rsp_para_num; /* 004h */ uint32_t data[HIKP_RSP_DATA_MAX]; /* 008h */ - uint32_t cpl_status; /* 0F8h */ - uint32_t pid_record; /* 0FCh */ + uint32_t rsv; /* 0F8h */ + uint32_t cpl_status; /* 0FCh */ struct iep_doorbell sw_db; /* 100h. Fixed and unmodifiable */ } field; -- 2.36.1.windows.1

1 17

[PATCH] perf/smmuv3: Enable HiSilicon Erratum quirk
by Junhao He 29 May '23

29 May '23

From: Yicong Yang <yangyicong(a)hisilicon.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I798Y2 CVE: NA ---------------------------------------------------------------------- Some HiSilicon SMMU PMCG suffers the erratum that the global PMU disable control sometimes fail to disable each used the counters. This will lead to error or inaccurate data since before we enable the counters the counter's still counting for the event used in last perf session. This patch tries to fix this by hardening the global disable process. Before disable the PMU, writing an invalid event type (0xff) to focibly stop the counters. Signed-off-by: Yicong Yang <yangyicong(a)hisilicon.com> Signed-off-by: Junhao He <hejunhao3(a)huawei.com> --- drivers/acpi/arm64/iort.c | 3 +++ drivers/perf/arm_smmuv3_pmu.c | 22 +++++++++++++++++++++- include/linux/acpi_iort.h | 1 + 3 files changed, 25 insertions(+), 1 deletion(-) diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c index d6e1569a72b1..33362f37b04a 100644 --- a/drivers/acpi/arm64/iort.c +++ b/drivers/acpi/arm64/iort.c @@ -1478,6 +1478,9 @@ static struct acpi_platform_list pmcg_plat_info[] __initdata = { /* HiSilicon Hip08 Platform */ {"HISI ", "HIP08 ", 0, ACPI_SIG_IORT, greater_than_or_equal, "Erratum #162001800", IORT_SMMU_V3_PMCG_HISI_HIP08}, + /* HiSilicon Hip09 Platform */ + {"HISI ", "HIP09 ", 0, ACPI_SIG_IORT, greater_than_or_equal, + "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, { } }; diff --git a/drivers/perf/arm_smmuv3_pmu.c b/drivers/perf/arm_smmuv3_pmu.c index f5de59451307..591d98bb4294 100644 --- a/drivers/perf/arm_smmuv3_pmu.c +++ b/drivers/perf/arm_smmuv3_pmu.c @@ -96,6 +96,7 @@ #define SMMU_PMCG_PA_SHIFT 12 #define SMMU_PMCG_EVCNTR_RDONLY BIT(0) +#define SMMU_PMCG_DISABLE_HARDEN BIT(1) static int cpuhp_state_num; @@ -140,10 +141,26 @@ static inline void smmu_pmu_enable(struct pmu *pmu) writel(SMMU_PMCG_CR_ENABLE, smmu_pmu->reg_base + SMMU_PMCG_CR); } +static inline void smmu_pmu_disable_harden(struct smmu_pmu *smmu_pmu) +{ + unsigned int idx; + + /* + * The global disable of PMU sometimes fail to stop the counting. + * Harden this by writing an invalid event type to each used counter + * to forcibly stop counting. + */ + for_each_set_bit(idx, smmu_pmu->used_counters, smmu_pmu->num_counters) + writel(0xffff, smmu_pmu->reg_base + SMMU_PMCG_EVTYPER(idx)); +} + static inline void smmu_pmu_disable(struct pmu *pmu) { struct smmu_pmu *smmu_pmu = to_smmu_pmu(pmu); + if (smmu_pmu->options & SMMU_PMCG_DISABLE_HARDEN) + smmu_pmu_disable_harden(smmu_pmu); + writel(0, smmu_pmu->reg_base + SMMU_PMCG_CR); writel(0, smmu_pmu->reg_base + SMMU_PMCG_IRQ_CTRL); } @@ -756,7 +773,10 @@ static void smmu_pmu_get_acpi_options(struct smmu_pmu *smmu_pmu) switch (model) { case IORT_SMMU_V3_PMCG_HISI_HIP08: /* HiSilicon Erratum 162001800 */ - smmu_pmu->options |= SMMU_PMCG_EVCNTR_RDONLY; + smmu_pmu->options |= SMMU_PMCG_EVCNTR_RDONLY | SMMU_PMCG_DISABLE_HARDEN; + break; + case IORT_SMMU_V3_PMCG_HISI_HIP09: + smmu_pmu->options |= SMMU_PMCG_DISABLE_HARDEN; break; } diff --git a/include/linux/acpi_iort.h b/include/linux/acpi_iort.h index 1a12baa58e40..136dba94c646 100644 --- a/include/linux/acpi_iort.h +++ b/include/linux/acpi_iort.h @@ -21,6 +21,7 @@ */ #define IORT_SMMU_V3_PMCG_GENERIC 0x00000000 /* Generic SMMUv3 PMCG */ #define IORT_SMMU_V3_PMCG_HISI_HIP08 0x00000001 /* HiSilicon HIP08 PMCG */ +#define IORT_SMMU_V3_PMCG_HISI_HIP09 0x00000002 /* HiSilicon HIP09 PMCG */ int iort_register_domain_token(int trans_id, phys_addr_t base, struct fwnode_handle *fw_node); -- 2.33.0

1 0

[OLK-5.10 0/3] Support T6 ETM and Workaround CPU hung bug on hip09
by Junhao He 29 May '23

29 May '23

1. Added support for HiSilicon T6 ETM 2. Fix CPU hold issue caused by hip09 ETM overflow Junhao He (3): coresight: etm4x: Add Support for HiSilicon T6 ETM coresight: etm4x: Workaround CPU hung bug on hip09 perf cs-etm: add error logging to cs_etm_is_etmv4() .../hwtracing/coresight/coresight-etm4x-core.c | 15 ++++++++++++++- tools/perf/arch/arm/util/cs-etm.c | 11 ++++++----- 2 files changed, 20 insertions(+), 6 deletions(-) -- 2.33.0

1 3

[PATCH OLK-5.10 1/2] config: enable CONFIG_ARM64_AMU_EXTN to be compatible with AMU platform
by Zeng Heng 29 May '23

29 May '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I73EPL -------------------------------- The KunPeng newest released platform supports the feature of AMU, and this configuration is backward compatible. This patch would acts as a prepatch for the following patch series. Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 76de734953fc..7b047c0265ee 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -488,7 +488,7 @@ CONFIG_AS_HAS_CFI_NEGATE_RA_STATE=y # # ARMv8.4 architectural features # -# CONFIG_ARM64_AMU_EXTN is not set +CONFIG_ARM64_AMU_EXTN=y CONFIG_AS_HAS_ARMV8_4=y CONFIG_ARM64_TLB_RANGE=y # end of ARMv8.4 architectural features -- 2.25.1

1 1

[OLK-5.10 1/4] cpumask: Introduce DYING mask
by Zeng Heng 29 May '23

29 May '23

From: Peter Zijlstra <peterz(a)infradead.org> mainline inclusion from mainline-v5.13-rc1 commit e40f74c535b8a0ecf3ef0388b51a34cdadb34fb5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6VS35 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Introduce a cpumask that indicates (for each CPU) what direction the CPU hotplug is currently going. Notably, it tracks rollbacks. Eg. when an up fails and we do a roll-back down, it will accurately reflect the direction. Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Valentin Schneider <valentin.schneider(a)arm.com> Link: https://lkml.kernel.org/r/20210310150109.151441252@infradead.org Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- include/linux/cpumask.h | 19 +++++++++++++++++++ kernel/cpu.c | 6 ++++++ 2 files changed, 25 insertions(+) diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h index 0159986ac9ce..92d5ecad8de6 100644 --- a/include/linux/cpumask.h +++ b/include/linux/cpumask.h @@ -91,10 +91,12 @@ extern struct cpumask __cpu_possible_mask; extern struct cpumask __cpu_online_mask; extern struct cpumask __cpu_present_mask; extern struct cpumask __cpu_active_mask; +extern struct cpumask __cpu_dying_mask; #define cpu_possible_mask ((const struct cpumask *)&__cpu_possible_mask) #define cpu_online_mask ((const struct cpumask *)&__cpu_online_mask) #define cpu_present_mask ((const struct cpumask *)&__cpu_present_mask) #define cpu_active_mask ((const struct cpumask *)&__cpu_active_mask) +#define cpu_dying_mask ((const struct cpumask *)&__cpu_dying_mask) extern atomic_t __num_online_cpus; @@ -118,6 +120,11 @@ static inline unsigned int num_online_cpus(void) #define cpu_possible(cpu) cpumask_test_cpu((cpu), cpu_possible_mask) #define cpu_present(cpu) cpumask_test_cpu((cpu), cpu_present_mask) #define cpu_active(cpu) cpumask_test_cpu((cpu), cpu_active_mask) +static inline int cpumask_test_cpu(int cpu, const struct cpumask *cpumask); +static inline bool cpu_dying(unsigned int cpu) +{ + return cpumask_test_cpu(cpu, cpu_dying_mask); +} #else #define num_online_cpus() 1U #define num_possible_cpus() 1U @@ -127,6 +134,10 @@ static inline unsigned int num_online_cpus(void) #define cpu_possible(cpu) ((cpu) == 0) #define cpu_present(cpu) ((cpu) == 0) #define cpu_active(cpu) ((cpu) == 0) +static inline bool cpu_dying(unsigned int cpu) +{ + return false; +} #endif extern cpumask_t cpus_booted_once_mask; @@ -851,6 +862,14 @@ set_cpu_active(unsigned int cpu, bool active) cpumask_clear_cpu(cpu, &__cpu_active_mask); } +static inline void +set_cpu_dying(unsigned int cpu, bool dying) +{ + if (dying) + cpumask_set_cpu(cpu, &__cpu_dying_mask); + else + cpumask_clear_cpu(cpu, &__cpu_dying_mask); +} /** * to_cpumask - convert an NR_CPUS bitmap to a struct cpumask * diff --git a/kernel/cpu.c b/kernel/cpu.c index c06ced18f78a..2a81a9dae3a7 100644 --- a/kernel/cpu.c +++ b/kernel/cpu.c @@ -157,6 +157,9 @@ static int cpuhp_invoke_callback(unsigned int cpu, enum cpuhp_state state, int (*cb)(unsigned int cpu); int ret, cnt; + if (cpu_dying(cpu) != !bringup) + set_cpu_dying(cpu, !bringup); + if (st->fail == state) { st->fail = CPUHP_INVALID; @@ -2502,6 +2505,9 @@ EXPORT_SYMBOL(__cpu_present_mask); struct cpumask __cpu_active_mask __read_mostly; EXPORT_SYMBOL(__cpu_active_mask); +struct cpumask __cpu_dying_mask __read_mostly; +EXPORT_SYMBOL(__cpu_dying_mask); + atomic_t __num_online_cpus __read_mostly; EXPORT_SYMBOL(__num_online_cpus); -- 2.25.1

1 3

[OLK-5.10 1/2] config: enable CONFIG_ARM64_AMU_EXTN to be compatible with AMU platform
by Zeng Heng 29 May '23

29 May '23

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I73EPL -------------------------------- The KunPeng newest released platform supports the feature of AMU, and this configuration is backward compatible. This patch would acts as a prepatch for the following patch series. Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 76de734953fc..7b047c0265ee 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -488,7 +488,7 @@ CONFIG_AS_HAS_CFI_NEGATE_RA_STATE=y # # ARMv8.4 architectural features # -# CONFIG_ARM64_AMU_EXTN is not set +CONFIG_ARM64_AMU_EXTN=y CONFIG_AS_HAS_ARMV8_4=y CONFIG_ARM64_TLB_RANGE=y # end of ARMv8.4 architectural features -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/6] ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum
by Yongqiang Liu 27 May '23

27 May '23

From: Tudor Ambarus <tudor.ambarus(a)linaro.org> stable inclusion from stable-v5.10.180 commit 0dde3141c527b09b96bef1e7eeb18b8127810ce9 category: bugfix bugzilla: 188791,https://gitee.com/openeuler/kernel/issues/I76XUJ CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4f04351888a83e595571de672e0a4a8b74f4fb31 upstream. When modifying the block device while it is mounted by the filesystem, syzbot reported the following: BUG: KASAN: slab-out-of-bounds in crc16+0x206/0x280 lib/crc16.c:58 Read of size 1 at addr ffff888075f5c0a8 by task syz-executor.2/15586 CPU: 1 PID: 15586 Comm: syz-executor.2 Not tainted 6.2.0-rc5-syzkaller-00205-gc96618275234 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106 print_address_description+0x74/0x340 mm/kasan/report.c:306 print_report+0x107/0x1f0 mm/kasan/report.c:417 kasan_report+0xcd/0x100 mm/kasan/report.c:517 crc16+0x206/0x280 lib/crc16.c:58 ext4_group_desc_csum+0x81b/0xb20 fs/ext4/super.c:3187 ext4_group_desc_csum_set+0x195/0x230 fs/ext4/super.c:3210 ext4_mb_clear_bb fs/ext4/mballoc.c:6027 [inline] ext4_free_blocks+0x191a/0x2810 fs/ext4/mballoc.c:6173 ext4_remove_blocks fs/ext4/extents.c:2527 [inline] ext4_ext_rm_leaf fs/ext4/extents.c:2710 [inline] ext4_ext_remove_space+0x24ef/0x46a0 fs/ext4/extents.c:2958 ext4_ext_truncate+0x177/0x220 fs/ext4/extents.c:4416 ext4_truncate+0xa6a/0xea0 fs/ext4/inode.c:4342 ext4_setattr+0x10c8/0x1930 fs/ext4/inode.c:5622 notify_change+0xe50/0x1100 fs/attr.c:482 do_truncate+0x200/0x2f0 fs/open.c:65 handle_truncate fs/namei.c:3216 [inline] do_open fs/namei.c:3561 [inline] path_openat+0x272b/0x2dd0 fs/namei.c:3714 do_filp_open+0x264/0x4f0 fs/namei.c:3741 do_sys_openat2+0x124/0x4e0 fs/open.c:1310 do_sys_open fs/open.c:1326 [inline] __do_sys_creat fs/open.c:1402 [inline] __se_sys_creat fs/open.c:1396 [inline] __x64_sys_creat+0x11f/0x160 fs/open.c:1396 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f72f8a8c0c9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f72f97e3168 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 RAX: ffffffffffffffda RBX: 00007f72f8bac050 RCX: 00007f72f8a8c0c9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000280 RBP: 00007f72f8ae7ae9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd165348bf R14: 00007f72f97e3300 R15: 0000000000022000 Replace le16_to_cpu(sbi->s_es->s_desc_size) with sbi->s_desc_size It reduces ext4's compiled text size, and makes the code more efficient (we remove an extra indirect reference and a potential byte swap on big endian systems), and there is no downside. It also avoids the potential KASAN / syzkaller failure, as a bonus. Reported-by: syzbot+fc51227e7100c9294894(a)syzkaller.appspotmail.com Reported-by: syzbot+8785e41224a3afd04321(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=70d28d11ab14bd7938f3e088365252aa923cff… Link: https://syzkaller.appspot.com/bug?id=b85721b38583ecc6b5e72ff524c67302abbc30… Link: https://lore.kernel.org/all/000000000000ece18705f3b20934@google.com/ Fixes: 717d50e4971b ("Ext4: Uninitialized Block Groups") Cc: stable(a)vger.kernel.org Signed-off-by: Tudor Ambarus <tudor.ambarus(a)linaro.org> Link: https://lore.kernel.org/r/20230504121525.3275886-1-tudor.ambarus@linaro.org Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/ext4/super.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 79f983b4c69b..cc2efe2e6ee2 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -2596,11 +2596,9 @@ static __le16 ext4_group_desc_csum(struct super_block *sb, __u32 block_group, crc = crc16(crc, (__u8 *)gdp, offset); offset += sizeof(gdp->bg_checksum); /* skip checksum */ /* for checksum of struct ext4_group_desc do the rest...*/ - if (ext4_has_feature_64bit(sb) && - offset < le16_to_cpu(sbi->s_es->s_desc_size)) + if (ext4_has_feature_64bit(sb) && offset < sbi->s_desc_size) crc = crc16(crc, (__u8 *)gdp + offset, - le16_to_cpu(sbi->s_es->s_desc_size) - - offset); + sbi->s_desc_size - offset); out: return cpu_to_le16(crc); -- 2.25.1

1 5

[PATCH OLK-5.10 0/2] Remove the automatic loading of the hisi_trng driver
by Weili Qian 26 May '23

26 May '23

From: JiangShui Yang <yangjiangshui(a)h-partners.com> Weili Qian (2): crypto: hisilicon/trng - use %u to print u32 variables crypto/trng: Remove the automatic loading of the hisi_trng driver drivers/crypto/hisilicon/trng/trng.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 2.30.0

1 2

[PATCH 01/15] fix hikptool rciep rsp filed error problem
by veega 26 May '23

26 May '23

From: veega2022 <zhuweijia(a)huawei.com> union hikp_space_rsp 0xF8h is reserved and 0xFCh is cpl_status Signed-off-by: hesiyuan <hesiyuan4(a)huawei.com> --- libhikptdev/src/rciep/hikpt_rciep.c | 2 +- libhikptdev/src/rciep/hikpt_rciep.h | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/libhikptdev/src/rciep/hikpt_rciep.c b/libhikptdev/src/rciep/hikpt_rciep.c index 9b7a82a..5c7e82f 100644 --- a/libhikptdev/src/rciep/hikpt_rciep.c +++ b/libhikptdev/src/rciep/hikpt_rciep.c @@ -97,7 +97,7 @@ static uint32_t hikp_wait_for_cpl_status(void) uint32_t status; do { - status = g_hikp_req->field.cpl_status; + status = g_hikp_rsp->field.cpl_status; if (status != HIKP_INIT_STAT) return status; count--; diff --git a/libhikptdev/src/rciep/hikpt_rciep.h b/libhikptdev/src/rciep/hikpt_rciep.h index 093724a..8fbb3c0 100644 --- a/libhikptdev/src/rciep/hikpt_rciep.h +++ b/libhikptdev/src/rciep/hikpt_rciep.h @@ -75,8 +75,8 @@ union hikp_space_rsp { uint32_t version; /* 000h */ uint32_t rsp_para_num; /* 004h */ uint32_t data[HIKP_RSP_DATA_MAX]; /* 008h */ - uint32_t cpl_status; /* 0F8h */ - uint32_t pid_record; /* 0FCh */ + uint32_t rsv; /* 0F8h */ + uint32_t cpl_status; /* 0FCh */ struct iep_doorbell sw_db; /* 100h. Fixed and unmodifiable */ } field; -- 2.36.1.windows.1

1 0

[PATCH OLK-5.10] Net: ethernet: 3snic 3s9xx network driver add "select NET_DEVLINK"
by Jialin Zhang 24 May '23

24 May '23

3snic inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I77U9U CVE: NA --------------------------- Net: ethernet: 3snic 3s9xx network Kconfig add "select NET_DEVLINK" Signed-off-by: Steven Song <steven.song(a)3snic.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/net/ethernet/3snic/Kconfig | 2 +- drivers/net/ethernet/3snic/sssnic/Kconfig | 2 -- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/net/ethernet/3snic/Kconfig b/drivers/net/ethernet/3snic/Kconfig index 2356f6f46a5c..eb71854198d4 100644 --- a/drivers/net/ethernet/3snic/Kconfig +++ b/drivers/net/ethernet/3snic/Kconfig @@ -5,8 +5,8 @@ config NET_VENDOR_3SNIC bool "3SNIC smart NIC devices" - default y depends on PCI + select NET_DEVLINK help If you have a network (Ethernet) card belonging to this class, say Y. diff --git a/drivers/net/ethernet/3snic/sssnic/Kconfig b/drivers/net/ethernet/3snic/sssnic/Kconfig index c636e57ece94..9a89d62ae5fd 100644 --- a/drivers/net/ethernet/3snic/sssnic/Kconfig +++ b/drivers/net/ethernet/3snic/sssnic/Kconfig @@ -8,7 +8,6 @@ config SSSNIC depends on PCI depends on ARM64 || X86_64 select SSSNIC_HW - default m help This driver supports 3SNIC Ethernet Controller SSSNIC device. For more information about this product, go to the product @@ -22,4 +21,3 @@ config SSSNIC config SSSNIC_HW tristate depends on PCI - default n -- 2.25.1

2 1

[PATCH OLK-5.10] Net: ethernet: 3snic 3s9xx network driver add "select NET_DEVLINK"
by Jialin Zhang 24 May '23

24 May '23

3snic inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I77U9U CVE: NA --------------------------- Net: ethernet: 3snic 3s9xx network Kconfig add "select NET_DEVLINK" Signed-off-by: Steven Song <steven.song(a)3snic.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/net/ethernet/3snic/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/3snic/Kconfig b/drivers/net/ethernet/3snic/Kconfig index 2356f6f46a5c..eb71854198d4 100644 --- a/drivers/net/ethernet/3snic/Kconfig +++ b/drivers/net/ethernet/3snic/Kconfig @@ -5,8 +5,8 @@ config NET_VENDOR_3SNIC bool "3SNIC smart NIC devices" - default y depends on PCI + select NET_DEVLINK help If you have a network (Ethernet) card belonging to this class, say Y. -- 2.25.1

2 1

[PATCH OLK-5.10] Revert "riscv: topology: fix default topology reporting"
by Jialin Zhang 24 May '23

24 May '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I73HJ0 -------------------------------- This reverts commit 932afc18ba98772fe428505c76160428f93e7bde. Fix build error in riscv64: build failed: riscv, allmodconfig arch/riscv/kernel/smpboot.o: In function `smp_callin': (.text+0x160): undefined reference to `store_cpu_topology' arch/riscv/kernel/smpboot.o: In function `smp_prepare_cpus': (.init.text+0x212): undefined reference to `store_cpu_topology' make: *** [vmlinux] Error 1 Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- arch/riscv/Kconfig | 2 +- arch/riscv/kernel/smpboot.c | 4 +--- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig index a63d8134a9e5..e52cd2cefe8e 100644 --- a/arch/riscv/Kconfig +++ b/arch/riscv/Kconfig @@ -36,7 +36,7 @@ config RISCV select CLINT_TIMER if !MMU select COMMON_CLK select EDAC_SUPPORT - select GENERIC_ARCH_TOPOLOGY + select GENERIC_ARCH_TOPOLOGY if SMP select GENERIC_ATOMIC64 if !64BIT select GENERIC_CLOCKEVENTS select GENERIC_EARLY_IOREMAP diff --git a/arch/riscv/kernel/smpboot.c b/arch/riscv/kernel/smpboot.c index 0e0aed380e28..0b04e0eae3ab 100644 --- a/arch/riscv/kernel/smpboot.c +++ b/arch/riscv/kernel/smpboot.c @@ -46,8 +46,6 @@ void __init smp_prepare_cpus(unsigned int max_cpus) int cpuid; int ret; - store_cpu_topology(smp_processor_id()); - /* This covers non-smp usecase mandated by "nosmp" option */ if (max_cpus == 0) return; @@ -154,8 +152,8 @@ asmlinkage __visible void smp_callin(void) mmgrab(mm); current->active_mm = mm; - store_cpu_topology(curr_cpuid); notify_cpu_starting(curr_cpuid); + update_siblings_masks(curr_cpuid); set_cpu_online(curr_cpuid, 1); /* -- 2.25.1

2 1

[OLK-5.10 0/8] Add support for HiSilicon UC/H60PA/PAv3 PMU driver
by Junhao He 23 May '23

23 May '23

1. Compared with the PAv2 PMU, the PAv3 PMU has different event IDs and definitions. The version number in the version register is used to distinguish the event IDs and definitions in the driver. 2. The H60PA PMU and PA are two different devices. The H60PA PMU supports higher bandwidth, and the PA PMU delay is relatively low. Different HIDs are used to distinguish the delay. 3. Each cluster is integrated with a unified cache (UC) PMU, which provides consistency between NUMA and UMA domains. It sits between L2 and the memory system. Chen Jun (1): perf: hisi: Extract hisi_pmu_init Junhao He (7): drivers/perf: hisi: Advertise the PERF_PMU_CAP_NO_EXCLUDE capability drivers/perf: hisi: Simplify the parameters of hisi_pmu_init() drivers/perf: hisi: Extract initialization of "cpa_pmu->pmu" drivers/perf: hisi: Remove redundant initialized of pmu->name drivers/perf: hisi: add NULL check for name drivers/perf: hisi: Add support for HiSilicon H60PA and PAv3 PMU driver drivers/perf: hisi: Add support for HiSilicon UC PMU driver drivers/perf/hisilicon/Makefile | 2 +- drivers/perf/hisilicon/hisi_uncore_cpa_pmu.c | 16 +- drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c | 33 +- drivers/perf/hisilicon/hisi_uncore_hha_pmu.c | 23 +- drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c | 27 +- drivers/perf/hisilicon/hisi_uncore_pa_pmu.c | 156 ++++- drivers/perf/hisilicon/hisi_uncore_pmu.c | 24 +- drivers/perf/hisilicon/hisi_uncore_pmu.h | 43 +- drivers/perf/hisilicon/hisi_uncore_sllc_pmu.c | 15 +- drivers/perf/hisilicon/hisi_uncore_uc_pmu.c | 577 ++++++++++++++++++ 10 files changed, 792 insertions(+), 124 deletions(-) create mode 100644 drivers/perf/hisilicon/hisi_uncore_uc_pmu.c -- 2.30.0

1 8

[PATCH OLK-5.10 0/2] ACC support no-sva feature
by Weili Qian 22 May '23

22 May '23

From: JiangShui Yang <yangjiangshui(a)h-partners.com> Weili Qian (1): crypto: hisilicon/qm - support no-sva feature Kai Ye (1): uacce: add features from kernel not support drivers/crypto/hisilicon/hpre/hpre_main.c | 13 +- drivers/crypto/hisilicon/qm.c | 250 +++++++--- drivers/crypto/hisilicon/sec2/sec.h | 1 - drivers/crypto/hisilicon/sec2/sec_crypto.c | 2 +- drivers/crypto/hisilicon/sec2/sec_main.c | 20 +- drivers/crypto/hisilicon/zip/zip_main.c | 2 +- drivers/misc/uacce/Kconfig | 3 +- drivers/misc/uacce/Makefile | 0 drivers/misc/uacce/uacce.c | 508 ++++++++++++++++++++- include/linux/hisi_acc_qm.h | 7 +- include/linux/uacce.h | 46 +- include/uapi/misc/uacce/hisi_qm.h | 28 +- include/uapi/misc/uacce/uacce.h | 53 ++- 13 files changed, 810 insertions(+), 123 deletions(-) mode change 100644 => 100755 drivers/misc/uacce/Kconfig mode change 100644 => 100755 drivers/misc/uacce/Makefile mode change 100644 => 100755 include/uapi/misc/uacce/hisi_qm.h mode change 100644 => 100755 include/uapi/misc/uacce/uacce.h -- 2.30.0

1 2

[PATCH OLK-5.10 00/11] Patchset related to sendbuf and rmb buffer.
by Litao Jiao 22 May '23

22 May '23

*** BLURB HERE *** 48147 (10): net/smc: add sysctl interface for SMC net/smc: fix compile warning for smc_sysctl net/smc: fix -Wmissing-prototypes warning when CONFIG_SYSCTL not set net/smc: fix a memory leak in smc_sysctl_net_exit() net/smc: Introduce a sysctl for setting SMC-R buffer type net/smc: Use sysctl-specified types of buffers in new link group net/smc: Allow SMC-D 1MB DMB allocations net/smc: Allow virtually contiguous sndbufs or RMBs for SMC-R net/smc: Unbind r/w buffer size from clcsock and make them tunable net/smc: Add size match for smc_buf_get_slot Litao Jiao (1): net/smc: Tune the maximum size of virtually contiguous sndbufs or RMBs for SMC-R Documentation/networking/smc-sysctl.rst | 41 ++++ include/net/net_namespace.h | 5 +- include/net/netns/smc.h | 13 ++ net/smc/Makefile | 1 + net/smc/af_smc.c | 78 ++++++- net/smc/smc_clc.c | 8 +- net/smc/smc_clc.h | 2 +- net/smc/smc_core.c | 265 ++++++++++++++++-------- net/smc/smc_core.h | 17 +- net/smc/smc_ib.c | 15 +- net/smc/smc_llc.c | 26 ++- net/smc/smc_rx.c | 90 ++++++-- net/smc/smc_sysctl.c | 93 +++++++++ net/smc/smc_sysctl.h | 32 +++ net/smc/smc_tx.c | 7 +- 15 files changed, 556 insertions(+), 137 deletions(-) create mode 100644 Documentation/networking/smc-sysctl.rst create mode 100644 include/net/netns/smc.h create mode 100644 net/smc/smc_sysctl.c create mode 100644 net/smc/smc_sysctl.h -- 2.33.0

1 11

[PATCH openEuler-22.03-LTS-SP1 1/2] xfs: verify buffer contents when we skip log replay
by Jialin Zhang 22 May '23

22 May '23

From: "Darrick J. Wong" <djwong(a)kernel.org> mainline inclusion from mainline-v6.3-rc6 commit 22ed903eee23a5b174e240f1cdfa9acf393a5210 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6X4UN CVE: CVE-2023-2124 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot detected a crash during log recovery: XFS (loop0): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 XFS (loop0): Torn write (CRC failure) detected at log block 0x180. Truncating head block from 0x200. XFS (loop0): Starting recovery (logdev: internal) ================================================================== BUG: KASAN: slab-out-of-bounds in xfs_btree_lookup_get_block+0x15c/0x6d0 fs/xfs/libxfs/xfs_btree.c:1813 Read of size 8 at addr ffff88807e89f258 by task syz-executor132/5074 CPU: 0 PID: 5074 Comm: syz-executor132 Not tainted 6.2.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106 print_address_description+0x74/0x340 mm/kasan/report.c:306 print_report+0x107/0x1f0 mm/kasan/report.c:417 kasan_report+0xcd/0x100 mm/kasan/report.c:517 xfs_btree_lookup_get_block+0x15c/0x6d0 fs/xfs/libxfs/xfs_btree.c:1813 xfs_btree_lookup+0x346/0x12c0 fs/xfs/libxfs/xfs_btree.c:1913 xfs_btree_simple_query_range+0xde/0x6a0 fs/xfs/libxfs/xfs_btree.c:4713 xfs_btree_query_range+0x2db/0x380 fs/xfs/libxfs/xfs_btree.c:4953 xfs_refcount_recover_cow_leftovers+0x2d1/0xa60 fs/xfs/libxfs/xfs_refcount.c:1946 xfs_reflink_recover_cow+0xab/0x1b0 fs/xfs/xfs_reflink.c:930 xlog_recover_finish+0x824/0x920 fs/xfs/xfs_log_recover.c:3493 xfs_log_mount_finish+0x1ec/0x3d0 fs/xfs/xfs_log.c:829 xfs_mountfs+0x146a/0x1ef0 fs/xfs/xfs_mount.c:933 xfs_fs_fill_super+0xf95/0x11f0 fs/xfs/xfs_super.c:1666 get_tree_bdev+0x400/0x620 fs/super.c:1282 vfs_get_tree+0x88/0x270 fs/super.c:1489 do_new_mount+0x289/0xad0 fs/namespace.c:3145 do_mount fs/namespace.c:3488 [inline] __do_sys_mount fs/namespace.c:3697 [inline] __se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3674 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f89fa3f4aca Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fffd5fb5ef8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00646975756f6e2c RCX: 00007f89fa3f4aca RDX: 0000000020000100 RSI: 0000000020009640 RDI: 00007fffd5fb5f10 RBP: 00007fffd5fb5f10 R08: 00007fffd5fb5f50 R09: 000000000000970d R10: 0000000000200800 R11: 0000000000000206 R12: 0000000000000004 R13: 0000555556c6b2c0 R14: 0000000000200800 R15: 00007fffd5fb5f50 </TASK> The fuzzed image contains an AGF with an obviously garbage agf_refcount_level value of 32, and a dirty log with a buffer log item for that AGF. The ondisk AGF has a higher LSN than the recovered log item. xlog_recover_buf_commit_pass2 reads the buffer, compares the LSNs, and decides to skip replay because the ondisk buffer appears to be newer. Unfortunately, the ondisk buffer is corrupt, but recovery just read the buffer with no buffer ops specified: error = xfs_buf_read(mp->m_ddev_targp, buf_f->blf_blkno, buf_f->blf_len, buf_flags, &bp, NULL); Skipping the buffer leaves its contents in memory unverified. This sets us up for a kernel crash because xfs_refcount_recover_cow_leftovers reads the buffer (which is still around in XBF_DONE state, so no read verification) and creates a refcountbt cursor of height 32. This is impossible so we run off the end of the cursor object and crash. Fix this by invoking the verifier on all skipped buffers and aborting log recovery if the ondisk buffer is corrupt. It might be smarter to force replay the log item atop the buffer and then see if it'll pass the write verifier (like ext4 does) but for now let's go with the conservative option where we stop immediately. Link: https://syzkaller.appspot.com/bug?extid=7e9494b8b399902e994e Signed-off-by: Darrick J. Wong <djwong(a)kernel.org> Reviewed-by: Dave Chinner <dchinner(a)redhat.com> Signed-off-by: Dave Chinner <david(a)fromorbit.com> Signed-off-by: Long Li <leo.lilong(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- fs/xfs/xfs_buf_item_recover.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/fs/xfs/xfs_buf_item_recover.c b/fs/xfs/xfs_buf_item_recover.c index 4b2ad8dce690..d892125eb022 100644 --- a/fs/xfs/xfs_buf_item_recover.c +++ b/fs/xfs/xfs_buf_item_recover.c @@ -943,6 +943,16 @@ xlog_recover_buf_commit_pass2( if (lsn && lsn != -1 && XFS_LSN_CMP(lsn, current_lsn) >= 0) { trace_xfs_log_recover_buf_skip(log, buf_f); xlog_recover_validate_buf_type(mp, bp, buf_f, NULLCOMMITLSN); + + /* + * We're skipping replay of this buffer log item due to the log + * item LSN being behind the ondisk buffer. Verify the buffer + * contents since we aren't going to run the write verifier. + */ + if (bp->b_ops) { + bp->b_ops->verify_read(bp); + error = bp->b_error; + } goto out_release; } -- 2.25.1

1 1