- Kernel - mailweb.openeuler.org

[PATCH kernel-4.19 1/2] Revert "ext4: fix panic when mount failed with parallel flush_stashed_error_work"
by Yang Yingliang 13 Oct '21

13 Oct '21

From: yangerkun <yangerkun(a)huawei.com> hulk inclusion category: bugfix bugzilla: 172146, https://gitee.com/openeuler/kernel/issues/I46HJ6 CVE: NA --------------------------- This reverts commit 881543818e4af30765ffb2604cd70a90f6007427. We will include the mainline patch, revert this now. Signed-off-by: yangerkun <yangerkun(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/ext4/super.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 280e991e61f47..d793e597c0623 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -4832,7 +4832,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) sbi->s_ea_block_cache = NULL; } if (sbi->s_journal) { - flush_work(&sbi->s_error_work); jbd2_journal_destroy(sbi->s_journal); sbi->s_journal = NULL; } -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/3] ext4: use true,false for bool variable
by Yang Yingliang 13 Oct '21

13 Oct '21

From: zhengbin <zhengbin13(a)huawei.com> mainline inclusion from mainline-5.6-rc1 commit 4756ee183f25b1fa2a7306a439da3bcd687244e0 category: bugfix bugzilla: 181871, https://gitee.com/openeuler/kernel/issues/I4DP71 CVE: NA --------------------------- Fixes coccicheck warning: fs/ext4/extents.c:5271:6-12: WARNING: Assignment of 0/1 to bool variable fs/ext4/extents.c:5287:4-10: WARNING: Assignment of 0/1 to bool variable Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: zhengbin <zhengbin13(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/1577241959-138695-1-git-send-email-zhengbin13@hua… Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: yangerkun <yangerkun(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/ext4/extents.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index 6a0aab71a01f0..fe7398a5888b6 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -5295,7 +5295,7 @@ ext4_ext_shift_path_extents(struct ext4_ext_path *path, ext4_lblk_t shift, { int depth, err = 0; struct ext4_extent *ex_start, *ex_last; - bool update = 0; + bool update = false; depth = path->p_depth; while (depth >= 0) { @@ -5311,7 +5311,7 @@ ext4_ext_shift_path_extents(struct ext4_ext_path *path, ext4_lblk_t shift, goto out; if (ex_start == EXT_FIRST_EXTENT(path[depth].p_hdr)) - update = 1; + update = true; while (ex_start <= ex_last) { if (SHIFT == SHIFT_LEFT) { -- 2.25.1

1 2

[PATCH kernel-4.19 1/3] ext4: use true,false for bool variable
by Yang Yingliang 13 Oct '21

13 Oct '21

From: zhengbin <zhengbin13(a)huawei.com> mainline inclusion from mainline-5.6-rc1 commit 4756ee183f25b1fa2a7306a439da3bcd687244e0 category: bugfix bugzilla: 181871, https://gitee.com/openeuler/kernel/issues/I4DP71 CVE: NA --------------------------- Fixes coccicheck warning: fs/ext4/extents.c:5271:6-12: WARNING: Assignment of 0/1 to bool variable fs/ext4/extents.c:5287:4-10: WARNING: Assignment of 0/1 to bool variable Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: zhengbin <zhengbin13(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/1577241959-138695-1-git-send-email-zhengbin13@hua… Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: yangerkun <yangerkun(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/ext4/extents.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index 6a0aab71a01f0..fe7398a5888b6 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -5295,7 +5295,7 @@ ext4_ext_shift_path_extents(struct ext4_ext_path *path, ext4_lblk_t shift, { int depth, err = 0; struct ext4_extent *ex_start, *ex_last; - bool update = 0; + bool update = false; depth = path->p_depth; while (depth >= 0) { @@ -5311,7 +5311,7 @@ ext4_ext_shift_path_extents(struct ext4_ext_path *path, ext4_lblk_t shift, goto out; if (ex_start == EXT_FIRST_EXTENT(path[depth].p_hdr)) - update = 1; + update = true; while (ex_start <= ex_last) { if (SHIFT == SHIFT_LEFT) { -- 2.25.1

1 2

[PATCH OLK-5.10 v4 0/2] net: spnic: initial commit Ramaxel NIC driver
by Yanling Song 13 Oct '21

13 Oct '21

This initial commit contains Ramaxel's spnic module Changes since v3: - Change VXLAN_OFFLOAD_PORT_LE to VXLAN_OFFLOAD_PORT_BE; Changes since v2: - Solve the "new blank line at EOF" error; - Change SPHW_COMM_H to SPHW_HW_COMM_H; Changes since v1: - Solve the compile error Yanling Song (2): net: spnic: initial commit the common module of Ramaxel NIC driver spnic: add NIC layer arch/arm64/configs/openeuler_defconfig | 2 + arch/x86/configs/openeuler_defconfig | 2 + drivers/net/ethernet/Kconfig | 1 + drivers/net/ethernet/Makefile | 1 + drivers/net/ethernet/ramaxel/Kconfig | 20 + drivers/net/ethernet/ramaxel/Makefile | 6 + drivers/net/ethernet/ramaxel/spnic/Kconfig | 14 + drivers/net/ethernet/ramaxel/spnic/Makefile | 39 + .../ethernet/ramaxel/spnic/hw/sphw_api_cmd.c | 1165 +++++++++++ .../ethernet/ramaxel/spnic/hw/sphw_api_cmd.h | 277 +++ .../ethernet/ramaxel/spnic/hw/sphw_cfg_cmd.h | 126 ++ .../net/ethernet/ramaxel/spnic/hw/sphw_cmdq.c | 1605 +++++++++++++++ .../net/ethernet/ramaxel/spnic/hw/sphw_cmdq.h | 195 ++ .../ethernet/ramaxel/spnic/hw/sphw_comm_cmd.h | 60 + .../ramaxel/spnic/hw/sphw_comm_msg_intf.h | 273 +++ .../ethernet/ramaxel/spnic/hw/sphw_common.c | 88 + .../ethernet/ramaxel/spnic/hw/sphw_common.h | 118 ++ .../net/ethernet/ramaxel/spnic/hw/sphw_crm.h | 984 +++++++++ .../net/ethernet/ramaxel/spnic/hw/sphw_csr.h | 171 ++ .../net/ethernet/ramaxel/spnic/hw/sphw_eqs.c | 1374 +++++++++++++ .../net/ethernet/ramaxel/spnic/hw/sphw_eqs.h | 157 ++ .../net/ethernet/ramaxel/spnic/hw/sphw_hw.h | 649 ++++++ .../ethernet/ramaxel/spnic/hw/sphw_hw_cfg.c | 1338 ++++++++++++ .../ethernet/ramaxel/spnic/hw/sphw_hw_cfg.h | 326 +++ .../ethernet/ramaxel/spnic/hw/sphw_hw_comm.c | 1253 ++++++++++++ .../ethernet/ramaxel/spnic/hw/sphw_hw_comm.h | 42 + .../ethernet/ramaxel/spnic/hw/sphw_hwdev.c | 1402 +++++++++++++ .../ethernet/ramaxel/spnic/hw/sphw_hwdev.h | 93 + .../net/ethernet/ramaxel/spnic/hw/sphw_hwif.c | 911 +++++++++ .../net/ethernet/ramaxel/spnic/hw/sphw_hwif.h | 102 + .../net/ethernet/ramaxel/spnic/hw/sphw_mbox.c | 1808 +++++++++++++++++ .../net/ethernet/ramaxel/spnic/hw/sphw_mbox.h | 273 +++ .../net/ethernet/ramaxel/spnic/hw/sphw_mgmt.c | 1382 +++++++++++++ .../net/ethernet/ramaxel/spnic/hw/sphw_mgmt.h | 156 ++ .../ramaxel/spnic/hw/sphw_mgmt_msg_base.h | 19 + .../net/ethernet/ramaxel/spnic/hw/sphw_mt.h | 534 +++++ .../ramaxel/spnic/hw/sphw_prof_adap.c | 94 + .../ramaxel/spnic/hw/sphw_prof_adap.h | 49 + .../ethernet/ramaxel/spnic/hw/sphw_profile.h | 36 + .../net/ethernet/ramaxel/spnic/hw/sphw_wq.c | 152 ++ .../net/ethernet/ramaxel/spnic/hw/sphw_wq.h | 119 ++ .../net/ethernet/ramaxel/spnic/spnic_dbg.c | 752 +++++++ .../net/ethernet/ramaxel/spnic/spnic_dcb.c | 965 +++++++++ .../net/ethernet/ramaxel/spnic/spnic_dcb.h | 56 + .../ethernet/ramaxel/spnic/spnic_dev_mgmt.c | 811 ++++++++ .../ethernet/ramaxel/spnic/spnic_dev_mgmt.h | 78 + .../ethernet/ramaxel/spnic/spnic_ethtool.c | 988 +++++++++ .../ramaxel/spnic/spnic_ethtool_stats.c | 1035 ++++++++++ .../net/ethernet/ramaxel/spnic/spnic_filter.c | 411 ++++ .../net/ethernet/ramaxel/spnic/spnic_irq.c | 178 ++ .../net/ethernet/ramaxel/spnic/spnic_lld.c | 937 +++++++++ .../net/ethernet/ramaxel/spnic/spnic_lld.h | 75 + .../ethernet/ramaxel/spnic/spnic_mag_cfg.c | 778 +++++++ .../ethernet/ramaxel/spnic/spnic_mag_cmd.h | 643 ++++++ .../net/ethernet/ramaxel/spnic/spnic_main.c | 925 +++++++++ .../ramaxel/spnic/spnic_mgmt_interface.h | 617 ++++++ .../ethernet/ramaxel/spnic/spnic_netdev_ops.c | 1526 ++++++++++++++ .../net/ethernet/ramaxel/spnic/spnic_nic.h | 148 ++ .../ethernet/ramaxel/spnic/spnic_nic_cfg.c | 1321 ++++++++++++ .../ethernet/ramaxel/spnic/spnic_nic_cfg.h | 724 +++++++ .../ethernet/ramaxel/spnic/spnic_nic_cfg_vf.c | 647 ++++++ .../ethernet/ramaxel/spnic/spnic_nic_cmd.h | 105 + .../ethernet/ramaxel/spnic/spnic_nic_dbg.c | 151 ++ .../ethernet/ramaxel/spnic/spnic_nic_dbg.h | 16 + .../ethernet/ramaxel/spnic/spnic_nic_dev.h | 352 ++++ .../ethernet/ramaxel/spnic/spnic_nic_event.c | 506 +++++ .../net/ethernet/ramaxel/spnic/spnic_nic_io.c | 1123 ++++++++++ .../net/ethernet/ramaxel/spnic/spnic_nic_io.h | 309 +++ .../net/ethernet/ramaxel/spnic/spnic_nic_qp.h | 421 ++++ .../net/ethernet/ramaxel/spnic/spnic_ntuple.c | 841 ++++++++ .../ethernet/ramaxel/spnic/spnic_pci_id_tbl.h | 12 + .../net/ethernet/ramaxel/spnic/spnic_rss.c | 750 +++++++ .../net/ethernet/ramaxel/spnic/spnic_rss.h | 48 + .../ethernet/ramaxel/spnic/spnic_rss_cfg.c | 390 ++++ drivers/net/ethernet/ramaxel/spnic/spnic_rx.c | 1249 ++++++++++++ drivers/net/ethernet/ramaxel/spnic/spnic_rx.h | 118 ++ .../net/ethernet/ramaxel/spnic/spnic_sriov.c | 200 ++ .../net/ethernet/ramaxel/spnic/spnic_sriov.h | 24 + drivers/net/ethernet/ramaxel/spnic/spnic_tx.c | 879 ++++++++ drivers/net/ethernet/ramaxel/spnic/spnic_tx.h | 129 ++ 80 files changed, 38654 insertions(+) create mode 100644 drivers/net/ethernet/ramaxel/Kconfig create mode 100644 drivers/net/ethernet/ramaxel/Makefile create mode 100644 drivers/net/ethernet/ramaxel/spnic/Kconfig create mode 100644 drivers/net/ethernet/ramaxel/spnic/Makefile create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_api_cmd.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_api_cmd.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_cfg_cmd.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_cmdq.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_cmdq.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_comm_cmd.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_comm_msg_intf.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_common.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_common.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_crm.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_csr.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_eqs.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_eqs.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hw.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hw_cfg.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hw_cfg.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hw_comm.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hw_comm.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hwdev.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hwdev.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hwif.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hwif.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_mbox.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_mbox.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_mgmt.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_mgmt.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_mgmt_msg_base.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_mt.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_prof_adap.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_prof_adap.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_profile.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_wq.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_wq.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_dbg.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_dcb.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_dcb.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_dev_mgmt.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_dev_mgmt.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_ethtool.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_ethtool_stats.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_filter.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_irq.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_lld.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_lld.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_mag_cfg.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_mag_cmd.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_main.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_mgmt_interface.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_netdev_ops.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_cfg.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_cfg.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_cfg_vf.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_cmd.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_dbg.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_dbg.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_dev.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_event.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_io.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_io.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_qp.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_ntuple.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_pci_id_tbl.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_rss.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_rss.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_rss_cfg.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_rx.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_rx.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_sriov.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_sriov.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_tx.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_tx.h -- 2.30.0

2 3

[PATCH openEuler-5.10 001/136] module: limit enabling module.sig_enforce
by Zheng Zengkai 12 Oct '21

12 Oct '21

From: Mimi Zohar <zohar(a)linux.ibm.com> stable inclusion from stable-5.10.47 commit 3051f230f19feb02dfe5b36794f8c883b576e184 bugzilla: 172973 https://gitee.com/openeuler/kernel/issues/I4DAKB Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0c18f29aae7ce3dadd26d8ee3505d07cc982df75 ] Irrespective as to whether CONFIG_MODULE_SIG is configured, specifying "module.sig_enforce=1" on the boot command line sets "sig_enforce". Only allow "sig_enforce" to be set when CONFIG_MODULE_SIG is configured. This patch makes the presence of /sys/module/module/parameters/sig_enforce dependent on CONFIG_MODULE_SIG=y. Fixes: fda784e50aac ("module: export module signature enforcement status") Reported-by: Nayna Jain <nayna(a)linux.ibm.com> Tested-by: Mimi Zohar <zohar(a)linux.ibm.com> Tested-by: Jessica Yu <jeyu(a)kernel.org> Signed-off-by: Mimi Zohar <zohar(a)linux.ibm.com> Signed-off-by: Jessica Yu <jeyu(a)kernel.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Acked-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- kernel/module.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/kernel/module.c b/kernel/module.c index a54dda703feb..c5af21dcb873 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -272,9 +272,18 @@ static void module_assert_mutex_or_preempt(void) #endif } +#ifdef CONFIG_MODULE_SIG static bool sig_enforce = IS_ENABLED(CONFIG_MODULE_SIG_FORCE); module_param(sig_enforce, bool_enable_only, 0644); +void set_module_sig_enforced(void) +{ + sig_enforce = true; +} +#else +#define sig_enforce false +#endif + /* * Export sig_enforce kernel cmdline parameter to allow other subsystems rely * on that instead of directly to CONFIG_MODULE_SIG_FORCE config. @@ -285,11 +294,6 @@ bool is_module_sig_enforced(void) } EXPORT_SYMBOL(is_module_sig_enforced); -void set_module_sig_enforced(void) -{ - sig_enforce = true; -} - /* Block module loading/unloading? */ int modules_disabled = 0; core_param(nomodule, modules_disabled, bint, 0); -- 2.20.1

1 135

【Meeting Notice】openEuler kernel 技术分享第十三期 & 双周例会 Time: 2021-10-15 14:00-16:30
by Meeting Book 12 Oct '21

12 Oct '21

1 0

[PATCH openEuler-1.0-LTS] net: 6pack: fix slab-out-of-bounds in decode_data
by Yang Yingliang 12 Oct '21

12 Oct '21

From: Pavel Skripkin <paskripkin(a)gmail.com> stable inclusion from linux-4.19.205 commit 4e370cc081a78ee23528311ca58fd98a06768ec7 CVE: CVE-2021-42008 -------------------------------- [ Upstream commit 19d1532a187669ce86d5a2696eb7275310070793 ] Syzbot reported slab-out-of bounds write in decode_data(). The problem was in missing validation checks. Syzbot's reproducer generated malicious input, which caused decode_data() to be called a lot in sixpack_decode(). Since rx_count_cooked is only 400 bytes and noone reported before, that 400 bytes is not enough, let's just check if input is malicious and complain about buffer overrun. Fail log: ================================================================== BUG: KASAN: slab-out-of-bounds in drivers/net/hamradio/6pack.c:843 Write of size 1 at addr ffff888087c5544e by task kworker/u4:0/7 CPU: 0 PID: 7 Comm: kworker/u4:0 Not tainted 5.6.0-rc3-syzkaller #0 ... Workqueue: events_unbound flush_to_ldisc Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374 __kasan_report.cold+0x1b/0x32 mm/kasan/report.c:506 kasan_report+0x12/0x20 mm/kasan/common.c:641 __asan_report_store1_noabort+0x17/0x20 mm/kasan/generic_report.c:137 decode_data.part.0+0x23b/0x270 drivers/net/hamradio/6pack.c:843 decode_data drivers/net/hamradio/6pack.c:965 [inline] sixpack_decode drivers/net/hamradio/6pack.c:968 [inline] Reported-and-tested-by: syzbot+fc8cd9a673d4577fb2e4(a)syzkaller.appspotmail.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Pavel Skripkin <paskripkin(a)gmail.com> Reviewed-by: Dan Carpenter <dan.carpenter(a)oracle.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> --- drivers/net/hamradio/6pack.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c index 8c636c4932274..1001e9a2edd4f 100644 --- a/drivers/net/hamradio/6pack.c +++ b/drivers/net/hamradio/6pack.c @@ -859,6 +859,12 @@ static void decode_data(struct sixpack *sp, unsigned char inbyte) return; } + if (sp->rx_count_cooked + 2 >= sizeof(sp->cooked_buf)) { + pr_err("6pack: cooked buffer overrun, data loss\n"); + sp->rx_count = 0; + return; + } + buf = sp->raw_buf; sp->cooked_buf[sp->rx_count_cooked++] = buf[0] | ((buf[1] << 2) & 0xc0); -- 2.25.1

1 0

[PATCH OLK-5.10 v3 0/2] net: spnic: initial commit Ramaxel NIC driver
by Yanling Song 12 Oct '21

12 Oct '21

This initial commit contains Ramaxel's spnic module Changes since v2: - Solve the "new blank line at EOF" error; - Change SPHW_COMM_H to SPHW_HW_COMM_H; Changes since v1: - Solve the compile error Yanling Song (2): net: spnic: initial commit the common module of Ramaxel NIC driver spnic: add NIC layer arch/arm64/configs/openeuler_defconfig | 2 + arch/x86/configs/openeuler_defconfig | 2 + drivers/net/ethernet/Kconfig | 1 + drivers/net/ethernet/Makefile | 1 + drivers/net/ethernet/ramaxel/Kconfig | 20 + drivers/net/ethernet/ramaxel/Makefile | 6 + drivers/net/ethernet/ramaxel/spnic/Kconfig | 14 + drivers/net/ethernet/ramaxel/spnic/Makefile | 39 + .../ethernet/ramaxel/spnic/hw/sphw_api_cmd.c | 1165 +++++++++++ .../ethernet/ramaxel/spnic/hw/sphw_api_cmd.h | 277 +++ .../ethernet/ramaxel/spnic/hw/sphw_cfg_cmd.h | 126 ++ .../net/ethernet/ramaxel/spnic/hw/sphw_cmdq.c | 1605 +++++++++++++++ .../net/ethernet/ramaxel/spnic/hw/sphw_cmdq.h | 195 ++ .../ethernet/ramaxel/spnic/hw/sphw_comm_cmd.h | 60 + .../ramaxel/spnic/hw/sphw_comm_msg_intf.h | 273 +++ .../ethernet/ramaxel/spnic/hw/sphw_common.c | 88 + .../ethernet/ramaxel/spnic/hw/sphw_common.h | 118 ++ .../net/ethernet/ramaxel/spnic/hw/sphw_crm.h | 984 +++++++++ .../net/ethernet/ramaxel/spnic/hw/sphw_csr.h | 171 ++ .../net/ethernet/ramaxel/spnic/hw/sphw_eqs.c | 1374 +++++++++++++ .../net/ethernet/ramaxel/spnic/hw/sphw_eqs.h | 157 ++ .../net/ethernet/ramaxel/spnic/hw/sphw_hw.h | 649 ++++++ .../ethernet/ramaxel/spnic/hw/sphw_hw_cfg.c | 1338 ++++++++++++ .../ethernet/ramaxel/spnic/hw/sphw_hw_cfg.h | 326 +++ .../ethernet/ramaxel/spnic/hw/sphw_hw_comm.c | 1253 ++++++++++++ .../ethernet/ramaxel/spnic/hw/sphw_hw_comm.h | 42 + .../ethernet/ramaxel/spnic/hw/sphw_hwdev.c | 1402 +++++++++++++ .../ethernet/ramaxel/spnic/hw/sphw_hwdev.h | 93 + .../net/ethernet/ramaxel/spnic/hw/sphw_hwif.c | 911 +++++++++ .../net/ethernet/ramaxel/spnic/hw/sphw_hwif.h | 102 + .../net/ethernet/ramaxel/spnic/hw/sphw_mbox.c | 1808 +++++++++++++++++ .../net/ethernet/ramaxel/spnic/hw/sphw_mbox.h | 273 +++ .../net/ethernet/ramaxel/spnic/hw/sphw_mgmt.c | 1382 +++++++++++++ .../net/ethernet/ramaxel/spnic/hw/sphw_mgmt.h | 156 ++ .../ramaxel/spnic/hw/sphw_mgmt_msg_base.h | 19 + .../net/ethernet/ramaxel/spnic/hw/sphw_mt.h | 534 +++++ .../ramaxel/spnic/hw/sphw_prof_adap.c | 94 + .../ramaxel/spnic/hw/sphw_prof_adap.h | 49 + .../ethernet/ramaxel/spnic/hw/sphw_profile.h | 36 + .../net/ethernet/ramaxel/spnic/hw/sphw_wq.c | 152 ++ .../net/ethernet/ramaxel/spnic/hw/sphw_wq.h | 119 ++ .../net/ethernet/ramaxel/spnic/spnic_dbg.c | 752 +++++++ .../net/ethernet/ramaxel/spnic/spnic_dcb.c | 965 +++++++++ .../net/ethernet/ramaxel/spnic/spnic_dcb.h | 56 + .../ethernet/ramaxel/spnic/spnic_dev_mgmt.c | 811 ++++++++ .../ethernet/ramaxel/spnic/spnic_dev_mgmt.h | 78 + .../ethernet/ramaxel/spnic/spnic_ethtool.c | 988 +++++++++ .../ramaxel/spnic/spnic_ethtool_stats.c | 1035 ++++++++++ .../net/ethernet/ramaxel/spnic/spnic_filter.c | 411 ++++ .../net/ethernet/ramaxel/spnic/spnic_irq.c | 178 ++ .../net/ethernet/ramaxel/spnic/spnic_lld.c | 937 +++++++++ .../net/ethernet/ramaxel/spnic/spnic_lld.h | 75 + .../ethernet/ramaxel/spnic/spnic_mag_cfg.c | 778 +++++++ .../ethernet/ramaxel/spnic/spnic_mag_cmd.h | 643 ++++++ .../net/ethernet/ramaxel/spnic/spnic_main.c | 925 +++++++++ .../ramaxel/spnic/spnic_mgmt_interface.h | 617 ++++++ .../ethernet/ramaxel/spnic/spnic_netdev_ops.c | 1526 ++++++++++++++ .../net/ethernet/ramaxel/spnic/spnic_nic.h | 148 ++ .../ethernet/ramaxel/spnic/spnic_nic_cfg.c | 1321 ++++++++++++ .../ethernet/ramaxel/spnic/spnic_nic_cfg.h | 724 +++++++ .../ethernet/ramaxel/spnic/spnic_nic_cfg_vf.c | 647 ++++++ .../ethernet/ramaxel/spnic/spnic_nic_cmd.h | 105 + .../ethernet/ramaxel/spnic/spnic_nic_dbg.c | 151 ++ .../ethernet/ramaxel/spnic/spnic_nic_dbg.h | 16 + .../ethernet/ramaxel/spnic/spnic_nic_dev.h | 352 ++++ .../ethernet/ramaxel/spnic/spnic_nic_event.c | 506 +++++ .../net/ethernet/ramaxel/spnic/spnic_nic_io.c | 1123 ++++++++++ .../net/ethernet/ramaxel/spnic/spnic_nic_io.h | 309 +++ .../net/ethernet/ramaxel/spnic/spnic_nic_qp.h | 421 ++++ .../net/ethernet/ramaxel/spnic/spnic_ntuple.c | 841 ++++++++ .../ethernet/ramaxel/spnic/spnic_pci_id_tbl.h | 12 + .../net/ethernet/ramaxel/spnic/spnic_rss.c | 750 +++++++ .../net/ethernet/ramaxel/spnic/spnic_rss.h | 48 + .../ethernet/ramaxel/spnic/spnic_rss_cfg.c | 390 ++++ drivers/net/ethernet/ramaxel/spnic/spnic_rx.c | 1249 ++++++++++++ drivers/net/ethernet/ramaxel/spnic/spnic_rx.h | 118 ++ .../net/ethernet/ramaxel/spnic/spnic_sriov.c | 200 ++ .../net/ethernet/ramaxel/spnic/spnic_sriov.h | 24 + drivers/net/ethernet/ramaxel/spnic/spnic_tx.c | 879 ++++++++ drivers/net/ethernet/ramaxel/spnic/spnic_tx.h | 129 ++ 80 files changed, 38654 insertions(+) create mode 100644 drivers/net/ethernet/ramaxel/Kconfig create mode 100644 drivers/net/ethernet/ramaxel/Makefile create mode 100644 drivers/net/ethernet/ramaxel/spnic/Kconfig create mode 100644 drivers/net/ethernet/ramaxel/spnic/Makefile create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_api_cmd.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_api_cmd.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_cfg_cmd.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_cmdq.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_cmdq.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_comm_cmd.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_comm_msg_intf.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_common.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_common.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_crm.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_csr.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_eqs.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_eqs.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hw.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hw_cfg.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hw_cfg.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hw_comm.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hw_comm.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hwdev.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hwdev.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hwif.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hwif.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_mbox.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_mbox.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_mgmt.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_mgmt.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_mgmt_msg_base.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_mt.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_prof_adap.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_prof_adap.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_profile.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_wq.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_wq.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_dbg.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_dcb.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_dcb.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_dev_mgmt.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_dev_mgmt.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_ethtool.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_ethtool_stats.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_filter.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_irq.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_lld.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_lld.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_mag_cfg.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_mag_cmd.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_main.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_mgmt_interface.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_netdev_ops.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_cfg.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_cfg.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_cfg_vf.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_cmd.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_dbg.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_dbg.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_dev.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_event.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_io.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_io.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_qp.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_ntuple.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_pci_id_tbl.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_rss.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_rss.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_rss_cfg.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_rx.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_rx.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_sriov.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_sriov.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_tx.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_tx.h -- 2.30.0

1 2

[PATCH v2 OLK-5.10 0/2] net: spnic: initial commit Ramaxel NIC driver
by Yanling Song 12 Oct '21

12 Oct '21

This initial commit contains Ramaxel's spnic module Changes since v1: - Solve the compile error Yanling Song (2): spnic: initial commit the common module of Ramaxel NIC driver spnic: add NIC layer arch/arm64/configs/openeuler_defconfig | 2 + arch/x86/configs/openeuler_defconfig | 2 + drivers/net/ethernet/Kconfig | 1 + drivers/net/ethernet/Makefile | 1 + drivers/net/ethernet/ramaxel/Kconfig | 20 + drivers/net/ethernet/ramaxel/Makefile | 6 + drivers/net/ethernet/ramaxel/spnic/Kconfig | 15 + drivers/net/ethernet/ramaxel/spnic/Makefile | 40 + .../ethernet/ramaxel/spnic/hw/sphw_api_cmd.c | 1165 +++++++++++ .../ethernet/ramaxel/spnic/hw/sphw_api_cmd.h | 277 +++ .../ethernet/ramaxel/spnic/hw/sphw_cfg_cmd.h | 126 ++ .../net/ethernet/ramaxel/spnic/hw/sphw_cmdq.c | 1606 +++++++++++++++ .../net/ethernet/ramaxel/spnic/hw/sphw_cmdq.h | 196 ++ .../ethernet/ramaxel/spnic/hw/sphw_comm_cmd.h | 60 + .../ramaxel/spnic/hw/sphw_comm_msg_intf.h | 273 +++ .../ethernet/ramaxel/spnic/hw/sphw_common.c | 88 + .../ethernet/ramaxel/spnic/hw/sphw_common.h | 118 ++ .../net/ethernet/ramaxel/spnic/hw/sphw_crm.h | 984 +++++++++ .../net/ethernet/ramaxel/spnic/hw/sphw_csr.h | 171 ++ .../net/ethernet/ramaxel/spnic/hw/sphw_eqs.c | 1374 +++++++++++++ .../net/ethernet/ramaxel/spnic/hw/sphw_eqs.h | 157 ++ .../net/ethernet/ramaxel/spnic/hw/sphw_hw.h | 649 ++++++ .../ethernet/ramaxel/spnic/hw/sphw_hw_cfg.c | 1339 ++++++++++++ .../ethernet/ramaxel/spnic/hw/sphw_hw_cfg.h | 327 +++ .../ethernet/ramaxel/spnic/hw/sphw_hw_comm.c | 1253 ++++++++++++ .../ethernet/ramaxel/spnic/hw/sphw_hw_comm.h | 42 + .../ethernet/ramaxel/spnic/hw/sphw_hwdev.c | 1402 +++++++++++++ .../ethernet/ramaxel/spnic/hw/sphw_hwdev.h | 93 + .../net/ethernet/ramaxel/spnic/hw/sphw_hwif.c | 911 +++++++++ .../net/ethernet/ramaxel/spnic/hw/sphw_hwif.h | 102 + .../net/ethernet/ramaxel/spnic/hw/sphw_mbox.c | 1808 +++++++++++++++++ .../net/ethernet/ramaxel/spnic/hw/sphw_mbox.h | 274 +++ .../net/ethernet/ramaxel/spnic/hw/sphw_mgmt.c | 1382 +++++++++++++ .../net/ethernet/ramaxel/spnic/hw/sphw_mgmt.h | 156 ++ .../ramaxel/spnic/hw/sphw_mgmt_msg_base.h | 19 + .../net/ethernet/ramaxel/spnic/hw/sphw_mt.h | 534 +++++ .../ramaxel/spnic/hw/sphw_prof_adap.c | 94 + .../ramaxel/spnic/hw/sphw_prof_adap.h | 49 + .../ethernet/ramaxel/spnic/hw/sphw_profile.h | 36 + .../net/ethernet/ramaxel/spnic/hw/sphw_wq.c | 152 ++ .../net/ethernet/ramaxel/spnic/hw/sphw_wq.h | 119 ++ .../net/ethernet/ramaxel/spnic/spnic_dbg.c | 753 +++++++ .../net/ethernet/ramaxel/spnic/spnic_dcb.c | 965 +++++++++ .../net/ethernet/ramaxel/spnic/spnic_dcb.h | 56 + .../ethernet/ramaxel/spnic/spnic_dev_mgmt.c | 811 ++++++++ .../ethernet/ramaxel/spnic/spnic_dev_mgmt.h | 78 + .../ethernet/ramaxel/spnic/spnic_ethtool.c | 989 +++++++++ .../ramaxel/spnic/spnic_ethtool_stats.c | 1035 ++++++++++ .../net/ethernet/ramaxel/spnic/spnic_filter.c | 412 ++++ .../net/ethernet/ramaxel/spnic/spnic_irq.c | 178 ++ .../net/ethernet/ramaxel/spnic/spnic_lld.c | 937 +++++++++ .../net/ethernet/ramaxel/spnic/spnic_lld.h | 75 + .../ethernet/ramaxel/spnic/spnic_mag_cfg.c | 778 +++++++ .../ethernet/ramaxel/spnic/spnic_mag_cmd.h | 643 ++++++ .../net/ethernet/ramaxel/spnic/spnic_main.c | 925 +++++++++ .../ramaxel/spnic/spnic_mgmt_interface.h | 617 ++++++ .../ethernet/ramaxel/spnic/spnic_netdev_ops.c | 1526 ++++++++++++++ .../net/ethernet/ramaxel/spnic/spnic_nic.h | 148 ++ .../ethernet/ramaxel/spnic/spnic_nic_cfg.c | 1321 ++++++++++++ .../ethernet/ramaxel/spnic/spnic_nic_cfg.h | 724 +++++++ .../ethernet/ramaxel/spnic/spnic_nic_cfg_vf.c | 647 ++++++ .../ethernet/ramaxel/spnic/spnic_nic_cmd.h | 105 + .../ethernet/ramaxel/spnic/spnic_nic_dbg.c | 151 ++ .../ethernet/ramaxel/spnic/spnic_nic_dbg.h | 16 + .../ethernet/ramaxel/spnic/spnic_nic_dev.h | 353 ++++ .../ethernet/ramaxel/spnic/spnic_nic_event.c | 506 +++++ .../net/ethernet/ramaxel/spnic/spnic_nic_io.c | 1124 ++++++++++ .../net/ethernet/ramaxel/spnic/spnic_nic_io.h | 309 +++ .../net/ethernet/ramaxel/spnic/spnic_nic_qp.h | 421 ++++ .../net/ethernet/ramaxel/spnic/spnic_ntuple.c | 841 ++++++++ .../ethernet/ramaxel/spnic/spnic_pci_id_tbl.h | 13 + .../net/ethernet/ramaxel/spnic/spnic_rss.c | 750 +++++++ .../net/ethernet/ramaxel/spnic/spnic_rss.h | 48 + .../ethernet/ramaxel/spnic/spnic_rss_cfg.c | 391 ++++ drivers/net/ethernet/ramaxel/spnic/spnic_rx.c | 1250 ++++++++++++ drivers/net/ethernet/ramaxel/spnic/spnic_rx.h | 118 ++ .../net/ethernet/ramaxel/spnic/spnic_sriov.c | 200 ++ .../net/ethernet/ramaxel/spnic/spnic_sriov.h | 24 + drivers/net/ethernet/ramaxel/spnic/spnic_tx.c | 879 ++++++++ drivers/net/ethernet/ramaxel/spnic/spnic_tx.h | 129 ++ 80 files changed, 38669 insertions(+) create mode 100644 drivers/net/ethernet/ramaxel/Kconfig create mode 100644 drivers/net/ethernet/ramaxel/Makefile create mode 100644 drivers/net/ethernet/ramaxel/spnic/Kconfig create mode 100644 drivers/net/ethernet/ramaxel/spnic/Makefile create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_api_cmd.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_api_cmd.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_cfg_cmd.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_cmdq.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_cmdq.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_comm_cmd.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_comm_msg_intf.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_common.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_common.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_crm.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_csr.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_eqs.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_eqs.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hw.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hw_cfg.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hw_cfg.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hw_comm.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hw_comm.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hwdev.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hwdev.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hwif.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hwif.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_mbox.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_mbox.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_mgmt.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_mgmt.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_mgmt_msg_base.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_mt.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_prof_adap.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_prof_adap.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_profile.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_wq.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_wq.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_dbg.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_dcb.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_dcb.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_dev_mgmt.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_dev_mgmt.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_ethtool.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_ethtool_stats.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_filter.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_irq.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_lld.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_lld.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_mag_cfg.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_mag_cmd.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_main.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_mgmt_interface.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_netdev_ops.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_cfg.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_cfg.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_cfg_vf.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_cmd.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_dbg.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_dbg.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_dev.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_event.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_io.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_io.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_qp.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_ntuple.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_pci_id_tbl.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_rss.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_rss.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_rss_cfg.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_rx.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_rx.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_sriov.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_sriov.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_tx.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_tx.h -- 2.30.0

2 5

[PATCH kernel-4.19] bpf: Fix integer overflow in prealloc_elems_and_freelist()
by Yang Yingliang 11 Oct '21

11 Oct '21

From: Xu Kuohai <xukuohai(a)huawei.com> mainline inclusion from mainline-5.15-rc4 commit 30e29a9a2bc6a4888335a6ede968b75cd329657a category: bugfix bugzilla: NA CVE: CVE-2021-41864 ------------------------------------------------- In prealloc_elems_and_freelist(), the multiplication to calculate the size passed to bpf_map_area_alloc() could lead to an integer overflow. As a result, out-of-bounds write could occur in pcpu_freelist_populate() as reported by KASAN: [...] [ 16.968613] BUG: KASAN: slab-out-of-bounds in pcpu_freelist_populate+0xd9/0x100 [ 16.969408] Write of size 8 at addr ffff888104fc6ea0 by task crash/78 [ 16.970038] [ 16.970195] CPU: 0 PID: 78 Comm: crash Not tainted 5.15.0-rc2+ #1 [ 16.970878] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 [ 16.972026] Call Trace: [ 16.972306] dump_stack_lvl+0x34/0x44 [ 16.972687] print_address_description.constprop.0+0x21/0x140 [ 16.973297] ? pcpu_freelist_populate+0xd9/0x100 [ 16.973777] ? pcpu_freelist_populate+0xd9/0x100 [ 16.974257] kasan_report.cold+0x7f/0x11b [ 16.974681] ? pcpu_freelist_populate+0xd9/0x100 [ 16.975190] pcpu_freelist_populate+0xd9/0x100 [ 16.975669] stack_map_alloc+0x209/0x2a0 [ 16.976106] __sys_bpf+0xd83/0x2ce0 [...] The possibility of this overflow was originally discussed in [0], but was overlooked. Fix the integer overflow by changing elem_size to u64 from u32. [0] https://lore.kernel.org/bpf/728b238e-a481-eb50-98e9-b0f430ab01e7@gmail.com/ Fixes: 557c0c6e7df8 ("bpf: convert stackmap to pre-allocation") Signed-off-by: Tatsuhiko Yasumatsu <th.yasumatsu(a)gmail.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://lore.kernel.org/bpf/20210930135545.173698-1-th.yasumatsu@gmail.com Signed-off-by: Xu Kuohai <xukuohai(a)huawei.com> Reviewed-by: Yang Jihong <yangjihong1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/bpf/stackmap.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c index a47d623f59fe7..92310b07cb98e 100644 --- a/kernel/bpf/stackmap.c +++ b/kernel/bpf/stackmap.c @@ -63,7 +63,8 @@ static inline int stack_map_data_size(struct bpf_map *map) static int prealloc_elems_and_freelist(struct bpf_stack_map *smap) { - u32 elem_size = sizeof(struct stack_map_bucket) + smap->map.value_size; + u64 elem_size = sizeof(struct stack_map_bucket) + + (u64)smap->map.value_size; int err; smap->elems = bpf_map_area_alloc(elem_size * smap->map.max_entries, -- 2.25.1

1 0

你推荐，我翻译：openEuler G11N SIG文章/书籍翻译计划，请您在10月17日前将希望翻译的文章/书籍名称和链接邮件发送至G11N mailing list。谢啦~
by suqin (D) 11 Oct '21

11 Oct '21

请将您希望翻译的文章/书籍名称和链接，在10月17日前邮件发送至G11N mailing list：g11n(a)openeuler.org<mailto:g11n@openeuler.org> （订阅<https://mailweb.openeuler.org/postorius/lists/g11n.openeuler.org/>）关于该活动有任何意见和建议，欢迎反馈哦~ [cid:image003.png@01D7BEB6.79A7BBC0] · 文章或书籍选定我们将组织志愿者翻译符合以下条件的文章或书籍： * 版权要求：可自由传播的免费电子文章或书籍（启动翻译之前，我们会征求原作者的翻译许可） * 内容要求：开源技术、操作系统或软件相关 * 内容语言：英文 * 英文字数：文章，每篇 < 1万字；书籍：< 10万字 * 如何反馈：请订阅openEuler G11N mailing list（如何订阅？<https://gitee.com/openeuler/globalization/blob/master/openeuler-g11n-contri…>），并将您希望翻译的文章或书籍名称和链接，邮件发送至G11N mailing list。收到您的反馈后，我们将根据翻译工作量和项目周期，制定和公布翻译计划，多谢啦~ [cid:image004.png@01D7BEBB.05DAB4E0]

1 0

[PATCH openEuler-5.10 01/32] net: hns3: make hclgevf_cmd_caps_bit_map0 and hclge_cmd_caps_bit_map0 static
by Zheng Zengkai 11 Oct '21

11 Oct '21

From: chongjiapeng <jiapeng.chong(a)linux.alibaba.com> mainline inclusion from mainline-v5.15-rc1 commit 0c0383918a3e category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4CVS3 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- This symbols is not used outside of hclge_cmd.c and hclgevf_cmd.c, so marks it static. Fix the following sparse warning: drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.c:345:35: warning: symbol 'hclgevf_cmd_caps_bit_map0' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c:365:33: warning: symbol 'hclge_cmd_caps_bit_map0' was not declared. Should it be static? Reported-by: Abaci Robot <abaci(a)linux.alibaba.com> Signed-off-by: chongjiapeng <jiapeng.chong(a)linux.alibaba.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Reviewed-by: Yongxin Li <liyongxin1(a)huawei.com> Signed-off-by: Junxin Chen <chenjunxin1(a)huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c | 2 +- drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c index 474c6d1664e7..ac9b69513332 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c @@ -362,7 +362,7 @@ static void hclge_set_default_capability(struct hclge_dev *hdev) } } -const struct hclge_caps_bit_map hclge_cmd_caps_bit_map0[] = { +static const struct hclge_caps_bit_map hclge_cmd_caps_bit_map0[] = { {HCLGE_CAP_UDP_GSO_B, HNAE3_DEV_SUPPORT_UDP_GSO_B}, {HCLGE_CAP_PTP_B, HNAE3_DEV_SUPPORT_PTP_B}, {HCLGE_CAP_INT_QL_B, HNAE3_DEV_SUPPORT_INT_QL_B}, diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.c index 59772b0e9531..f89bfb352adf 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.c @@ -342,7 +342,7 @@ static void hclgevf_set_default_capability(struct hclgevf_dev *hdev) set_bit(HNAE3_DEV_SUPPORT_FEC_B, ae_dev->caps); } -const struct hclgevf_caps_bit_map hclgevf_cmd_caps_bit_map0[] = { +static const struct hclgevf_caps_bit_map hclgevf_cmd_caps_bit_map0[] = { {HCLGEVF_CAP_UDP_GSO_B, HNAE3_DEV_SUPPORT_UDP_GSO_B}, {HCLGEVF_CAP_INT_QL_B, HNAE3_DEV_SUPPORT_INT_QL_B}, {HCLGEVF_CAP_TQP_TXRX_INDEP_B, HNAE3_DEV_SUPPORT_TQP_TXRX_INDEP_B}, -- 2.20.1

1 31

[PATCH openEuler-21.03] arm64/mpam: fix device_errcode out of bounds
by yinxiujiang 09 Oct '21

09 Oct '21

From: yin-xiujiang <yinxiujiang(a)kylinos.cn> kylin inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4AHUH?from=project-issue CVE: NA --------------------------------------------------- the size of mpam_msc_err_str is _MPAM_NUM_ERRCODE, so device_errcode needs to be less than _MPAM_NUM_ERRCODE Signed-off-by: yin-xiujiang <yinxiujiang(a)kylinos.cn> --- arch/arm64/kernel/mpam/mpam_device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/kernel/mpam/mpam_device.c b/arch/arm64/kernel/mpam/mpam_device.c index 86aaf52146bc..fd538fd22c6e 100644 --- a/arch/arm64/kernel/mpam/mpam_device.c +++ b/arch/arm64/kernel/mpam/mpam_device.c @@ -435,7 +435,7 @@ static irqreturn_t mpam_handle_error_irq(int irq, void *data) return IRQ_NONE; /* No-one expects MPAM errors! */ - if (device_errcode <= _MPAM_NUM_ERRCODE) + if (device_errcode < _MPAM_NUM_ERRCODE) pr_err_ratelimited("unexpected error '%s' [esr:%x]\n", mpam_msc_err_str[device_errcode], device_esr); -- 2.27.0

2 1

[PATCH OLK-5.10] perf stat: Add --quiet option
by yinxiujiang 09 Oct '21

09 Oct '21

From: Andi Kleen <andi(a)firstfloor.org> mainline inclusion from mainline-5.11 commit 55a4de94c64bacffbcd802c954764e0de2ab217f category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4CMQA CVE: NA -------------------------------- Add a new --quiet option to 'perf stat'. This is useful with 'perf stat record' to write the data only to the perf.data file, which can lower measurement overhead because the data doesn't need to be formatted. On my 4C desktop: % time ./perf stat record -e $(python -c 'print ",\ ".join(["cycles"]*1000)') -a -I 1000 sleep 5 ... real 0m5.377s user 0m0.238s sys 0m0.452s % time ./perf stat record --quiet -e $(python -c 'print ",\ ".join(["cycles"]*1000)') -a -I 1000 sleep 5 real 0m5.452s user 0m0.183s sys 0m0.423s In this example it cuts the user time by 20%. On systems with more cores the savings are higher. Signed-off-by: Andi Kleen <andi(a)firstfloor.org> Acked-by: Jiri Olsa <jolsa(a)kernel.org> Cc: Alexey Budankov <alexey.budankov(a)linux.intel.com> Link: http://lore.kernel.org/lkml/20201027002737.30942-1-andi@firstfloor.org Signed-off-by: Arnaldo Carvalho de Melo <acme(a)redhat.com> Signed-off-by: yin-xiujiang <yinxiujiang(a)kylinos.cn> --- tools/perf/Documentation/perf-stat.txt | 4 ++++ tools/perf/builtin-stat.c | 6 +++++- tools/perf/util/stat.h | 1 + 3 files changed, 10 insertions(+), 1 deletion(-) diff --git a/tools/perf/Documentation/perf-stat.txt b/tools/perf/Documentation/perf-stat.txt index 9f9f29025e49..f9bcd95bf352 100644 --- a/tools/perf/Documentation/perf-stat.txt +++ b/tools/perf/Documentation/perf-stat.txt @@ -320,6 +320,10 @@ STAT RECORD ----------- Stores stat data into perf data file. +--quiet:: +Don't print output. This is useful with perf stat record below to only +write data to the perf.data file. + -o file:: --output file:: Output file name. diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c index b01af171d94f..89e80a3bc9c3 100644 --- a/tools/perf/builtin-stat.c +++ b/tools/perf/builtin-stat.c @@ -973,6 +973,8 @@ static void print_counters(struct timespec *ts, int argc, const char **argv) if (STAT_RECORD && perf_stat.data.is_pipe) return; + if (stat_config.quiet) + return; perf_evlist__print_counters(evsel_list, &stat_config, &target, ts, argc, argv); } @@ -1171,6 +1173,8 @@ static struct option stat_options[] = { "threads of same physical core"), OPT_BOOLEAN(0, "summary", &stat_config.summary, "print summary for interval mode"), + OPT_BOOLEAN(0, "quiet", &stat_config.quiet, + "don't print output (useful with record)"), #ifdef HAVE_LIBPFM OPT_CALLBACK(0, "pfm-events", &evsel_list, "event", "libpfm4 event selector. use 'perf list' to list available events", @@ -2132,7 +2136,7 @@ int cmd_stat(int argc, const char **argv) goto out; } - if (!output) { + if (!output && !stat_config.quiet) { struct timespec tm; mode = append_file ? "a" : "w"; diff --git a/tools/perf/util/stat.h b/tools/perf/util/stat.h index 487010c624be..05adf8165025 100644 --- a/tools/perf/util/stat.h +++ b/tools/perf/util/stat.h @@ -122,6 +122,7 @@ struct perf_stat_config { bool metric_no_group; bool metric_no_merge; bool stop_read_counter; + bool quiet; FILE *output; unsigned int interval; unsigned int timeout; -- 2.27.0

2 1

[PATCH v1 openEuler-1.0-LTS 0/4]
by jiazhenyuan 09 Oct '21

09 Oct '21

issue: https://gitee.com/openeuler/kernel/issues/I4AFRJ?from=project-issue jiazhenyuan (4): tcp: address problems caused by EDT misshaps tcp: always set retrans_stamp on recovery tcp: create a helper to model exponential backoff tcp: adjust rto_base in retransmits_timed_out() net/ipv4/tcp_input.c | 16 +++++++---- net/ipv4/tcp_output.c | 9 +++--- net/ipv4/tcp_timer.c | 65 ++++++++++++++++++++----------------------- 3 files changed, 44 insertions(+), 46 deletions(-) -- 2.27.0

2 6

[PATCH kernel-4.19 openEuler-1.0-LTS 0/2] lib/timerqueue: Rely
by Cheng Jian 08 Oct '21

08 Oct '21

Davidlohr Bueso (1): lib/timerqueue: Rely on rbtree semantics for next timer Xiongfeng Wang (1): timerqueue: fix kabi for struct timerqueue_head include/linux/timerqueue.h | 14 +++++++++----- lib/timerqueue.c | 30 ++++++++++++------------------ 2 files changed, 21 insertions(+), 23 deletions(-) -- 2.25.1

1 2

[PATCH openEuler-5.10] imans: Use initial ima namespace domain tag when IMANS is disabled.
by Zheng Zengkai 08 Oct '21

08 Oct '21

From: Ajo Jose Panoor <ajo.jose.panoor(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4C9AE CVE: NA ----------------------------------------------------------------- As part of the imans support, a key domain tag is added to the search criteria in digsig module. When IMA Namespace is disabled, the initial ima namespace domain tag should be used instead of nsproxy. Signed-off-by: Ajo Jose Panoor <ajo.jose.panoor(a)huawei.com> Reviewed-by: Zhang Tianxing <zhangtianxing3(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- security/integrity/digsig.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index 2c923dc0dbd3..c866a5c2c9b1 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -74,8 +74,11 @@ static struct key_tag *domain_tag_from_id(const unsigned int id) return ERR_PTR(-EINVAL); if (id == INTEGRITY_KEYRING_IMA) +#ifdef CONFIG_IMA_NS return current->nsproxy->ima_ns->key_domain; - +#else + return init_ima_ns.key_domain; +#endif return NULL; } -- 2.20.1

1 0

[PATCH openEuler-1.0-LTS] Fix incorrect call to free srb in qla2xxx_mqueuecommand()
by yinxiujiang 08 Oct '21

08 Oct '21

From: Arun Easi <aeasi(a)marvell.com> stable inclusion from linux-4.19.207 commit c5ab9b67d8b061de74e2ca51bf787ee599bd7f89 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4AFG0?from=project-issue CVE: NA ------------------------------------------------- RIP: 0010:kmem_cache_free+0xfa/0x1b0 Call Trace: qla2xxx_mqueuecommand+0x2b5/0x2c0 [qla2xxx] scsi_queue_rq+0x5e2/0xa40 __blk_mq_try_issue_directly+0x128/0x1d0 blk_mq_request_issue_directly+0x4e/0xb0 Fix incorrect call to free srb in qla2xxx_mqueuecommand(), as srb is now allocated by upper layers. This fixes smatch warning of srb unintended free. Link: https://lore.kernel.org/r/20210329085229.4367-7-njavali@marvell.com Fixes: af2a0c51b120 ("scsi: qla2xxx: Fix SRB leak on switch command timeout") Cc: stable(a)vger.kernel.org # 5.5 Reported-by: Laurence Oberman <loberman(a)redhat.com> Reported-by: Dan Carpenter <dan.carpenter(a)oracle.com> Reported-by: magicyan2022 Reviewed-by: Himanshu Madhani <himanshu.madhani(a)oracle.com> Signed-off-by: Arun Easi <aeasi(a)marvell.com> Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: yin-xiujiang <yinxiujiang(a)kylinos.cn> --- drivers/scsi/qla2xxx/qla_os.c | 7 ------- 1 file changed, 7 deletions(-) diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c index bfbf213b15c0..8e9d386146ac 100644 --- a/drivers/scsi/qla2xxx/qla_os.c +++ b/drivers/scsi/qla2xxx/qla_os.c @@ -1028,8 +1028,6 @@ qla2xxx_mqueuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd, if (rval != QLA_SUCCESS) { ql_dbg(ql_dbg_io + ql_dbg_verbose, vha, 0x3078, "Start scsi failed rval=%d for cmd=%p.\n", rval, cmd); - if (rval == QLA_INTERFACE_ERROR) - goto qc24_free_sp_fail_command; goto qc24_host_busy_free_sp; } @@ -1044,11 +1042,6 @@ qla2xxx_mqueuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd, qc24_target_busy: return SCSI_MLQUEUE_TARGET_BUSY; -qc24_free_sp_fail_command: - sp->free(sp); - CMD_SP(cmd) = NULL; - qla2xxx_rel_qpair_sp(sp->qpair, sp); - qc24_fail_command: cmd->scsi_done(cmd); -- 2.27.0

3 2

[PATCH openEuler-21.09 2/2] tools: add a tool to calculate the idle rate
by Hongyu Li 30 Sep '21

30 Sep '21

openEuler inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4CIJQ CVE: NA ---------------------------------------------------------------------- This tool can help calculate the CPU idle rate in higher precision. Signed-off-by: Hongyu Li <543306408(a)qq.com> --- tools/accounting/Makefile | 2 +- tools/accounting/idle_cal.c | 91 +++++++++++++++++++++++++++++++++++++ 2 files changed, 92 insertions(+), 1 deletion(-) create mode 100644 tools/accounting/idle_cal.c diff --git a/tools/accounting/Makefile b/tools/accounting/Makefile index 03687f19cbb1..d14151e28173 100644 --- a/tools/accounting/Makefile +++ b/tools/accounting/Makefile @@ -2,7 +2,7 @@ CC := $(CROSS_COMPILE)gcc CFLAGS := -I../../usr/include -PROGS := getdelays +PROGS := getdelays idle_cal all: $(PROGS) diff --git a/tools/accounting/idle_cal.c b/tools/accounting/idle_cal.c new file mode 100644 index 000000000000..397b0fc1c69c --- /dev/null +++ b/tools/accounting/idle_cal.c @@ -0,0 +1,91 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * idle_cal.c + * + * Copyright (C) 2007 + * + * cpu idle time accouting + */ + + +#include <stdlib.h> +#include <stdio.h> +#include <fcntl.h> +#include <string.h> +#include <unistd.h> +#include <time.h> +#include <limits.h> +#include <sys/time.h> + +#define CPUS 4 +#define BUFFSIZE 4096 +#define HZ 100 +#define FILE_NAME "/proc/stat2" + +struct cpu_info { + char name[BUFFSIZE]; + long long value[1]; +}; + +int main(void) +{ + char buf[BUFFSIZE]; + struct cpu_info cpus[CPUS+1]; + struct cpu_info cpus_2[CPUS+1]; + long long sub; + double value; + + FILE *fp = fopen(FILE_NAME, "r"); + int i = 0; + struct timeval start, end; + + + while (i < CPUS+1) { + int n = fscanf(fp, "%s %lld\n", cpus[i].name, &cpus[i].value[0]); + + if (n < 0) { + printf("wrong"); + return -1; + } + i += 1; + } + + for (int i = 0; i < CPUS+1; i++) + printf("%s %lld\n", cpus[i].name, cpus[i].value[0]); + gettimeofday(&start, NULL); + fflush(fp); + fclose(fp); + i = 0; + + sleep(2); + + FILE *fp_2 = fopen(FILE_NAME, "r"); + + while (i < CPUS+1) { + int n = fscanf(fp_2, "%s %lld\n", cpus_2[i].name, &cpus_2[i].value[0]); + + if (n < 0) { + printf("wrong"); + return -1; + } + i += 1; + } + + for (int i = 0; i < CPUS+1; i++) + printf("%s %lld\n", cpus_2[i].name, cpus_2[i].value[0]); + gettimeofday(&end, NULL); + fclose(fp_2); + + sub = end.tv_sec-start.tv_sec; + value = sub*1000000.0+end.tv_usec-start.tv_usec; + + printf("CPU idle rate %f\n", 1000000/HZ*(cpus_2[0].value[0]-cpus[0].value[0])/value); + + for (int i = 1; i < CPUS+1; i++) { + printf("CPU%d idle rate %f\n", i-1, 1000000/HZ + *(cpus_2[i].value[0]-cpus[i].value[0])/value); + } + + return 0; +} + -- 2.17.1

2 1

[PATCH openEuler-21.09 1/2] eulerfs: add the /proc/stat2 file.
by Hongyu Li 30 Sep '21

30 Sep '21

openEuler inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4CIJQ CVE: NA ---------------------------------------------------------------------- The default way of calculating CPU utilization is to check which task is executed during the interval of two ticks. This leads to the inaccurate results of CPU utilization. This problem can be solved by counting the idle time via scheduler rather than the tick interval. We can record the time before executing idle process and calculate the execute time before quiting the idle process. The idle time of each CPU is given in the /proc/stat2 file. This way can give higher precision in accounting the CPU idle time compared with the /proc/stat. Signed-off-by: Hongyu Li <543306408(a)qq.com> --- fs/proc/Kconfig | 7 ++++ fs/proc/Makefile | 1 + fs/proc/stat2.c | 91 ++++++++++++++++++++++++++++++++++++++++++ kernel/sched/cputime.c | 34 ++++++++++++++++ kernel/sched/idle.c | 28 +++++++++++++ 5 files changed, 161 insertions(+) create mode 100644 fs/proc/stat2.c diff --git a/fs/proc/Kconfig b/fs/proc/Kconfig index c930001056f9..33588a37579e 100644 --- a/fs/proc/Kconfig +++ b/fs/proc/Kconfig @@ -107,3 +107,10 @@ config PROC_PID_ARCH_STATUS config PROC_CPU_RESCTRL def_bool n depends on PROC_FS + +config PROC_IDLE + bool "include /proc/stat2 file" + depends on PROC_FS + default y + help + Provide the CPU idle time in the /proc/stat2 file. diff --git a/fs/proc/Makefile b/fs/proc/Makefile index 8704d41dd67c..b0d5f2b347d7 100644 --- a/fs/proc/Makefile +++ b/fs/proc/Makefile @@ -34,5 +34,6 @@ proc-$(CONFIG_PROC_VMCORE) += vmcore.o proc-$(CONFIG_PRINTK) += kmsg.o proc-$(CONFIG_PROC_PAGE_MONITOR) += page.o proc-$(CONFIG_BOOT_CONFIG) += bootconfig.o +proc-$(CONFIG_PROC_IDLE) += stat2.o obj-$(CONFIG_ETMEM_SCAN) += etmem_scan.o obj-$(CONFIG_ETMEM_SWAP) += etmem_swap.o diff --git a/fs/proc/stat2.c b/fs/proc/stat2.c new file mode 100644 index 000000000000..6036a946c71d --- /dev/null +++ b/fs/proc/stat2.c @@ -0,0 +1,91 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * linux/fs/proc/stat2.c + * + * Copyright (C) 2007 + * + * cpu idle time accouting + */ + +#include <linux/cpumask.h> +#include <linux/device.h> +#include <linux/fs.h> +#include <linux/init.h> +#include <linux/interrupt.h> +#include <linux/kernel.h> +#include <linux/kernel_stat.h> +#include <linux/module.h> +#include <linux/proc_fs.h> +#include <linux/sched.h> +#include <linux/sched/stat.h> +#include <linux/seq_file.h> +#include <linux/slab.h> +#include <linux/time.h> +#include <linux/irqnr.h> +#include <linux/sched/cputime.h> +#include <linux/tick.h> + +#ifdef CONFIG_PROC_IDLE + +#define PROC_NAME "stat2" + +extern u64 cal_idle_sum_exec_runtime(int cpu); + +static u64 get_idle_sum_exec_runtime(int cpu) +{ + u64 idle = cal_idle_sum_exec_runtime(cpu); + + return idle; +} + +static int show_idle(struct seq_file *p, void *v) +{ + int i; + u64 idle; + + idle = 0; + + for_each_possible_cpu(i) { + + idle += get_idle_sum_exec_runtime(i); + + } + + seq_put_decimal_ull(p, "cpu ", nsec_to_clock_t(idle)); + seq_putc(p, '\n'); + + for_each_online_cpu(i) { + + idle = get_idle_sum_exec_runtime(i); + + seq_printf(p, "cpu%d", i); + seq_put_decimal_ull(p, " ", nsec_to_clock_t(idle)); + seq_putc(p, '\n'); + } + + return 0; +} + +static int idle_open(struct inode *inode, struct file *file) +{ + unsigned int size = 32 + 32 * num_online_cpus(); + + return single_open_size(file, show_idle, NULL, size); +} + +static struct proc_ops idle_procs_ops = { + .proc_open = idle_open, + .proc_read_iter = seq_read_iter, + .proc_lseek = seq_lseek, + .proc_release = single_release, +}; + +static int __init kernel_module_init(void) +{ + proc_create(PROC_NAME, 0, NULL, &idle_procs_ops); + return 0; +} + +fs_initcall(kernel_module_init); + +#endif /*CONFIG_PROC_IDLE*/ diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c index 5a55d2300452..25218a8f822f 100644 --- a/kernel/sched/cputime.c +++ b/kernel/sched/cputime.c @@ -19,6 +19,8 @@ */ DEFINE_PER_CPU(struct irqtime, cpu_irqtime); +extern struct static_key_true proc_idle; + static int sched_clock_irqtime; void enable_sched_clock_irqtime(void) @@ -1078,3 +1080,35 @@ void kcpustat_cpu_fetch(struct kernel_cpustat *dst, int cpu) EXPORT_SYMBOL_GPL(kcpustat_cpu_fetch); #endif /* CONFIG_VIRT_CPU_ACCOUNTING_GEN */ + + +#ifdef CONFIG_PROC_IDLE + + +u64 cal_idle_sum_exec_runtime(int cpu) +{ + struct rq *rq = cpu_rq(cpu); + struct sched_entity *idle_se = &rq->idle->se; + u64 idle = idle_se->sum_exec_runtime; + + if (!static_branch_likely(&proc_idle)) + return 0ULL; + + if (rq->curr == rq->idle) { + u64 now = sched_clock(); + u64 delta_exec; + + delta_exec = now - idle_se->exec_start; + if (unlikely((s64)delta_exec <= 0)) + return idle; + + schedstat_set(idle_se->statistics.exec_max, + max(delta_exec, idle_se->statistics.exec_max)); + + idle += delta_exec; + } + + return idle; +} + +#endif /* CONFIG_PROC_IDLE */ diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c index 36b545f17206..15f076ab5823 100644 --- a/kernel/sched/idle.c +++ b/kernel/sched/idle.c @@ -10,6 +10,8 @@ #include <trace/events/power.h> +DEFINE_STATIC_KEY_TRUE(proc_idle); + /* Linker adds these: start and end of __cpuidle functions */ extern char __cpuidle_text_start[], __cpuidle_text_end[]; @@ -424,6 +426,23 @@ static void check_preempt_curr_idle(struct rq *rq, struct task_struct *p, int fl static void put_prev_task_idle(struct rq *rq, struct task_struct *prev) { +#ifdef CONFIG_PROC_IDLE + if (!static_branch_likely(&proc_idle)) + return; + + struct sched_entity *idle_se = &rq->idle->se; + u64 now = sched_clock(); + u64 delta_exec; + + delta_exec = now - idle_se->exec_start; + if (unlikely((s64)delta_exec <= 0)) + return; + + schedstat_set(idle_se->statistics.exec_max, + max(delta_exec, idle_se->statistics.exec_max)); + + idle_se->sum_exec_runtime += delta_exec; +#endif } static void set_next_task_idle(struct rq *rq, struct task_struct *next, bool first) @@ -436,6 +455,15 @@ struct task_struct *pick_next_task_idle(struct rq *rq) { struct task_struct *next = rq->idle; +#ifdef CONFIG_PROC_IDLE + if (static_branch_likely(&proc_idle)) { + struct sched_entity *idle_se = &rq->idle->se; + u64 now = sched_clock(); + + idle_se->exec_start = now; + } +#endif + set_next_task_idle(rq, next, true); return next; -- 2.17.1

2 1

[PATCH openEuler-21.09 0/2] Improve the precisoin of accounuting CPU utilization rate
by Hongyu Li 30 Sep '21

30 Sep '21

The current way of calculating the CPU utilization rate is not accurate. The accounting system only works In the interval of two ticks. However, a process can give up the CPU before the tick ending. This can be fixed by counting the idel time via the scheduler. We can use the sum_exe_runtime of the idle process of each CPU to calculate the the CPU utilization rate. The idle time of each CPU is given in the /proc/stat2 file. An example of using this file is also attached. Hongyu Li (2): eulerfs: add the /proc/stat2 file. tools: add a tool to calculate the idle rate fs/proc/Kconfig | 7 +++ fs/proc/Makefile | 1 + fs/proc/stat2.c | 91 +++++++++++++++++++++++++++++++++++++ kernel/sched/cputime.c | 34 ++++++++++++++ kernel/sched/idle.c | 28 ++++++++++++ tools/accounting/Makefile | 2 +- tools/accounting/idle_cal.c | 91 +++++++++++++++++++++++++++++++++++++ 7 files changed, 253 insertions(+), 1 deletion(-) create mode 100644 fs/proc/stat2.c create mode 100644 tools/accounting/idle_cal.c -- 2.17.1

1 0

Does Euler 2.9 support BPFTrace Or not?
by Wangpeng (Forest, ISCP SRE) 30 Sep '21

30 Sep '21

Hi Community: Does Euler 2.9 support BPFTrace Or not? It is very necessary for us now. B.R.

2 1

[PATCH openEuler-21.09] eulerfs: add the /proc/stat2 file.
by Hongyu Li 30 Sep '21

30 Sep '21

openEuler inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4CIJQ CVE: NA ---------------------------------------------------------------------- The default way of calculating CPU utilization is to check which task is executed during the interval of two ticks. This leads to the inaccurate results of CPU utilization. This problem can be solved by counting the idle time via scheduler rather than the tick interval. We can record the time before executing idle process and calculate the execute time before quiting the idle process. The idle time of each CPU is given in the /proc/stat2 file. This way can give higher precision in accounting the CPU idle time compared with the /proc/stat. Signed-off-by: Hongyu Li <543306408(a)qq.com> --- fs/proc/Kconfig | 7 ++++ fs/proc/Makefile | 1 + fs/proc/stat2.c | 91 ++++++++++++++++++++++++++++++++++++++++++ kernel/sched/cputime.c | 34 ++++++++++++++++ kernel/sched/idle.c | 28 +++++++++++++ 5 files changed, 161 insertions(+) create mode 100644 fs/proc/stat2.c diff --git a/fs/proc/Kconfig b/fs/proc/Kconfig index c930001056f9..33588a37579e 100644 --- a/fs/proc/Kconfig +++ b/fs/proc/Kconfig @@ -107,3 +107,10 @@ config PROC_PID_ARCH_STATUS config PROC_CPU_RESCTRL def_bool n depends on PROC_FS + +config PROC_IDLE + bool "include /proc/stat2 file" + depends on PROC_FS + default y + help + Provide the CPU idle time in the /proc/stat2 file. diff --git a/fs/proc/Makefile b/fs/proc/Makefile index 8704d41dd67c..b0d5f2b347d7 100644 --- a/fs/proc/Makefile +++ b/fs/proc/Makefile @@ -34,5 +34,6 @@ proc-$(CONFIG_PROC_VMCORE) += vmcore.o proc-$(CONFIG_PRINTK) += kmsg.o proc-$(CONFIG_PROC_PAGE_MONITOR) += page.o proc-$(CONFIG_BOOT_CONFIG) += bootconfig.o +proc-$(CONFIG_PROC_IDLE) += stat2.o obj-$(CONFIG_ETMEM_SCAN) += etmem_scan.o obj-$(CONFIG_ETMEM_SWAP) += etmem_swap.o diff --git a/fs/proc/stat2.c b/fs/proc/stat2.c new file mode 100644 index 000000000000..6036a946c71d --- /dev/null +++ b/fs/proc/stat2.c @@ -0,0 +1,91 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * linux/fs/proc/stat2.c + * + * Copyright (C) 2007 + * + * cpu idle time accouting + */ + +#include <linux/cpumask.h> +#include <linux/device.h> +#include <linux/fs.h> +#include <linux/init.h> +#include <linux/interrupt.h> +#include <linux/kernel.h> +#include <linux/kernel_stat.h> +#include <linux/module.h> +#include <linux/proc_fs.h> +#include <linux/sched.h> +#include <linux/sched/stat.h> +#include <linux/seq_file.h> +#include <linux/slab.h> +#include <linux/time.h> +#include <linux/irqnr.h> +#include <linux/sched/cputime.h> +#include <linux/tick.h> + +#ifdef CONFIG_PROC_IDLE + +#define PROC_NAME "stat2" + +extern u64 cal_idle_sum_exec_runtime(int cpu); + +static u64 get_idle_sum_exec_runtime(int cpu) +{ + u64 idle = cal_idle_sum_exec_runtime(cpu); + + return idle; +} + +static int show_idle(struct seq_file *p, void *v) +{ + int i; + u64 idle; + + idle = 0; + + for_each_possible_cpu(i) { + + idle += get_idle_sum_exec_runtime(i); + + } + + seq_put_decimal_ull(p, "cpu ", nsec_to_clock_t(idle)); + seq_putc(p, '\n'); + + for_each_online_cpu(i) { + + idle = get_idle_sum_exec_runtime(i); + + seq_printf(p, "cpu%d", i); + seq_put_decimal_ull(p, " ", nsec_to_clock_t(idle)); + seq_putc(p, '\n'); + } + + return 0; +} + +static int idle_open(struct inode *inode, struct file *file) +{ + unsigned int size = 32 + 32 * num_online_cpus(); + + return single_open_size(file, show_idle, NULL, size); +} + +static struct proc_ops idle_procs_ops = { + .proc_open = idle_open, + .proc_read_iter = seq_read_iter, + .proc_lseek = seq_lseek, + .proc_release = single_release, +}; + +static int __init kernel_module_init(void) +{ + proc_create(PROC_NAME, 0, NULL, &idle_procs_ops); + return 0; +} + +fs_initcall(kernel_module_init); + +#endif /*CONFIG_PROC_IDLE*/ diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c index 5a55d2300452..25218a8f822f 100644 --- a/kernel/sched/cputime.c +++ b/kernel/sched/cputime.c @@ -19,6 +19,8 @@ */ DEFINE_PER_CPU(struct irqtime, cpu_irqtime); +extern struct static_key_true proc_idle; + static int sched_clock_irqtime; void enable_sched_clock_irqtime(void) @@ -1078,3 +1080,35 @@ void kcpustat_cpu_fetch(struct kernel_cpustat *dst, int cpu) EXPORT_SYMBOL_GPL(kcpustat_cpu_fetch); #endif /* CONFIG_VIRT_CPU_ACCOUNTING_GEN */ + + +#ifdef CONFIG_PROC_IDLE + + +u64 cal_idle_sum_exec_runtime(int cpu) +{ + struct rq *rq = cpu_rq(cpu); + struct sched_entity *idle_se = &rq->idle->se; + u64 idle = idle_se->sum_exec_runtime; + + if (!static_branch_likely(&proc_idle)) + return 0ULL; + + if (rq->curr == rq->idle) { + u64 now = sched_clock(); + u64 delta_exec; + + delta_exec = now - idle_se->exec_start; + if (unlikely((s64)delta_exec <= 0)) + return idle; + + schedstat_set(idle_se->statistics.exec_max, + max(delta_exec, idle_se->statistics.exec_max)); + + idle += delta_exec; + } + + return idle; +} + +#endif /* CONFIG_PROC_IDLE */ diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c index 36b545f17206..15f076ab5823 100644 --- a/kernel/sched/idle.c +++ b/kernel/sched/idle.c @@ -10,6 +10,8 @@ #include <trace/events/power.h> +DEFINE_STATIC_KEY_TRUE(proc_idle); + /* Linker adds these: start and end of __cpuidle functions */ extern char __cpuidle_text_start[], __cpuidle_text_end[]; @@ -424,6 +426,23 @@ static void check_preempt_curr_idle(struct rq *rq, struct task_struct *p, int fl static void put_prev_task_idle(struct rq *rq, struct task_struct *prev) { +#ifdef CONFIG_PROC_IDLE + if (!static_branch_likely(&proc_idle)) + return; + + struct sched_entity *idle_se = &rq->idle->se; + u64 now = sched_clock(); + u64 delta_exec; + + delta_exec = now - idle_se->exec_start; + if (unlikely((s64)delta_exec <= 0)) + return; + + schedstat_set(idle_se->statistics.exec_max, + max(delta_exec, idle_se->statistics.exec_max)); + + idle_se->sum_exec_runtime += delta_exec; +#endif } static void set_next_task_idle(struct rq *rq, struct task_struct *next, bool first) @@ -436,6 +455,15 @@ struct task_struct *pick_next_task_idle(struct rq *rq) { struct task_struct *next = rq->idle; +#ifdef CONFIG_PROC_IDLE + if (static_branch_likely(&proc_idle)) { + struct sched_entity *idle_se = &rq->idle->se; + u64 now = sched_clock(); + + idle_se->exec_start = now; + } +#endif + set_next_task_idle(rq, next, true); return next; -- 2.17.1

1 0

[PATCH openEuler-21.09] eulerfs: add the /proc/idle file.
by Hongyu Li 30 Sep '21

30 Sep '21

openEuler inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4CIJQ CVE: NA ---------------------------------------------------------------------- The default way of calculating CPU utilization is to check which task is executed during the interval of two ticks. This leads to the inaccurate results of CPU utilization. This problem can be solved by counting the idle time via scheduler rather than the tick interval. We can record the time before executing idle process and calculate the execute time before quiting the idle process. The idle time of each CPU is given in the /proc/stat2 file. This way can give higher precision in accounting the CPU idle time compared with the /proc/stat. Signed-off-by: Hongyu Li <543306408(a)qq.com> --- fs/proc/Kconfig | 7 ++++ fs/proc/Makefile | 1 + fs/proc/stat2.c | 91 ++++++++++++++++++++++++++++++++++++++++++ kernel/sched/cputime.c | 34 ++++++++++++++++ kernel/sched/idle.c | 28 +++++++++++++ 5 files changed, 161 insertions(+) create mode 100644 fs/proc/stat2.c diff --git a/fs/proc/Kconfig b/fs/proc/Kconfig index c930001056f9..33588a37579e 100644 --- a/fs/proc/Kconfig +++ b/fs/proc/Kconfig @@ -107,3 +107,10 @@ config PROC_PID_ARCH_STATUS config PROC_CPU_RESCTRL def_bool n depends on PROC_FS + +config PROC_IDLE + bool "include /proc/stat2 file" + depends on PROC_FS + default y + help + Provide the CPU idle time in the /proc/stat2 file. diff --git a/fs/proc/Makefile b/fs/proc/Makefile index 8704d41dd67c..b0d5f2b347d7 100644 --- a/fs/proc/Makefile +++ b/fs/proc/Makefile @@ -34,5 +34,6 @@ proc-$(CONFIG_PROC_VMCORE) += vmcore.o proc-$(CONFIG_PRINTK) += kmsg.o proc-$(CONFIG_PROC_PAGE_MONITOR) += page.o proc-$(CONFIG_BOOT_CONFIG) += bootconfig.o +proc-$(CONFIG_PROC_IDLE) += stat2.o obj-$(CONFIG_ETMEM_SCAN) += etmem_scan.o obj-$(CONFIG_ETMEM_SWAP) += etmem_swap.o diff --git a/fs/proc/stat2.c b/fs/proc/stat2.c new file mode 100644 index 000000000000..6036a946c71d --- /dev/null +++ b/fs/proc/stat2.c @@ -0,0 +1,91 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * linux/fs/proc/stat2.c + * + * Copyright (C) 2007 + * + * cpu idle time accouting + */ + +#include <linux/cpumask.h> +#include <linux/device.h> +#include <linux/fs.h> +#include <linux/init.h> +#include <linux/interrupt.h> +#include <linux/kernel.h> +#include <linux/kernel_stat.h> +#include <linux/module.h> +#include <linux/proc_fs.h> +#include <linux/sched.h> +#include <linux/sched/stat.h> +#include <linux/seq_file.h> +#include <linux/slab.h> +#include <linux/time.h> +#include <linux/irqnr.h> +#include <linux/sched/cputime.h> +#include <linux/tick.h> + +#ifdef CONFIG_PROC_IDLE + +#define PROC_NAME "stat2" + +extern u64 cal_idle_sum_exec_runtime(int cpu); + +static u64 get_idle_sum_exec_runtime(int cpu) +{ + u64 idle = cal_idle_sum_exec_runtime(cpu); + + return idle; +} + +static int show_idle(struct seq_file *p, void *v) +{ + int i; + u64 idle; + + idle = 0; + + for_each_possible_cpu(i) { + + idle += get_idle_sum_exec_runtime(i); + + } + + seq_put_decimal_ull(p, "cpu ", nsec_to_clock_t(idle)); + seq_putc(p, '\n'); + + for_each_online_cpu(i) { + + idle = get_idle_sum_exec_runtime(i); + + seq_printf(p, "cpu%d", i); + seq_put_decimal_ull(p, " ", nsec_to_clock_t(idle)); + seq_putc(p, '\n'); + } + + return 0; +} + +static int idle_open(struct inode *inode, struct file *file) +{ + unsigned int size = 32 + 32 * num_online_cpus(); + + return single_open_size(file, show_idle, NULL, size); +} + +static struct proc_ops idle_procs_ops = { + .proc_open = idle_open, + .proc_read_iter = seq_read_iter, + .proc_lseek = seq_lseek, + .proc_release = single_release, +}; + +static int __init kernel_module_init(void) +{ + proc_create(PROC_NAME, 0, NULL, &idle_procs_ops); + return 0; +} + +fs_initcall(kernel_module_init); + +#endif /*CONFIG_PROC_IDLE*/ diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c index 5a55d2300452..25218a8f822f 100644 --- a/kernel/sched/cputime.c +++ b/kernel/sched/cputime.c @@ -19,6 +19,8 @@ */ DEFINE_PER_CPU(struct irqtime, cpu_irqtime); +extern struct static_key_true proc_idle; + static int sched_clock_irqtime; void enable_sched_clock_irqtime(void) @@ -1078,3 +1080,35 @@ void kcpustat_cpu_fetch(struct kernel_cpustat *dst, int cpu) EXPORT_SYMBOL_GPL(kcpustat_cpu_fetch); #endif /* CONFIG_VIRT_CPU_ACCOUNTING_GEN */ + + +#ifdef CONFIG_PROC_IDLE + + +u64 cal_idle_sum_exec_runtime(int cpu) +{ + struct rq *rq = cpu_rq(cpu); + struct sched_entity *idle_se = &rq->idle->se; + u64 idle = idle_se->sum_exec_runtime; + + if (!static_branch_likely(&proc_idle)) + return 0ULL; + + if (rq->curr == rq->idle) { + u64 now = sched_clock(); + u64 delta_exec; + + delta_exec = now - idle_se->exec_start; + if (unlikely((s64)delta_exec <= 0)) + return idle; + + schedstat_set(idle_se->statistics.exec_max, + max(delta_exec, idle_se->statistics.exec_max)); + + idle += delta_exec; + } + + return idle; +} + +#endif /* CONFIG_PROC_IDLE */ diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c index 36b545f17206..15f076ab5823 100644 --- a/kernel/sched/idle.c +++ b/kernel/sched/idle.c @@ -10,6 +10,8 @@ #include <trace/events/power.h> +DEFINE_STATIC_KEY_TRUE(proc_idle); + /* Linker adds these: start and end of __cpuidle functions */ extern char __cpuidle_text_start[], __cpuidle_text_end[]; @@ -424,6 +426,23 @@ static void check_preempt_curr_idle(struct rq *rq, struct task_struct *p, int fl static void put_prev_task_idle(struct rq *rq, struct task_struct *prev) { +#ifdef CONFIG_PROC_IDLE + if (!static_branch_likely(&proc_idle)) + return; + + struct sched_entity *idle_se = &rq->idle->se; + u64 now = sched_clock(); + u64 delta_exec; + + delta_exec = now - idle_se->exec_start; + if (unlikely((s64)delta_exec <= 0)) + return; + + schedstat_set(idle_se->statistics.exec_max, + max(delta_exec, idle_se->statistics.exec_max)); + + idle_se->sum_exec_runtime += delta_exec; +#endif } static void set_next_task_idle(struct rq *rq, struct task_struct *next, bool first) @@ -436,6 +455,15 @@ struct task_struct *pick_next_task_idle(struct rq *rq) { struct task_struct *next = rq->idle; +#ifdef CONFIG_PROC_IDLE + if (static_branch_likely(&proc_idle)) { + struct sched_entity *idle_se = &rq->idle->se; + u64 now = sched_clock(); + + idle_se->exec_start = now; + } +#endif + set_next_task_idle(rq, next, true); return next; -- 2.17.1

1 0

[PATCH OLK-5.10 1/9] mm: add Kernel Electric-Fence infrastructure
by 1415317271＠qq.com 30 Sep '21

30 Sep '21

From: Alexander Potapenko <glider(a)google.com> Patch series "KFENCE: A low-overhead sampling-based memory safety error detector", v7. This adds the Kernel Electric-Fence (KFENCE) infrastructure. KFENCE is a low-overhead sampling-based memory safety error detector of heap use-after-free, invalid-free, and out-of-bounds access errors. This series enables KFENCE for the x86 and arm64 architectures, and adds KFENCE hooks to the SLAB and SLUB allocators. KFENCE is designed to be enabled in production kernels, and has near zero performance overhead. Compared to KASAN, KFENCE trades performance for precision. The main motivation behind KFENCE's design, is that with enough total uptime KFENCE will detect bugs in code paths not typically exercised by non-production test workloads. One way to quickly achieve a large enough total uptime is when the tool is deployed across a large fleet of machines. KFENCE objects each reside on a dedicated page, at either the left or right page boundaries. The pages to the left and right of the object page are "guard pages", whose attributes are changed to a protected state, and cause page faults on any attempted access to them. Such page faults are then intercepted by KFENCE, which handles the fault gracefully by reporting a memory access error. Guarded allocations are set up based on a sample interval (can be set via kfence.sample_interval). After expiration of the sample interval, the next allocation through the main allocator (SLAB or SLUB) returns a guarded allocation from the KFENCE object pool. At this point, the timer is reset, and the next allocation is set up after the expiration of the interval. To enable/disable a KFENCE allocation through the main allocator's fast-path without overhead, KFENCE relies on static branches via the static keys infrastructure. The static branch is toggled to redirect the allocation to KFENCE. The KFENCE memory pool is of fixed size, and if the pool is exhausted no further KFENCE allocations occur. The default config is conservative with only 255 objects, resulting in a pool size of 2 MiB (with 4 KiB pages). We have verified by running synthetic benchmarks (sysbench I/O, hackbench) and production server-workload benchmarks that a kernel with KFENCE (using sample intervals 100-500ms) is performance-neutral compared to a non-KFENCE baseline kernel. KFENCE is inspired by GWP-ASan [1], a userspace tool with similar properties. The name "KFENCE" is a homage to the Electric Fence Malloc Debugger [2]. For more details, see Documentation/dev-tools/kfence.rst added in the series -- also viewable here: https://raw.githubusercontent.com/google/kasan/kfence/Documentation/dev-too… [1] http://llvm.org/docs/GwpAsan.html [2] https://linux.die.net/man/3/efence This patch (of 9): This adds the Kernel Electric-Fence (KFENCE) infrastructure. KFENCE is a low-overhead sampling-based memory safety error detector of heap use-after-free, invalid-free, and out-of-bounds access errors. KFENCE is designed to be enabled in production kernels, and has near zero performance overhead. Compared to KASAN, KFENCE trades performance for precision. The main motivation behind KFENCE's design, is that with enough total uptime KFENCE will detect bugs in code paths not typically exercised by non-production test workloads. One way to quickly achieve a large enough total uptime is when the tool is deployed across a large fleet of machines. KFENCE objects each reside on a dedicated page, at either the left or right page boundaries. The pages to the left and right of the object page are "guard pages", whose attributes are changed to a protected state, and cause page faults on any attempted access to them. Such page faults are then intercepted by KFENCE, which handles the fault gracefully by reporting a memory access error. To detect out-of-bounds writes to memory within the object's page itself, KFENCE also uses pattern-based redzones. The following figure illustrates the page layout: ---+-----------+-----------+-----------+-----------+-----------+--- | xxxxxxxxx | O : | xxxxxxxxx | : O | xxxxxxxxx | | xxxxxxxxx | B : | xxxxxxxxx | : B | xxxxxxxxx | | x GUARD x | J : RED- | x GUARD x | RED- : J | x GUARD x | | xxxxxxxxx | E : ZONE | xxxxxxxxx | ZONE : E | xxxxxxxxx | | xxxxxxxxx | C : | xxxxxxxxx | : C | xxxxxxxxx | | xxxxxxxxx | T : | xxxxxxxxx | : T | xxxxxxxxx | ---+-----------+-----------+-----------+-----------+-----------+--- Guarded allocations are set up based on a sample interval (can be set via kfence.sample_interval). After expiration of the sample interval, a guarded allocation from the KFENCE object pool is returned to the main allocator (SLAB or SLUB). At this point, the timer is reset, and the next allocation is set up after the expiration of the interval. To enable/disable a KFENCE allocation through the main allocator's fast-path without overhead, KFENCE relies on static branches via the static keys infrastructure. The static branch is toggled to redirect the allocation to KFENCE. To date, we have verified by running synthetic benchmarks (sysbench I/O, hackbench) that a kernel compiled with KFENCE is performance-neutral compared to the non-KFENCE baseline. For more details, see Documentation/dev-tools/kfence.rst (added later in the series). [elver(a)google.com: fix parameter description for kfence_object_start()] Link: https://lkml.kernel.org/r/20201106092149.GA2851373@elver.google.com [elver(a)google.com: avoid stalling work queue task without allocations] Link: https://lkml.kernel.org/r/CADYN=9J0DQhizAGB0-jz4HOBBh+05kMBXb4c0cXMS7Qi5NAJ… Link: https://lkml.kernel.org/r/20201110135320.3309507-1-elver@google.com [elver(a)google.com: fix potential deadlock due to wake_up()] Link: https://lkml.kernel.org/r/000000000000c0645805b7f982e4@google.com Link: https://lkml.kernel.org/r/20210104130749.1768991-1-elver@google.com [elver(a)google.com: add option to use KFENCE without static keys] Link: https://lkml.kernel.org/r/20210111091544.3287013-1-elver@google.com [elver(a)google.com: add missing copyright and description headers] Link: https://lkml.kernel.org/r/20210118092159.145934-1-elver@google.com Link: https://lkml.kernel.org/r/20201103175841.3495947-2-elver@google.com Signed-off-by: Marco Elver <elver(a)google.com> Signed-off-by: Alexander Potapenko <glider(a)google.com> Reviewed-by: Dmitry Vyukov <dvyukov(a)google.com> Reviewed-by: SeongJae Park <sjpark(a)amazon.de> Co-developed-by: Marco Elver <elver(a)google.com> Reviewed-by: Jann Horn <jannh(a)google.com> Cc: "H. Peter Anvin" <hpa(a)zytor.com> Cc: Paul E. McKenney <paulmck(a)kernel.org> Cc: Andrey Konovalov <andreyknvl(a)google.com> Cc: Andrey Ryabinin <aryabinin(a)virtuozzo.com> Cc: Andy Lutomirski <luto(a)kernel.org> Cc: Borislav Petkov <bp(a)alien8.de> Cc: Catalin Marinas <catalin.marinas(a)arm.com> Cc: Christopher Lameter <cl(a)linux.com> Cc: Dave Hansen <dave.hansen(a)linux.intel.com> Cc: David Rientjes <rientjes(a)google.com> Cc: Eric Dumazet <edumazet(a)google.com> Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Cc: Hillf Danton <hdanton(a)sina.com> Cc: Ingo Molnar <mingo(a)redhat.com> Cc: Jonathan Corbet <corbet(a)lwn.net> Cc: Joonsoo Kim <iamjoonsoo.kim(a)lge.com> Cc: Joern Engel <joern(a)purestorage.com> Cc: Kees Cook <keescook(a)chromium.org> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Pekka Enberg <penberg(a)kernel.org> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Thomas Gleixner <tglx(a)linutronix.de> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Will Deacon <will(a)kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Yingjie Shang <1415317271(a)qq.com> Reviewed-by: Bixuan Cui <cuibixuan(a)huawei.com> --- include/linux/kfence.h | 216 +++++++++++ init/main.c | 3 + lib/Kconfig.debug | 1 + lib/Kconfig.kfence | 67 ++++ mm/Makefile | 1 + mm/kfence/Makefile | 3 + mm/kfence/core.c | 840 +++++++++++++++++++++++++++++++++++++++++ mm/kfence/kfence.h | 113 ++++++ mm/kfence/report.c | 240 ++++++++++++ 9 files changed, 1484 insertions(+) create mode 100644 include/linux/kfence.h create mode 100644 lib/Kconfig.kfence create mode 100644 mm/kfence/Makefile create mode 100644 mm/kfence/core.c create mode 100644 mm/kfence/kfence.h create mode 100644 mm/kfence/report.c diff --git a/include/linux/kfence.h b/include/linux/kfence.h new file mode 100644 index 000000000000..81f3911cb298 --- /dev/null +++ b/include/linux/kfence.h @@ -0,0 +1,216 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Kernel Electric-Fence (KFENCE). Public interface for allocator and fault + * handler integration. For more info see Documentation/dev-tools/kfence.rst. + * + * Copyright (C) 2020, Google LLC. + */ + +#ifndef _LINUX_KFENCE_H +#define _LINUX_KFENCE_H + +#include <linux/mm.h> +#include <linux/types.h> + +#ifdef CONFIG_KFENCE + +/* + * We allocate an even number of pages, as it simplifies calculations to map + * address to metadata indices; effectively, the very first page serves as an + * extended guard page, but otherwise has no special purpose. + */ +#define KFENCE_POOL_SIZE ((CONFIG_KFENCE_NUM_OBJECTS + 1) * 2 * PAGE_SIZE) +extern char *__kfence_pool; + +#ifdef CONFIG_KFENCE_STATIC_KEYS +#include <linux/static_key.h> +DECLARE_STATIC_KEY_FALSE(kfence_allocation_key); +#else +#include <linux/atomic.h> +extern atomic_t kfence_allocation_gate; +#endif + +/** + * is_kfence_address() - check if an address belongs to KFENCE pool + * @addr: address to check + * + * Return: true or false depending on whether the address is within the KFENCE + * object range. + * + * KFENCE objects live in a separate page range and are not to be intermixed + * with regular heap objects (e.g. KFENCE objects must never be added to the + * allocator freelists). Failing to do so may and will result in heap + * corruptions, therefore is_kfence_address() must be used to check whether + * an object requires specific handling. + * + * Note: This function may be used in fast-paths, and is performance critical. + * Future changes should take this into account; for instance, we want to avoid + * introducing another load and therefore need to keep KFENCE_POOL_SIZE a + * constant (until immediate patching support is added to the kernel). + */ +static __always_inline bool is_kfence_address(const void *addr) +{ + /* + * The non-NULL check is required in case the __kfence_pool pointer was + * never initialized; keep it in the slow-path after the range-check. + */ + return unlikely((unsigned long)((char *)addr - __kfence_pool) < KFENCE_POOL_SIZE && addr); +} + +/** + * kfence_alloc_pool() - allocate the KFENCE pool via memblock + */ +void __init kfence_alloc_pool(void); + +/** + * kfence_init() - perform KFENCE initialization at boot time + * + * Requires that kfence_alloc_pool() was called before. This sets up the + * allocation gate timer, and requires that workqueues are available. + */ +void __init kfence_init(void); + +/** + * kfence_shutdown_cache() - handle shutdown_cache() for KFENCE objects + * @s: cache being shut down + * + * Before shutting down a cache, one must ensure there are no remaining objects + * allocated from it. Because KFENCE objects are not referenced from the cache + * directly, we need to check them here. + * + * Note that shutdown_cache() is internal to SL*B, and kmem_cache_destroy() does + * not return if allocated objects still exist: it prints an error message and + * simply aborts destruction of a cache, leaking memory. + * + * If the only such objects are KFENCE objects, we will not leak the entire + * cache, but instead try to provide more useful debug info by making allocated + * objects "zombie allocations". Objects may then still be used or freed (which + * is handled gracefully), but usage will result in showing KFENCE error reports + * which include stack traces to the user of the object, the original allocation + * site, and caller to shutdown_cache(). + */ +void kfence_shutdown_cache(struct kmem_cache *s); + +/* + * Allocate a KFENCE object. Allocators must not call this function directly, + * use kfence_alloc() instead. + */ +void *__kfence_alloc(struct kmem_cache *s, size_t size, gfp_t flags); + +/** + * kfence_alloc() - allocate a KFENCE object with a low probability + * @s: struct kmem_cache with object requirements + * @size: exact size of the object to allocate (can be less than @s->size + * e.g. for kmalloc caches) + * @flags: GFP flags + * + * Return: + * * NULL - must proceed with allocating as usual, + * * non-NULL - pointer to a KFENCE object. + * + * kfence_alloc() should be inserted into the heap allocation fast path, + * allowing it to transparently return KFENCE-allocated objects with a low + * probability using a static branch (the probability is controlled by the + * kfence.sample_interval boot parameter). + */ +static __always_inline void *kfence_alloc(struct kmem_cache *s, size_t size, gfp_t flags) +{ +#ifdef CONFIG_KFENCE_STATIC_KEYS + if (static_branch_unlikely(&kfence_allocation_key)) +#else + if (unlikely(!atomic_read(&kfence_allocation_gate))) +#endif + return __kfence_alloc(s, size, flags); + return NULL; +} + +/** + * kfence_ksize() - get actual amount of memory allocated for a KFENCE object + * @addr: pointer to a heap object + * + * Return: + * * 0 - not a KFENCE object, must call __ksize() instead, + * * non-0 - this many bytes can be accessed without causing a memory error. + * + * kfence_ksize() returns the number of bytes requested for a KFENCE object at + * allocation time. This number may be less than the object size of the + * corresponding struct kmem_cache. + */ +size_t kfence_ksize(const void *addr); + +/** + * kfence_object_start() - find the beginning of a KFENCE object + * @addr: address within a KFENCE-allocated object + * + * Return: address of the beginning of the object. + * + * SL[AU]B-allocated objects are laid out within a page one by one, so it is + * easy to calculate the beginning of an object given a pointer inside it and + * the object size. The same is not true for KFENCE, which places a single + * object at either end of the page. This helper function is used to find the + * beginning of a KFENCE-allocated object. + */ +void *kfence_object_start(const void *addr); + +/** + * __kfence_free() - release a KFENCE heap object to KFENCE pool + * @addr: object to be freed + * + * Requires: is_kfence_address(addr) + * + * Release a KFENCE object and mark it as freed. + */ +void __kfence_free(void *addr); + +/** + * kfence_free() - try to release an arbitrary heap object to KFENCE pool + * @addr: object to be freed + * + * Return: + * * false - object doesn't belong to KFENCE pool and was ignored, + * * true - object was released to KFENCE pool. + * + * Release a KFENCE object and mark it as freed. May be called on any object, + * even non-KFENCE objects, to simplify integration of the hooks into the + * allocator's free codepath. The allocator must check the return value to + * determine if it was a KFENCE object or not. + */ +static __always_inline __must_check bool kfence_free(void *addr) +{ + if (!is_kfence_address(addr)) + return false; + __kfence_free(addr); + return true; +} + +/** + * kfence_handle_page_fault() - perform page fault handling for KFENCE pages + * @addr: faulting address + * + * Return: + * * false - address outside KFENCE pool, + * * true - page fault handled by KFENCE, no additional handling required. + * + * A page fault inside KFENCE pool indicates a memory error, such as an + * out-of-bounds access, a use-after-free or an invalid memory access. In these + * cases KFENCE prints an error message and marks the offending page as + * present, so that the kernel can proceed. + */ +bool __must_check kfence_handle_page_fault(unsigned long addr); + +#else /* CONFIG_KFENCE */ + +static inline bool is_kfence_address(const void *addr) { return false; } +static inline void kfence_alloc_pool(void) { } +static inline void kfence_init(void) { } +static inline void kfence_shutdown_cache(struct kmem_cache *s) { } +static inline void *kfence_alloc(struct kmem_cache *s, size_t size, gfp_t flags) { return NULL; } +static inline size_t kfence_ksize(const void *addr) { return 0; } +static inline void *kfence_object_start(const void *addr) { return NULL; } +static inline void __kfence_free(void *addr) { } +static inline bool __must_check kfence_free(void *addr) { return false; } +static inline bool __must_check kfence_handle_page_fault(unsigned long addr) { return false; } + +#endif + +#endif /* _LINUX_KFENCE_H */ diff --git a/init/main.c b/init/main.c index fc0277a9e7a3..2d027dc11b10 100644 --- a/init/main.c +++ b/init/main.c @@ -40,6 +40,7 @@ #include <linux/security.h> #include <linux/smp.h> #include <linux/profile.h> +#include <linux/kfence.h> #include <linux/rcupdate.h> #include <linux/moduleparam.h> #include <linux/kallsyms.h> @@ -828,6 +829,7 @@ static void __init mm_init(void) */ page_ext_init_flatmem(); init_debug_pagealloc(); + kfence_alloc_pool(); report_meminit(); mem_init(); kmem_cache_init(); @@ -956,6 +958,7 @@ asmlinkage __visible void __init __no_sanitize_address start_kernel(void) hrtimers_init(); softirq_init(); timekeeping_init(); + kfence_init(); /* * For best initial stack canary entropy, prepare it after: diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug index 799e49a29797..29e64b4cd412 100644 --- a/lib/Kconfig.debug +++ b/lib/Kconfig.debug @@ -878,6 +878,7 @@ config DEBUG_STACKOVERFLOW If in doubt, say "N". source "lib/Kconfig.kasan" +source "lib/Kconfig.kfence" endmenu # "Memory Debugging" diff --git a/lib/Kconfig.kfence b/lib/Kconfig.kfence new file mode 100644 index 000000000000..b88ac9d6b2e6 --- /dev/null +++ b/lib/Kconfig.kfence @@ -0,0 +1,67 @@ +# SPDX-License-Identifier: GPL-2.0-only + +config HAVE_ARCH_KFENCE + bool + +menuconfig KFENCE + bool "KFENCE: low-overhead sampling-based memory safety error detector" + depends on HAVE_ARCH_KFENCE && !KASAN && (SLAB || SLUB) + select STACKTRACE + help + KFENCE is a low-overhead sampling-based detector of heap out-of-bounds + access, use-after-free, and invalid-free errors. KFENCE is designed + to have negligible cost to permit enabling it in production + environments. + + Note that, KFENCE is not a substitute for explicit testing with tools + such as KASAN. KFENCE can detect a subset of bugs that KASAN can + detect, albeit at very different performance profiles. If you can + afford to use KASAN, continue using KASAN, for example in test + environments. If your kernel targets production use, and cannot + enable KASAN due to its cost, consider using KFENCE. + +if KFENCE + +config KFENCE_STATIC_KEYS + bool "Use static keys to set up allocations" + default y + depends on JUMP_LABEL # To ensure performance, require jump labels + help + Use static keys (static branches) to set up KFENCE allocations. Using + static keys is normally recommended, because it avoids a dynamic + branch in the allocator's fast path. However, with very low sample + intervals, or on systems that do not support jump labels, a dynamic + branch may still be an acceptable performance trade-off. + +config KFENCE_SAMPLE_INTERVAL + int "Default sample interval in milliseconds" + default 100 + help + The KFENCE sample interval determines the frequency with which heap + allocations will be guarded by KFENCE. May be overridden via boot + parameter "kfence.sample_interval". + + Set this to 0 to disable KFENCE by default, in which case only + setting "kfence.sample_interval" to a non-zero value enables KFENCE. + +config KFENCE_NUM_OBJECTS + int "Number of guarded objects available" + range 1 65535 + default 255 + help + The number of guarded objects available. For each KFENCE object, 2 + pages are required; with one containing the object and two adjacent + ones used as guard pages. + +config KFENCE_STRESS_TEST_FAULTS + int "Stress testing of fault handling and error reporting" if EXPERT + default 0 + help + The inverse probability with which to randomly protect KFENCE object + pages, resulting in spurious use-after-frees. The main purpose of + this option is to stress test KFENCE with concurrent error reports + and allocations/frees. A value of 0 disables stress testing logic. + + Only for KFENCE testing; set to 0 if you are not a KFENCE developer. + +endif # KFENCE diff --git a/mm/Makefile b/mm/Makefile index 2b1991759835..3d81a67d66a2 100644 --- a/mm/Makefile +++ b/mm/Makefile @@ -82,6 +82,7 @@ obj-$(CONFIG_PAGE_POISONING) += page_poison.o obj-$(CONFIG_SLAB) += slab.o obj-$(CONFIG_SLUB) += slub.o obj-$(CONFIG_KASAN) += kasan/ +obj-$(CONFIG_KFENCE) += kfence/ obj-$(CONFIG_FAILSLAB) += failslab.o obj-$(CONFIG_MEMORY_HOTPLUG) += memory_hotplug.o obj-$(CONFIG_MEMTEST) += memtest.o diff --git a/mm/kfence/Makefile b/mm/kfence/Makefile new file mode 100644 index 000000000000..d991e9a349f0 --- /dev/null +++ b/mm/kfence/Makefile @@ -0,0 +1,3 @@ +# SPDX-License-Identifier: GPL-2.0 + +obj-$(CONFIG_KFENCE) := core.o report.o diff --git a/mm/kfence/core.c b/mm/kfence/core.c new file mode 100644 index 000000000000..d6a32c13336b --- /dev/null +++ b/mm/kfence/core.c @@ -0,0 +1,840 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * KFENCE guarded object allocator and fault handling. + * + * Copyright (C) 2020, Google LLC. + */ + +#define pr_fmt(fmt) "kfence: " fmt + +#include <linux/atomic.h> +#include <linux/bug.h> +#include <linux/debugfs.h> +#include <linux/kcsan-checks.h> +#include <linux/kfence.h> +#include <linux/list.h> +#include <linux/lockdep.h> +#include <linux/memblock.h> +#include <linux/moduleparam.h> +#include <linux/random.h> +#include <linux/rcupdate.h> +#include <linux/seq_file.h> +#include <linux/slab.h> +#include <linux/spinlock.h> +#include <linux/string.h> + +#include <asm/kfence.h> + +#include "kfence.h" + +/* Disables KFENCE on the first warning assuming an irrecoverable error. */ +#define KFENCE_WARN_ON(cond) \ + ({ \ + const bool __cond = WARN_ON(cond); \ + if (unlikely(__cond)) \ + WRITE_ONCE(kfence_enabled, false); \ + __cond; \ + }) + +/* === Data ================================================================= */ + +static bool kfence_enabled __read_mostly; + +static unsigned long kfence_sample_interval __read_mostly = CONFIG_KFENCE_SAMPLE_INTERVAL; + +#ifdef MODULE_PARAM_PREFIX +#undef MODULE_PARAM_PREFIX +#endif +#define MODULE_PARAM_PREFIX "kfence." + +static int param_set_sample_interval(const char *val, const struct kernel_param *kp) +{ + unsigned long num; + int ret = kstrtoul(val, 0, &num); + + if (ret < 0) + return ret; + + if (!num) /* Using 0 to indicate KFENCE is disabled. */ + WRITE_ONCE(kfence_enabled, false); + else if (!READ_ONCE(kfence_enabled) && system_state != SYSTEM_BOOTING) + return -EINVAL; /* Cannot (re-)enable KFENCE on-the-fly. */ + + *((unsigned long *)kp->arg) = num; + return 0; +} + +static int param_get_sample_interval(char *buffer, const struct kernel_param *kp) +{ + if (!READ_ONCE(kfence_enabled)) + return sprintf(buffer, "0\n"); + + return param_get_ulong(buffer, kp); +} + +static const struct kernel_param_ops sample_interval_param_ops = { + .set = param_set_sample_interval, + .get = param_get_sample_interval, +}; +module_param_cb(sample_interval, &sample_interval_param_ops, &kfence_sample_interval, 0600); + +/* The pool of pages used for guard pages and objects. */ +char *__kfence_pool __ro_after_init; +EXPORT_SYMBOL(__kfence_pool); /* Export for test modules. */ + +/* + * Per-object metadata, with one-to-one mapping of object metadata to + * backing pages (in __kfence_pool). + */ +static_assert(CONFIG_KFENCE_NUM_OBJECTS > 0); +struct kfence_metadata kfence_metadata[CONFIG_KFENCE_NUM_OBJECTS]; + +/* Freelist with available objects. */ +static struct list_head kfence_freelist = LIST_HEAD_INIT(kfence_freelist); +static DEFINE_RAW_SPINLOCK(kfence_freelist_lock); /* Lock protecting freelist. */ + +#ifdef CONFIG_KFENCE_STATIC_KEYS +/* The static key to set up a KFENCE allocation. */ +DEFINE_STATIC_KEY_FALSE(kfence_allocation_key); +#endif + +/* Gates the allocation, ensuring only one succeeds in a given period. */ +atomic_t kfence_allocation_gate = ATOMIC_INIT(1); + +/* Statistics counters for debugfs. */ +enum kfence_counter_id { + KFENCE_COUNTER_ALLOCATED, + KFENCE_COUNTER_ALLOCS, + KFENCE_COUNTER_FREES, + KFENCE_COUNTER_ZOMBIES, + KFENCE_COUNTER_BUGS, + KFENCE_COUNTER_COUNT, +}; +static atomic_long_t counters[KFENCE_COUNTER_COUNT]; +static const char *const counter_names[] = { + [KFENCE_COUNTER_ALLOCATED] = "currently allocated", + [KFENCE_COUNTER_ALLOCS] = "total allocations", + [KFENCE_COUNTER_FREES] = "total frees", + [KFENCE_COUNTER_ZOMBIES] = "zombie allocations", + [KFENCE_COUNTER_BUGS] = "total bugs", +}; +static_assert(ARRAY_SIZE(counter_names) == KFENCE_COUNTER_COUNT); + +/* === Internals ============================================================ */ + +static bool kfence_protect(unsigned long addr) +{ + return !KFENCE_WARN_ON(!kfence_protect_page(ALIGN_DOWN(addr, PAGE_SIZE), true)); +} + +static bool kfence_unprotect(unsigned long addr) +{ + return !KFENCE_WARN_ON(!kfence_protect_page(ALIGN_DOWN(addr, PAGE_SIZE), false)); +} + +static inline struct kfence_metadata *addr_to_metadata(unsigned long addr) +{ + long index; + + /* The checks do not affect performance; only called from slow-paths. */ + + if (!is_kfence_address((void *)addr)) + return NULL; + + /* + * May be an invalid index if called with an address at the edge of + * __kfence_pool, in which case we would report an "invalid access" + * error. + */ + index = (addr - (unsigned long)__kfence_pool) / (PAGE_SIZE * 2) - 1; + if (index < 0 || index >= CONFIG_KFENCE_NUM_OBJECTS) + return NULL; + + return &kfence_metadata[index]; +} + +static inline unsigned long metadata_to_pageaddr(const struct kfence_metadata *meta) +{ + unsigned long offset = (meta - kfence_metadata + 1) * PAGE_SIZE * 2; + unsigned long pageaddr = (unsigned long)&__kfence_pool[offset]; + + /* The checks do not affect performance; only called from slow-paths. */ + + /* Only call with a pointer into kfence_metadata. */ + if (KFENCE_WARN_ON(meta < kfence_metadata || + meta >= kfence_metadata + CONFIG_KFENCE_NUM_OBJECTS)) + return 0; + + /* + * This metadata object only ever maps to 1 page; verify that the stored + * address is in the expected range. + */ + if (KFENCE_WARN_ON(ALIGN_DOWN(meta->addr, PAGE_SIZE) != pageaddr)) + return 0; + + return pageaddr; +} + +/* + * Update the object's metadata state, including updating the alloc/free stacks + * depending on the state transition. + */ +static noinline void metadata_update_state(struct kfence_metadata *meta, + enum kfence_object_state next) +{ + struct kfence_track *track = + next == KFENCE_OBJECT_FREED ? &meta->free_track : &meta->alloc_track; + + lockdep_assert_held(&meta->lock); + + /* + * Skip over 1 (this) functions; noinline ensures we do not accidentally + * skip over the caller by never inlining. + */ + track->num_stack_entries = stack_trace_save(track->stack_entries, KFENCE_STACK_DEPTH, 1); + track->pid = task_pid_nr(current); + + /* + * Pairs with READ_ONCE() in + * kfence_shutdown_cache(), + * kfence_handle_page_fault(). + */ + WRITE_ONCE(meta->state, next); +} + +/* Write canary byte to @addr. */ +static inline bool set_canary_byte(u8 *addr) +{ + *addr = KFENCE_CANARY_PATTERN(addr); + return true; +} + +/* Check canary byte at @addr. */ +static inline bool check_canary_byte(u8 *addr) +{ + if (likely(*addr == KFENCE_CANARY_PATTERN(addr))) + return true; + + atomic_long_inc(&counters[KFENCE_COUNTER_BUGS]); + kfence_report_error((unsigned long)addr, addr_to_metadata((unsigned long)addr), + KFENCE_ERROR_CORRUPTION); + return false; +} + +/* __always_inline this to ensure we won't do an indirect call to fn. */ +static __always_inline void for_each_canary(const struct kfence_metadata *meta, bool (*fn)(u8 *)) +{ + const unsigned long pageaddr = ALIGN_DOWN(meta->addr, PAGE_SIZE); + unsigned long addr; + + lockdep_assert_held(&meta->lock); + + /* + * We'll iterate over each canary byte per-side until fn() returns + * false. However, we'll still iterate over the canary bytes to the + * right of the object even if there was an error in the canary bytes to + * the left of the object. Specifically, if check_canary_byte() + * generates an error, showing both sides might give more clues as to + * what the error is about when displaying which bytes were corrupted. + */ + + /* Apply to left of object. */ + for (addr = pageaddr; addr < meta->addr; addr++) { + if (!fn((u8 *)addr)) + break; + } + + /* Apply to right of object. */ + for (addr = meta->addr + meta->size; addr < pageaddr + PAGE_SIZE; addr++) { + if (!fn((u8 *)addr)) + break; + } +} + +static void *kfence_guarded_alloc(struct kmem_cache *cache, size_t size, gfp_t gfp) +{ + struct kfence_metadata *meta = NULL; + unsigned long flags; + struct page *page; + void *addr; + + /* Try to obtain a free object. */ + raw_spin_lock_irqsave(&kfence_freelist_lock, flags); + if (!list_empty(&kfence_freelist)) { + meta = list_entry(kfence_freelist.next, struct kfence_metadata, list); + list_del_init(&meta->list); + } + raw_spin_unlock_irqrestore(&kfence_freelist_lock, flags); + if (!meta) + return NULL; + + if (unlikely(!raw_spin_trylock_irqsave(&meta->lock, flags))) { + /* + * This is extremely unlikely -- we are reporting on a + * use-after-free, which locked meta->lock, and the reporting + * code via printk calls kmalloc() which ends up in + * kfence_alloc() and tries to grab the same object that we're + * reporting on. While it has never been observed, lockdep does + * report that there is a possibility of deadlock. Fix it by + * using trylock and bailing out gracefully. + */ + raw_spin_lock_irqsave(&kfence_freelist_lock, flags); + /* Put the object back on the freelist. */ + list_add_tail(&meta->list, &kfence_freelist); + raw_spin_unlock_irqrestore(&kfence_freelist_lock, flags); + + return NULL; + } + + meta->addr = metadata_to_pageaddr(meta); + /* Unprotect if we're reusing this page. */ + if (meta->state == KFENCE_OBJECT_FREED) + kfence_unprotect(meta->addr); + + /* + * Note: for allocations made before RNG initialization, will always + * return zero. We still benefit from enabling KFENCE as early as + * possible, even when the RNG is not yet available, as this will allow + * KFENCE to detect bugs due to earlier allocations. The only downside + * is that the out-of-bounds accesses detected are deterministic for + * such allocations. + */ + if (prandom_u32_max(2)) { + /* Allocate on the "right" side, re-calculate address. */ + meta->addr += PAGE_SIZE - size; + meta->addr = ALIGN_DOWN(meta->addr, cache->align); + } + + addr = (void *)meta->addr; + + /* Update remaining metadata. */ + metadata_update_state(meta, KFENCE_OBJECT_ALLOCATED); + /* Pairs with READ_ONCE() in kfence_shutdown_cache(). */ + WRITE_ONCE(meta->cache, cache); + meta->size = size; + for_each_canary(meta, set_canary_byte); + + /* Set required struct page fields. */ + page = virt_to_page(meta->addr); + page->slab_cache = cache; + + raw_spin_unlock_irqrestore(&meta->lock, flags); + + /* Memory initialization. */ + + /* + * We check slab_want_init_on_alloc() ourselves, rather than letting + * SL*B do the initialization, as otherwise we might overwrite KFENCE's + * redzone. + */ + if (unlikely(slab_want_init_on_alloc(gfp, cache))) + memzero_explicit(addr, size); + if (cache->ctor) + cache->ctor(addr); + + if (CONFIG_KFENCE_STRESS_TEST_FAULTS && !prandom_u32_max(CONFIG_KFENCE_STRESS_TEST_FAULTS)) + kfence_protect(meta->addr); /* Random "faults" by protecting the object. */ + + atomic_long_inc(&counters[KFENCE_COUNTER_ALLOCATED]); + atomic_long_inc(&counters[KFENCE_COUNTER_ALLOCS]); + + return addr; +} + +static void kfence_guarded_free(void *addr, struct kfence_metadata *meta, bool zombie) +{ + struct kcsan_scoped_access assert_page_exclusive; + unsigned long flags; + + raw_spin_lock_irqsave(&meta->lock, flags); + + if (meta->state != KFENCE_OBJECT_ALLOCATED || meta->addr != (unsigned long)addr) { + /* Invalid or double-free, bail out. */ + atomic_long_inc(&counters[KFENCE_COUNTER_BUGS]); + kfence_report_error((unsigned long)addr, meta, KFENCE_ERROR_INVALID_FREE); + raw_spin_unlock_irqrestore(&meta->lock, flags); + return; + } + + /* Detect racy use-after-free, or incorrect reallocation of this page by KFENCE. */ + kcsan_begin_scoped_access((void *)ALIGN_DOWN((unsigned long)addr, PAGE_SIZE), PAGE_SIZE, + KCSAN_ACCESS_SCOPED | KCSAN_ACCESS_WRITE | KCSAN_ACCESS_ASSERT, + &assert_page_exclusive); + + if (CONFIG_KFENCE_STRESS_TEST_FAULTS) + kfence_unprotect((unsigned long)addr); /* To check canary bytes. */ + + /* Restore page protection if there was an OOB access. */ + if (meta->unprotected_page) { + kfence_protect(meta->unprotected_page); + meta->unprotected_page = 0; + } + + /* Check canary bytes for memory corruption. */ + for_each_canary(meta, check_canary_byte); + + /* + * Clear memory if init-on-free is set. While we protect the page, the + * data is still there, and after a use-after-free is detected, we + * unprotect the page, so the data is still accessible. + */ + if (!zombie && unlikely(slab_want_init_on_free(meta->cache))) + memzero_explicit(addr, meta->size); + + /* Mark the object as freed. */ + metadata_update_state(meta, KFENCE_OBJECT_FREED); + + raw_spin_unlock_irqrestore(&meta->lock, flags); + + /* Protect to detect use-after-frees. */ + kfence_protect((unsigned long)addr); + + kcsan_end_scoped_access(&assert_page_exclusive); + if (!zombie) { + /* Add it to the tail of the freelist for reuse. */ + raw_spin_lock_irqsave(&kfence_freelist_lock, flags); + KFENCE_WARN_ON(!list_empty(&meta->list)); + list_add_tail(&meta->list, &kfence_freelist); + raw_spin_unlock_irqrestore(&kfence_freelist_lock, flags); + + atomic_long_dec(&counters[KFENCE_COUNTER_ALLOCATED]); + atomic_long_inc(&counters[KFENCE_COUNTER_FREES]); + } else { + /* See kfence_shutdown_cache(). */ + atomic_long_inc(&counters[KFENCE_COUNTER_ZOMBIES]); + } +} + +static void rcu_guarded_free(struct rcu_head *h) +{ + struct kfence_metadata *meta = container_of(h, struct kfence_metadata, rcu_head); + + kfence_guarded_free((void *)meta->addr, meta, false); +} + +static bool __init kfence_init_pool(void) +{ + unsigned long addr = (unsigned long)__kfence_pool; + struct page *pages; + int i; + + if (!__kfence_pool) + return false; + + if (!arch_kfence_init_pool()) + goto err; + + pages = virt_to_page(addr); + + /* + * Set up object pages: they must have PG_slab set, to avoid freeing + * these as real pages. + * + * We also want to avoid inserting kfence_free() in the kfree() + * fast-path in SLUB, and therefore need to ensure kfree() correctly + * enters __slab_free() slow-path. + */ + for (i = 0; i < KFENCE_POOL_SIZE / PAGE_SIZE; i++) { + if (!i || (i % 2)) + continue; + + /* Verify we do not have a compound head page. */ + if (WARN_ON(compound_head(&pages[i]) != &pages[i])) + goto err; + + __SetPageSlab(&pages[i]); + } + + /* + * Protect the first 2 pages. The first page is mostly unnecessary, and + * merely serves as an extended guard page. However, adding one + * additional page in the beginning gives us an even number of pages, + * which simplifies the mapping of address to metadata index. + */ + for (i = 0; i < 2; i++) { + if (unlikely(!kfence_protect(addr))) + goto err; + + addr += PAGE_SIZE; + } + + for (i = 0; i < CONFIG_KFENCE_NUM_OBJECTS; i++) { + struct kfence_metadata *meta = &kfence_metadata[i]; + + /* Initialize metadata. */ + INIT_LIST_HEAD(&meta->list); + raw_spin_lock_init(&meta->lock); + meta->state = KFENCE_OBJECT_UNUSED; + meta->addr = addr; /* Initialize for validation in metadata_to_pageaddr(). */ + list_add_tail(&meta->list, &kfence_freelist); + + /* Protect the right redzone. */ + if (unlikely(!kfence_protect(addr + PAGE_SIZE))) + goto err; + + addr += 2 * PAGE_SIZE; + } + + return true; + +err: + /* + * Only release unprotected pages, and do not try to go back and change + * page attributes due to risk of failing to do so as well. If changing + * page attributes for some pages fails, it is very likely that it also + * fails for the first page, and therefore expect addr==__kfence_pool in + * most failure cases. + */ + memblock_free_late(__pa(addr), KFENCE_POOL_SIZE - (addr - (unsigned long)__kfence_pool)); + __kfence_pool = NULL; + return false; +} + +/* === DebugFS Interface ==================================================== */ + +static int stats_show(struct seq_file *seq, void *v) +{ + int i; + + seq_printf(seq, "enabled: %i\n", READ_ONCE(kfence_enabled)); + for (i = 0; i < KFENCE_COUNTER_COUNT; i++) + seq_printf(seq, "%s: %ld\n", counter_names[i], atomic_long_read(&counters[i])); + + return 0; +} +DEFINE_SHOW_ATTRIBUTE(stats); + +/* + * debugfs seq_file operations for /sys/kernel/debug/kfence/objects. + * start_object() and next_object() return the object index + 1, because NULL is used + * to stop iteration. + */ +static void *start_object(struct seq_file *seq, loff_t *pos) +{ + if (*pos < CONFIG_KFENCE_NUM_OBJECTS) + return (void *)((long)*pos + 1); + return NULL; +} + +static void stop_object(struct seq_file *seq, void *v) +{ +} + +static void *next_object(struct seq_file *seq, void *v, loff_t *pos) +{ + ++*pos; + if (*pos < CONFIG_KFENCE_NUM_OBJECTS) + return (void *)((long)*pos + 1); + return NULL; +} + +static int show_object(struct seq_file *seq, void *v) +{ + struct kfence_metadata *meta = &kfence_metadata[(long)v - 1]; + unsigned long flags; + + raw_spin_lock_irqsave(&meta->lock, flags); + kfence_print_object(seq, meta); + raw_spin_unlock_irqrestore(&meta->lock, flags); + seq_puts(seq, "---------------------------------\n"); + + return 0; +} + +static const struct seq_operations object_seqops = { + .start = start_object, + .next = next_object, + .stop = stop_object, + .show = show_object, +}; + +static int open_objects(struct inode *inode, struct file *file) +{ + return seq_open(file, &object_seqops); +} + +static const struct file_operations objects_fops = { + .open = open_objects, + .read = seq_read, + .llseek = seq_lseek, +}; + +static int __init kfence_debugfs_init(void) +{ + struct dentry *kfence_dir = debugfs_create_dir("kfence", NULL); + + debugfs_create_file("stats", 0444, kfence_dir, NULL, &stats_fops); + debugfs_create_file("objects", 0400, kfence_dir, NULL, &objects_fops); + return 0; +} + +late_initcall(kfence_debugfs_init); + +/* === Allocation Gate Timer ================================================ */ + +/* + * Set up delayed work, which will enable and disable the static key. We need to + * use a work queue (rather than a simple timer), since enabling and disabling a + * static key cannot be done from an interrupt. + * + * Note: Toggling a static branch currently causes IPIs, and here we'll end up + * with a total of 2 IPIs to all CPUs. If this ends up a problem in future (with + * more aggressive sampling intervals), we could get away with a variant that + * avoids IPIs, at the cost of not immediately capturing allocations if the + * instructions remain cached. + */ +static struct delayed_work kfence_timer; +static void toggle_allocation_gate(struct work_struct *work) +{ + if (!READ_ONCE(kfence_enabled)) + return; + + /* Enable static key, and await allocation to happen. */ + atomic_set(&kfence_allocation_gate, 0); +#ifdef CONFIG_KFENCE_STATIC_KEYS + static_branch_enable(&kfence_allocation_key); + /* + * Await an allocation. Timeout after 1 second, in case the kernel stops + * doing allocations, to avoid stalling this worker task for too long. + */ + { + unsigned long end_wait = jiffies + HZ; + + do { + set_current_state(TASK_UNINTERRUPTIBLE); + if (atomic_read(&kfence_allocation_gate) != 0) + break; + schedule_timeout(1); + } while (time_before(jiffies, end_wait)); + __set_current_state(TASK_RUNNING); + } + /* Disable static key and reset timer. */ + static_branch_disable(&kfence_allocation_key); +#endif + schedule_delayed_work(&kfence_timer, msecs_to_jiffies(kfence_sample_interval)); +} +static DECLARE_DELAYED_WORK(kfence_timer, toggle_allocation_gate); + +/* === Public interface ===================================================== */ + +void __init kfence_alloc_pool(void) +{ + if (!kfence_sample_interval) + return; + + __kfence_pool = memblock_alloc(KFENCE_POOL_SIZE, PAGE_SIZE); + + if (!__kfence_pool) + pr_err("failed to allocate pool\n"); +} + +void __init kfence_init(void) +{ + /* Setting kfence_sample_interval to 0 on boot disables KFENCE. */ + if (!kfence_sample_interval) + return; + + if (!kfence_init_pool()) { + pr_err("%s failed\n", __func__); + return; + } + + WRITE_ONCE(kfence_enabled, true); + schedule_delayed_work(&kfence_timer, 0); + pr_info("initialized - using %lu bytes for %d objects", KFENCE_POOL_SIZE, + CONFIG_KFENCE_NUM_OBJECTS); + if (IS_ENABLED(CONFIG_DEBUG_KERNEL)) + pr_cont(" at 0x%px-0x%px\n", (void *)__kfence_pool, + (void *)(__kfence_pool + KFENCE_POOL_SIZE)); + else + pr_cont("\n"); +} + +void kfence_shutdown_cache(struct kmem_cache *s) +{ + unsigned long flags; + struct kfence_metadata *meta; + int i; + + for (i = 0; i < CONFIG_KFENCE_NUM_OBJECTS; i++) { + bool in_use; + + meta = &kfence_metadata[i]; + + /* + * If we observe some inconsistent cache and state pair where we + * should have returned false here, cache destruction is racing + * with either kmem_cache_alloc() or kmem_cache_free(). Taking + * the lock will not help, as different critical section + * serialization will have the same outcome. + */ + if (READ_ONCE(meta->cache) != s || + READ_ONCE(meta->state) != KFENCE_OBJECT_ALLOCATED) + continue; + + raw_spin_lock_irqsave(&meta->lock, flags); + in_use = meta->cache == s && meta->state == KFENCE_OBJECT_ALLOCATED; + raw_spin_unlock_irqrestore(&meta->lock, flags); + + if (in_use) { + /* + * This cache still has allocations, and we should not + * release them back into the freelist so they can still + * safely be used and retain the kernel's default + * behaviour of keeping the allocations alive (leak the + * cache); however, they effectively become "zombie + * allocations" as the KFENCE objects are the only ones + * still in use and the owning cache is being destroyed. + * + * We mark them freed, so that any subsequent use shows + * more useful error messages that will include stack + * traces of the user of the object, the original + * allocation, and caller to shutdown_cache(). + */ + kfence_guarded_free((void *)meta->addr, meta, /*zombie=*/true); + } + } + + for (i = 0; i < CONFIG_KFENCE_NUM_OBJECTS; i++) { + meta = &kfence_metadata[i]; + + /* See above. */ + if (READ_ONCE(meta->cache) != s || READ_ONCE(meta->state) != KFENCE_OBJECT_FREED) + continue; + + raw_spin_lock_irqsave(&meta->lock, flags); + if (meta->cache == s && meta->state == KFENCE_OBJECT_FREED) + meta->cache = NULL; + raw_spin_unlock_irqrestore(&meta->lock, flags); + } +} + +void *__kfence_alloc(struct kmem_cache *s, size_t size, gfp_t flags) +{ + /* + * allocation_gate only needs to become non-zero, so it doesn't make + * sense to continue writing to it and pay the associated contention + * cost, in case we have a large number of concurrent allocations. + */ + if (atomic_read(&kfence_allocation_gate) || atomic_inc_return(&kfence_allocation_gate) > 1) + return NULL; + + if (!READ_ONCE(kfence_enabled)) + return NULL; + + if (size > PAGE_SIZE) + return NULL; + + return kfence_guarded_alloc(s, size, flags); +} + +size_t kfence_ksize(const void *addr) +{ + const struct kfence_metadata *meta = addr_to_metadata((unsigned long)addr); + + /* + * Read locklessly -- if there is a race with __kfence_alloc(), this is + * either a use-after-free or invalid access. + */ + return meta ? meta->size : 0; +} + +void *kfence_object_start(const void *addr) +{ + const struct kfence_metadata *meta = addr_to_metadata((unsigned long)addr); + + /* + * Read locklessly -- if there is a race with __kfence_alloc(), this is + * either a use-after-free or invalid access. + */ + return meta ? (void *)meta->addr : NULL; +} + +void __kfence_free(void *addr) +{ + struct kfence_metadata *meta = addr_to_metadata((unsigned long)addr); + + /* + * If the objects of the cache are SLAB_TYPESAFE_BY_RCU, defer freeing + * the object, as the object page may be recycled for other-typed + * objects once it has been freed. meta->cache may be NULL if the cache + * was destroyed. + */ + if (unlikely(meta->cache && (meta->cache->flags & SLAB_TYPESAFE_BY_RCU))) + call_rcu(&meta->rcu_head, rcu_guarded_free); + else + kfence_guarded_free(addr, meta, false); +} + +bool kfence_handle_page_fault(unsigned long addr) +{ + const int page_index = (addr - (unsigned long)__kfence_pool) / PAGE_SIZE; + struct kfence_metadata *to_report = NULL; + enum kfence_error_type error_type; + unsigned long flags; + + if (!is_kfence_address((void *)addr)) + return false; + + if (!READ_ONCE(kfence_enabled)) /* If disabled at runtime ... */ + return kfence_unprotect(addr); /* ... unprotect and proceed. */ + + atomic_long_inc(&counters[KFENCE_COUNTER_BUGS]); + + if (page_index % 2) { + /* This is a redzone, report a buffer overflow. */ + struct kfence_metadata *meta; + int distance = 0; + + meta = addr_to_metadata(addr - PAGE_SIZE); + if (meta && READ_ONCE(meta->state) == KFENCE_OBJECT_ALLOCATED) { + to_report = meta; + /* Data race ok; distance calculation approximate. */ + distance = addr - data_race(meta->addr + meta->size); + } + + meta = addr_to_metadata(addr + PAGE_SIZE); + if (meta && READ_ONCE(meta->state) == KFENCE_OBJECT_ALLOCATED) { + /* Data race ok; distance calculation approximate. */ + if (!to_report || distance > data_race(meta->addr) - addr) + to_report = meta; + } + + if (!to_report) + goto out; + + raw_spin_lock_irqsave(&to_report->lock, flags); + to_report->unprotected_page = addr; + error_type = KFENCE_ERROR_OOB; + + /* + * If the object was freed before we took the look we can still + * report this as an OOB -- the report will simply show the + * stacktrace of the free as well. + */ + } else { + to_report = addr_to_metadata(addr); + if (!to_report) + goto out; + + raw_spin_lock_irqsave(&to_report->lock, flags); + error_type = KFENCE_ERROR_UAF; + /* + * We may race with __kfence_alloc(), and it is possible that a + * freed object may be reallocated. We simply report this as a + * use-after-free, with the stack trace showing the place where + * the object was re-allocated. + */ + } + +out: + if (to_report) { + kfence_report_error(addr, to_report, error_type); + raw_spin_unlock_irqrestore(&to_report->lock, flags); + } else { + /* This may be a UAF or OOB access, but we can't be sure. */ + kfence_report_error(addr, NULL, KFENCE_ERROR_INVALID); + } + + return kfence_unprotect(addr); /* Unprotect and let access proceed. */ +} diff --git a/mm/kfence/kfence.h b/mm/kfence/kfence.h new file mode 100644 index 000000000000..1014060f9707 --- /dev/null +++ b/mm/kfence/kfence.h @@ -0,0 +1,113 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Kernel Electric-Fence (KFENCE). For more info please see + * Documentation/dev-tools/kfence.rst. + * + * Copyright (C) 2020, Google LLC. + */ + +#ifndef MM_KFENCE_KFENCE_H +#define MM_KFENCE_KFENCE_H + +#include <linux/mm.h> +#include <linux/slab.h> +#include <linux/spinlock.h> +#include <linux/types.h> + +#include "../slab.h" /* for struct kmem_cache */ + +/* For non-debug builds, avoid leaking kernel pointers into dmesg. */ +#ifdef CONFIG_DEBUG_KERNEL +#define PTR_FMT "%px" +#else +#define PTR_FMT "%p" +#endif + +/* + * Get the canary byte pattern for @addr. Use a pattern that varies based on the + * lower 3 bits of the address, to detect memory corruptions with higher + * probability, where similar constants are used. + */ +#define KFENCE_CANARY_PATTERN(addr) ((u8)0xaa ^ (u8)((unsigned long)(addr) & 0x7)) + +/* Maximum stack depth for reports. */ +#define KFENCE_STACK_DEPTH 64 + +/* KFENCE object states. */ +enum kfence_object_state { + KFENCE_OBJECT_UNUSED, /* Object is unused. */ + KFENCE_OBJECT_ALLOCATED, /* Object is currently allocated. */ + KFENCE_OBJECT_FREED, /* Object was allocated, and then freed. */ +}; + +/* Alloc/free tracking information. */ +struct kfence_track { + pid_t pid; + int num_stack_entries; + unsigned long stack_entries[KFENCE_STACK_DEPTH]; +}; + +/* KFENCE metadata per guarded allocation. */ +struct kfence_metadata { + struct list_head list; /* Freelist node; access under kfence_freelist_lock. */ + struct rcu_head rcu_head; /* For delayed freeing. */ + + /* + * Lock protecting below data; to ensure consistency of the below data, + * since the following may execute concurrently: __kfence_alloc(), + * __kfence_free(), kfence_handle_page_fault(). However, note that we + * cannot grab the same metadata off the freelist twice, and multiple + * __kfence_alloc() cannot run concurrently on the same metadata. + */ + raw_spinlock_t lock; + + /* The current state of the object; see above. */ + enum kfence_object_state state; + + /* + * Allocated object address; cannot be calculated from size, because of + * alignment requirements. + * + * Invariant: ALIGN_DOWN(addr, PAGE_SIZE) is constant. + */ + unsigned long addr; + + /* + * The size of the original allocation. + */ + size_t size; + + /* + * The kmem_cache cache of the last allocation; NULL if never allocated + * or the cache has already been destroyed. + */ + struct kmem_cache *cache; + + /* + * In case of an invalid access, the page that was unprotected; we + * optimistically only store one address. + */ + unsigned long unprotected_page; + + /* Allocation and free stack information. */ + struct kfence_track alloc_track; + struct kfence_track free_track; +}; + +extern struct kfence_metadata kfence_metadata[CONFIG_KFENCE_NUM_OBJECTS]; + +/* KFENCE error types for report generation. */ +enum kfence_error_type { + KFENCE_ERROR_OOB, /* Detected a out-of-bounds access. */ + KFENCE_ERROR_UAF, /* Detected a use-after-free access. */ + KFENCE_ERROR_CORRUPTION, /* Detected a memory corruption on free. */ + KFENCE_ERROR_INVALID, /* Invalid access of unknown type. */ + KFENCE_ERROR_INVALID_FREE, /* Invalid free. */ +}; + +void kfence_report_error(unsigned long address, const struct kfence_metadata *meta, + enum kfence_error_type type); + +void kfence_print_object(struct seq_file *seq, const struct kfence_metadata *meta); + +#endif /* MM_KFENCE_KFENCE_H */ diff --git a/mm/kfence/report.c b/mm/kfence/report.c new file mode 100644 index 000000000000..64f27c8d46a3 --- /dev/null +++ b/mm/kfence/report.c @@ -0,0 +1,240 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * KFENCE reporting. + * + * Copyright (C) 2020, Google LLC. + */ + +#include <stdarg.h> + +#include <linux/kernel.h> +#include <linux/lockdep.h> +#include <linux/printk.h> +#include <linux/seq_file.h> +#include <linux/stacktrace.h> +#include <linux/string.h> + +#include <asm/kfence.h> + +#include "kfence.h" + +/* Helper function to either print to a seq_file or to console. */ +__printf(2, 3) +static void seq_con_printf(struct seq_file *seq, const char *fmt, ...) +{ + va_list args; + + va_start(args, fmt); + if (seq) + seq_vprintf(seq, fmt, args); + else + vprintk(fmt, args); + va_end(args); +} + +/* + * Get the number of stack entries to skip to get out of MM internals. @type is + * optional, and if set to NULL, assumes an allocation or free stack. + */ +static int get_stack_skipnr(const unsigned long stack_entries[], int num_entries, + const enum kfence_error_type *type) +{ + char buf[64]; + int skipnr, fallback = 0; + bool is_access_fault = false; + + if (type) { + /* Depending on error type, find different stack entries. */ + switch (*type) { + case KFENCE_ERROR_UAF: + case KFENCE_ERROR_OOB: + case KFENCE_ERROR_INVALID: + is_access_fault = true; + break; + case KFENCE_ERROR_CORRUPTION: + case KFENCE_ERROR_INVALID_FREE: + break; + } + } + + for (skipnr = 0; skipnr < num_entries; skipnr++) { + int len = scnprintf(buf, sizeof(buf), "%ps", (void *)stack_entries[skipnr]); + + if (is_access_fault) { + if (!strncmp(buf, KFENCE_SKIP_ARCH_FAULT_HANDLER, len)) + goto found; + } else { + if (str_has_prefix(buf, "kfence_") || str_has_prefix(buf, "__kfence_") || + !strncmp(buf, "__slab_free", len)) { + /* + * In case of tail calls from any of the below + * to any of the above. + */ + fallback = skipnr + 1; + } + + /* Also the *_bulk() variants by only checking prefixes. */ + if (str_has_prefix(buf, "kfree") || + str_has_prefix(buf, "kmem_cache_free") || + str_has_prefix(buf, "__kmalloc") || + str_has_prefix(buf, "kmem_cache_alloc")) + goto found; + } + } + if (fallback < num_entries) + return fallback; +found: + skipnr++; + return skipnr < num_entries ? skipnr : 0; +} + +static void kfence_print_stack(struct seq_file *seq, const struct kfence_metadata *meta, + bool show_alloc) +{ + const struct kfence_track *track = show_alloc ? &meta->alloc_track : &meta->free_track; + + if (track->num_stack_entries) { + /* Skip allocation/free internals stack. */ + int i = get_stack_skipnr(track->stack_entries, track->num_stack_entries, NULL); + + /* stack_trace_seq_print() does not exist; open code our own. */ + for (; i < track->num_stack_entries; i++) + seq_con_printf(seq, " %pS\n", (void *)track->stack_entries[i]); + } else { + seq_con_printf(seq, " no %s stack\n", show_alloc ? "allocation" : "deallocation"); + } +} + +void kfence_print_object(struct seq_file *seq, const struct kfence_metadata *meta) +{ + const int size = abs(meta->size); + const unsigned long start = meta->addr; + const struct kmem_cache *const cache = meta->cache; + + lockdep_assert_held(&meta->lock); + + if (meta->state == KFENCE_OBJECT_UNUSED) { + seq_con_printf(seq, "kfence-#%zd unused\n", meta - kfence_metadata); + return; + } + + seq_con_printf(seq, + "kfence-#%zd [0x" PTR_FMT "-0x" PTR_FMT + ", size=%d, cache=%s] allocated by task %d:\n", + meta - kfence_metadata, (void *)start, (void *)(start + size - 1), size, + (cache && cache->name) ? cache->name : "<destroyed>", meta->alloc_track.pid); + kfence_print_stack(seq, meta, true); + + if (meta->state == KFENCE_OBJECT_FREED) { + seq_con_printf(seq, "\nfreed by task %d:\n", meta->free_track.pid); + kfence_print_stack(seq, meta, false); + } +} + +/* + * Show bytes at @addr that are different from the expected canary values, up to + * @max_bytes. + */ +static void print_diff_canary(unsigned long address, size_t bytes_to_show, + const struct kfence_metadata *meta) +{ + const unsigned long show_until_addr = address + bytes_to_show; + const u8 *cur, *end; + + /* Do not show contents of object nor read into following guard page. */ + end = (const u8 *)(address < meta->addr ? min(show_until_addr, meta->addr) + : min(show_until_addr, PAGE_ALIGN(address))); + + pr_cont("["); + for (cur = (const u8 *)address; cur < end; cur++) { + if (*cur == KFENCE_CANARY_PATTERN(cur)) + pr_cont(" ."); + else if (IS_ENABLED(CONFIG_DEBUG_KERNEL)) + pr_cont(" 0x%02x", *cur); + else /* Do not leak kernel memory in non-debug builds. */ + pr_cont(" !"); + } + pr_cont(" ]"); +} + +void kfence_report_error(unsigned long address, const struct kfence_metadata *meta, + enum kfence_error_type type) +{ + unsigned long stack_entries[KFENCE_STACK_DEPTH] = { 0 }; + int num_stack_entries = stack_trace_save(stack_entries, KFENCE_STACK_DEPTH, 1); + int skipnr = get_stack_skipnr(stack_entries, num_stack_entries, &type); + const ptrdiff_t object_index = meta ? meta - kfence_metadata : -1; + + /* Require non-NULL meta, except if KFENCE_ERROR_INVALID. */ + if (WARN_ON(type != KFENCE_ERROR_INVALID && !meta)) + return; + + if (meta) + lockdep_assert_held(&meta->lock); + /* + * Because we may generate reports in printk-unfriendly parts of the + * kernel, such as scheduler code, the use of printk() could deadlock. + * Until such time that all printing code here is safe in all parts of + * the kernel, accept the risk, and just get our message out (given the + * system might already behave unpredictably due to the memory error). + * As such, also disable lockdep to hide warnings, and avoid disabling + * lockdep for the rest of the kernel. + */ + lockdep_off(); + + pr_err("==================================================================\n"); + /* Print report header. */ + switch (type) { + case KFENCE_ERROR_OOB: { + const bool left_of_object = address < meta->addr; + + pr_err("BUG: KFENCE: out-of-bounds in %pS\n\n", (void *)stack_entries[skipnr]); + pr_err("Out-of-bounds access at 0x" PTR_FMT " (%luB %s of kfence-#%zd):\n", + (void *)address, + left_of_object ? meta->addr - address : address - meta->addr, + left_of_object ? "left" : "right", object_index); + break; + } + case KFENCE_ERROR_UAF: + pr_err("BUG: KFENCE: use-after-free in %pS\n\n", (void *)stack_entries[skipnr]); + pr_err("Use-after-free access at 0x" PTR_FMT " (in kfence-#%zd):\n", + (void *)address, object_index); + break; + case KFENCE_ERROR_CORRUPTION: + pr_err("BUG: KFENCE: memory corruption in %pS\n\n", (void *)stack_entries[skipnr]); + pr_err("Corrupted memory at 0x" PTR_FMT " ", (void *)address); + print_diff_canary(address, 16, meta); + pr_cont(" (in kfence-#%zd):\n", object_index); + break; + case KFENCE_ERROR_INVALID: + pr_err("BUG: KFENCE: invalid access in %pS\n\n", (void *)stack_entries[skipnr]); + pr_err("Invalid access at 0x" PTR_FMT ":\n", (void *)address); + break; + case KFENCE_ERROR_INVALID_FREE: + pr_err("BUG: KFENCE: invalid free in %pS\n\n", (void *)stack_entries[skipnr]); + pr_err("Invalid free of 0x" PTR_FMT " (in kfence-#%zd):\n", (void *)address, + object_index); + break; + } + + /* Print stack trace and object info. */ + stack_trace_print(stack_entries + skipnr, num_stack_entries - skipnr, 0); + + if (meta) { + pr_err("\n"); + kfence_print_object(NULL, meta); + } + + /* Print report footer. */ + pr_err("\n"); + dump_stack_print_info(KERN_ERR); + pr_err("==================================================================\n"); + + lockdep_on(); + + if (panic_on_warn) + panic("panic_on_warn set ...\n"); + + /* We encountered a memory unsafety error, taint the kernel! */ + add_taint(TAINT_BAD_PAGE, LOCKDEP_STILL_OK); +} -- 2.25.1

2 1

[PATCH kernel-4.19 1/2] ACPI / APEI: Add a notifier chain for unknown (vendor) CPER records
by Yang Yingliang 30 Sep '21

30 Sep '21

From: Shiju Jose <shiju.jose(a)huawei.com> mainline inclusion from mainline-v5.10-rc1 commit 9aa9cf3ee9451d08adafc03cef8e44c7ea3898e7 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4CMAR CVE: NA -------------------------------- CPER records describing a firmware-first error are identified by GUID. The ghes driver currently logs, but ignores any unknown CPER records. This prevents describing errors that can't be represented by a standard entry, that would otherwise allow a driver to recover from an error. The UEFI spec calls these 'Non-standard Section Body' (N.2.3 of version 2.8). Add a notifier chain for these non-standard/vendor-records. Callers must identify their type of records by GUID. Record data is copied to memory from the ghes_estatus_pool to allow us to keep it until after the notifier has run. Co-developed-by: James Morse <james.morse(a)arm.com> Link: https://lore.kernel.org/r/20200903123456.1823-2-shiju.jose@huawei.com Signed-off-by: James Morse <james.morse(a)arm.com> Signed-off-by: Shiju Jose <shiju.jose(a)huawei.com> Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi(a)arm.com> Acked-by: "Rafael J. Wysocki" <rjw(a)rjwysocki.net> Signed-off-by: Weilong Chen <chenweilong(a)huawei.com> Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/acpi/apei/ghes.c | 64 ++++++++++++++++++++++++++++++++++++++++ include/acpi/ghes.h | 18 +++++++++++ 2 files changed, 82 insertions(+) diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c index e807e8f74d1e0..08658c433b1fc 100644 --- a/drivers/acpi/apei/ghes.c +++ b/drivers/acpi/apei/ghes.c @@ -84,6 +84,12 @@ ((struct acpi_hest_generic_status *) \ ((struct ghes_estatus_node *)(estatus_node) + 1)) +#define GHES_VENDOR_ENTRY_LEN(gdata_len) \ + (sizeof(struct ghes_vendor_record_entry) + (gdata_len)) +#define GHES_GDATA_FROM_VENDOR_ENTRY(vendor_entry) \ + ((struct acpi_hest_generic_data *) \ + ((struct ghes_vendor_record_entry *)(vendor_entry) + 1)) + static inline bool is_hest_type_generic_v2(struct ghes *ghes) { return ghes->generic->header.type == ACPI_HEST_TYPE_GENERIC_ERROR_V2; @@ -126,6 +132,12 @@ EXPORT_SYMBOL(ghes_ts_err_chain); static DEFINE_RAW_SPINLOCK(ghes_ioremap_lock_nmi); static DEFINE_SPINLOCK(ghes_ioremap_lock_irq); +struct ghes_vendor_record_entry { + struct work_struct work; + int error_severity; + char vendor_record[]; +}; + static struct gen_pool *ghes_estatus_pool; static unsigned long ghes_estatus_pool_size_request; @@ -464,6 +476,57 @@ static void ghes_handle_aer(struct acpi_hest_generic_data *gdata) #endif } +static BLOCKING_NOTIFIER_HEAD(vendor_record_notify_list); + +int ghes_register_vendor_record_notifier(struct notifier_block *nb) +{ + return blocking_notifier_chain_register(&vendor_record_notify_list, nb); +} +EXPORT_SYMBOL_GPL(ghes_register_vendor_record_notifier); + +void ghes_unregister_vendor_record_notifier(struct notifier_block *nb) +{ + blocking_notifier_chain_unregister(&vendor_record_notify_list, nb); +} +EXPORT_SYMBOL_GPL(ghes_unregister_vendor_record_notifier); + +static void ghes_vendor_record_work_func(struct work_struct *work) +{ + struct ghes_vendor_record_entry *entry; + struct acpi_hest_generic_data *gdata; + u32 len; + + entry = container_of(work, struct ghes_vendor_record_entry, work); + gdata = GHES_GDATA_FROM_VENDOR_ENTRY(entry); + + blocking_notifier_call_chain(&vendor_record_notify_list, + entry->error_severity, gdata); + + len = GHES_VENDOR_ENTRY_LEN(acpi_hest_get_record_size(gdata)); + gen_pool_free(ghes_estatus_pool, (unsigned long)entry, len); +} + +static void ghes_defer_non_standard_event(struct acpi_hest_generic_data *gdata, + int sev) +{ + struct acpi_hest_generic_data *copied_gdata; + struct ghes_vendor_record_entry *entry; + u32 len; + + len = GHES_VENDOR_ENTRY_LEN(acpi_hest_get_record_size(gdata)); + entry = (void *)gen_pool_alloc(ghes_estatus_pool, len); + if (!entry) + return; + + copied_gdata = GHES_GDATA_FROM_VENDOR_ENTRY(entry); + memcpy(copied_gdata, gdata, acpi_hest_get_record_size(gdata)); + entry->error_severity = sev; + + INIT_WORK(&entry->work, ghes_vendor_record_work_func); + schedule_work(&entry->work); +} + + void __weak ghes_arm_process_error(struct ghes *ghes, struct cper_sec_proc_arm *err, int sec_sev) { @@ -517,6 +580,7 @@ static void ghes_do_proc(struct ghes *ghes, } else { void *err = acpi_hest_get_payload(gdata); + ghes_defer_non_standard_event(gdata, sev); log_non_standard_event(sec_type, fru_id, fru_text, sec_sev, err, gdata->error_data_length); diff --git a/include/acpi/ghes.h b/include/acpi/ghes.h index 9aaeaaa3d1a7f..0e96c78f9f180 100644 --- a/include/acpi/ghes.h +++ b/include/acpi/ghes.h @@ -52,6 +52,24 @@ enum { GHES_SEV_PANIC = 0x3, }; +#ifdef CONFIG_ACPI_APEI_GHES +/** + * ghes_register_vendor_record_notifier - register a notifier for vendor + * records that the kernel would otherwise ignore. + * @nb: pointer to the notifier_block structure of the event handler. + * + * return 0 : SUCCESS, non-zero : FAIL + */ +int ghes_register_vendor_record_notifier(struct notifier_block *nb); + +/** + * ghes_unregister_vendor_record_notifier - unregister the previously + * registered vendor record notifier. + * @nb: pointer to the notifier_block structure of the vendor record handler. + */ +void ghes_unregister_vendor_record_notifier(struct notifier_block *nb); +#endif + /* From drivers/edac/ghes_edac.c */ #ifdef CONFIG_EDAC_GHES -- 2.25.1

1 1

[PATCH kernel-4.19] blk-mq-sched: Fix blk_mq_sched_alloc_tags() error handling
by Yang Yingliang 30 Sep '21

30 Sep '21

From: John Garry <john.garry(a)huawei.com> mainline inclusion from mainline-v5.14-rc1 commit b93af3055d6f32d3b0361cfdb110c9399c1241ba category: bugfix bugzilla: 177012 CVE: NA --------------------------- If the blk_mq_sched_alloc_tags() -> blk_mq_alloc_rqs() call fails, then we call blk_mq_sched_free_tags() -> blk_mq_free_rqs(). It is incorrect to do so, as any rqs would have already been freed in the blk_mq_alloc_rqs() call. Fix by calling blk_mq_free_rq_map() only directly. Fixes: 6917ff0b5bd41 ("blk-mq-sched: refactor scheduler initialization") Signed-off-by: John Garry <john.garry(a)huawei.com> Reviewed-by: Ming Lei <ming.lei(a)redhat.com> Link: https://lore.kernel.org/r/1627378373-148090-1-git-send-email-john.garry@hua… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> conflicts: block/blk-mq-sched.c Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/blk-mq-sched.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c index ce4b2ac6d6977..3521eca1b2984 100644 --- a/block/blk-mq-sched.c +++ b/block/blk-mq-sched.c @@ -513,8 +513,10 @@ static int blk_mq_sched_alloc_tags(struct request_queue *q, return -ENOMEM; ret = blk_mq_alloc_rqs(set, hctx->sched_tags, hctx_idx, q->nr_requests); - if (ret) - blk_mq_sched_free_tags(set, hctx, hctx_idx); + if (ret) { + blk_mq_free_rq_map(hctx->sched_tags); + hctx->sched_tags = NULL; + } return ret; } -- 2.25.1

1 0

[PATCH kernel-4.19 1/3] jbd2: Drop unnecessary branch from jbd2_journal_forget()
by Yang Yingliang 30 Sep '21

30 Sep '21

From: Jan Kara <jack(a)suse.cz> mainline inclusion from mainline-5.5-rc1 commit 6d69843e5d3f0c394e1e3004cc2b36efbe402b71 category: bugfix bugzilla: 176007 CVE: NA --------------------------- We have cleared both dirty & jbddirty bits from the bh. So there's no difference between bforget() and brelse(). Thus there's no point jumping to no_jbd branch. Signed-off-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20190809124233.13277-5-jack@suse.cz Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Conflicts: fs/jbd2/transaction.c Signed-off-by: yangerkun <yangerkun(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/jbd2/transaction.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c index 4055929a043cf..c48658a4d53c0 100644 --- a/fs/jbd2/transaction.c +++ b/fs/jbd2/transaction.c @@ -1639,10 +1639,6 @@ int jbd2_journal_forget (handle_t *handle, struct buffer_head *bh) __jbd2_journal_file_buffer(jh, transaction, BJ_Forget); } else { __jbd2_journal_unfile_buffer(jh); - if (!buffer_jbd(bh)) { - spin_unlock(&journal->j_list_lock); - goto not_jbd; - } } spin_unlock(&journal->j_list_lock); } else if (jh->b_transaction) { -- 2.25.1

1 2

[PATCH openEuler-1.0-LTS] USB: ehci: fix an interrupt calltrace error
by Yang Yingliang 30 Sep '21

30 Sep '21

From: Longfang Liu <liulongfang(a)huawei.com> mainline inclusion from mainline-v5.11-rc5 commit 643a4df7fe3f6831d14536fd692be85f92670a52 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4CDK3?from=project-issue CVE: NA ---------------------------------------- The system that use Synopsys USB host controllers goes to suspend when using USB audio player. This causes the USB host controller continuous send interrupt signal to system, When the number of interrupts exceeds 100000, the system will forcibly close the interrupts and output a calltrace error. When the system goes to suspend, the last interrupt is reported to the driver. At this time, the system has set the state to suspend. This causes the last interrupt to not be processed by the system and not clear the interrupt flag. This uncleared interrupt flag constantly triggers new interrupt event. This causing the driver to receive more than 100,000 interrupts, which causes the system to forcibly close the interrupt report and report the calltrace error. so, when the driver goes to sleep and changes the system state to suspend, the interrupt flag needs to be cleared. Signed-off-by: Longfang Liu <liulongfang(a)huawei.com> Acked-by: Alan Stern <stern(a)rowland.harvard.edu> Link: https://lore.kernel.org/r/1610416647-45774-1-git-send-email-liulongfang@hua… Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Longfang Liu <liulongfang(a)huawei.com> Acked-by: Xie XiuQi <xiexiuqi(a)huawei.com> Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/usb/host/ehci-hub.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c index ce0eaf7d7c12a..a99c1ac5d8c8b 100644 --- a/drivers/usb/host/ehci-hub.c +++ b/drivers/usb/host/ehci-hub.c @@ -346,8 +346,12 @@ static int ehci_bus_suspend (struct usb_hcd *hcd) unlink_empty_async_suspended(ehci); + /* Some Synopsys controllers mistakenly leave IAA turned on */ + ehci_writel(ehci, STS_IAA, &ehci->regs->status); + /* Any IAA cycle that started before the suspend is now invalid */ end_iaa_cycle(ehci); + ehci_handle_start_intr_unlinks(ehci); ehci_handle_intr_unlinks(ehci); end_free_itds(ehci); -- 2.25.1

1 0

[PATCH kernel-4.19 1/2] sched/topology: Warn when NUMA diameter > 2
by Yang Yingliang 30 Sep '21

30 Sep '21

From: Valentin Schneider <valentin.schneider(a)arm.com> mainline inclusion from mainline-v5.11-rc1 commit b5b217346de85ed1b03fdecd5c5076b34fbb2f0b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4CAA9 CVE: NA ---------------------------------------------------------- NUMA topologies where the shortest path between some two nodes requires three or more hops (i.e. diameter > 2) end up being misrepresented in the scheduler topology structures. This is currently detected when booting a kernel with CONFIG_SCHED_DEBUG=y + sched_debug on the cmdline, although this will only yield a warning about sched_group spans not matching sched_domain spans: ERROR: groups don't span domain->span Add an explicit warning for that case, triggered regardless of CONFIG_SCHED_DEBUG, and decorate it with an appropriate comment. The topology described in the comment can be booted up on QEMU by appending the following to your usual QEMU incantation: -smp cores=4 \ -numa node,cpus=0,nodeid=0 -numa node,cpus=1,nodeid=1, \ -numa node,cpus=2,nodeid=2, -numa node,cpus=3,nodeid=3, \ -numa dist,src=0,dst=1,val=20, -numa dist,src=0,dst=2,val=30, \ -numa dist,src=0,dst=3,val=40, -numa dist,src=1,dst=2,val=20, \ -numa dist,src=1,dst=3,val=30, -numa dist,src=2,dst=3,val=20 A somewhat more realistic topology (6-node mesh) with the same affliction can be conjured with: -smp cores=6 \ -numa node,cpus=0,nodeid=0 -numa node,cpus=1,nodeid=1, \ -numa node,cpus=2,nodeid=2, -numa node,cpus=3,nodeid=3, \ -numa node,cpus=4,nodeid=4, -numa node,cpus=5,nodeid=5, \ -numa dist,src=0,dst=1,val=20, -numa dist,src=0,dst=2,val=30, \ -numa dist,src=0,dst=3,val=40, -numa dist,src=0,dst=4,val=30, \ -numa dist,src=0,dst=5,val=20, \ -numa dist,src=1,dst=2,val=20, -numa dist,src=1,dst=3,val=30, \ -numa dist,src=1,dst=4,val=20, -numa dist,src=1,dst=5,val=30, \ -numa dist,src=2,dst=3,val=20, -numa dist,src=2,dst=4,val=30, \ -numa dist,src=2,dst=5,val=40, \ -numa dist,src=3,dst=4,val=20, -numa dist,src=3,dst=5,val=30, \ -numa dist,src=4,dst=5,val=20 Signed-off-by: Valentin Schneider <valentin.schneider(a)arm.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Acked-by: Mel Gorman <mgorman(a)techsingularity.net> Link: https://lore.kernel.org/lkml/jhjtux5edo2.mognet@arm.com Signed-off-by: Cheng Jian <cj.chengjian(a)huawei.com> Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/sched/topology.c | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c index 0002b269ed3da..cd2005832d59c 100644 --- a/kernel/sched/topology.c +++ b/kernel/sched/topology.c @@ -461,6 +461,7 @@ cpu_attach_domain(struct sched_domain *sd, struct root_domain *rd, int cpu) { struct rq *rq = cpu_rq(cpu); struct sched_domain *tmp; + int numa_distance = 0; /* Remove the sched domains which do not contribute to scheduling. */ for (tmp = sd; tmp; ) { @@ -492,6 +493,38 @@ cpu_attach_domain(struct sched_domain *sd, struct root_domain *rd, int cpu) sd->child = NULL; } + for (tmp = sd; tmp; tmp = tmp->parent) + numa_distance += !!(tmp->flags & SD_NUMA); + + /* + * FIXME: Diameter >=3 is misrepresented. + * + * Smallest diameter=3 topology is: + * + * node 0 1 2 3 + * 0: 10 20 30 40 + * 1: 20 10 20 30 + * 2: 30 20 10 20 + * 3: 40 30 20 10 + * + * 0 --- 1 --- 2 --- 3 + * + * NUMA-3 0-3 N/A N/A 0-3 + * groups: {0-2},{1-3} {1-3},{0-2} + * + * NUMA-2 0-2 0-3 0-3 1-3 + * groups: {0-1},{1-3} {0-2},{2-3} {1-3},{0-1} {2-3},{0-2} + * + * NUMA-1 0-1 0-2 1-3 2-3 + * groups: {0},{1} {1},{2},{0} {2},{3},{1} {3},{2} + * + * NUMA-0 0 1 2 3 + * + * The NUMA-2 groups for nodes 0 and 3 are obviously buggered, as the + * group span isn't a subset of the domain span. + */ + WARN_ONCE(numa_distance > 2, "Shortest NUMA path spans too many nodes\n"); + sched_domain_debug(sd, cpu); rq_attach_root(rq, rd); -- 2.25.1

1 1

[PATCH kernel-4.19] ipc: replace costly bailout check in sysvipc_find_ipc()
by Yang Yingliang 30 Sep '21

30 Sep '21

From: Rafael Aquini <aquini(a)redhat.com> mainline inclusion from mainline-v5.15 commit 20401d1058f3f841f35a594ac2fc1293710e55b9 category: bugfix bugzilla: NA CVE: CVE-2021-3669 -------------------------------- sysvipc_find_ipc() was left with a costly way to check if the offset position fed to it is bigger than the total number of IPC IDs in use. So much so that the time it takes to iterate over /proc/sysvipc/* files grows exponentially for a custom benchmark that creates "N" SYSV shm segments and then times the read of /proc/sysvipc/shm (milliseconds): 12 msecs to read 1024 segs from /proc/sysvipc/shm 18 msecs to read 2048 segs from /proc/sysvipc/shm 65 msecs to read 4096 segs from /proc/sysvipc/shm 325 msecs to read 8192 segs from /proc/sysvipc/shm 1303 msecs to read 16384 segs from /proc/sysvipc/shm 5182 msecs to read 32768 segs from /proc/sysvipc/shm The root problem lies with the loop that computes the total amount of ids in use to check if the "pos" feeded to sysvipc_find_ipc() grew bigger than "ids->in_use". That is a quite inneficient way to get to the maximum index in the id lookup table, specially when that value is already provided by struct ipc_ids.max_idx. This patch follows up on the optimization introduced via commit 15df03c879836 ("sysvipc: make get_maxid O(1) again") and gets rid of the aforementioned costly loop replacing it by a simpler checkpoint based on ipc_get_maxidx() returned value, which allows for a smooth linear increase in time complexity for the same custom benchmark: 2 msecs to read 1024 segs from /proc/sysvipc/shm 2 msecs to read 2048 segs from /proc/sysvipc/shm 4 msecs to read 4096 segs from /proc/sysvipc/shm 9 msecs to read 8192 segs from /proc/sysvipc/shm 19 msecs to read 16384 segs from /proc/sysvipc/shm 39 msecs to read 32768 segs from /proc/sysvipc/shm Link: https://lkml.kernel.org/r/20210809203554.1562989-1-aquini@redhat.com Signed-off-by: Rafael Aquini <aquini(a)redhat.com> Acked-by: Davidlohr Bueso <dbueso(a)suse.de> Acked-by: Manfred Spraul <manfred(a)colorfullife.com> Cc: Waiman Long <llong(a)redhat.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Conflicts: ipc/util.c Signed-off-by: zhiwentao <zhiwentao(a)huawei.com> Reviewed-by: Wang Hui <john.wanghui(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- ipc/util.c | 17 +++++------------ 1 file changed, 5 insertions(+), 12 deletions(-) diff --git a/ipc/util.c b/ipc/util.c index af1b572effb14..53204b1d2e207 100644 --- a/ipc/util.c +++ b/ipc/util.c @@ -725,21 +725,14 @@ struct pid_namespace *ipc_seq_pid_ns(struct seq_file *s) static struct kern_ipc_perm *sysvipc_find_ipc(struct ipc_ids *ids, loff_t pos, loff_t *new_pos) { - struct kern_ipc_perm *ipc; - int total, id; - - total = 0; - for (id = 0; id < pos && total < ids->in_use; id++) { - ipc = idr_find(&ids->ipcs_idr, id); - if (ipc != NULL) - total++; - } - ipc = NULL; - if (total >= ids->in_use) + struct kern_ipc_perm *ipc = NULL; + int max_idx = ipc_get_maxidx(ids); + + if (max_idx == -1 || pos > max_idx) goto out; - for (; pos < IPCMNI; pos++) { + for (; pos <= max_idx; pos++) { ipc = idr_find(&ids->ipcs_idr, pos); if (ipc != NULL) { rcu_read_lock(); -- 2.25.1

1 0

[PATCH kernel-4.19 1/4] net: hns3: fix memory override when bd_num is bigger than port info size
by Yang Yingliang 30 Sep '21

30 Sep '21

From: Yonglong Liu <liuyonglong(a)huawei.com> driver inclusion category: bugfix bugzilla: NA CVE: NA ---------------------------- The bd_num is from firmware, it may be bigger than the size of struct hclge_port_info, and may cause memory override problem. Signed-off-by: Yonglong Liu <liuyonglong(a)huawei.com> Reviewed-by: Jian Shen <shenjian15(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- .../net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c b/drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c index 5404048ad60d1..ebbc25cc86940 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c @@ -88,9 +88,9 @@ int hns3_get_port_info(const struct hns3_nic_priv *net_priv, desc_data = (__le32 *)(&desc.data[0]); bd_num = le32_to_cpu(*desc_data); - if (bd_num > hdev->hw.cmq.csq.desc_num) { - dev_err(&hdev->pdev->dev, "get invalid BD num %u(max %u)\n", - bd_num, hdev->hw.cmq.csq.desc_num); + if (bd_num * sizeof(struct hclge_desc) > + sizeof(struct hclge_port_info)) { + dev_err(&hdev->pdev->dev, "get invalid BD num %u\n", bd_num); return -EINVAL; } -- 2.25.1

1 3

[PATCH kernel-4.19] scsi: hisi_sas: Optimize the code flow of setting sense data when ssp I/O abnormally completed
by Yang Yingliang 30 Sep '21

30 Sep '21

From: yangxingui <yangxingui(a)huawei.com> driver inclusion category: bugfix bugzilla: NA CVE: NA --------------------------- In the data underflow scenario, if correct sense data and response frame have been written to the host memory and the CQ RSPNS_GOOD bit is 0, then driver sends the sense data to the upper layer. Signed-off-by: yangxingui <yangxingui(a)huawei.com> Reviewed-by: Xiang Chen <chenxiang66(a)hisilicon.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/scsi/hisi_sas/hisi_sas.h | 8 +++++-- drivers/scsi/hisi_sas/hisi_sas_main.c | 17 ------------- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 33 ++++++++++++++++++++++---- 3 files changed, 34 insertions(+), 24 deletions(-) diff --git a/drivers/scsi/hisi_sas/hisi_sas.h b/drivers/scsi/hisi_sas/hisi_sas.h index 193fc960d87fd..742ffcaeaa95c 100644 --- a/drivers/scsi/hisi_sas/hisi_sas.h +++ b/drivers/scsi/hisi_sas/hisi_sas.h @@ -102,6 +102,12 @@ enum hisi_sas_dev_type { HISI_SAS_DEV_TYPE_SATA, }; +enum datapres_field { + NO_DATA = 0, + RESPONSE_DATA = 1, + SENSE_DATA = 2, +}; + struct hisi_sas_hw_error { u32 irq_msk; u32 msk; @@ -571,8 +577,6 @@ extern void hisi_sas_free(struct hisi_hba *hisi_hba); extern u8 hisi_sas_get_ata_protocol(struct host_to_dev_fis *fis, int direction); extern struct hisi_sas_port *to_hisi_sas_port(struct asd_sas_port *sas_port); -extern void hisi_sas_set_sense_data(struct sas_task *task, - struct hisi_sas_slot *slot); extern void hisi_sas_sata_done(struct sas_task *task, struct hisi_sas_slot *slot); extern int hisi_sas_get_fw_info(struct hisi_hba *hisi_hba); diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c index ea08d53c11495..67befcc033126 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_main.c +++ b/drivers/scsi/hisi_sas/hisi_sas_main.c @@ -105,23 +105,6 @@ u8 hisi_sas_get_ata_protocol(struct host_to_dev_fis *fis, int direction) } EXPORT_SYMBOL_GPL(hisi_sas_get_ata_protocol); -void hisi_sas_set_sense_data(struct sas_task *task, - struct hisi_sas_slot *slot) -{ - struct ssp_response_iu *iu = - hisi_sas_status_buf_addr_mem(slot) + - sizeof(struct hisi_sas_err_record); - if (iu->datapres == 2) { - struct task_status_struct *ts = &task->task_status; - - ts->buf_valid_size = - min_t(int, SAS_STATUS_BUF_SIZE, - be32_to_cpu(iu->sense_data_len)); - memcpy(ts->buf, iu->sense_data, ts->buf_valid_size); - } -} -EXPORT_SYMBOL_GPL(hisi_sas_set_sense_data); - void hisi_sas_sata_done(struct sas_task *task, struct hisi_sas_slot *slot) { diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c index 06b4f2db62f7b..9ce1177a8e455 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c @@ -395,6 +395,8 @@ #define CMPLT_HDR_ERROR_PHASE_MSK (0xff << CMPLT_HDR_ERROR_PHASE_OFF) #define CMPLT_HDR_RSPNS_XFRD_OFF 10 #define CMPLT_HDR_RSPNS_XFRD_MSK (0x1 << CMPLT_HDR_RSPNS_XFRD_OFF) +#define CMPLT_HDR_RSPNS_GOOD_OFF 11 +#define CMPLT_HDR_RSPNS_GOOD_MSK (0x1 << CMPLT_HDR_RSPNS_GOOD_OFF) #define CMPLT_HDR_ERX_OFF 12 #define CMPLT_HDR_ERX_MSK (0x1 << CMPLT_HDR_ERX_OFF) #define CMPLT_HDR_ABORT_STAT_OFF 13 @@ -2208,6 +2210,24 @@ static irqreturn_t fatal_axi_int_v3_hw(int irq_no, void *p) return IRQ_HANDLED; } +static void hisi_sas_set_sense_data(struct sas_task *task, + struct hisi_sas_slot *slot) +{ + struct ssp_response_iu *iu = + hisi_sas_status_buf_addr_mem(slot) + + sizeof(struct hisi_sas_err_record); + if ((iu->status == SAM_STAT_CHECK_CONDITION) && + (iu->datapres == SENSE_DATA)) { + struct task_status_struct *ts = &task->task_status; + + ts->buf_valid_size = + min_t(int, SAS_STATUS_BUF_SIZE, + be32_to_cpu(iu->sense_data_len)); + memcpy(ts->buf, iu->sense_data, ts->buf_valid_size); + ts->stat = SAM_STAT_CHECK_CONDITION; + } +} + static void slot_err_v3_hw(struct hisi_hba *hisi_hba, struct sas_task *task, struct hisi_sas_slot *slot) @@ -2224,17 +2244,20 @@ slot_err_v3_hw(struct hisi_hba *hisi_hba, struct sas_task *task, switch (task->task_proto) { case SAS_PROTOCOL_SSP: - if (complete_hdr->dw3 & CMPLT_HDR_IO_IN_TARGET_MSK) { - ts->stat = SAS_QUEUE_FULL; - slot->abort = 1; - } else if (dma_rx_err_type & RX_DATA_LEN_UNDERFLOW_MSK) { + if (dma_rx_err_type & RX_DATA_LEN_UNDERFLOW_MSK) { ts->residual = trans_tx_fail_type; ts->stat = SAS_DATA_UNDERRUN; + if ((!(complete_hdr->dw0 & CMPLT_HDR_RSPNS_GOOD_MSK)) && + (complete_hdr->dw0 & CMPLT_HDR_RSPNS_XFRD_MSK)) { + hisi_sas_set_sense_data(task, slot); + } + } else if (complete_hdr->dw3 & CMPLT_HDR_IO_IN_TARGET_MSK) { + ts->stat = SAS_QUEUE_FULL; + slot->abort = 1; } else { ts->stat = SAS_OPEN_REJECT; ts->open_rej_reason = SAS_OREJ_RSVD_RETRY; } - hisi_sas_set_sense_data(task, slot); break; case SAS_PROTOCOL_SATA: case SAS_PROTOCOL_STP: -- 2.25.1

1 0

How can I get the kernel config values in EulerOS 2.9?
by Wangpeng (Forest, ISCP SRE) 29 Sep '21

29 Sep '21

Hi Community: How can I get the kernel config values in EulerOS? For example, in other release, I can do that by "zcat /proc/config.gz" B.R.

2 1

openEuler Summit 2021 诚挚的邀请您提交演讲议题、成为共建单位、贡献展示方案
by Marketing openEuler 29 Sep '21

29 Sep '21

openEuler Summit 是由欧拉开源社区举办的开发者峰会。全新升级后的首场峰会将于 11 月10日在北京举行。 openEuler 从服务器操作系统，升级为数字基础设施的操作系统，支持 IT、CT、OT 等数字基础设施全场景，覆盖服务器、云、边、嵌入式等各种形态的需求。伴随 openEuler 21.09 的发布，openEuler 已经包含了服务器、云原生、边缘计算和嵌入式的四大应用场景。 openEuler 通过开源开放，不断探索科技创新的边界。开发者、用户、社区贡献者、软件爱好者在 openEuler Summit 汇聚，共同解读 openEuler 的最新版，探讨未来的技术路线，让技术、生态、商业在这里产生奇妙的化学反应。 *本次峰会旨在推动 openEuler 在多样性计算、云计算、边缘计算、嵌入式等技术方向的持续探索和创新。* 开源是一种态度、分享是一种精神。Call for Speaker、Call for Sponsor、Call for Demo 现已全面开放报名。大会报名通道同步开启。 *我们诚挚的邀请您提交演讲议题、发表联合演讲、成为共建单位、贡献展示方案、参与社区建设。* - *大会官网：*https://www.openeuler.org/zh/interaction/summit-list/summit2021/ - *Call for Speaker：*https://shimowendang.com/forms/X6X9jj9KPcdQwVr8/fill - *Call for Sponsor：*https://shimowendang.com/forms/k76zTLKvumYwRdsP/fill - *Call for Demo：*https://shimowendang.com/forms/LjHs8JlsLSsW92kl/fill

1 0

[PATCH] eulerfs: add the /proc/idle file.
by Hongyu Li 29 Sep '21

29 Sep '21

From: Hongyu Li <“543306408(a)qq.xn--com-9o0a> openEuler inclusion category: bugfix bugzilla: https://gitee.com/openeuler-competition/summer-2021/issues/I3EBT6 CVE: NA ---------------------------------------------------------------------- The /proc/idle can give higher precision in accounting the CPU idle time compared with the traditional /proc/stat ways. Signed-off-by: Hongyu Li <“543306408(a)qq.xn--com-9o0a> --- fs/proc/Kconfig | 7 ++++ fs/proc/Makefile | 1 + fs/proc/proc_idle.c | 82 ++++++++++++++++++++++++++++++++++++++++++ kernel/sched/cputime.c | 16 +++++++++ kernel/sched/idle.c | 21 +++++++++++ 5 files changed, 127 insertions(+) create mode 100644 fs/proc/proc_idle.c diff --git a/fs/proc/Kconfig b/fs/proc/Kconfig index c930001056f9..46620afe9cac 100644 --- a/fs/proc/Kconfig +++ b/fs/proc/Kconfig @@ -107,3 +107,10 @@ config PROC_PID_ARCH_STATUS config PROC_CPU_RESCTRL def_bool n depends on PROC_FS + +config PROC_IDLE + bool "include /proc/idle file" + depends on PROC_FS + default y + help + Provide the CPU idle time in the /proc/idle file. diff --git a/fs/proc/Makefile b/fs/proc/Makefile index 8704d41dd67c..69dd2da3a080 100644 --- a/fs/proc/Makefile +++ b/fs/proc/Makefile @@ -34,5 +34,6 @@ proc-$(CONFIG_PROC_VMCORE) += vmcore.o proc-$(CONFIG_PRINTK) += kmsg.o proc-$(CONFIG_PROC_PAGE_MONITOR) += page.o proc-$(CONFIG_BOOT_CONFIG) += bootconfig.o +proc-$(CONFIG_PROC_IDLE) += proc_idle.o obj-$(CONFIG_ETMEM_SCAN) += etmem_scan.o obj-$(CONFIG_ETMEM_SWAP) += etmem_swap.o diff --git a/fs/proc/proc_idle.c b/fs/proc/proc_idle.c new file mode 100644 index 000000000000..bbb52e247448 --- /dev/null +++ b/fs/proc/proc_idle.c @@ -0,0 +1,82 @@ +#include <linux/cpumask.h> +#include <linux/device.h> +#include <linux/fs.h> +#include <linux/init.h> +#include <linux/interrupt.h> +#include <linux/kernel.h> +#include <linux/kernel_stat.h> +#include <linux/module.h> +#include <linux/proc_fs.h> +#include <linux/sched.h> +#include <linux/sched/stat.h> +#include <linux/seq_file.h> +#include <linux/slab.h> +#include <linux/time.h> +#include <linux/irqnr.h> +#include <linux/sched/cputime.h> +#include <linux/tick.h> + +#ifdef CONFIG_PROC_IDLE + +#define PROC_NAME "idle" + +extern u64 cpu_rq_get(int cpu); + +static u64 get_idle_sum_exec_runtime(int cpu) +{ + u64 idle = cpu_rq_get(cpu); + + return idle; +} + +static int show_idle(struct seq_file *p, void *v) +{ + int i; + u64 idle; + + idle = 0; + + for_each_possible_cpu(i) { + + idle += get_idle_sum_exec_runtime(i); + + } + + seq_put_decimal_ull(p, "cpu ", nsec_to_clock_t(idle)); + seq_putc(p, '\n'); + + for_each_online_cpu(i) { + + idle = get_idle_sum_exec_runtime(i); + + seq_printf(p, "cpu%d", i); + seq_put_decimal_ull(p, " ", nsec_to_clock_t(idle)); + seq_putc(p, '\n'); + } + + return 0; +} + +static int idle_open(struct inode *inode, struct file *file) +{ + unsigned int size = 1024 + 128 * num_online_cpus(); + + return single_open_size(file, show_idle, NULL, size); +} + +static struct proc_ops idle_procs_ops = { + .proc_open = idle_open, + .proc_read_iter = seq_read_iter, + .proc_lseek = seq_lseek, + .proc_release = single_release, +}; + +static int __init kernel_module_init(void) +{ + proc_create(PROC_NAME, 0, NULL, &idle_procs_ops); + return 0; +} + +fs_initcall(kernel_module_init); + +#endif /*CONFIG_PROC_IDLE*/ diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c index 5a55d2300452..bb280852bb06 100644 --- a/kernel/sched/cputime.c +++ b/kernel/sched/cputime.c @@ -1078,3 +1078,19 @@ void kcpustat_cpu_fetch(struct kernel_cpustat *dst, int cpu) EXPORT_SYMBOL_GPL(kcpustat_cpu_fetch); #endif /* CONFIG_VIRT_CPU_ACCOUNTING_GEN */ + + +#ifdef CONFIG_PROC_IDLE + + +u64 cpu_rq_get(int cpu) +{ + struct rq *rq = cpu_rq(cpu); + struct sched_entity *idle_se = &rq->idle->se; + u64 idle = idle_se->sum_exec_runtime; + + return idle; +} +EXPORT_SYMBOL_GPL(cpu_rq_get); + +#endif /* CONFIG_PROC_IDLE */ diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c index 36b545f17206..e3fb940a61e8 100644 --- a/kernel/sched/idle.c +++ b/kernel/sched/idle.c @@ -424,6 +424,20 @@ static void check_preempt_curr_idle(struct rq *rq, struct task_struct *p, int fl static void put_prev_task_idle(struct rq *rq, struct task_struct *prev) { +#ifdef CONFIG_PROC_IDLE + struct sched_entity *idle_se = &rq->idle->se; + u64 now = sched_clock(); + u64 delta_exec; + + delta_exec = now - idle_se->exec_start; + if (unlikely((s64)delta_exec <= 0)) + return; + + schedstat_set(idle_se->statistics.exec_max, + max(delta_exec, idle_se->statistics.exec_max)); + + idle_se->sum_exec_runtime += delta_exec; +#endif } static void set_next_task_idle(struct rq *rq, struct task_struct *next, bool first) @@ -436,6 +450,13 @@ struct task_struct *pick_next_task_idle(struct rq *rq) { struct task_struct *next = rq->idle; +#ifdef CONFIG_PROC_IDLE + struct sched_entity *idle_se = &rq->idle->se; + u64 now = sched_clock(); + + idle_se->exec_start = now; +#endif + set_next_task_idle(rq, next, true); return next; -- 2.17.1

2 1

[PATCH kernel-4.19] Bluetooth: fix use-after-free error in lock_sock_nested()
by Yang Yingliang 29 Sep '21

29 Sep '21

From: Wang ShaoBo <bobo.shaobowang(a)huawei.com> mainline inclusion from mainline-v5.16 commit 1bff51ea59a9afb67d2dd78518ab0582a54a472c category: bugfix bugzilla: NA CVE: CVE-2021-3752 --------------------------- use-after-free error in lock_sock_nested is reported: [ 179.140137][ T3731] ===================================================== [ 179.142675][ T3731] BUG: KMSAN: use-after-free in lock_sock_nested+0x280/0x2c0 [ 179.145494][ T3731] CPU: 4 PID: 3731 Comm: kworker/4:2 Not tainted 5.12.0-rc6+ #54 [ 179.148432][ T3731] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 [ 179.151806][ T3731] Workqueue: events l2cap_chan_timeout [ 179.152730][ T3731] Call Trace: [ 179.153301][ T3731] dump_stack+0x24c/0x2e0 [ 179.154063][ T3731] kmsan_report+0xfb/0x1e0 [ 179.154855][ T3731] __msan_warning+0x5c/0xa0 [ 179.155579][ T3731] lock_sock_nested+0x280/0x2c0 [ 179.156436][ T3731] ? kmsan_get_metadata+0x116/0x180 [ 179.157257][ T3731] l2cap_sock_teardown_cb+0xb8/0x890 [ 179.158154][ T3731] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 179.159141][ T3731] ? kmsan_get_metadata+0x116/0x180 [ 179.159994][ T3731] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 179.160959][ T3731] ? l2cap_sock_recv_cb+0x420/0x420 [ 179.161834][ T3731] l2cap_chan_del+0x3e1/0x1d50 [ 179.162608][ T3731] ? kmsan_get_metadata+0x116/0x180 [ 179.163435][ T3731] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 179.164406][ T3731] l2cap_chan_close+0xeea/0x1050 [ 179.165189][ T3731] ? kmsan_internal_unpoison_shadow+0x42/0x70 [ 179.166180][ T3731] l2cap_chan_timeout+0x1da/0x590 [ 179.167066][ T3731] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 179.168023][ T3731] ? l2cap_chan_create+0x560/0x560 [ 179.168818][ T3731] process_one_work+0x121d/0x1ff0 [ 179.169598][ T3731] worker_thread+0x121b/0x2370 [ 179.170346][ T3731] kthread+0x4ef/0x610 [ 179.171010][ T3731] ? process_one_work+0x1ff0/0x1ff0 [ 179.171828][ T3731] ? kthread_blkcg+0x110/0x110 [ 179.172587][ T3731] ret_from_fork+0x1f/0x30 [ 179.173348][ T3731] [ 179.173752][ T3731] Uninit was created at: [ 179.174409][ T3731] kmsan_internal_poison_shadow+0x5c/0xf0 [ 179.175373][ T3731] kmsan_slab_free+0x76/0xc0 [ 179.176060][ T3731] kfree+0x3a5/0x1180 [ 179.176664][ T3731] __sk_destruct+0x8af/0xb80 [ 179.177375][ T3731] __sk_free+0x812/0x8c0 [ 179.178032][ T3731] sk_free+0x97/0x130 [ 179.178686][ T3731] l2cap_sock_release+0x3d5/0x4d0 [ 179.179457][ T3731] sock_close+0x150/0x450 [ 179.180117][ T3731] __fput+0x6bd/0xf00 [ 179.180787][ T3731] ____fput+0x37/0x40 [ 179.181481][ T3731] task_work_run+0x140/0x280 [ 179.182219][ T3731] do_exit+0xe51/0x3e60 [ 179.182930][ T3731] do_group_exit+0x20e/0x450 [ 179.183656][ T3731] get_signal+0x2dfb/0x38f0 [ 179.184344][ T3731] arch_do_signal_or_restart+0xaa/0xe10 [ 179.185266][ T3731] exit_to_user_mode_prepare+0x2d2/0x560 [ 179.186136][ T3731] syscall_exit_to_user_mode+0x35/0x60 [ 179.186984][ T3731] do_syscall_64+0xc5/0x140 [ 179.187681][ T3731] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 179.188604][ T3731] ===================================================== In our case, there are two Thread A and B: Context: Thread A: Context: Thread B: l2cap_chan_timeout() __se_sys_shutdown() l2cap_chan_close() l2cap_sock_shutdown() l2cap_chan_del() l2cap_chan_close() l2cap_sock_teardown_cb() l2cap_sock_teardown_cb() Once l2cap_sock_teardown_cb() excuted, this sock will be marked as SOCK_ZAPPED, and can be treated as killable in l2cap_sock_kill() if sock_orphan() has excuted, at this time we close sock through sock_close() which end to call l2cap_sock_kill() like Thread C: Context: Thread C: sock_close() l2cap_sock_release() sock_orphan() l2cap_sock_kill() #free sock if refcnt is 1 If C completed, Once A or B reaches l2cap_sock_teardown_cb() again, use-after-free happened. We should set chan->data to NULL if sock is destructed, for telling teardown operation is not allowed in l2cap_sock_teardown_cb(), and also we should avoid killing an already killed socket in l2cap_sock_close_cb(). Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Marcel Holtmann <marcel(a)holtmann.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/bluetooth/l2cap_sock.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index d1d5fa35dcc9a..b4f6b74c40038 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -1308,6 +1308,9 @@ static void l2cap_sock_close_cb(struct l2cap_chan *chan) { struct sock *sk = chan->data; + if (!sk) + return; + l2cap_sock_kill(sk); } @@ -1316,6 +1319,9 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err) struct sock *sk = chan->data; struct sock *parent; + if (!sk) + return; + BT_DBG("chan %p state %s", chan, state_to_string(chan->state)); /* This callback can be called both for server (BT_LISTEN) @@ -1498,8 +1504,10 @@ static void l2cap_sock_destruct(struct sock *sk) { BT_DBG("sk %p", sk); - if (l2cap_pi(sk)->chan) + if (l2cap_pi(sk)->chan) { + l2cap_pi(sk)->chan->data = NULL; l2cap_chan_put(l2cap_pi(sk)->chan); + } if (l2cap_pi(sk)->rx_busy_skb) { kfree_skb(l2cap_pi(sk)->rx_busy_skb); -- 2.25.1

1 0

[PATCH openEuler-5.10 01/17] slub: fix unreclaimable slab stat for bulk free
by Zheng Zengkai 29 Sep '21

29 Sep '21

From: Shakeel Butt <shakeelb(a)google.com> mainline inclusion from mainline-v5.14-rc4 commit f227f0faf63b46a113c4d1aca633c80195622dd2 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4C12I CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- SLUB uses page allocator for higher order allocations and update unreclaimable slab stat for such allocations. At the moment, the bulk free for SLUB does not share code with normal free code path for these type of allocations and have missed the stat update. So, fix the stat update by common code. The user visible impact of the bug is the potential of inconsistent unreclaimable slab stat visible through meminfo and vmstat. Link: https://lkml.kernel.org/r/20210728155354.3440560-1-shakeelb@google.com Fixes: 6a486c0ad4dc ("mm, sl[ou]b: improve memory accounting") Signed-off-by: Shakeel Butt <shakeelb(a)google.com> Acked-by: Michal Hocko <mhocko(a)suse.com> Acked-by: Roman Gushchin <guro(a)fb.com> Reviewed-by: Muchun Song <songmuchun(a)bytedance.com> Cc: Christoph Lameter <cl(a)linux.com> Cc: Pekka Enberg <penberg(a)kernel.org> Cc: David Rientjes <rientjes(a)google.com> Cc: Joonsoo Kim <iamjoonsoo.kim(a)lge.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Chen Huang <chenhuang5(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- mm/slub.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/mm/slub.c b/mm/slub.c index f06f002bb098..4a83fa347672 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -3164,6 +3164,16 @@ struct detached_freelist { struct kmem_cache *s; }; +static inline void free_nonslab_page(struct page *page) +{ + unsigned int order = compound_order(page); + + VM_BUG_ON_PAGE(!PageCompound(page), page); + kfree_hook(page_address(page)); + mod_lruvec_page_state(page, NR_SLAB_UNRECLAIMABLE_B, -(PAGE_SIZE << order)); + __free_pages(page, order); +} + /* * This function progressively scans the array with free objects (with * a limited look ahead) and extract objects belonging to the same @@ -3200,9 +3210,7 @@ int build_detached_freelist(struct kmem_cache *s, size_t size, if (!s) { /* Handle kalloc'ed objects */ if (unlikely(!PageSlab(page))) { - BUG_ON(!PageCompound(page)); - kfree_hook(object); - __free_pages(page, compound_order(page)); + free_nonslab_page(page); p[size] = NULL; /* mark object processed */ return size; } @@ -4102,13 +4110,7 @@ void kfree(const void *x) page = virt_to_head_page(x); if (unlikely(!PageSlab(page))) { - unsigned int order = compound_order(page); - - BUG_ON(!PageCompound(page)); - kfree_hook(object); - mod_lruvec_page_state(page, NR_SLAB_UNRECLAIMABLE_B, - -(PAGE_SIZE << order)); - __free_pages(page, order); + free_nonslab_page(page); return; } slab_free(page->slab_cache, page, object, NULL, 1, _RET_IP_); -- 2.20.1

1 16

[PATCH openEuler-21.09] eulerfs: add the /proc/idle file.
by Hongyu Li 29 Sep '21

29 Sep '21

From: Hongyu Li <“543306408(a)qq.xn--com-9o0a> openEuler inclusion category: bugfix bugzilla: https://gitee.com/openeuler-competition/summer-2021/issues/I3EBT6 CVE: NA ---------------------------------------------------------------------- The /proc/idle can give higher precision in accounting the CPU idle time compared with the traditional /proc/stat ways. Signed-off-by: Hongyu Li <“543306408(a)qq.xn--com-9o0a> --- fs/proc/Kconfig | 7 ++++ fs/proc/Makefile | 1 + fs/proc/proc_idle.c | 82 ++++++++++++++++++++++++++++++++++++++++++ kernel/sched/cputime.c | 16 +++++++++ kernel/sched/idle.c | 21 +++++++++++ 5 files changed, 127 insertions(+) create mode 100644 fs/proc/proc_idle.c diff --git a/fs/proc/Kconfig b/fs/proc/Kconfig index c930001056f9..46620afe9cac 100644 --- a/fs/proc/Kconfig +++ b/fs/proc/Kconfig @@ -107,3 +107,10 @@ config PROC_PID_ARCH_STATUS config PROC_CPU_RESCTRL def_bool n depends on PROC_FS + +config PROC_IDLE + bool "include /proc/idle file" + depends on PROC_FS + default y + help + Provide the CPU idle time in the /proc/idle file. diff --git a/fs/proc/Makefile b/fs/proc/Makefile index 8704d41dd67c..69dd2da3a080 100644 --- a/fs/proc/Makefile +++ b/fs/proc/Makefile @@ -34,5 +34,6 @@ proc-$(CONFIG_PROC_VMCORE) += vmcore.o proc-$(CONFIG_PRINTK) += kmsg.o proc-$(CONFIG_PROC_PAGE_MONITOR) += page.o proc-$(CONFIG_BOOT_CONFIG) += bootconfig.o +proc-$(CONFIG_PROC_IDLE) += proc_idle.o obj-$(CONFIG_ETMEM_SCAN) += etmem_scan.o obj-$(CONFIG_ETMEM_SWAP) += etmem_swap.o diff --git a/fs/proc/proc_idle.c b/fs/proc/proc_idle.c new file mode 100644 index 000000000000..bbb52e247448 --- /dev/null +++ b/fs/proc/proc_idle.c @@ -0,0 +1,82 @@ +#include <linux/cpumask.h> +#include <linux/device.h> +#include <linux/fs.h> +#include <linux/init.h> +#include <linux/interrupt.h> +#include <linux/kernel.h> +#include <linux/kernel_stat.h> +#include <linux/module.h> +#include <linux/proc_fs.h> +#include <linux/sched.h> +#include <linux/sched/stat.h> +#include <linux/seq_file.h> +#include <linux/slab.h> +#include <linux/time.h> +#include <linux/irqnr.h> +#include <linux/sched/cputime.h> +#include <linux/tick.h> + +#ifdef CONFIG_PROC_IDLE + +#define PROC_NAME "idle" + +extern u64 cpu_rq_get(int cpu); + +static u64 get_idle_sum_exec_runtime(int cpu) +{ + u64 idle = cpu_rq_get(cpu); + + return idle; +} + +static int show_idle(struct seq_file *p, void *v) +{ + int i; + u64 idle; + + idle = 0; + + for_each_possible_cpu(i) { + + idle += get_idle_sum_exec_runtime(i); + + } + + seq_put_decimal_ull(p, "cpu ", nsec_to_clock_t(idle)); + seq_putc(p, '\n'); + + for_each_online_cpu(i) { + + idle = get_idle_sum_exec_runtime(i); + + seq_printf(p, "cpu%d", i); + seq_put_decimal_ull(p, " ", nsec_to_clock_t(idle)); + seq_putc(p, '\n'); + } + + return 0; +} + +static int idle_open(struct inode *inode, struct file *file) +{ + unsigned int size = 1024 + 128 * num_online_cpus(); + + return single_open_size(file, show_idle, NULL, size); +} + +static struct proc_ops idle_procs_ops = { + .proc_open = idle_open, + .proc_read_iter = seq_read_iter, + .proc_lseek = seq_lseek, + .proc_release = single_release, +}; + +static int __init kernel_module_init(void) +{ + proc_create(PROC_NAME, 0, NULL, &idle_procs_ops); + return 0; +} + +fs_initcall(kernel_module_init); + +#endif /*CONFIG_PROC_IDLE*/ diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c index 5a55d2300452..bb280852bb06 100644 --- a/kernel/sched/cputime.c +++ b/kernel/sched/cputime.c @@ -1078,3 +1078,19 @@ void kcpustat_cpu_fetch(struct kernel_cpustat *dst, int cpu) EXPORT_SYMBOL_GPL(kcpustat_cpu_fetch); #endif /* CONFIG_VIRT_CPU_ACCOUNTING_GEN */ + + +#ifdef CONFIG_PROC_IDLE + + +u64 cpu_rq_get(int cpu) +{ + struct rq *rq = cpu_rq(cpu); + struct sched_entity *idle_se = &rq->idle->se; + u64 idle = idle_se->sum_exec_runtime; + + return idle; +} +EXPORT_SYMBOL_GPL(cpu_rq_get); + +#endif /* CONFIG_PROC_IDLE */ diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c index 36b545f17206..e3fb940a61e8 100644 --- a/kernel/sched/idle.c +++ b/kernel/sched/idle.c @@ -424,6 +424,20 @@ static void check_preempt_curr_idle(struct rq *rq, struct task_struct *p, int fl static void put_prev_task_idle(struct rq *rq, struct task_struct *prev) { +#ifdef CONFIG_PROC_IDLE + struct sched_entity *idle_se = &rq->idle->se; + u64 now = sched_clock(); + u64 delta_exec; + + delta_exec = now - idle_se->exec_start; + if (unlikely((s64)delta_exec <= 0)) + return; + + schedstat_set(idle_se->statistics.exec_max, + max(delta_exec, idle_se->statistics.exec_max)); + + idle_se->sum_exec_runtime += delta_exec; +#endif } static void set_next_task_idle(struct rq *rq, struct task_struct *next, bool first) @@ -436,6 +450,13 @@ struct task_struct *pick_next_task_idle(struct rq *rq) { struct task_struct *next = rq->idle; +#ifdef CONFIG_PROC_IDLE + struct sched_entity *idle_se = &rq->idle->se; + u64 now = sched_clock(); + + idle_se->exec_start = now; +#endif + set_next_task_idle(rq, next, true); return next; -- 2.17.1

1 0

[PATCH kernel-4.19] bpf, mips: Validate conditional branch offsets
by Yang Yingliang 29 Sep '21

29 Sep '21

From: Piotr Krysiuk <piotras(a)gmail.com> mainline inclusion from mainline-v5.16 commit 37cb28ec7d3a36a5bace7063a3dba633ab110f8b category: bugfix bugzilla: NA CVE: CVE-2021-38300 ------------------------------------------------- The conditional branch instructions on MIPS use 18-bit signed offsets allowing for a branch range of 128 KBytes (backward and forward). However, this limit is not observed by the cBPF JIT compiler, and so the JIT compiler emits out-of-range branches when translating certain cBPF programs. A specific example of such a cBPF program is included in the "BPF_MAXINSNS: exec all MSH" test from lib/test_bpf.c that executes anomalous machine code containing incorrect branch offsets under JIT. Furthermore, this issue can be abused to craft undesirable machine code, where the control flow is hijacked to execute arbitrary Kernel code. The following steps can be used to reproduce the issue: # echo 1 > /proc/sys/net/core/bpf_jit_enable # modprobe test_bpf test_name="BPF_MAXINSNS: exec all MSH" This should produce multiple warnings from build_bimm() similar to: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 209 at arch/mips/mm/uasm-mips.c:210 build_insn+0x558/0x590 Micro-assembler field overflow Modules linked in: test_bpf(+) CPU: 0 PID: 209 Comm: modprobe Not tainted 5.14.3 #1 Stack : 00000000 807bb824 82b33c9c 801843c0 00000000 00000004 00000000 63c9b5ee 82b33af4 80999898 80910000 80900000 82fd6030 00000001 82b33a98 82087180 00000000 00000000 80873b28 00000000 000000fc 82b3394c 00000000 2e34312e 6d6d6f43 809a180f 809a1836 6f6d203a 80900000 00000001 82b33bac 80900000 00027f80 00000000 00000000 807bb824 00000000 804ed790 001cc317 00000001 [...] Call Trace: [<80108f44>] show_stack+0x38/0x118 [<807a7aac>] dump_stack_lvl+0x5c/0x7c [<807a4b3c>] __warn+0xcc/0x140 [<807a4c3c>] warn_slowpath_fmt+0x8c/0xb8 [<8011e198>] build_insn+0x558/0x590 [<8011e358>] uasm_i_bne+0x20/0x2c [<80127b48>] build_body+0xa58/0x2a94 [<80129c98>] bpf_jit_compile+0x114/0x1e4 [<80613fc4>] bpf_prepare_filter+0x2ec/0x4e4 [<8061423c>] bpf_prog_create+0x80/0xc4 [<c0a006e4>] test_bpf_init+0x300/0xba8 [test_bpf] [<8010051c>] do_one_initcall+0x50/0x1d4 [<801c5e54>] do_init_module+0x60/0x220 [<801c8b20>] sys_finit_module+0xc4/0xfc [<801144d0>] syscall_common+0x34/0x58 [...] ---[ end trace a287d9742503c645 ]--- Then the anomalous machine code executes: => 0xc0a18000: addiu sp,sp,-16 0xc0a18004: sw s3,0(sp) 0xc0a18008: sw s4,4(sp) 0xc0a1800c: sw s5,8(sp) 0xc0a18010: sw ra,12(sp) 0xc0a18014: move s5,a0 0xc0a18018: move s4,zero 0xc0a1801c: move s3,zero # __BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, 0) 0xc0a18020: lui t6,0x8012 0xc0a18024: ori t4,t6,0x9e14 0xc0a18028: li a1,0 0xc0a1802c: jalr t4 0xc0a18030: move a0,s5 0xc0a18034: bnez v0,0xc0a1ffb8 # incorrect branch offset 0xc0a18038: move v0,zero 0xc0a1803c: andi s4,s3,0xf 0xc0a18040: b 0xc0a18048 0xc0a18044: sll s4,s4,0x2 [...] # __BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, 0) 0xc0a1ffa0: lui t6,0x8012 0xc0a1ffa4: ori t4,t6,0x9e14 0xc0a1ffa8: li a1,0 0xc0a1ffac: jalr t4 0xc0a1ffb0: move a0,s5 0xc0a1ffb4: bnez v0,0xc0a1ffb8 # incorrect branch offset 0xc0a1ffb8: move v0,zero 0xc0a1ffbc: andi s4,s3,0xf 0xc0a1ffc0: b 0xc0a1ffc8 0xc0a1ffc4: sll s4,s4,0x2 # __BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, 0) 0xc0a1ffc8: lui t6,0x8012 0xc0a1ffcc: ori t4,t6,0x9e14 0xc0a1ffd0: li a1,0 0xc0a1ffd4: jalr t4 0xc0a1ffd8: move a0,s5 0xc0a1ffdc: bnez v0,0xc0a3ffb8 # correct branch offset 0xc0a1ffe0: move v0,zero 0xc0a1ffe4: andi s4,s3,0xf 0xc0a1ffe8: b 0xc0a1fff0 0xc0a1ffec: sll s4,s4,0x2 [...] # epilogue 0xc0a3ffb8: lw s3,0(sp) 0xc0a3ffbc: lw s4,4(sp) 0xc0a3ffc0: lw s5,8(sp) 0xc0a3ffc4: lw ra,12(sp) 0xc0a3ffc8: addiu sp,sp,16 0xc0a3ffcc: jr ra 0xc0a3ffd0: nop To mitigate this issue, we assert the branch ranges for each emit call that could generate an out-of-range branch. Fixes: 36366e367ee9 ("MIPS: BPF: Restore MIPS32 cBPF JIT") Fixes: c6610de353da ("MIPS: net: Add BPF JIT") Signed-off-by: Piotr Krysiuk <piotras(a)gmail.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Tested-by: Johan Almbladh <johan.almbladh(a)anyfinetworks.com> Acked-by: Johan Almbladh <johan.almbladh(a)anyfinetworks.com> Cc: Paul Burton <paulburton(a)kernel.org> Cc: Thomas Bogendoerfer <tsbogend(a)alpha.franken.de> Link: https://lore.kernel.org/bpf/20210915160437.4080-1-piotras@gmail.com Signed-off-by: Pu Lehui <pulehui(a)huawei.com> Reviewed-by: Kuohai Xu <xukuohai(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/mips/net/bpf_jit.c | 57 +++++++++++++++++++++++++++++++---------- 1 file changed, 43 insertions(+), 14 deletions(-) diff --git a/arch/mips/net/bpf_jit.c b/arch/mips/net/bpf_jit.c index 4d8cb9bb8365d..43e6597c720c2 100644 --- a/arch/mips/net/bpf_jit.c +++ b/arch/mips/net/bpf_jit.c @@ -662,6 +662,11 @@ static void build_epilogue(struct jit_ctx *ctx) ((int)K < 0 ? ((int)K >= SKF_LL_OFF ? func##_negative : func) : \ func##_positive) +static bool is_bad_offset(int b_off) +{ + return b_off > 0x1ffff || b_off < -0x20000; +} + static int build_body(struct jit_ctx *ctx) { const struct bpf_prog *prog = ctx->skf; @@ -728,7 +733,10 @@ static int build_body(struct jit_ctx *ctx) /* Load return register on DS for failures */ emit_reg_move(r_ret, r_zero, ctx); /* Return with error */ - emit_b(b_imm(prog->len, ctx), ctx); + b_off = b_imm(prog->len, ctx); + if (is_bad_offset(b_off)) + return -E2BIG; + emit_b(b_off, ctx); emit_nop(ctx); break; case BPF_LD | BPF_W | BPF_IND: @@ -775,8 +783,10 @@ static int build_body(struct jit_ctx *ctx) emit_jalr(MIPS_R_RA, r_s0, ctx); emit_reg_move(MIPS_R_A0, r_skb, ctx); /* delay slot */ /* Check the error value */ - emit_bcond(MIPS_COND_NE, r_ret, 0, - b_imm(prog->len, ctx), ctx); + b_off = b_imm(prog->len, ctx); + if (is_bad_offset(b_off)) + return -E2BIG; + emit_bcond(MIPS_COND_NE, r_ret, 0, b_off, ctx); emit_reg_move(r_ret, r_zero, ctx); /* We are good */ /* X <- P[1:K] & 0xf */ @@ -855,8 +865,10 @@ static int build_body(struct jit_ctx *ctx) /* A /= X */ ctx->flags |= SEEN_X | SEEN_A; /* Check if r_X is zero */ - emit_bcond(MIPS_COND_EQ, r_X, r_zero, - b_imm(prog->len, ctx), ctx); + b_off = b_imm(prog->len, ctx); + if (is_bad_offset(b_off)) + return -E2BIG; + emit_bcond(MIPS_COND_EQ, r_X, r_zero, b_off, ctx); emit_load_imm(r_ret, 0, ctx); /* delay slot */ emit_div(r_A, r_X, ctx); break; @@ -864,8 +876,10 @@ static int build_body(struct jit_ctx *ctx) /* A %= X */ ctx->flags |= SEEN_X | SEEN_A; /* Check if r_X is zero */ - emit_bcond(MIPS_COND_EQ, r_X, r_zero, - b_imm(prog->len, ctx), ctx); + b_off = b_imm(prog->len, ctx); + if (is_bad_offset(b_off)) + return -E2BIG; + emit_bcond(MIPS_COND_EQ, r_X, r_zero, b_off, ctx); emit_load_imm(r_ret, 0, ctx); /* delay slot */ emit_mod(r_A, r_X, ctx); break; @@ -926,7 +940,10 @@ static int build_body(struct jit_ctx *ctx) break; case BPF_JMP | BPF_JA: /* pc += K */ - emit_b(b_imm(i + k + 1, ctx), ctx); + b_off = b_imm(i + k + 1, ctx); + if (is_bad_offset(b_off)) + return -E2BIG; + emit_b(b_off, ctx); emit_nop(ctx); break; case BPF_JMP | BPF_JEQ | BPF_K: @@ -1056,12 +1073,16 @@ static int build_body(struct jit_ctx *ctx) break; case BPF_RET | BPF_A: ctx->flags |= SEEN_A; - if (i != prog->len - 1) + if (i != prog->len - 1) { /* * If this is not the last instruction * then jump to the epilogue */ - emit_b(b_imm(prog->len, ctx), ctx); + b_off = b_imm(prog->len, ctx); + if (is_bad_offset(b_off)) + return -E2BIG; + emit_b(b_off, ctx); + } emit_reg_move(r_ret, r_A, ctx); /* delay slot */ break; case BPF_RET | BPF_K: @@ -1075,7 +1096,10 @@ static int build_body(struct jit_ctx *ctx) * If this is not the last instruction * then jump to the epilogue */ - emit_b(b_imm(prog->len, ctx), ctx); + b_off = b_imm(prog->len, ctx); + if (is_bad_offset(b_off)) + return -E2BIG; + emit_b(b_off, ctx); emit_nop(ctx); } break; @@ -1133,8 +1157,10 @@ static int build_body(struct jit_ctx *ctx) /* Load *dev pointer */ emit_load_ptr(r_s0, r_skb, off, ctx); /* error (0) in the delay slot */ - emit_bcond(MIPS_COND_EQ, r_s0, r_zero, - b_imm(prog->len, ctx), ctx); + b_off = b_imm(prog->len, ctx); + if (is_bad_offset(b_off)) + return -E2BIG; + emit_bcond(MIPS_COND_EQ, r_s0, r_zero, b_off, ctx); emit_reg_move(r_ret, r_zero, ctx); if (code == (BPF_ANC | SKF_AD_IFINDEX)) { BUILD_BUG_ON(FIELD_SIZEOF(struct net_device, ifindex) != 4); @@ -1244,7 +1270,10 @@ void bpf_jit_compile(struct bpf_prog *fp) /* Generate the actual JIT code */ build_prologue(&ctx); - build_body(&ctx); + if (build_body(&ctx)) { + module_memfree(ctx.target); + goto out; + } build_epilogue(&ctx); /* Update the icache */ -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand()
by Yang Yingliang 29 Sep '21

29 Sep '21

From: Arun Easi <aeasi(a)marvell.com> stable inclusion from linux-4.19.191 commit c5ab9b67d8b061de74e2ca51bf787ee599bd7f89 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4AFG0?from=project-issue CVE: NA -------------------------------- commit 6641df81ab799f28a5d564f860233dd26cca0d93 upstream. RIP: 0010:kmem_cache_free+0xfa/0x1b0 Call Trace: qla2xxx_mqueuecommand+0x2b5/0x2c0 [qla2xxx] scsi_queue_rq+0x5e2/0xa40 __blk_mq_try_issue_directly+0x128/0x1d0 blk_mq_request_issue_directly+0x4e/0xb0 Fix incorrect call to free srb in qla2xxx_mqueuecommand(), as srb is now allocated by upper layers. This fixes smatch warning of srb unintended free. Link: https://lore.kernel.org/r/20210329085229.4367-7-njavali@marvell.com Fixes: af2a0c51b120 ("scsi: qla2xxx: Fix SRB leak on switch command timeout") Cc: stable(a)vger.kernel.org # 5.5 Reported-by: Laurence Oberman <loberman(a)redhat.com> Reported-by: Dan Carpenter <dan.carpenter(a)oracle.com> Reviewed-by: Himanshu Madhani <himanshu.madhani(a)oracle.com> Signed-off-by: Arun Easi <aeasi(a)marvell.com> Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: yin-xiujiang <yinxiujiang(a)kylinos.cn> # openEuler_contributor Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/scsi/qla2xxx/qla_os.c | 7 ------- 1 file changed, 7 deletions(-) diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c index bfbf213b15c0b..8e9d386146ac6 100644 --- a/drivers/scsi/qla2xxx/qla_os.c +++ b/drivers/scsi/qla2xxx/qla_os.c @@ -1028,8 +1028,6 @@ qla2xxx_mqueuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd, if (rval != QLA_SUCCESS) { ql_dbg(ql_dbg_io + ql_dbg_verbose, vha, 0x3078, "Start scsi failed rval=%d for cmd=%p.\n", rval, cmd); - if (rval == QLA_INTERFACE_ERROR) - goto qc24_free_sp_fail_command; goto qc24_host_busy_free_sp; } @@ -1044,11 +1042,6 @@ qla2xxx_mqueuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd, qc24_target_busy: return SCSI_MLQUEUE_TARGET_BUSY; -qc24_free_sp_fail_command: - sp->free(sp); - CMD_SP(cmd) = NULL; - qla2xxx_rel_qpair_sp(sp->qpair, sp); - qc24_fail_command: cmd->scsi_done(cmd); -- 2.25.1

1 0

[PATCH kernel-4.19] crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd()
by Yang Yingliang 28 Sep '21

28 Sep '21

From: Dan Carpenter <dan.carpenter(a)oracle.com> mainline inclusion from mainline-v5.16 commit 505d9dcb0f7ddf9d075e729523a33d38642ae680 category: bugfix bugzilla: NA CVE: CVE-2021-3764, CVE-2021-3744 --------------------------- There are three bugs in this code: 1) If we ccp_init_data() fails for &src then we need to free aad. Use goto e_aad instead of goto e_ctx. 2) The label to free the &final_wa was named incorrectly as "e_tag" but it should have been "e_final_wa". One error path leaked &final_wa. 3) The &tag was leaked on one error path. In that case, I added a free before the goto because the resource was local to that block. Fixes: 36cf515b9bbe ("crypto: ccp - Enable support for AES GCM on v5 CCPs") Reported-by: "minihanshen(沈明航)" <minihanshen(a)tencent.com> Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Reviewed-by: John Allen <john.allen(a)amd.com> Tested-by: John Allen <john.allen(a)amd.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: weiyang wang <wangweiyang2(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/crypto/ccp/ccp-ops.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c index 4dca1c7b9d47b..cdffff7c8abb9 100644 --- a/drivers/crypto/ccp/ccp-ops.c +++ b/drivers/crypto/ccp/ccp-ops.c @@ -768,7 +768,7 @@ static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, in_place ? DMA_BIDIRECTIONAL : DMA_TO_DEVICE); if (ret) - goto e_ctx; + goto e_aad; if (in_place) { dst = src; @@ -853,7 +853,7 @@ static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, op.u.aes.size = 0; ret = cmd_q->ccp->vdata->perform->aes(&op); if (ret) - goto e_dst; + goto e_final_wa; if (aes->action == CCP_AES_ACTION_ENCRYPT) { /* Put the ciphered tag after the ciphertext. */ @@ -863,17 +863,19 @@ static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, ret = ccp_init_dm_workarea(&tag, cmd_q, authsize, DMA_BIDIRECTIONAL); if (ret) - goto e_tag; + goto e_final_wa; ret = ccp_set_dm_area(&tag, 0, p_tag, 0, authsize); - if (ret) - goto e_tag; + if (ret) { + ccp_dm_free(&tag); + goto e_final_wa; + } ret = crypto_memneq(tag.address, final_wa.address, authsize) ? -EBADMSG : 0; ccp_dm_free(&tag); } -e_tag: +e_final_wa: ccp_dm_free(&final_wa); e_dst: -- 2.25.1

1 0

[PATCH OLK-5.10 0/2] net: spnic: initial commit Ramaxel NIC driver
by Yanling Song 28 Sep '21

28 Sep '21

This initial commit contains Ramaxel's spnic module Yanling Song (2): spnic: initial commit the common module of Ramaxel NIC driver spnic: add NIC layer arch/arm64/configs/openeuler_defconfig | 2 + arch/x86/configs/openeuler_defconfig | 2 + drivers/net/ethernet/Kconfig | 1 + drivers/net/ethernet/Makefile | 1 + drivers/net/ethernet/ramaxel/Kconfig | 20 + drivers/net/ethernet/ramaxel/Makefile | 6 + drivers/net/ethernet/ramaxel/spnic/Kconfig | 15 + drivers/net/ethernet/ramaxel/spnic/Makefile | 40 + .../ethernet/ramaxel/spnic/hw/sphw_api_cmd.c | 1165 +++++++++++ .../ethernet/ramaxel/spnic/hw/sphw_api_cmd.h | 277 +++ .../ethernet/ramaxel/spnic/hw/sphw_cfg_cmd.h | 126 ++ .../net/ethernet/ramaxel/spnic/hw/sphw_cmdq.c | 1606 +++++++++++++++ .../net/ethernet/ramaxel/spnic/hw/sphw_cmdq.h | 196 ++ .../ethernet/ramaxel/spnic/hw/sphw_comm_cmd.h | 60 + .../ramaxel/spnic/hw/sphw_comm_msg_intf.h | 273 +++ .../ethernet/ramaxel/spnic/hw/sphw_common.c | 88 + .../ethernet/ramaxel/spnic/hw/sphw_common.h | 118 ++ .../net/ethernet/ramaxel/spnic/hw/sphw_crm.h | 984 +++++++++ .../net/ethernet/ramaxel/spnic/hw/sphw_csr.h | 171 ++ .../net/ethernet/ramaxel/spnic/hw/sphw_eqs.c | 1374 +++++++++++++ .../net/ethernet/ramaxel/spnic/hw/sphw_eqs.h | 157 ++ .../net/ethernet/ramaxel/spnic/hw/sphw_hw.h | 649 ++++++ .../ethernet/ramaxel/spnic/hw/sphw_hw_cfg.c | 1339 ++++++++++++ .../ethernet/ramaxel/spnic/hw/sphw_hw_cfg.h | 327 +++ .../ethernet/ramaxel/spnic/hw/sphw_hw_comm.c | 1253 ++++++++++++ .../ethernet/ramaxel/spnic/hw/sphw_hw_comm.h | 42 + .../ethernet/ramaxel/spnic/hw/sphw_hwdev.c | 1402 +++++++++++++ .../ethernet/ramaxel/spnic/hw/sphw_hwdev.h | 93 + .../net/ethernet/ramaxel/spnic/hw/sphw_hwif.c | 911 +++++++++ .../net/ethernet/ramaxel/spnic/hw/sphw_hwif.h | 102 + .../net/ethernet/ramaxel/spnic/hw/sphw_mbox.c | 1808 +++++++++++++++++ .../net/ethernet/ramaxel/spnic/hw/sphw_mbox.h | 274 +++ .../net/ethernet/ramaxel/spnic/hw/sphw_mgmt.c | 1382 +++++++++++++ .../net/ethernet/ramaxel/spnic/hw/sphw_mgmt.h | 156 ++ .../ramaxel/spnic/hw/sphw_mgmt_msg_base.h | 19 + .../net/ethernet/ramaxel/spnic/hw/sphw_mt.h | 534 +++++ .../ramaxel/spnic/hw/sphw_prof_adap.c | 94 + .../ramaxel/spnic/hw/sphw_prof_adap.h | 49 + .../ethernet/ramaxel/spnic/hw/sphw_profile.h | 36 + .../net/ethernet/ramaxel/spnic/hw/sphw_wq.c | 152 ++ .../net/ethernet/ramaxel/spnic/hw/sphw_wq.h | 119 ++ .../net/ethernet/ramaxel/spnic/spnic_dbg.c | 753 +++++++ .../net/ethernet/ramaxel/spnic/spnic_dcb.c | 965 +++++++++ .../net/ethernet/ramaxel/spnic/spnic_dcb.h | 56 + .../ethernet/ramaxel/spnic/spnic_dev_mgmt.c | 811 ++++++++ .../ethernet/ramaxel/spnic/spnic_dev_mgmt.h | 78 + .../ethernet/ramaxel/spnic/spnic_ethtool.c | 983 +++++++++ .../ramaxel/spnic/spnic_ethtool_stats.c | 1035 ++++++++++ .../net/ethernet/ramaxel/spnic/spnic_filter.c | 412 ++++ .../net/ethernet/ramaxel/spnic/spnic_irq.c | 178 ++ .../net/ethernet/ramaxel/spnic/spnic_lld.c | 937 +++++++++ .../net/ethernet/ramaxel/spnic/spnic_lld.h | 75 + .../ethernet/ramaxel/spnic/spnic_mag_cfg.c | 778 +++++++ .../ethernet/ramaxel/spnic/spnic_mag_cmd.h | 643 ++++++ .../net/ethernet/ramaxel/spnic/spnic_main.c | 925 +++++++++ .../ramaxel/spnic/spnic_mgmt_interface.h | 617 ++++++ .../ethernet/ramaxel/spnic/spnic_netdev_ops.c | 1526 ++++++++++++++ .../net/ethernet/ramaxel/spnic/spnic_nic.h | 148 ++ .../ethernet/ramaxel/spnic/spnic_nic_cfg.c | 1321 ++++++++++++ .../ethernet/ramaxel/spnic/spnic_nic_cfg.h | 724 +++++++ .../ethernet/ramaxel/spnic/spnic_nic_cfg_vf.c | 647 ++++++ .../ethernet/ramaxel/spnic/spnic_nic_cmd.h | 105 + .../ethernet/ramaxel/spnic/spnic_nic_dbg.c | 151 ++ .../ethernet/ramaxel/spnic/spnic_nic_dbg.h | 16 + .../ethernet/ramaxel/spnic/spnic_nic_dev.h | 353 ++++ .../ethernet/ramaxel/spnic/spnic_nic_event.c | 506 +++++ .../net/ethernet/ramaxel/spnic/spnic_nic_io.c | 1124 ++++++++++ .../net/ethernet/ramaxel/spnic/spnic_nic_io.h | 309 +++ .../net/ethernet/ramaxel/spnic/spnic_nic_qp.h | 421 ++++ .../net/ethernet/ramaxel/spnic/spnic_ntuple.c | 841 ++++++++ .../ethernet/ramaxel/spnic/spnic_pci_id_tbl.h | 13 + .../net/ethernet/ramaxel/spnic/spnic_rss.c | 750 +++++++ .../net/ethernet/ramaxel/spnic/spnic_rss.h | 48 + .../ethernet/ramaxel/spnic/spnic_rss_cfg.c | 391 ++++ drivers/net/ethernet/ramaxel/spnic/spnic_rx.c | 1250 ++++++++++++ drivers/net/ethernet/ramaxel/spnic/spnic_rx.h | 118 ++ .../net/ethernet/ramaxel/spnic/spnic_sriov.c | 200 ++ .../net/ethernet/ramaxel/spnic/spnic_sriov.h | 24 + drivers/net/ethernet/ramaxel/spnic/spnic_tx.c | 879 ++++++++ drivers/net/ethernet/ramaxel/spnic/spnic_tx.h | 129 ++ 80 files changed, 38663 insertions(+) create mode 100644 drivers/net/ethernet/ramaxel/Kconfig create mode 100644 drivers/net/ethernet/ramaxel/Makefile create mode 100644 drivers/net/ethernet/ramaxel/spnic/Kconfig create mode 100644 drivers/net/ethernet/ramaxel/spnic/Makefile create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_api_cmd.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_api_cmd.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_cfg_cmd.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_cmdq.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_cmdq.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_comm_cmd.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_comm_msg_intf.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_common.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_common.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_crm.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_csr.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_eqs.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_eqs.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hw.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hw_cfg.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hw_cfg.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hw_comm.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hw_comm.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hwdev.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hwdev.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hwif.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_hwif.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_mbox.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_mbox.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_mgmt.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_mgmt.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_mgmt_msg_base.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_mt.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_prof_adap.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_prof_adap.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_profile.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_wq.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/hw/sphw_wq.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_dbg.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_dcb.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_dcb.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_dev_mgmt.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_dev_mgmt.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_ethtool.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_ethtool_stats.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_filter.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_irq.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_lld.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_lld.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_mag_cfg.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_mag_cmd.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_main.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_mgmt_interface.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_netdev_ops.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_cfg.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_cfg.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_cfg_vf.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_cmd.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_dbg.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_dbg.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_dev.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_event.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_io.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_io.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_nic_qp.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_ntuple.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_pci_id_tbl.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_rss.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_rss.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_rss_cfg.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_rx.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_rx.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_sriov.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_sriov.h create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_tx.c create mode 100644 drivers/net/ethernet/ramaxel/spnic/spnic_tx.h -- 2.30.0

1 2

[PATCH OLK-5.10 01/31] mm: fix page_owner initializing issue for arm32
by Zheng Zengkai 28 Sep '21

28 Sep '21

From: Zhenhua Huang <zhenhuah(a)codeaurora.org> mainline inclusion from mainline-v5.11-rc1 commit 7fb7ab6d618a4dc7ea3f3eafc92388a35b4f8894 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I49LXW CVE: NA ------------------------------------------------- Page owner of pages used by page owner itself used is missing on arm32 targets. The reason is dummy_handle and failure_handle is not initialized correctly. Buddy allocator is used to initialize these two handles. However, buddy allocator is not ready when page owner calls it. This change fixed that by initializing page owner after buddy initialization. The working flow before and after this change are: original logic: 1. allocated memory for page_ext(using memblock). 2. invoke the init callback of page_ext_ops like page_owner(using buddy allocator). 3. initialize buddy. after this change: 1. allocated memory for page_ext(using memblock). 2. initialize buddy. 3. invoke the init callback of page_ext_ops like page_owner(using buddy allocator). with the change, failure/dummy_handle can get its correct value and page owner output for example has the one for page owner itself: Page allocated via order 2, mask 0x6202c0(GFP_USER|__GFP_NOWARN), pid 1006, ts 67278156558 ns PFN 543776 type Unmovable Block 531 type Unmovable Flags 0x0() init_page_owner+0x28/0x2f8 invoke_init_callbacks_flatmem+0x24/0x34 start_kernel+0x33c/0x5d8 Link: https://lkml.kernel.org/r/1603104925-5888-1-git-send-email-zhenhuah@codeaur… Signed-off-by: Zhenhua Huang <zhenhuah(a)codeaurora.org> Acked-by: Vlastimil Babka <vbabka(a)suse.cz> Cc: Joonsoo Kim <iamjoonsoo.kim(a)lge.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> (cherry picked from commit 7fb7ab6d618a4dc7ea3f3eafc92388a35b4f8894) Signed-off-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yuanzheng Song <songyuanzheng(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- include/linux/page_ext.h | 8 ++++++++ init/main.c | 2 ++ mm/page_ext.c | 10 ++++++++-- 3 files changed, 18 insertions(+), 2 deletions(-) diff --git a/include/linux/page_ext.h b/include/linux/page_ext.h index cfce186f0c4e..aff81ba31bd8 100644 --- a/include/linux/page_ext.h +++ b/include/linux/page_ext.h @@ -44,8 +44,12 @@ static inline void page_ext_init_flatmem(void) { } extern void page_ext_init(void); +static inline void page_ext_init_flatmem_late(void) +{ +} #else extern void page_ext_init_flatmem(void); +extern void page_ext_init_flatmem_late(void); static inline void page_ext_init(void) { } @@ -76,6 +80,10 @@ static inline void page_ext_init(void) { } +static inline void page_ext_init_flatmem_late(void) +{ +} + static inline void page_ext_init_flatmem(void) { } diff --git a/init/main.c b/init/main.c index fc0277a9e7a3..f6fe37a744b7 100644 --- a/init/main.c +++ b/init/main.c @@ -830,6 +830,8 @@ static void __init mm_init(void) init_debug_pagealloc(); report_meminit(); mem_init(); + /* page_owner must be initialized after buddy is ready */ + page_ext_init_flatmem_late(); kmem_cache_init(); kmemleak_init(); pgtable_init(); diff --git a/mm/page_ext.c b/mm/page_ext.c index cf931ebb58d7..df6f74aac8e1 100644 --- a/mm/page_ext.c +++ b/mm/page_ext.c @@ -99,12 +99,19 @@ static void __init invoke_init_callbacks(void) } } +#ifndef CONFIG_SPARSEMEM +void __init page_ext_init_flatmem_late(void) +{ + invoke_init_callbacks(); +} +#endif + static inline struct page_ext *get_entry(void *base, unsigned long index) { return base + page_ext_size * index; } -#if !defined(CONFIG_SPARSEMEM) +#ifndef CONFIG_SPARSEMEM void __meminit pgdat_page_ext_init(struct pglist_data *pgdat) @@ -177,7 +184,6 @@ void __init page_ext_init_flatmem(void) goto fail; } pr_info("allocated %ld bytes of page_ext\n", total_usage); - invoke_init_callbacks(); return; fail: -- 2.20.1

1 30

[PATCH openEuler-1.0-LTS] net:fix tcp timeout retransmits are always missing 2 times
by jiazhenyuan 28 Sep '21

28 Sep '21

mainline inclusion from mainline-v5.3.0 commit 3256a2d6ab1f71f9a1bd2d7f6f18eb8108c48d17 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4AFRJ?from=project-issue CVE: NA --------------------------------------------------------------- tcp: adjust rto_base in retransmits_timed_out() The cited commit exposed an old retransmits_timed_out() bug which assumed it could call tcp_model_timeout() with TCP_RTO_MIN as rto_base for all states. But flows in SYN_SENT or SYN_RECV state uses a different RTO base (1 sec instead of 200 ms, unless BPF choses another value) This caused a reduction of SYN retransmits from 6 to 4 with the default /proc/sys/net/ipv4/tcp_syn_retries value. Fixes: a41e8a8 ("tcp: better handle TCP_USER_TIMEOUT in SYN_SENT state") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Yuchung Cheng <ycheng(a)google.com> Cc: Marek Majkowski <marek(a)cloudflare.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: jiazhenyuan <jiazhenyuan(a)uniontech.com> --- net/ipv4/tcp_timer.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c index 681882a40968..81a47e87c35d 100644 --- a/net/ipv4/tcp_timer.c +++ b/net/ipv4/tcp_timer.c @@ -190,7 +190,7 @@ static bool retransmits_timed_out(struct sock *sk, unsigned int boundary, unsigned int timeout) { - const unsigned int rto_base = TCP_RTO_MIN; + unsigned int rto_base = TCP_RTO_MIN; unsigned int linear_backoff_thresh, start_ts; if (!inet_csk(sk)->icsk_retransmits) @@ -201,6 +201,9 @@ static bool retransmits_timed_out(struct sock *sk, return false; if (likely(timeout == 0)) { + if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) + rto_base = tcp_timeout_init(sk); + linear_backoff_thresh = ilog2(TCP_RTO_MAX/rto_base); if (boundary <= linear_backoff_thresh) -- 2.27.0

2 1

[PATCH openEuler-1.0-LTS 01/14] Revert "bpf: Fix truncation handling for mod32 dst reg wrt zero"
by Yang Yingliang 28 Sep '21

28 Sep '21

From: He Fengqing <hefengqing(a)huawei.com> hulk inclusion category: bugfix bugzilla: NA CVE: CVE-2021-3444 ------------------------------------------------- This reverts commit 946dd60de74146a418f62275e5a6f83496f74dcd. Signed-off-by: He Fengqing <hefengqing(a)huawei.com> Reviewed-by: Kuohai Xu <xukuohai(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/bpf/verifier.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 962dc7c48430f..61a535eec0a9b 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -6322,7 +6322,7 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env) bool isdiv = BPF_OP(insn->code) == BPF_DIV; struct bpf_insn *patchlet; struct bpf_insn chk_and_div[] = { - /* [R,W]x div 0 -> 0 */ + /* Rx div 0 -> 0 */ BPF_RAW_INSN((is64 ? BPF_JMP : BPF_JMP32) | BPF_JNE | BPF_K, insn->src_reg, 0, 2, 0), @@ -6331,18 +6331,16 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env) *insn, }; struct bpf_insn chk_and_mod[] = { - /* [R,W]x mod 0 -> [R,W]x */ + /* Rx mod 0 -> Rx */ BPF_RAW_INSN((is64 ? BPF_JMP : BPF_JMP32) | BPF_JEQ | BPF_K, insn->src_reg, - 0, 1 + (is64 ? 0 : 1), 0), + 0, 1, 0), *insn, - BPF_JMP_IMM(BPF_JA, 0, 0, 1), - BPF_MOV32_REG(insn->dst_reg, insn->dst_reg), }; patchlet = isdiv ? chk_and_div : chk_and_mod; cnt = isdiv ? ARRAY_SIZE(chk_and_div) : - ARRAY_SIZE(chk_and_mod) - (is64 ? 2 : 0); + ARRAY_SIZE(chk_and_mod); new_prog = bpf_patch_insn_data(env, i + delta, patchlet, cnt); if (!new_prog) -- 2.25.1

1 13

[PATCH openEuler-1.0-LTS] net:fix tcp timeout retransmits are always missing 2 times
by jiazhenyuan 28 Sep '21

28 Sep '21

mainline inclusion from mainline-v5.3.0 commit 3256a2d6ab1f71f9a1bd2d7f6f18eb8108c48d17 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4AFRJ?from=project-issue CVE: NA --------------------------------------------------------------- tcp: adjust rto_base in retransmits_timed_out() The cited commit exposed an old retransmits_timed_out() bug which assumed it could call tcp_model_timeout() with TCP_RTO_MIN as rto_base for all states. But flows in SYN_SENT or SYN_RECV state uses a different RTO base (1 sec instead of 200 ms, unless BPF choses another value) This caused a reduction of SYN retransmits from 6 to 4 with the default /proc/sys/net/ipv4/tcp_syn_retries value. Fixes: a41e8a8 ("tcp: better handle TCP_USER_TIMEOUT in SYN_SENT state") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Yuchung Cheng <ycheng(a)google.com> Cc: Marek Majkowski <marek(a)cloudflare.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: jiazhenyuan <jiazhenyuan(a)uniontech.com> --- net/ipv4/tcp_timer.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c index 681882a40968..81a47e87c35d 100644 --- a/net/ipv4/tcp_timer.c +++ b/net/ipv4/tcp_timer.c @@ -190,7 +190,7 @@ static bool retransmits_timed_out(struct sock *sk, unsigned int boundary, unsigned int timeout) { - const unsigned int rto_base = TCP_RTO_MIN; + unsigned int rto_base = TCP_RTO_MIN; unsigned int linear_backoff_thresh, start_ts; if (!inet_csk(sk)->icsk_retransmits) @@ -201,6 +201,9 @@ static bool retransmits_timed_out(struct sock *sk, return false; if (likely(timeout == 0)) { + if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) + rto_base = tcp_timeout_init(sk); + linear_backoff_thresh = ilog2(TCP_RTO_MAX/rto_base); if (boundary <= linear_backoff_thresh) -- 2.27.0

3 2

[PATCH kernel-4.19] block: fix wrong define name
by Yang Yingliang 28 Sep '21

28 Sep '21

From: Laibin Qiu <qiulaibin(a)huawei.com> hulk inclusion category: bugfix bugzilla: 182135 CVE: NA ------------------------------------------------- Fix wrong define name. Fixes: 8abeeaef3fbf ("block: fix compile error when CONFIG_BLK_DEV_THROTTLING disable") Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/blk-cgroup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index ce04c5a5ebb11..36cccf6005c44 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -1342,7 +1342,7 @@ void blkcg_drain_queue(struct request_queue *q) * @q could be exiting and q->td has not been initialized. * If so, don't need drain any throttled bios. */ -#ifdef CONFIG_BLK_DEV_THROTTLIN +#ifdef CONFIG_BLK_DEV_THROTTLING if (!q->td) return; #endif -- 2.25.1

1 0

[PATCH kernel-4.19 01/13] Revert "bpf: Fix truncation handling for mod32 dst reg wrt zero"
by Yang Yingliang 28 Sep '21

28 Sep '21

From: He Fengqing <hefengqing(a)huawei.com> hulk inclusion category: bugfix bugzilla: NA CVE: CVE-2021-3444 ------------------------------------------------- This reverts commit de207ba498fa2bbd29db790c4571b91617cab889. Signed-off-by: He Fengqing <hefengqing(a)huawei.com> Reviewed-by: Kuohai Xu <xukuohai(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/bpf/verifier.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 21986716e56ff..0d2211c6352c3 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -6426,7 +6426,7 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env) bool isdiv = BPF_OP(insn->code) == BPF_DIV; struct bpf_insn *patchlet; struct bpf_insn chk_and_div[] = { - /* [R,W]x div 0 -> 0 */ + /* Rx div 0 -> 0 */ BPF_RAW_INSN((is64 ? BPF_JMP : BPF_JMP32) | BPF_JNE | BPF_K, insn->src_reg, 0, 2, 0), @@ -6435,18 +6435,16 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env) *insn, }; struct bpf_insn chk_and_mod[] = { - /* [R,W]x mod 0 -> [R,W]x */ + /* Rx mod 0 -> Rx */ BPF_RAW_INSN((is64 ? BPF_JMP : BPF_JMP32) | BPF_JEQ | BPF_K, insn->src_reg, - 0, 1 + (is64 ? 0 : 1), 0), + 0, 1, 0), *insn, - BPF_JMP_IMM(BPF_JA, 0, 0, 1), - BPF_MOV32_REG(insn->dst_reg, insn->dst_reg), }; patchlet = isdiv ? chk_and_div : chk_and_mod; cnt = isdiv ? ARRAY_SIZE(chk_and_div) : - ARRAY_SIZE(chk_and_mod) - (is64 ? 2 : 0); + ARRAY_SIZE(chk_and_mod); new_prog = bpf_patch_insn_data(env, i + delta, patchlet, cnt); if (!new_prog) -- 2.25.1

1 12

[PATCH kernel-4.19 00/31] backport linux-4.19.208
by Yang Yingliang 28 Sep '21

28 Sep '21

Andy Shevchenko (2): apparmor: remove duplicate macro list_entry_is_head() dmaengine: acpi: Avoid comparison GSI with Linux vIRQ Christophe Leroy (1): crypto: talitos - fix max key size for sha384 and sha512 Cyrill Gorcunov (1): prctl: allow to setup brk for et_dyn executables Dan Carpenter (1): thermal/drivers/exynos: Fix an error code in exynos_tmu_probe() Greg Kroah-Hartman (1): Linux 4.19.208 Guenter Roeck (2): parisc: Move pci_dev_is_behind_card_dino to where it is used drm/nouveau/nvkm: Replace -ENOSYS with -ENODEV Ilya Leoshkevich (1): s390/bpf: Fix optimizing out zero-extensions Jeff Layton (1): ceph: lockdep annotations for try_nonblocking_invalidate Johannes Berg (1): dmaengine: ioat: depends on !UML Li Huafei (1): tracing/kprobe: Fix kprobe_on_func_entry() modification Lukas Bulwahn (1): Kconfig.debug: drop selecting non-existing HARDLOCKUP_DETECTOR_ARCH Nanyong Sun (6): nilfs2: fix memory leak in nilfs_sysfs_create_device_group nilfs2: fix NULL pointer in nilfs_##name##_attr_release nilfs2: fix memory leak in nilfs_sysfs_create_##name##_group nilfs2: fix memory leak in nilfs_sysfs_delete_##name##_group nilfs2: fix memory leak in nilfs_sysfs_create_snapshot_group nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group Neeraj Upadhyay (1): rcu: Fix missed wakeup of exp_wq waiters Pavel Skripkin (1): profiling: fix shift-out-of-bounds bugs Radhey Shyam Pandey (1): dmaengine: xilinx_dma: Set DMA mask for coherent APIs Radim Krčmář (1): KVM: remember position in kvm->vcpus array Thomas Gleixner (1): drivers: base: cacheinfo: Get rid of DEFINE_SMP_CALL_CACHE_FUNCTION() Uwe Kleine-König (4): pwm: lpc32xx: Don't modify HW state in .probe() after the PWM chip was registered pwm: img: Don't modify HW state in .remove() callback pwm: rockchip: Don't modify HW state in .remove() callback pwm: stm32-lp: Don't modify HW state in .remove() callback Xie Yongji (1): 9p/trans_virtio: Remove sysfs file on probe failure Zhen Lei (1): nilfs2: use refcount_dec_and_lock() to fix potential UAF Zou Wei (1): dmaengine: sprd: Add missing MODULE_DEVICE_TABLE Makefile | 2 +- arch/arm64/kernel/cacheinfo.c | 7 +-- arch/mips/kernel/cacheinfo.c | 7 +-- arch/riscv/kernel/cacheinfo.c | 7 +-- arch/s390/net/bpf_jit_comp.c | 50 ++++++++++--------- arch/x86/kernel/cpu/cacheinfo.c | 7 +-- drivers/crypto/talitos.c | 2 +- drivers/dma/Kconfig | 2 +- drivers/dma/acpi-dma.c | 10 ++-- drivers/dma/sprd-dma.c | 1 + drivers/dma/xilinx/xilinx_dma.c | 2 +- .../gpu/drm/nouveau/nvkm/engine/device/ctrl.c | 2 +- drivers/parisc/dino.c | 18 +++---- drivers/pwm/pwm-img.c | 16 ------ drivers/pwm/pwm-lpc32xx.c | 10 ++-- drivers/pwm/pwm-rockchip.c | 14 ------ drivers/pwm/pwm-stm32-lp.c | 2 - drivers/thermal/samsung/exynos_tmu.c | 1 + fs/ceph/caps.c | 2 + fs/nilfs2/sysfs.c | 26 ++++------ fs/nilfs2/the_nilfs.c | 9 ++-- include/linux/cacheinfo.h | 18 ------- include/linux/kvm_host.h | 11 ++-- kernel/profile.c | 21 ++++---- kernel/rcu/tree_exp.h | 2 +- kernel/sys.c | 7 --- kernel/trace/trace_kprobe.c | 3 +- lib/Kconfig.debug | 1 - net/9p/trans_virtio.c | 4 +- security/apparmor/apparmorfs.c | 3 -- virt/kvm/kvm_main.c | 5 +- 31 files changed, 102 insertions(+), 170 deletions(-) -- 2.25.1

1 31