- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 v5 00/11] Memory access profiler(SPE) driven NUMA balancing
by Ze Zuo 04 Jun '24

04 Jun '24

Hi, In Arm processors, there is a hardware PMU (Performance Monitoring Unit) facility called Statistical Profiling Extension (SPE) that can gather memory access metrics. In this patchset, SPE is exploited as an access information sampling approach to drive NUMA balancing. This sampling approach is introducedto replace the method based on address space scanning and hint faults with the access information provided by the hardware. With this, it is no longer necessary for NUMA balancing to scan over the address space periodically and rely on task-to-page association built by NUMA hint faults. Instead, the access samples obtained from hardware PMU are fed to NUMA balancing as equivalents to page fault. Except for the replaced sampling approach, the rest of the NUMA balancing policy is retained to do pages and tasks migrations according to the samples. Profiling based on SPE is an valid alternative sampling approach in NUMA balancing for the optimal page and task placement. This can be also extended to other architectures as long as there is a hardware PMU that supports memory access profiling. An abstract layer mem_sampling is introduced to reserve support for other kernel features and different types of hardware PMU. To help evaluate performance of this approach in system, syctl interfaces are added to enable/disable hardware mem sampling. NUMA balancing sampling approach can be also switched back to hint-faults- based approach dynamically. TODOs Currently, SPE for NUMA balance does not support PMD-level page migration, but it will be supported in later version. Changes since v4: -- some patch check warning fixs, no functional change. Changes since v3: -- some clean code, no functional change. Changes since v2: -- clean code and commit fixs, no functional change. Changes since v1: -- clean code, no functional change. Ze Zuo (11): drivers/arm/spe: In-kernel SPE driver for page access profiling mm: Add PMU based memory sampling abstract layer mm/mem_sampling.c: Add controlling interface for mem_sampling sched: Enable per-process mem_sampling from sched switch path mm/mem_sampling.c: Drive NUMA balancing via mem_sampling access data mm/mem_sampling.c: Add controlling interface for mem_sampling on numa balance tracing, numa balance: add trace events for numa data caused by mem_sampling driver/arm/spe: make mem_sampling and perf reuse arm spe driver tracing, mem-sampling-sample: Adding tracking events to hardware-sampled page access samples/bpf: Add program for memory access by spe config: Enable memory sampling based pmu for numa balance by default arch/arm64/configs/openeuler_defconfig | 3 + drivers/Kconfig | 2 + drivers/Makefile | 1 + drivers/arm/Kconfig | 2 + drivers/arm/spe/Kconfig | 11 + drivers/arm/spe/Makefile | 2 + drivers/arm/spe/spe-decoder/Makefile | 2 + drivers/arm/spe/spe-decoder/arm-spe-decoder.c | 213 +++++ drivers/arm/spe/spe-decoder/arm-spe-decoder.h | 74 ++ .../arm/spe/spe-decoder/arm-spe-pkt-decoder.c | 227 +++++ .../arm/spe/spe-decoder/arm-spe-pkt-decoder.h | 153 ++++ drivers/arm/spe/spe.c | 854 ++++++++++++++++++ drivers/arm/spe/spe.h | 130 +++ drivers/perf/Kconfig | 2 +- drivers/perf/arm_pmu_acpi.c | 30 +- drivers/perf/arm_spe_pmu.c | 371 ++------ include/linux/mem_sampling.h | 109 +++ include/linux/perf/arm_pmu.h | 8 + include/trace/events/kmem.h | 80 ++ kernel/sched/core.c | 2 + kernel/sched/fair.c | 12 + mm/Kconfig | 24 + mm/Makefile | 1 + mm/mem_sampling.c | 514 +++++++++++ samples/bpf/spe/Makefile | 26 + samples/bpf/spe/Makefile.arch | 47 + samples/bpf/spe/README.md | 0 samples/bpf/spe/spe-record.bpf.c | 40 + samples/bpf/spe/spe-record.h | 47 + samples/bpf/spe/spe-record.user.c | 116 +++ 30 files changed, 2791 insertions(+), 312 deletions(-) create mode 100644 drivers/arm/Kconfig create mode 100644 drivers/arm/spe/Kconfig create mode 100644 drivers/arm/spe/Makefile create mode 100644 drivers/arm/spe/spe-decoder/Makefile create mode 100644 drivers/arm/spe/spe-decoder/arm-spe-decoder.c create mode 100644 drivers/arm/spe/spe-decoder/arm-spe-decoder.h create mode 100644 drivers/arm/spe/spe-decoder/arm-spe-pkt-decoder.c create mode 100644 drivers/arm/spe/spe-decoder/arm-spe-pkt-decoder.h create mode 100644 drivers/arm/spe/spe.c create mode 100644 drivers/arm/spe/spe.h create mode 100644 include/linux/mem_sampling.h create mode 100644 mm/mem_sampling.c create mode 100644 samples/bpf/spe/Makefile create mode 100644 samples/bpf/spe/Makefile.arch create mode 100644 samples/bpf/spe/README.md create mode 100644 samples/bpf/spe/spe-record.bpf.c create mode 100644 samples/bpf/spe/spe-record.h create mode 100644 samples/bpf/spe/spe-record.user.c -- 2.33.0

2 12

[PATCH V3 OLK-5.10 0/2] Fix soft lockup in stress test
by Zhang Zekun 04 Jun '24

04 Jun '24

speed up the speed of freeing iova and add a cond_resched(). v3: Fix check format warning. v2: add a cover letter to generate a pr. Zhang Zekun (2): iommu/iova: free iovas on each cpu in flush queue iommu/iova: Try to schedule out when free iova too long drivers/iommu/iova.c | 41 +++++++++++++++++++++++++---------------- 1 file changed, 25 insertions(+), 16 deletions(-) -- 2.17.1

2 3

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 6908dfcea35ff8f01855776fcaae9d426a27b44a
by kernel test robot 04 Jun '24

04 Jun '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 6908dfcea35ff8f01855776fcaae9d426a27b44a !8296 atm: iphase: fix possible use-after-free in ia_module_exit() Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allmodconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- arm64-defconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- arm64-randconfig-001-20240603 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- x86_64-buildonly-randconfig-001-20240603 | `-- drivers-misc-uacce-.tmp_uacce.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-006-20240603 | `-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-randconfig-006-20240603 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code `-- x86_64-randconfig-014-20240603 `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code clang_recent_errors |-- x86_64-allyesconfig | |-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension | `-- fs-f2fs-.tmp_recovery.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-001-20240604 | `-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-002-20240604 | `-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-004-20240603 | `-- fs-f2fs-.tmp_recovery.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-randconfig-003-20240603 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension |-- x86_64-randconfig-073-20240521 | `-- kernel-livepatch-core.c:warning:no-previous-prototype-for-function-klp_check_patch_kprobed `-- x86_64-randconfig-123-20240604 `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension elapsed time: 755m configs tested: 31 configs skipped: 147 tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240603 gcc arm64 randconfig-002-20240603 gcc arm64 randconfig-004-20240603 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240603 gcc x86_64 buildonly-randconfig-001-20240604 clang x86_64 buildonly-randconfig-002-20240603 gcc x86_64 buildonly-randconfig-002-20240604 clang x86_64 buildonly-randconfig-003-20240603 gcc x86_64 buildonly-randconfig-004-20240603 clang x86_64 buildonly-randconfig-005-20240603 clang x86_64 buildonly-randconfig-006-20240603 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240603 gcc x86_64 randconfig-002-20240603 clang x86_64 randconfig-003-20240603 clang x86_64 randconfig-004-20240603 gcc x86_64 randconfig-005-20240603 gcc x86_64 randconfig-006-20240603 gcc x86_64 randconfig-011-20240603 gcc x86_64 randconfig-012-20240603 gcc x86_64 randconfig-013-20240603 clang x86_64 randconfig-014-20240603 gcc x86_64 randconfig-015-20240603 gcc x86_64 randconfig-016-20240603 clang x86_64 randconfig-071-20240603 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 85fbd1be6338eacc84976df503d1a92c84323ae3
by kernel test robot 04 Jun '24

04 Jun '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 85fbd1be6338eacc84976df503d1a92c84323ae3 !8435 LoongArch: add GMAC&GNET support Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- arch-arm64-kernel-cpufeature.c:warning:enable_pseudo_nmi-defined-but-not-used | `-- arch-arm64-kvm-vgic-vgic-mmio.c:warning:variable-is_pending-set-but-not-used |-- arm64-randconfig-004-20240603 | `-- arch-arm64-kernel-cpufeature.c:warning:enable_pseudo_nmi-defined-but-not-used |-- loongarch-allnoconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) `-- loongarch-randconfig-002-20240603 `-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) clang_recent_errors |-- arm64-allmodconfig | `-- arch-arm64-kvm-vgic-vgic-mmio.c:warning:variable-is_pending-set-but-not-used `-- arm64-randconfig-003-20240603 `-- arch-arm64-kernel-cpufeature.c:warning:unused-variable-enable_pseudo_nmi elapsed time: 748m configs tested: 40 configs skipped: 143 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240603 gcc arm64 randconfig-002-20240603 gcc arm64 randconfig-003-20240603 clang arm64 randconfig-004-20240603 gcc loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240603 gcc loongarch randconfig-002-20240603 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240603 gcc x86_64 buildonly-randconfig-002-20240603 gcc x86_64 buildonly-randconfig-003-20240603 gcc x86_64 buildonly-randconfig-004-20240603 clang x86_64 buildonly-randconfig-005-20240603 clang x86_64 buildonly-randconfig-006-20240603 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240603 gcc x86_64 randconfig-002-20240603 clang x86_64 randconfig-003-20240603 clang x86_64 randconfig-004-20240603 gcc x86_64 randconfig-005-20240603 gcc x86_64 randconfig-006-20240603 gcc x86_64 randconfig-011-20240603 gcc x86_64 randconfig-012-20240603 gcc x86_64 randconfig-013-20240603 clang x86_64 randconfig-014-20240603 gcc x86_64 randconfig-015-20240603 gcc x86_64 randconfig-016-20240603 clang x86_64 randconfig-071-20240603 clang x86_64 randconfig-072-20240603 clang x86_64 randconfig-073-20240603 clang x86_64 randconfig-074-20240603 clang x86_64 randconfig-075-20240603 gcc x86_64 randconfig-076-20240603 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS 83e8197dd35ec3fc87c6741759fa0fcd878a4186
by kernel test robot 04 Jun '24

04 Jun '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 83e8197dd35ec3fc87c6741759fa0fcd878a4186 !8397 mm/hugetlb: fix missing hugetlb_lock for resv uncharge Warning ids grouped by kconfigs: clang_recent_errors |-- arm64-allyesconfig | |-- Documentation-devicetree-bindings-iio-addac-adi-ad74413r.yaml:channel:Missing-additionalProperties-unevaluatedProperties-constraint | `-- Documentation-devicetree-bindings-sound-amlogic-gx-sound-card.yaml:codec(-):Missing-additionalProperties-unevaluatedProperties-constraint `-- x86_64-allnoconfig |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:common-qp.h-is-included-more-than-once. |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_device.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_genl.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_genl_admin.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_uvs_cmd.c:ubcore_device.h-is-included-more-than-once. `-- drivers-ub-urma-uburma-uburma_mmap.c:linux-version.h-not-needed. elapsed time: 723m configs tested: 35 configs skipped: 148 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240603 gcc arm64 randconfig-002-20240603 gcc arm64 randconfig-003-20240603 clang arm64 randconfig-004-20240603 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240603 gcc x86_64 buildonly-randconfig-002-20240603 gcc x86_64 buildonly-randconfig-003-20240603 gcc x86_64 buildonly-randconfig-004-20240603 clang x86_64 buildonly-randconfig-005-20240603 clang x86_64 buildonly-randconfig-006-20240603 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240603 gcc x86_64 randconfig-002-20240603 clang x86_64 randconfig-003-20240603 clang x86_64 randconfig-004-20240603 gcc x86_64 randconfig-005-20240603 gcc x86_64 randconfig-006-20240603 gcc x86_64 randconfig-011-20240603 gcc x86_64 randconfig-012-20240603 gcc x86_64 randconfig-013-20240603 clang x86_64 randconfig-014-20240603 gcc x86_64 randconfig-015-20240603 gcc x86_64 randconfig-016-20240603 clang x86_64 randconfig-071-20240603 clang x86_64 randconfig-072-20240603 clang x86_64 randconfig-073-20240603 clang x86_64 randconfig-074-20240603 clang x86_64 randconfig-075-20240603 gcc x86_64 randconfig-076-20240603 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 v4 00/11] Memory access profiler(SPE) driven NUMA balancing
by Ze Zuo 03 Jun '24

03 Jun '24

Hi, In Arm processors, there is a hardware PMU (Performance Monitoring Unit) facility called Statistical Profiling Extension (SPE) that can gather memory access metrics. In this patchset, SPE is exploited as an access information sampling approach to drive NUMA balancing. This sampling approach is introducedto replace the method based on address space scanning and hint faults with the access information provided by the hardware. With this, it is no longer necessary for NUMA balancing to scan over the address space periodically and rely on task-to-page association built by NUMA hint faults. Instead, the access samples obtained from hardware PMU are fed to NUMA balancing as equivalents to page fault. Except for the replaced sampling approach, the rest of the NUMA balancing policy is retained to do pages and tasks migrations according to the samples. Profiling based on SPE is an valid alternative sampling approach in NUMA balancing for the optimal page and task placement. This can be also extended to other architectures as long as there is a hardware PMU that supports memory access profiling. An abstract layer mem_sampling is introduced to reserve support for other kernel features and different types of hardware PMU. To help evaluate performance of this approach in system, syctl interfaces are added to enable/disable hardware mem sampling. NUMA balancing sampling approach can be also switched back to hint-faults- based approach dynamically. TODOs Currently, SPE for NUMA balance does not support PMD-level page migration, but it will be supported in later version. Changes since v3: -- some clean code, no functional change. Changes since v2: -- clean code and commit fixs, no functional change. Changes since v1: -- clean code, no functional change. Ze Zuo (11): drivers/arm/spe: In-kernel SPE driver for page access profiling mm: Add PMU based memory sampling abstract layer mm/mem_sampling.c: Add controlling interface for mem_sampling sched: Enable per-process mem_sampling from sched switch path mm/mem_sampling.c: Drive NUMA balancing via mem_sampling access data mm/mem_sampling.c: Add controlling interface for mem_sampling on numa balance tracing, numa balance: add trace events for numa data caused by mem_sampling driver/arm/spe: make mem_sampling and perf reuse arm spe driver tracing, mem-sampling-sample: Adding tracking events to hardware-sampled page access samples/bpf: Add program for memory access by spe config: Enable memory sampling based pmu for numa balance by default arch/arm64/configs/openeuler_defconfig | 3 + drivers/Kconfig | 2 + drivers/Makefile | 1 + drivers/arm/Kconfig | 2 + drivers/arm/spe/Kconfig | 11 + drivers/arm/spe/Makefile | 2 + drivers/arm/spe/spe-decoder/Makefile | 2 + drivers/arm/spe/spe-decoder/arm-spe-decoder.c | 213 +++++ drivers/arm/spe/spe-decoder/arm-spe-decoder.h | 74 ++ .../arm/spe/spe-decoder/arm-spe-pkt-decoder.c | 227 +++++ .../arm/spe/spe-decoder/arm-spe-pkt-decoder.h | 153 ++++ drivers/arm/spe/spe.c | 854 ++++++++++++++++++ drivers/arm/spe/spe.h | 130 +++ drivers/perf/Kconfig | 2 +- drivers/perf/arm_pmu_acpi.c | 30 +- drivers/perf/arm_spe_pmu.c | 371 ++------ include/linux/mem_sampling.h | 109 +++ include/linux/perf/arm_pmu.h | 8 + include/trace/events/kmem.h | 80 ++ kernel/sched/core.c | 2 + kernel/sched/fair.c | 12 + mm/Kconfig | 24 + mm/Makefile | 1 + mm/mem_sampling.c | 514 +++++++++++ samples/bpf/spe/Makefile | 26 + samples/bpf/spe/Makefile.arch | 47 + samples/bpf/spe/README.md | 0 samples/bpf/spe/spe-record.bpf.c | 40 + samples/bpf/spe/spe-record.h | 47 + samples/bpf/spe/spe-record.user.c | 116 +++ 30 files changed, 2791 insertions(+), 312 deletions(-) create mode 100644 drivers/arm/Kconfig create mode 100644 drivers/arm/spe/Kconfig create mode 100644 drivers/arm/spe/Makefile create mode 100644 drivers/arm/spe/spe-decoder/Makefile create mode 100644 drivers/arm/spe/spe-decoder/arm-spe-decoder.c create mode 100644 drivers/arm/spe/spe-decoder/arm-spe-decoder.h create mode 100644 drivers/arm/spe/spe-decoder/arm-spe-pkt-decoder.c create mode 100644 drivers/arm/spe/spe-decoder/arm-spe-pkt-decoder.h create mode 100644 drivers/arm/spe/spe.c create mode 100644 drivers/arm/spe/spe.h create mode 100644 include/linux/mem_sampling.h create mode 100644 mm/mem_sampling.c create mode 100644 samples/bpf/spe/Makefile create mode 100644 samples/bpf/spe/Makefile.arch create mode 100644 samples/bpf/spe/README.md create mode 100644 samples/bpf/spe/spe-record.bpf.c create mode 100644 samples/bpf/spe/spe-record.h create mode 100644 samples/bpf/spe/spe-record.user.c -- 2.33.0

2 12

[PATCH v8 OLK-5.10 0/6] Add support for l0
by Wupeng Ma 03 Jun '24

03 Jun '24

From: Ma Wupeng <mawupeng1(a)huawei.com> Add support for l3t & l0. Last Level Cache driver for platforms such Kunpeng 920. This provides interfaces to enable LLC cache lockdown. L0 driver for platforms such Kunpeng 920. This provides interfaces to for user to alloc and lock memory. Changelog since v1: - return -EINVAL if sccl_to_node_id return err. - code refactoring in hisi_lockdown.c Changelog since v2: - code cleanup in hisi_lockdown.c Changelog since v3: - adjusting the patch order - cleanup in l3t.c - rename get_page_policy_node to get_vma_policy_node - export symbol cpu_logical_map without GPL Changelog since v4: - fix UAF. Changelog since v5: - update patch title in get_vma_policy_node. Changelog since v6: - bugfix for l3t.c Changlog since v7: - update error msg in hisi_l0.c Ma Wupeng (6): export symbol alloc_contig_pages arm64: export cpu_logical_map mm/mempolicy: Add and export get_vma_policy_node hisi: l3t: Add L3 cache driver for hisi hisi: l0: Add support for l0 arm64: config: Enable hisi l3t & l0 by default arch/arm64/configs/openeuler_defconfig | 2 + arch/arm64/kernel/setup.c | 1 + drivers/soc/hisilicon/Kconfig | 18 ++ drivers/soc/hisilicon/Makefile | 3 + drivers/soc/hisilicon/hisi_l0.c | 171 ++++++++++++++++ drivers/soc/hisilicon/hisi_l3t.h | 45 +++++ drivers/soc/hisilicon/hisi_lockdown.c | 140 +++++++++++++ drivers/soc/hisilicon/l3t.c | 263 +++++++++++++++++++++++++ include/linux/mempolicy.h | 4 + mm/mempolicy.c | 23 +++ mm/page_alloc.c | 1 + 11 files changed, 671 insertions(+) create mode 100644 drivers/soc/hisilicon/hisi_l0.c create mode 100644 drivers/soc/hisilicon/hisi_l3t.h create mode 100644 drivers/soc/hisilicon/hisi_lockdown.c create mode 100644 drivers/soc/hisilicon/l3t.c -- 2.25.1

2 7

[PATCH openEuler-22.03-LTS-SP1]
by Luo Gengkun 03 Jun '24

03 Jun '24

mainline inclusion from mainline-v6.9 commit ee0166b637a5e376118e9659e5b4148080f1d27e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U7YV CVE: CVE-2024-36898 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If a line is requested with debounce, and that results in debouncing in software, and the line is subsequently reconfigured to enable edge detection then the allocation of the kfifo to contain edge events is overlooked. This results in events being written to and read from an uninitialised kfifo. Read events are returned to userspace. Initialise the kfifo in the case where the software debounce is already active. Fixes: 65cff7046406 ("gpiolib: cdev: support setting debounce") Signed-off-by: Kent Gibson <warthog618(a)gmail.com> Link: https://lore.kernel.org/r/20240510065342.36191-1-warthog618@gmail.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Conflicts: drivers/gpio/gpiolib-cdev.c [fix context conflicts] Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/gpio/gpiolib-cdev.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c index 381cfa26a4a1..0f98a07efcd6 100644 --- a/drivers/gpio/gpiolib-cdev.c +++ b/drivers/gpio/gpiolib-cdev.c @@ -816,6 +816,8 @@ static int edge_detector_update(struct line *line, unsigned int line_idx, u64 eflags, bool polarity_change) { + u64 errflags; + int ret; unsigned int debounce_period_us = gpio_v2_line_config_debounce_period(lc, line_idx); @@ -827,6 +829,18 @@ static int edge_detector_update(struct line *line, if (debounce_period_us && READ_ONCE(line->sw_debounced)) { line->eflags = eflags; WRITE_ONCE(line->desc->debounce_period_us, debounce_period_us); + /* + * ensure event fifo is initialised if edge detection + * is now enabled. + */ + errflags = eflags & GPIO_V2_LINE_EDGE_FLAGS; + if (errflags && !kfifo_initialized(&line->req->events)) { + ret = kfifo_alloc(&line->req->events, + line->req->event_buffer_size, + GFP_KERNEL); + if (ret) + return ret; + } return 0; } -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS] SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
by Liu Jian 03 Jun '24

03 Jun '24

From: felix <fuzhen5(a)huawei.com> mainline inclusion from mainline-v6.7-rc1 commit bfca5fb4e97c46503ddfc582335917b0cc228264 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RFGY CVE: CVE-2023-52803 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- RPC client pipefs dentries cleanup is in separated rpc_remove_pipedir() workqueue,which takes care about pipefs superblock locking. In some special scenarios, when kernel frees the pipefs sb of the current client and immediately alloctes a new pipefs sb, rpc_remove_pipedir function would misjudge the existence of pipefs sb which is not the one it used to hold. As a result, the rpc_remove_pipedir would clean the released freed pipefs dentries. To fix this issue, rpc_remove_pipedir should check whether the current pipefs sb is consistent with the original pipefs sb. This error can be catched by KASAN: ========================================================= [ 250.497700] BUG: KASAN: slab-use-after-free in dget_parent+0x195/0x200 [ 250.498315] Read of size 4 at addr ffff88800a2ab804 by task kworker/0:18/106503 [ 250.500549] Workqueue: events rpc_free_client_work [ 250.501001] Call Trace: [ 250.502880] kasan_report+0xb6/0xf0 [ 250.503209] ? dget_parent+0x195/0x200 [ 250.503561] dget_parent+0x195/0x200 [ 250.503897] ? __pfx_rpc_clntdir_depopulate+0x10/0x10 [ 250.504384] rpc_rmdir_depopulate+0x1b/0x90 [ 250.504781] rpc_remove_client_dir+0xf5/0x150 [ 250.505195] rpc_free_client_work+0xe4/0x230 [ 250.505598] process_one_work+0x8ee/0x13b0 ... [ 22.039056] Allocated by task 244: [ 22.039390] kasan_save_stack+0x22/0x50 [ 22.039758] kasan_set_track+0x25/0x30 [ 22.040109] __kasan_slab_alloc+0x59/0x70 [ 22.040487] kmem_cache_alloc_lru+0xf0/0x240 [ 22.040889] __d_alloc+0x31/0x8e0 [ 22.041207] d_alloc+0x44/0x1f0 [ 22.041514] __rpc_lookup_create_exclusive+0x11c/0x140 [ 22.041987] rpc_mkdir_populate.constprop.0+0x5f/0x110 [ 22.042459] rpc_create_client_dir+0x34/0x150 [ 22.042874] rpc_setup_pipedir_sb+0x102/0x1c0 [ 22.043284] rpc_client_register+0x136/0x4e0 [ 22.043689] rpc_new_client+0x911/0x1020 [ 22.044057] rpc_create_xprt+0xcb/0x370 [ 22.044417] rpc_create+0x36b/0x6c0 ... [ 22.049524] Freed by task 0: [ 22.049803] kasan_save_stack+0x22/0x50 [ 22.050165] kasan_set_track+0x25/0x30 [ 22.050520] kasan_save_free_info+0x2b/0x50 [ 22.050921] __kasan_slab_free+0x10e/0x1a0 [ 22.051306] kmem_cache_free+0xa5/0x390 [ 22.051667] rcu_core+0x62c/0x1930 [ 22.051995] __do_softirq+0x165/0x52a [ 22.052347] [ 22.052503] Last potentially related work creation: [ 22.052952] kasan_save_stack+0x22/0x50 [ 22.053313] __kasan_record_aux_stack+0x8e/0xa0 [ 22.053739] __call_rcu_common.constprop.0+0x6b/0x8b0 [ 22.054209] dentry_free+0xb2/0x140 [ 22.054540] __dentry_kill+0x3be/0x540 [ 22.054900] shrink_dentry_list+0x199/0x510 [ 22.055293] shrink_dcache_parent+0x190/0x240 [ 22.055703] do_one_tree+0x11/0x40 [ 22.056028] shrink_dcache_for_umount+0x61/0x140 [ 22.056461] generic_shutdown_super+0x70/0x590 [ 22.056879] kill_anon_super+0x3a/0x60 [ 22.057234] rpc_kill_sb+0x121/0x200 Fixes: 0157d021d23a ("SUNRPC: handle RPC client pipefs dentries by network namespace aware routines") Signed-off-by: felix <fuzhen5(a)huawei.com> Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Conflicts: include/linux/sunrpc/clnt.h [The conflict mainly lies in struct rpc_clnt.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- include/linux/sunrpc/clnt.h | 1 + net/sunrpc/clnt.c | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/include/linux/sunrpc/clnt.h b/include/linux/sunrpc/clnt.h index 8aa865bce4f6..5803a6891b30 100644 --- a/include/linux/sunrpc/clnt.h +++ b/include/linux/sunrpc/clnt.h @@ -70,6 +70,7 @@ struct rpc_clnt { struct dentry *cl_debugfs; /* debugfs directory */ #endif struct rpc_xprt_iter cl_xpi; + struct super_block *pipefs_sb; }; /* diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c index 0fc540b0d183..1b224caf9a70 100644 --- a/net/sunrpc/clnt.c +++ b/net/sunrpc/clnt.c @@ -113,7 +113,8 @@ static void rpc_clnt_remove_pipedir(struct rpc_clnt *clnt) pipefs_sb = rpc_get_sb_net(net); if (pipefs_sb) { - __rpc_clnt_remove_pipedir(clnt); + if (pipefs_sb == clnt->pipefs_sb) + __rpc_clnt_remove_pipedir(clnt); rpc_put_sb_net(net); } } @@ -153,6 +154,8 @@ rpc_setup_pipedir(struct super_block *pipefs_sb, struct rpc_clnt *clnt) { struct dentry *dentry; + clnt->pipefs_sb = pipefs_sb; + if (clnt->cl_program->pipe_dir_name != NULL) { dentry = rpc_setup_pipedir_sb(pipefs_sb, clnt); if (IS_ERR(dentry)) -- 2.34.1

2 1

[PATCH v7 OLK-5.10 0/6] Add support for l0
by Wupeng Ma 03 Jun '24

03 Jun '24

From: Ma Wupeng <mawupeng1(a)huawei.com> Add support for l3t & l0. Last Level Cache driver for platforms such Kunpeng 920. This provides interfaces to enable LLC cache lockdown. L0 driver for platforms such Kunpeng 920. This provides interfaces to for user to alloc and lock memory. Changelog since v1: - return -EINVAL if sccl_to_node_id return err. - code refactoring in hisi_lockdown.c Changelog since v2: - code cleanup in hisi_lockdown.c Changelog since v3: - adjusting the patch order - cleanup in l3t.c - rename get_page_policy_node to get_vma_policy_node - export symbol cpu_logical_map without GPL Changelog since v4: - fix UAF. Changelog since v5: - update patch title in get_vma_policy_node. Changelog since v6: - bugfix for l3t.c Ma Wupeng (6): export symbol alloc_contig_pages arm64: export cpu_logical_map mm/mempolicy: Add and export get_vma_policy_node hisi: l3t: Add L3 cache driver for hisi hisi: l0: Add support for l0 arm64: config: Enable hisi l3t & l0 by default arch/arm64/configs/openeuler_defconfig | 2 + arch/arm64/kernel/setup.c | 1 + drivers/soc/hisilicon/Kconfig | 18 ++ drivers/soc/hisilicon/Makefile | 3 + drivers/soc/hisilicon/hisi_l0.c | 171 ++++++++++++++++ drivers/soc/hisilicon/hisi_l3t.h | 45 +++++ drivers/soc/hisilicon/hisi_lockdown.c | 140 +++++++++++++ drivers/soc/hisilicon/l3t.c | 263 +++++++++++++++++++++++++ include/linux/mempolicy.h | 4 + mm/mempolicy.c | 23 +++ mm/page_alloc.c | 1 + 11 files changed, 671 insertions(+) create mode 100644 drivers/soc/hisilicon/hisi_l0.c create mode 100644 drivers/soc/hisilicon/hisi_l3t.h create mode 100644 drivers/soc/hisilicon/hisi_lockdown.c create mode 100644 drivers/soc/hisilicon/l3t.c -- 2.25.1

2 7

[PATCH OLK-5.10 V4 0/5] Fix CVE-2023-52732.
by Zizhi Wo 03 Jun '24

03 Jun '24

V4: Fix wrong adaptation in ceph_mdsc_sync(). V3: Fix wrong adaptation in remove_session_caps_cb(). V2: Modify conflicting files in the commit message. V1: Fix main error. Jeff Layton (4): ceph: drop private list from remove_session_caps_cb ceph: fix auth cap handling logic in remove_session_caps_cb ceph: refactor remove_session_caps_cb ceph: shut down access to inode when async create fails Xiubo Li (1): ceph: blocklist the kclient when receiving corrupted snap trace fs/ceph/addr.c | 24 ++++-- fs/ceph/caps.c | 138 +++++++++++++++++++++++++++++++-- fs/ceph/export.c | 12 ++- fs/ceph/file.c | 13 +++- fs/ceph/inode.c | 33 +++++++- fs/ceph/locks.c | 7 ++ fs/ceph/mds_client.c | 144 ++++++++--------------------------- fs/ceph/snap.c | 36 ++++++++- fs/ceph/super.h | 12 +++ include/linux/ceph/libceph.h | 1 + 10 files changed, 290 insertions(+), 130 deletions(-) -- 2.39.2

2 6

[PATCH openEuler-22.03-LTS-SP1] tty: vcc: Add check for kstrdup() in vcc_probe()
by Yi Yang 03 Jun '24

03 Jun '24

stable inclusion from stable-v5.10.202 commit 4ef41a7f33ffe1a335e7db7e1564ddc6afad47cc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RFK8 CVE: CVE-2023-52789 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d81ffb87aaa75f842cd7aa57091810353755b3e6 ] Add check for the return value of kstrdup() and return the error, if it fails in order to avoid NULL pointer dereference. Signed-off-by: Yi Yang <yiyang13(a)huawei.com> Reviewed-by: Jiri Slaby <jirislaby(a)kernel.org> Link: https://lore.kernel.org/r/20230904035220.48164-1-yiyang13@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: sanglipeng <sanglipeng1(a)jd.com> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/vcc.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/drivers/tty/vcc.c b/drivers/tty/vcc.c index 9ffd42e333b8..6b2d35ac6e3b 100644 --- a/drivers/tty/vcc.c +++ b/drivers/tty/vcc.c @@ -587,18 +587,22 @@ static int vcc_probe(struct vio_dev *vdev, const struct vio_device_id *id) return -ENOMEM; name = kstrdup(dev_name(&vdev->dev), GFP_KERNEL); + if (!name) { + rv = -ENOMEM; + goto free_port; + } rv = vio_driver_init(&port->vio, vdev, VDEV_CONSOLE_CON, vcc_versions, ARRAY_SIZE(vcc_versions), NULL, name); if (rv) - goto free_port; + goto free_name; port->vio.debug = vcc_dbg_vio; vcc_ldc_cfg.debug = vcc_dbg_ldc; rv = vio_ldc_alloc(&port->vio, &vcc_ldc_cfg, port); if (rv) - goto free_port; + goto free_name; spin_lock_init(&port->lock); @@ -632,6 +636,11 @@ static int vcc_probe(struct vio_dev *vdev, const struct vio_device_id *id) goto unreg_tty; } port->domain = kstrdup(domain, GFP_KERNEL); + if (!port->domain) { + rv = -ENOMEM; + goto unreg_tty; + } + mdesc_release(hp); @@ -661,8 +670,9 @@ static int vcc_probe(struct vio_dev *vdev, const struct vio_device_id *id) vcc_table_remove(port->index); free_ldc: vio_ldc_free(&port->vio); -free_port: +free_name: kfree(name); +free_port: kfree(port); return rv; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
by Wang Zhaolong 03 Jun '24

03 Jun '24

From: Paulo Alcantara <pc(a)manguebit.com> mainline inclusion from mainline-v6.7-rc1 commit d328c09ee9f15ee5a26431f5aad7c9239fa85e62 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4LM CVE: CVE-2023-52752 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Skip SMB sessions that are being teared down (e.g. @ses->ses_status == SES_EXITING) in cifs_debug_data_proc_show() to avoid use-after-free in @ses. This fixes the following GPF when reading from /proc/fs/cifs/DebugData while mounting and umounting [ 816.251274] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6d81: 0000 [#1] PREEMPT SMP NOPTI ... [ 816.260138] Call Trace: [ 816.260329] <TASK> [ 816.260499] ? die_addr+0x36/0x90 [ 816.260762] ? exc_general_protection+0x1b3/0x410 [ 816.261126] ? asm_exc_general_protection+0x26/0x30 [ 816.261502] ? cifs_debug_tcon+0xbd/0x240 [cifs] [ 816.261878] ? cifs_debug_tcon+0xab/0x240 [cifs] [ 816.262249] cifs_debug_data_proc_show+0x516/0xdb0 [cifs] [ 816.262689] ? seq_read_iter+0x379/0x470 [ 816.262995] seq_read_iter+0x118/0x470 [ 816.263291] proc_reg_read_iter+0x53/0x90 [ 816.263596] ? srso_alias_return_thunk+0x5/0x7f [ 816.263945] vfs_read+0x201/0x350 [ 816.264211] ksys_read+0x75/0x100 [ 816.264472] do_syscall_64+0x3f/0x90 [ 816.264750] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 [ 816.265135] RIP: 0033:0x7fd5e669d381 Cc: stable(a)vger.kernel.org Signed-off-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/client/cifs_debug.c fs/cifs/cifs_debug.c [Path is changed and related functions has been refactored for a long time] Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/cifs/cifs_debug.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c index a85aeff90df8..2595a528be97 100644 --- a/fs/cifs/cifs_debug.c +++ b/fs/cifs/cifs_debug.c @@ -287,6 +287,8 @@ static int cifs_debug_data_proc_show(struct seq_file *m, void *v) list_for_each(tmp2, &server->smb_ses_list) { ses = list_entry(tmp2, struct cifs_ses, smb_ses_list); + if (ses->status == CifsExiting) + continue; if ((ses->serverDomain == NULL) || (ses->serverOS == NULL) || (ses->serverNOS == NULL)) { -- 2.34.3

2 1

[PATCH openEuler-1.0-LTS] isofs: Fix out of bound access for corrupted isofs image
by Guo Mengqi 03 Jun '24

03 Jun '24

From: Jan Kara <jack(a)suse.cz> stable inclusion from stable-v4.19.217 commit b0ddff8d68f2e43857a84dce54c3deab181c8ae1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RD2M CVE: CVE-2021-47478 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e96a1866b40570b5950cda8602c2819189c62a48 upstream. When isofs image is suitably corrupted isofs_read_inode() can read data beyond the end of buffer. Sanity-check the directory entry length before using it. Reported-and-tested-by: syzbot+6fc7fb214625d82af7d1(a)syzkaller.appspotmail.com CC: stable(a)vger.kernel.org Signed-off-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- fs/isofs/inode.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c index 488a9e7f8f66..f77a7f19b0db 100644 --- a/fs/isofs/inode.c +++ b/fs/isofs/inode.c @@ -1327,6 +1327,8 @@ static int isofs_read_inode(struct inode *inode, int relocated) de = (struct iso_directory_record *) (bh->b_data + offset); de_len = *(unsigned char *) de; + if (de_len < sizeof(struct iso_directory_record)) + goto fail; if (offset + de_len > bufsize) { int frag1 = bufsize - offset; -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS] smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
by Wang Zhaolong 03 Jun '24

03 Jun '24

From: Paulo Alcantara <pc(a)manguebit.com> mainline inclusion from mainline-v6.7-rc1 commit d328c09ee9f15ee5a26431f5aad7c9239fa85e62 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4LM CVE: CVE-2023-52752 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Skip SMB sessions that are being teared down (e.g. @ses->ses_status == SES_EXITING) in cifs_debug_data_proc_show() to avoid use-after-free in @ses. This fixes the following GPF when reading from /proc/fs/cifs/DebugData while mounting and umounting [ 816.251274] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6d81: 0000 [#1] PREEMPT SMP NOPTI ... [ 816.260138] Call Trace: [ 816.260329] <TASK> [ 816.260499] ? die_addr+0x36/0x90 [ 816.260762] ? exc_general_protection+0x1b3/0x410 [ 816.261126] ? asm_exc_general_protection+0x26/0x30 [ 816.261502] ? cifs_debug_tcon+0xbd/0x240 [cifs] [ 816.261878] ? cifs_debug_tcon+0xab/0x240 [cifs] [ 816.262249] cifs_debug_data_proc_show+0x516/0xdb0 [cifs] [ 816.262689] ? seq_read_iter+0x379/0x470 [ 816.262995] seq_read_iter+0x118/0x470 [ 816.263291] proc_reg_read_iter+0x53/0x90 [ 816.263596] ? srso_alias_return_thunk+0x5/0x7f [ 816.263945] vfs_read+0x201/0x350 [ 816.264211] ksys_read+0x75/0x100 [ 816.264472] do_syscall_64+0x3f/0x90 [ 816.264750] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 [ 816.265135] RIP: 0033:0x7fd5e669d381 Cc: stable(a)vger.kernel.org Signed-off-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/client/cifs_debug.c fs/cifs/cifs_debug.c [Path is changed and related functions has been refactored for a long time] Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/cifs/cifs_debug.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c index a85aeff90df8..2595a528be97 100644 --- a/fs/cifs/cifs_debug.c +++ b/fs/cifs/cifs_debug.c @@ -287,6 +287,8 @@ static int cifs_debug_data_proc_show(struct seq_file *m, void *v) list_for_each(tmp2, &server->smb_ses_list) { ses = list_entry(tmp2, struct cifs_ses, smb_ses_list); + if (ses->status == CifsExiting) + continue; if ((ses->serverDomain == NULL) || (ses->serverOS == NULL) || (ses->serverNOS == NULL)) { -- 2.34.3

2 1

[PATCH OLK-5.10] mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq
by Xiang Yang 03 Jun '24

03 Jun '24

From: Duoming Zhou <duoming(a)zju.edu.cn> mainline inclusion from mainline-v6.1-rc1 commit 175302f6b79ebbb207c2d58d6d3e679465de23b0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9UNYW CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The function hfcpci_softirq() is a timer handler. If it is running, the timer_pending() will return 0 and the del_timer_sync() in HFC_cleanup() will not be executed. As a result, the use-after-free bug will happen. The process is shown below: (cleanup routine) | (timer handler) HFC_cleanup() | hfcpci_softirq() if (timer_pending(&hfc_tl)) | del_timer_sync() | ... | ... pci_unregister_driver(hc) | driver_unregister | driver_for_each_device bus_remove_driver | _hfcpci_softirq driver_detach | ... put_device(dev) //[1]FREE | | dev_get_drvdata(dev) //[2]USE The device is deallocated is position [1] and used in position [2]. Fix by removing the "timer_pending" check in HFC_cleanup(), which makes sure that the hfcpci_softirq() have finished before the resource is deallocated. Fixes: 009fc857c5f6 ("mISDN: fix possible use-after-free in HFC_cleanup()") Signed-off-by: Duoming Zhou <duoming(a)zju.edu.cn> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- drivers/isdn/hardware/mISDN/hfcpci.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/isdn/hardware/mISDN/hfcpci.c b/drivers/isdn/hardware/mISDN/hfcpci.c index d6cf01c32a33..fe391de1aba3 100644 --- a/drivers/isdn/hardware/mISDN/hfcpci.c +++ b/drivers/isdn/hardware/mISDN/hfcpci.c @@ -2350,8 +2350,7 @@ HFC_init(void) static void __exit HFC_cleanup(void) { - if (timer_pending(&hfc_tl)) - del_timer_sync(&hfc_tl); + del_timer_sync(&hfc_tl); pci_unregister_driver(&hfc_driver); } -- 2.34.1

2 1

[PATCH OLK-5.10 v2] iomap: Ensure sub-page dirty state is set during mmap writes
by Long Li 03 Jun '24

03 Jun '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9UNQS CVE: NA ------------------------------------------ While running xfstests, specifically test xfs/032, the following errors were reported: XFS (sdb): ino 4a data fork has delalloc extent at [0x3c:0x10] XFS: Assertion failed: 0, file: fs/xfs/xfs_icache.c, line: 1854 The issue stems from the dirty state of sub-pages not being set during mmap writes. This behavior was observed after the introduction of the commit 99e9a55ba32b ("iomap: add support to track dirty state of sub-pages"), which enabled iomap to track the dirty state of sub-pages when the block size is smaller than the page size. Currently, iomap updates the sub-page dirty state only in `__iomap_write_end()`. However, the mmap write path does not invoke this function, resulting in dirty pages created by mmap writes not being scheduled for write-back. This patch fixes the issue by ensuring that the sub-page dirty state is set during mmap writes. Fixes: 99e9a55ba32b ("iomap: add support to track dirty state of sub pages") Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/iomap/buffered-io.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c index 25448d5827d2..569296ad9215 100644 --- a/fs/iomap/buffered-io.c +++ b/fs/iomap/buffered-io.c @@ -158,9 +158,6 @@ iomap_set_range_dirty(struct page *page, unsigned int off, unsigned int len) if (PageError(page)) return; - if (len) - iomap_set_page_dirty(page); - if (!page_has_private(page)) return; @@ -757,6 +754,7 @@ static size_t __iomap_write_end(struct inode *inode, loff_t pos, size_t len, if (unlikely(copied < len && !PageUptodate(page))) return 0; iomap_set_range_uptodate(page, offset_in_page(pos), len); + iomap_set_page_dirty(page); iomap_set_range_dirty(page, offset_in_page(pos), len); return copied; } @@ -1074,6 +1072,7 @@ iomap_page_mkwrite_actor(struct inode *inode, loff_t pos, loff_t length, } else { WARN_ON_ONCE(!PageUptodate(page)); set_page_dirty(page); + iomap_set_range_dirty(page, offset_in_page(pos), length); } return length; -- 2.31.1

2 1

[PATCH v6 OLK-5.10 0/6] Add support for l0
by Wupeng Ma 03 Jun '24

03 Jun '24

From: Ma Wupeng <mawupeng1(a)huawei.com> Add support for l3t & l0. Last Level Cache driver for platforms such Kunpeng 920. This provides interfaces to enable LLC cache lockdown. L0 driver for platforms such Kunpeng 920. This provides interfaces to for user to alloc and lock memory. Changelog since v1: - return -EINVAL if sccl_to_node_id return err. - code refactoring in hisi_lockdown.c Changelog since v2: - code cleanup in hisi_lockdown.c Changelog since v3: - adjusting the patch order - cleanup in l3t.c - rename get_page_policy_node to get_vma_policy_node - export symbol cpu_logical_map without GPL Changelog since v4: - fix UAF. Changelog since v5: - update patch title in get_vma_policy_node. Ma Wupeng (6): export symbol alloc_contig_pages arm64: export cpu_logical_map mm/mempolicy: Add and export get_vma_policy_node hisi: l3t: Add L3 cache driver for hisi hisi: l0: Add support for l0 arm64: config: Enable hisi l3t & l0 by default arch/arm64/configs/openeuler_defconfig | 2 + arch/arm64/kernel/setup.c | 1 + drivers/soc/hisilicon/Kconfig | 18 ++ drivers/soc/hisilicon/Makefile | 3 + drivers/soc/hisilicon/hisi_l0.c | 173 ++++++++++++++++ drivers/soc/hisilicon/hisi_l3t.h | 45 +++++ drivers/soc/hisilicon/hisi_lockdown.c | 140 +++++++++++++ drivers/soc/hisilicon/l3t.c | 263 +++++++++++++++++++++++++ include/linux/mempolicy.h | 4 + mm/mempolicy.c | 23 +++ mm/page_alloc.c | 1 + 11 files changed, 673 insertions(+) create mode 100644 drivers/soc/hisilicon/hisi_l0.c create mode 100644 drivers/soc/hisilicon/hisi_l3t.h create mode 100644 drivers/soc/hisilicon/hisi_lockdown.c create mode 100644 drivers/soc/hisilicon/l3t.c -- 2.25.1

2 7

[PATCH openEuler-1.0-LTS 0/2] CVE-2021-47409
by Wenyu Huang 03 Jun '24

03 Jun '24

Miaoqian Lin (1): usb: dwc2: Fix memory leak in dwc2_hcd_init Yang Yingliang (1): usb: dwc2: check return value after calling platform_get_resource() drivers/usb/dwc2/hcd.c | 4 ++++ 1 file changed, 4 insertions(+) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS v2 0/2] *** CVE-2021-47356 ***
by Xiang Yang 03 Jun '24

03 Jun '24

Duoming Zhou (1): mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq Zou Wei (1): mISDN: fix possible use-after-free in HFC_cleanup() drivers/isdn/hardware/mISDN/hfcpci.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1] net: ena: Fix incorrect descriptor free behavior
by Li Huafei 03 Jun '24

03 Jun '24

From: David Arinzon <darinzon(a)amazon.com> stable inclusion from stable-v5.10.216 commit b26aa765f7437e1bbe8db4c1641b12bd5dd378f0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRO8 CVE: CVE-2024-35958 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit bf02d9fe00632d22fa91d34749c7aacf397b6cde ] ENA has two types of TX queues: - queues which only process TX packets arriving from the network stack - queues which only process TX packets forwarded to it by XDP_REDIRECT or XDP_TX instructions The ena_free_tx_bufs() cycles through all descriptors in a TX queue and unmaps + frees every descriptor that hasn't been acknowledged yet by the device (uncompleted TX transactions). The function assumes that the processed TX queue is necessarily from the first category listed above and ends up using napi_consume_skb() for descriptors belonging to an XDP specific queue. This patch solves a bug in which, in case of a VF reset, the descriptors aren't freed correctly, leading to crashes. Fixes: 548c4940b9f1 ("net: ena: Implement XDP_TX action") Signed-off-by: Shay Agroskin <shayagr(a)amazon.com> Signed-off-by: David Arinzon <darinzon(a)amazon.com> Reviewed-by: Shannon Nelson <shannon.nelson(a)amd.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/net/ethernet/amazon/ena/ena_netdev.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c index 52414ac2c901a..8b766c5c35c4c 100644 --- a/drivers/net/ethernet/amazon/ena/ena_netdev.c +++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c @@ -1104,8 +1104,11 @@ static void ena_unmap_tx_buff(struct ena_ring *tx_ring, static void ena_free_tx_bufs(struct ena_ring *tx_ring) { bool print_once = true; + bool is_xdp_ring; u32 i; + is_xdp_ring = ENA_IS_XDP_INDEX(tx_ring->adapter, tx_ring->qid); + for (i = 0; i < tx_ring->ring_size; i++) { struct ena_tx_buffer *tx_info = &tx_ring->tx_buffer_info[i]; @@ -1125,10 +1128,15 @@ static void ena_free_tx_bufs(struct ena_ring *tx_ring) ena_unmap_tx_buff(tx_ring, tx_info); - dev_kfree_skb_any(tx_info->skb); + if (is_xdp_ring) + xdp_return_frame(tx_info->xdpf); + else + dev_kfree_skb_any(tx_info->skb); } - netdev_tx_reset_queue(netdev_get_tx_queue(tx_ring->netdev, - tx_ring->qid)); + + if (!is_xdp_ring) + netdev_tx_reset_queue(netdev_get_tx_queue(tx_ring->netdev, + tx_ring->qid)); } static void ena_free_all_tx_bufs(struct ena_adapter *adapter) -- 2.25.1

2 1

[PATCH OLK-5.10] net: ena: Fix incorrect descriptor free behavior
by Li Huafei 03 Jun '24

03 Jun '24

From: David Arinzon <darinzon(a)amazon.com> stable inclusion from stable-v5.10.216 commit b26aa765f7437e1bbe8db4c1641b12bd5dd378f0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRO8 CVE: CVE-2024-35958 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit bf02d9fe00632d22fa91d34749c7aacf397b6cde ] ENA has two types of TX queues: - queues which only process TX packets arriving from the network stack - queues which only process TX packets forwarded to it by XDP_REDIRECT or XDP_TX instructions The ena_free_tx_bufs() cycles through all descriptors in a TX queue and unmaps + frees every descriptor that hasn't been acknowledged yet by the device (uncompleted TX transactions). The function assumes that the processed TX queue is necessarily from the first category listed above and ends up using napi_consume_skb() for descriptors belonging to an XDP specific queue. This patch solves a bug in which, in case of a VF reset, the descriptors aren't freed correctly, leading to crashes. Fixes: 548c4940b9f1 ("net: ena: Implement XDP_TX action") Signed-off-by: Shay Agroskin <shayagr(a)amazon.com> Signed-off-by: David Arinzon <darinzon(a)amazon.com> Reviewed-by: Shannon Nelson <shannon.nelson(a)amd.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/net/ethernet/amazon/ena/ena_netdev.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c index e13ae04d2f0fd..fc81db75b19d0 100644 --- a/drivers/net/ethernet/amazon/ena/ena_netdev.c +++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c @@ -1105,8 +1105,11 @@ static void ena_unmap_tx_buff(struct ena_ring *tx_ring, static void ena_free_tx_bufs(struct ena_ring *tx_ring) { bool print_once = true; + bool is_xdp_ring; u32 i; + is_xdp_ring = ENA_IS_XDP_INDEX(tx_ring->adapter, tx_ring->qid); + for (i = 0; i < tx_ring->ring_size; i++) { struct ena_tx_buffer *tx_info = &tx_ring->tx_buffer_info[i]; @@ -1126,10 +1129,15 @@ static void ena_free_tx_bufs(struct ena_ring *tx_ring) ena_unmap_tx_buff(tx_ring, tx_info); - dev_kfree_skb_any(tx_info->skb); + if (is_xdp_ring) + xdp_return_frame(tx_info->xdpf); + else + dev_kfree_skb_any(tx_info->skb); } - netdev_tx_reset_queue(netdev_get_tx_queue(tx_ring->netdev, - tx_ring->qid)); + + if (!is_xdp_ring) + netdev_tx_reset_queue(netdev_get_tx_queue(tx_ring->netdev, + tx_ring->qid)); } static void ena_free_all_tx_bufs(struct ena_adapter *adapter) -- 2.25.1

2 1

[PATCH OLK-5.10] iomap: Ensure sub-page dirty state is set during mmap writes
by Long Li 03 Jun '24

03 Jun '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9UNQS CVE: NA ------------------------------------------ While running xfstests, specifically test xfs/032, the following errors were reported: XFS (sdb): ino 4a data fork has delalloc extent at [0x3c:0x10] XFS: Assertion failed: 0, file: fs/xfs/xfs_icache.c, line: 1854 The issue stems from the dirty state of sub-pages not being set during mmap writes. This behavior was observed after the introduction of the commit 99e9a55ba32b ("iomap: add support to track dirty state of sub-pages"), which enabled iomap to track the dirty state of sub-pages when the block size is smaller than the page size. Currently, iomap updates the sub-page dirty state only in `__iomap_write_end()`. However, the mmap write path does not invoke this function, resulting in dirty pages created by mmap writes not being scheduled for write-back. This patch fixes the issue by ensuring that the sub-page dirty state is set during mmap writes. Fixes: 99e9a55ba32b ("iomap: add support to track dirty state of sub pages") Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/iomap/buffered-io.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c index 25448d5827d2..73524df884bb 100644 --- a/fs/iomap/buffered-io.c +++ b/fs/iomap/buffered-io.c @@ -1073,7 +1073,7 @@ iomap_page_mkwrite_actor(struct inode *inode, loff_t pos, loff_t length, block_commit_write(page, 0, length); } else { WARN_ON_ONCE(!PageUptodate(page)); - set_page_dirty(page); + iomap_set_range_dirty(page, offset_in_page(pos), length); } return length; -- 2.31.1

2 1

[PATCH v5 OLK-5.10 0/6] Add support for l0
by Wupeng Ma 03 Jun '24

03 Jun '24

From: Ma Wupeng <mawupeng1(a)huawei.com> Add support for l3t & l0. Last Level Cache driver for platforms such Kunpeng 920. This provides interfaces to enable LLC cache lockdown. L0 driver for platforms such Kunpeng 920. This provides interfaces to for user to alloc and lock memory. Changelog since v1: - return -EINVAL if sccl_to_node_id return err. - code refactoring in hisi_lockdown.c Changelog since v2: - code cleanup in hisi_lockdown.c Changelog since v3: - adjusting the patch order - cleanup in l3t.c - rename get_page_policy_node to get_vma_policy_node - export symbol cpu_logical_map without GPL Changelog since v4: - fix UAF. Ma Wupeng (6): export symbol alloc_contig_pages arm64: export cpu_logical_map mm/mempolicy: Add and export get_page_policy_node hisi: l3t: Add L3 cache driver for hisi hisi: l0: Add support for l0 arm64: config: Enable hisi l3t & l0 by default arch/arm64/configs/openeuler_defconfig | 2 + arch/arm64/kernel/setup.c | 1 + drivers/soc/hisilicon/Kconfig | 18 ++ drivers/soc/hisilicon/Makefile | 3 + drivers/soc/hisilicon/hisi_l0.c | 173 ++++++++++++++++ drivers/soc/hisilicon/hisi_l3t.h | 45 +++++ drivers/soc/hisilicon/hisi_lockdown.c | 140 +++++++++++++ drivers/soc/hisilicon/l3t.c | 263 +++++++++++++++++++++++++ include/linux/mempolicy.h | 4 + mm/mempolicy.c | 23 +++ mm/page_alloc.c | 1 + 11 files changed, 673 insertions(+) create mode 100644 drivers/soc/hisilicon/hisi_l0.c create mode 100644 drivers/soc/hisilicon/hisi_l3t.h create mode 100644 drivers/soc/hisilicon/hisi_lockdown.c create mode 100644 drivers/soc/hisilicon/l3t.c -- 2.25.1

2 7

[PATCH openEuler-1.0-LTS] usb: dwc2: check return value after calling platform_get_resource()
by Wenyu Huang 03 Jun '24

03 Jun '24

From: Yang Yingliang <yangyingliang(a)huawei.com> stable inclusion from stable-v4.19.315 commit a7182993dd8e09f96839ddc3ac54f9b37370d282 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4OY CVE: CVE-2021-47409 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 856e6e8e0f9300befa87dde09edb578555c99a82 ] It will cause null-ptr-deref if platform_get_resource() returns NULL, we need check the return value. Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Link: https://lore.kernel.org/r/20210831084236.1359677-1-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/usb/dwc2/hcd.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c index a5c8329fd462..de9b6a640def 100644 --- a/drivers/usb/dwc2/hcd.c +++ b/drivers/usb/dwc2/hcd.c @@ -5233,6 +5233,10 @@ int dwc2_hcd_init(struct dwc2_hsotg *hsotg) hcd->has_tt = 1; res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + if (!res) { + retval = -EINVAL; + goto error1; + } hcd->rsrc_start = res->start; hcd->rsrc_len = resource_size(res); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1
by Luo Gengkun 03 Jun '24

03 Jun '24

From: l00855224 <l00855224(a)notesmail.huawei.com/> mainline inclusion from mainline-v6.9 commit ee0166b637a5e376118e9659e5b4148080f1d27e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U7YV CVE: CVE-2024-36898 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If a line is requested with debounce, and that results in debouncing in software, and the line is subsequently reconfigured to enable edge detection then the allocation of the kfifo to contain edge events is overlooked. This results in events being written to and read from an uninitialised kfifo. Read events are returned to userspace. Initialise the kfifo in the case where the software debounce is already active. Fixes: 65cff7046406 ("gpiolib: cdev: support setting debounce") Signed-off-by: Kent Gibson <warthog618(a)gmail.com> Link: https://lore.kernel.org/r/20240510065342.36191-1-warthog618@gmail.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Conflicts: drivers/gpio/gpiolib-cdev.c [fix context conflicts] Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/gpio/gpiolib-cdev.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c index 381cfa26a4a1..0f98a07efcd6 100644 --- a/drivers/gpio/gpiolib-cdev.c +++ b/drivers/gpio/gpiolib-cdev.c @@ -816,6 +816,8 @@ static int edge_detector_update(struct line *line, unsigned int line_idx, u64 eflags, bool polarity_change) { + u64 errflags; + int ret; unsigned int debounce_period_us = gpio_v2_line_config_debounce_period(lc, line_idx); @@ -827,6 +829,18 @@ static int edge_detector_update(struct line *line, if (debounce_period_us && READ_ONCE(line->sw_debounced)) { line->eflags = eflags; WRITE_ONCE(line->desc->debounce_period_us, debounce_period_us); + /* + * ensure event fifo is initialised if edge detection + * is now enabled. + */ + errflags = eflags & GPIO_V2_LINE_EDGE_FLAGS; + if (errflags && !kfifo_initialized(&line->req->events)) { + ret = kfifo_alloc(&line->req->events, + line->req->event_buffer_size, + GFP_KERNEL); + if (ret) + return ret; + } return 0; } -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS] smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
by Wang Zhaolong 03 Jun '24

03 Jun '24

From: Paulo Alcantara <pc(a)manguebit.com> mainline inclusion from mainline-v6.7-rc1 commit d328c09ee9f15ee5a26431f5aad7c9239fa85e62 category: bugfix bugzilla: 190029 CVE: CVE-2023-52752 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Skip SMB sessions that are being teared down (e.g. @ses->ses_status == SES_EXITING) in cifs_debug_data_proc_show() to avoid use-after-free in @ses. This fixes the following GPF when reading from /proc/fs/cifs/DebugData while mounting and umounting [ 816.251274] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6d81: 0000 [#1] PREEMPT SMP NOPTI ... [ 816.260138] Call Trace: [ 816.260329] <TASK> [ 816.260499] ? die_addr+0x36/0x90 [ 816.260762] ? exc_general_protection+0x1b3/0x410 [ 816.261126] ? asm_exc_general_protection+0x26/0x30 [ 816.261502] ? cifs_debug_tcon+0xbd/0x240 [cifs] [ 816.261878] ? cifs_debug_tcon+0xab/0x240 [cifs] [ 816.262249] cifs_debug_data_proc_show+0x516/0xdb0 [cifs] [ 816.262689] ? seq_read_iter+0x379/0x470 [ 816.262995] seq_read_iter+0x118/0x470 [ 816.263291] proc_reg_read_iter+0x53/0x90 [ 816.263596] ? srso_alias_return_thunk+0x5/0x7f [ 816.263945] vfs_read+0x201/0x350 [ 816.264211] ksys_read+0x75/0x100 [ 816.264472] do_syscall_64+0x3f/0x90 [ 816.264750] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 [ 816.265135] RIP: 0033:0x7fd5e669d381 Cc: stable(a)vger.kernel.org Signed-off-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/client/cifs_debug.c fs/cifs/cifs_debug.c [Path is changed and related functions has been refactored for a long time] Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/cifs/cifs_debug.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c index a85aeff90df8..2595a528be97 100644 --- a/fs/cifs/cifs_debug.c +++ b/fs/cifs/cifs_debug.c @@ -287,6 +287,8 @@ static int cifs_debug_data_proc_show(struct seq_file *m, void *v) list_for_each(tmp2, &server->smb_ses_list) { ses = list_entry(tmp2, struct cifs_ses, smb_ses_list); + if (ses->status == CifsExiting) + continue; if ((ses->serverDomain == NULL) || (ses->serverOS == NULL) || (ses->serverNOS == NULL)) { -- 2.34.3

2 1

[PATCH openEuler-1.0-LTS] memory: fsl_ifc: fix leak of private memory on probe failure
by Tong Tiangen 03 Jun '24

03 Jun '24

From: Krzysztof Kozlowski <krzysztof.kozlowski(a)canonical.com> stable inclusion from stable-v4.19.198 commit ee1aa737ba0b75ab8af3444c4ae5bdba36aed6e6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RL3N CVE: CVE-2021-47314 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8e0d09b1232d0538066c40ed4c13086faccbdff6 ] On probe error the driver should free the memory allocated for private structure. Fix this by using resource-managed allocation. Fixes: a20cbdeffce2 ("powerpc/fsl: Add support for Integrated Flash Controller") Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)canonical.com> Link: https://lore.kernel.org/r/20210527154322.81253-2-krzysztof.kozlowski@canoni… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- drivers/memory/fsl_ifc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/memory/fsl_ifc.c b/drivers/memory/fsl_ifc.c index 1b182b117f9c..1272e8886a42 100644 --- a/drivers/memory/fsl_ifc.c +++ b/drivers/memory/fsl_ifc.c @@ -109,7 +109,6 @@ static int fsl_ifc_ctrl_remove(struct platform_device *dev) iounmap(ctrl->gregs); dev_set_drvdata(&dev->dev, NULL); - kfree(ctrl); return 0; } @@ -221,7 +220,8 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev) dev_info(&dev->dev, "Freescale Integrated Flash Controller\n"); - fsl_ifc_ctrl_dev = kzalloc(sizeof(*fsl_ifc_ctrl_dev), GFP_KERNEL); + fsl_ifc_ctrl_dev = devm_kzalloc(&dev->dev, sizeof(*fsl_ifc_ctrl_dev), + GFP_KERNEL); if (!fsl_ifc_ctrl_dev) return -ENOMEM; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] tty: vcc: Add check for kstrdup() in vcc_probe()
by Yi Yang 03 Jun '24

03 Jun '24

stable inclusion from stable-v4.19.300 commit 909963e0c16778cec28efb1affc21558825f4200 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RFK8 CVE: CVE-2023-52789 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d81ffb87aaa75f842cd7aa57091810353755b3e6 ] Add check for the return value of kstrdup() and return the error, if it fails in order to avoid NULL pointer dereference. Signed-off-by: Yi Yang <yiyang13(a)huawei.com> Reviewed-by: Jiri Slaby <jirislaby(a)kernel.org> Link: https://lore.kernel.org/r/20230904035220.48164-1-yiyang13@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/vcc.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/drivers/tty/vcc.c b/drivers/tty/vcc.c index 58b454c34560..73dae8902216 100644 --- a/drivers/tty/vcc.c +++ b/drivers/tty/vcc.c @@ -586,18 +586,22 @@ static int vcc_probe(struct vio_dev *vdev, const struct vio_device_id *id) return -ENOMEM; name = kstrdup(dev_name(&vdev->dev), GFP_KERNEL); + if (!name) { + rv = -ENOMEM; + goto free_port; + } rv = vio_driver_init(&port->vio, vdev, VDEV_CONSOLE_CON, vcc_versions, ARRAY_SIZE(vcc_versions), NULL, name); if (rv) - goto free_port; + goto free_name; port->vio.debug = vcc_dbg_vio; vcc_ldc_cfg.debug = vcc_dbg_ldc; rv = vio_ldc_alloc(&port->vio, &vcc_ldc_cfg, port); if (rv) - goto free_port; + goto free_name; spin_lock_init(&port->lock); @@ -630,6 +634,11 @@ static int vcc_probe(struct vio_dev *vdev, const struct vio_device_id *id) goto unreg_tty; } port->domain = kstrdup(domain, GFP_KERNEL); + if (!port->domain) { + rv = -ENOMEM; + goto unreg_tty; + } + mdesc_release(hp); @@ -659,8 +668,9 @@ static int vcc_probe(struct vio_dev *vdev, const struct vio_device_id *id) vcc_table_remove(port->index); free_ldc: vio_ldc_free(&port->vio); -free_port: +free_name: kfree(name); +free_port: kfree(port); return rv; -- 2.25.1

2 1

[PATCH OLK-5.10] mISDN: fix possible use-after-free in HFC_cleanup()
by Xiang Yang 03 Jun '24

03 Jun '24

From: Zou Wei <zou_wei(a)huawei.com> stable inclusion from stable-v4.19.198 commit 5f2818185da0fe82a932f0856633038b66faf124 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4CC CVE: CVE-2021-47356 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 009fc857c5f6fda81f2f7dd851b2d54193a8e733 ] This module's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling del_timer_sync(), which makes sure the timer handler has finished, and unable to re-schedule itself. Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Zou Wei <zou_wei(a)huawei.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- drivers/isdn/hardware/mISDN/hfcpci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/isdn/hardware/mISDN/hfcpci.c b/drivers/isdn/hardware/mISDN/hfcpci.c index ebb3fa2e1d00..53349850f866 100644 --- a/drivers/isdn/hardware/mISDN/hfcpci.c +++ b/drivers/isdn/hardware/mISDN/hfcpci.c @@ -2348,7 +2348,7 @@ static void __exit HFC_cleanup(void) { if (timer_pending(&hfc_tl)) - del_timer(&hfc_tl); + del_timer_sync(&hfc_tl); pci_unregister_driver(&hfc_driver); } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2024-36015
by Chen Ridong 03 Jun '24

03 Jun '24

*** BLURB HERE *** Christophe JAILLET (1): ppdev: Remove usage of the deprecated ida_simple_xx() API Huai-Yuan Liu (1): ppdev: Add an error check in register_device drivers/char/ppdev.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE: CVE-2024-36015
by Chen Ridong 03 Jun '24

03 Jun '24

*** BLURB HERE *** Christophe JAILLET (1): ppdev: Remove usage of the deprecated ida_simple_xx() API Huai-Yuan Liu (1): ppdev: Add an error check in register_device drivers/char/ppdev.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] CVE: CVE-2024-36015
by Chen Ridong 03 Jun '24

03 Jun '24

*** BLURB HERE *** Christophe JAILLET (1): ppdev: Remove usage of the deprecated ida_simple_xx() API Huai-Yuan Liu (1): ppdev: Add an error check in register_device drivers/char/ppdev.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/1] CVE: CVE-2024-36015
by Chen Ridong 03 Jun '24

03 Jun '24

*** BLURB HERE *** Huai-Yuan Liu (1): ppdev: Add an error check in register_device drivers/char/ppdev.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE: CVE-2024-36015
by Chen Ridong 03 Jun '24

03 Jun '24

*** BLURB HERE *** Huai-Yuan Liu (1): ppdev: Add an error check in register_device drivers/char/ppdev.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10 v3 00/11] Memory access profiler(SPE) driven NUMA balancing
by Ze Zuo 03 Jun '24

03 Jun '24

Hi, In Arm processors, there is a hardware PMU (Performance Monitoring Unit) facility called Statistical Profiling Extension (SPE) that can gather memory access metrics. In this patchset, SPE is exploited as an access information sampling approach to drive NUMA balancing. This sampling approach is introducedto replace the method based on address space scanning and hint faults with the access information provided by the hardware. With this, it is no longer necessary for NUMA balancing to scan over the address space periodically and rely on task-to-page association built by NUMA hint faults. Instead, the access samples obtained from hardware PMU are fed to NUMA balancing as equivalents to page fault. Except for the replaced sampling approach, the rest of the NUMA balancing policy is retained to do pages and tasks migrations according to the samples. Profiling based on SPE is an valid alternative sampling approach in NUMA balancing for the optimal page and task placement. This can be also extended to other architectures as long as there is a hardware PMU that supports memory access profiling. An abstract layer mem_sampling is introduced to reserve support for other kernel features and different types of hardware PMU. To help evaluate performance of this approach in system, syctl interfaces are added to enable/disable hardware mem sampling. NUMA balancing sampling approach can be also switched back to hint-faults- based approach dynamically. TODOs Currently, SPE for NUMA balance does not support PMD-level page migration, but it will be supported in later version. Changes since v2: -- clean code and commit fixs, no functional change. Changes since v1: -- clean code, no functional change. Ze Zuo (11): drivers/arm/spe: In-kernel SPE driver for page access profiling mm: Add PMU based memory sampling abstract layer mm/mem_sampling.c: Add controlling interface for mem_sampling sched: Enable per-process mem_sampling from sched switch path mm/mem_sampling.c: Drive NUMA balancing via mem_sampling access data mm/mem_sampling.c: Add controlling interface for mem_sampling on numa balance tracing, numa balance: add trace events for numa data caused by mem_sampling driver/arm/spe: make mem_sampling and perf reuse arm spe driver tracing, mem-sampling-sample: Adding tracking events to hardware-sampled page access samples/bpf: Add program for memory access by spe config: Enable memory sampling based pmu for numa balance by default arch/arm64/configs/openeuler_defconfig | 3 + arch/x86/configs/openeuler_defconfig | 1 + drivers/Kconfig | 2 + drivers/Makefile | 1 + drivers/arm/Kconfig | 2 + drivers/arm/spe/Kconfig | 11 + drivers/arm/spe/Makefile | 2 + drivers/arm/spe/spe-decoder/Makefile | 2 + drivers/arm/spe/spe-decoder/arm-spe-decoder.c | 213 +++++ drivers/arm/spe/spe-decoder/arm-spe-decoder.h | 74 ++ .../arm/spe/spe-decoder/arm-spe-pkt-decoder.c | 227 +++++ .../arm/spe/spe-decoder/arm-spe-pkt-decoder.h | 153 ++++ drivers/arm/spe/spe.c | 854 ++++++++++++++++++ drivers/arm/spe/spe.h | 130 +++ drivers/perf/Kconfig | 2 +- drivers/perf/arm_pmu_acpi.c | 30 +- drivers/perf/arm_spe_pmu.c | 371 ++------ include/linux/mem_sampling.h | 110 +++ include/linux/perf/arm_pmu.h | 8 + include/trace/events/kmem.h | 80 ++ kernel/sched/core.c | 2 + kernel/sched/fair.c | 12 + mm/Kconfig | 23 + mm/Makefile | 1 + mm/mem_sampling.c | 522 +++++++++++ samples/bpf/spe/Makefile | 26 + samples/bpf/spe/Makefile.arch | 47 + samples/bpf/spe/README.md | 0 samples/bpf/spe/spe-record.bpf.c | 40 + samples/bpf/spe/spe-record.h | 47 + samples/bpf/spe/spe-record.user.c | 116 +++ 31 files changed, 2800 insertions(+), 312 deletions(-) create mode 100644 drivers/arm/Kconfig create mode 100644 drivers/arm/spe/Kconfig create mode 100644 drivers/arm/spe/Makefile create mode 100644 drivers/arm/spe/spe-decoder/Makefile create mode 100644 drivers/arm/spe/spe-decoder/arm-spe-decoder.c create mode 100644 drivers/arm/spe/spe-decoder/arm-spe-decoder.h create mode 100644 drivers/arm/spe/spe-decoder/arm-spe-pkt-decoder.c create mode 100644 drivers/arm/spe/spe-decoder/arm-spe-pkt-decoder.h create mode 100644 drivers/arm/spe/spe.c create mode 100644 drivers/arm/spe/spe.h create mode 100644 include/linux/mem_sampling.h create mode 100644 mm/mem_sampling.c create mode 100644 samples/bpf/spe/Makefile create mode 100644 samples/bpf/spe/Makefile.arch create mode 100644 samples/bpf/spe/README.md create mode 100644 samples/bpf/spe/spe-record.bpf.c create mode 100644 samples/bpf/spe/spe-record.h create mode 100644 samples/bpf/spe/spe-record.user.c -- 2.33.0

2 12

[PATCH v4 OLK-5.10 0/6] Add support for l0
by Wupeng Ma 03 Jun '24

03 Jun '24

From: Ma Wupeng <mawupeng1(a)huawei.com> Add support for l3t & l0. Last Level Cache driver for platforms such Kunpeng 920. This provides interfaces to enable LLC cache lockdown. L0 driver for platforms such Kunpeng 920. This provides interfaces to for user to alloc and lock memory. Changelog since v1: - return -EINVAL if sccl_to_node_id return err. - code refactoring in hisi_lockdown.c Changelog since v2: - code cleanup in hisi_lockdown.c Changelog since v3: - adjusting the patch order - cleanup in l3t.c - rename get_page_policy_node to get_vma_policy_node - export symbol cpu_logical_map without GPL Ma Wupeng (6): export symbol alloc_contig_pages arm64: export cpu_logical_map mm/mempolicy: Add and export get_page_policy_node hisi: l3t: Add L3 cache driver for hisi hisi: l0: Add support for l0 arm64: config: Enable hisi l3t & l0 by default arch/arm64/configs/openeuler_defconfig | 2 + arch/arm64/kernel/setup.c | 1 + drivers/soc/hisilicon/Kconfig | 18 ++ drivers/soc/hisilicon/Makefile | 3 + drivers/soc/hisilicon/hisi_l0.c | 172 ++++++++++++++++ drivers/soc/hisilicon/hisi_l3t.h | 45 +++++ drivers/soc/hisilicon/hisi_lockdown.c | 140 +++++++++++++ drivers/soc/hisilicon/l3t.c | 263 +++++++++++++++++++++++++ include/linux/mempolicy.h | 4 + mm/mempolicy.c | 23 +++ mm/page_alloc.c | 1 + 11 files changed, 672 insertions(+) create mode 100644 drivers/soc/hisilicon/hisi_l0.c create mode 100644 drivers/soc/hisilicon/hisi_l3t.h create mode 100644 drivers/soc/hisilicon/hisi_lockdown.c create mode 100644 drivers/soc/hisilicon/l3t.c -- 2.25.1

2 7

[PATCH openEuler-1.0-LTS] pwm: Fix double shift bug
by Wenyu Huang 03 Jun '24

03 Jun '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v4.19.315 commit a98ff250b5af87f92f17bb9725cb21de1931ee57 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4KN CVE: CVE-2023-52756 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit d27abbfd4888d79dd24baf50e774631046ac4732 ] These enums are passed to set/test_bit(). The set/test_bit() functions take a bit number instead of a shifted value. Passing a shifted value is a double shift bug like doing BIT(BIT(1)). The double shift bug doesn't cause a problem here because we are only checking 0 and 1 but if the value was 5 or above then it can lead to a buffer overflow. Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Reviewed-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Reviewed-by: Sam Protsenko <semen.protsenko(a)linaro.org> Signed-off-by: Thierry Reding <thierry.reding(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- include/linux/pwm.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/include/linux/pwm.h b/include/linux/pwm.h index bd7d611d63e9..c6e981035c3f 100644 --- a/include/linux/pwm.h +++ b/include/linux/pwm.h @@ -44,8 +44,8 @@ struct pwm_args { }; enum { - PWMF_REQUESTED = 1 << 0, - PWMF_EXPORTED = 1 << 1, + PWMF_REQUESTED = 0, + PWMF_EXPORTED = 1, }; /* -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] udf: Fix NULL pointer dereference in udf_symlink function
by Jialin Zhang 03 Jun '24

03 Jun '24

From: Arturo Giusti <koredump(a)protonmail.com> stable inclusion from stable-v4.19.198 commit 3638705ecd5ad2785e996f820121c0ad15ce64b5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4CD CVE: CVE-2021-47353 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit fa236c2b2d4436d9f19ee4e5d5924e90ffd7bb43 ] In function udf_symlink, epos.bh is assigned with the value returned by udf_tgetblk. The function udf_tgetblk is defined in udf/misc.c and returns the value of sb_getblk function that could be NULL. Then, epos.bh is used without any check, causing a possible NULL pointer dereference when sb_getblk fails. This fix adds a check to validate the value of epos.bh. Link: https://bugzilla.kernel.org/show_bug.cgi?id=213083 Signed-off-by: Arturo Giusti <koredump(a)protonmail.com> Signed-off-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- fs/udf/namei.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/udf/namei.c b/fs/udf/namei.c index 58cc2414992b..9cfb555db1ad 100644 --- a/fs/udf/namei.c +++ b/fs/udf/namei.c @@ -948,6 +948,10 @@ static int udf_symlink(struct inode *dir, struct dentry *dentry, iinfo->i_location.partitionReferenceNum, 0); epos.bh = udf_tgetblk(sb, block); + if (unlikely(!epos.bh)) { + err = -ENOMEM; + goto out_no_entry; + } lock_buffer(epos.bh); memset(epos.bh->b_data, 0x00, bsize); set_buffer_uptodate(epos.bh); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
by Zhang Changzhong 03 Jun '24

03 Jun '24

From: Duoming Zhou <duoming(a)zju.edu.cn> mainline inclusion from mainline-v6.9 commit adf0398cee86643b8eacde95f17d073d022f782c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9OZAK CVE: CVE-2024-27399 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a race condition between l2cap_chan_timeout() and l2cap_chan_del(). When we use l2cap_chan_del() to delete the channel, the chan->conn will be set to null. But the conn could be dereferenced again in the mutex_lock() of l2cap_chan_timeout(). As a result the null pointer dereference bug will happen. The KASAN report triggered by POC is shown below: [ 472.074580] ================================================================== [ 472.075284] BUG: KASAN: null-ptr-deref in mutex_lock+0x68/0xc0 [ 472.075308] Write of size 8 at addr 0000000000000158 by task kworker/0:0/7 [ 472.075308] [ 472.075308] CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.9.0-rc5-00356-g78c0094a146b #36 [ 472.075308] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu4 [ 472.075308] Workqueue: events l2cap_chan_timeout [ 472.075308] Call Trace: [ 472.075308] <TASK> [ 472.075308] dump_stack_lvl+0x137/0x1a0 [ 472.075308] print_report+0x101/0x250 [ 472.075308] ? __virt_addr_valid+0x77/0x160 [ 472.075308] ? mutex_lock+0x68/0xc0 [ 472.075308] kasan_report+0x139/0x170 [ 472.075308] ? mutex_lock+0x68/0xc0 [ 472.075308] kasan_check_range+0x2c3/0x2e0 [ 472.075308] mutex_lock+0x68/0xc0 [ 472.075308] l2cap_chan_timeout+0x181/0x300 [ 472.075308] process_one_work+0x5d2/0xe00 [ 472.075308] worker_thread+0xe1d/0x1660 [ 472.075308] ? pr_cont_work+0x5e0/0x5e0 [ 472.075308] kthread+0x2b7/0x350 [ 472.075308] ? pr_cont_work+0x5e0/0x5e0 [ 472.075308] ? kthread_blkcg+0xd0/0xd0 [ 472.075308] ret_from_fork+0x4d/0x80 [ 472.075308] ? kthread_blkcg+0xd0/0xd0 [ 472.075308] ret_from_fork_asm+0x11/0x20 [ 472.075308] </TASK> [ 472.075308] ================================================================== [ 472.094860] Disabling lock debugging due to kernel taint [ 472.096136] BUG: kernel NULL pointer dereference, address: 0000000000000158 [ 472.096136] #PF: supervisor write access in kernel mode [ 472.096136] #PF: error_code(0x0002) - not-present page [ 472.096136] PGD 0 P4D 0 [ 472.096136] Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI [ 472.096136] CPU: 0 PID: 7 Comm: kworker/0:0 Tainted: G B 6.9.0-rc5-00356-g78c0094a146b #36 [ 472.096136] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu4 [ 472.096136] Workqueue: events l2cap_chan_timeout [ 472.096136] RIP: 0010:mutex_lock+0x88/0xc0 [ 472.096136] Code: be 08 00 00 00 e8 f8 23 1f fd 4c 89 f7 be 08 00 00 00 e8 eb 23 1f fd 42 80 3c 23 00 74 08 48 88 [ 472.096136] RSP: 0018:ffff88800744fc78 EFLAGS: 00000246 [ 472.096136] RAX: 0000000000000000 RBX: 1ffff11000e89f8f RCX: ffffffff8457c865 [ 472.096136] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88800744fc78 [ 472.096136] RBP: 0000000000000158 R08: ffff88800744fc7f R09: 1ffff11000e89f8f [ 472.096136] R10: dffffc0000000000 R11: ffffed1000e89f90 R12: dffffc0000000000 [ 472.096136] R13: 0000000000000158 R14: ffff88800744fc78 R15: ffff888007405a00 [ 472.096136] FS: 0000000000000000(0000) GS:ffff88806d200000(0000) knlGS:0000000000000000 [ 472.096136] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 472.096136] CR2: 0000000000000158 CR3: 000000000da32000 CR4: 00000000000006f0 [ 472.096136] Call Trace: [ 472.096136] <TASK> [ 472.096136] ? __die_body+0x8d/0xe0 [ 472.096136] ? page_fault_oops+0x6b8/0x9a0 [ 472.096136] ? kernelmode_fixup_or_oops+0x20c/0x2a0 [ 472.096136] ? do_user_addr_fault+0x1027/0x1340 [ 472.096136] ? _printk+0x7a/0xa0 [ 472.096136] ? mutex_lock+0x68/0xc0 [ 472.096136] ? add_taint+0x42/0xd0 [ 472.096136] ? exc_page_fault+0x6a/0x1b0 [ 472.096136] ? asm_exc_page_fault+0x26/0x30 [ 472.096136] ? mutex_lock+0x75/0xc0 [ 472.096136] ? mutex_lock+0x88/0xc0 [ 472.096136] ? mutex_lock+0x75/0xc0 [ 472.096136] l2cap_chan_timeout+0x181/0x300 [ 472.096136] process_one_work+0x5d2/0xe00 [ 472.096136] worker_thread+0xe1d/0x1660 [ 472.096136] ? pr_cont_work+0x5e0/0x5e0 [ 472.096136] kthread+0x2b7/0x350 [ 472.096136] ? pr_cont_work+0x5e0/0x5e0 [ 472.096136] ? kthread_blkcg+0xd0/0xd0 [ 472.096136] ret_from_fork+0x4d/0x80 [ 472.096136] ? kthread_blkcg+0xd0/0xd0 [ 472.096136] ret_from_fork_asm+0x11/0x20 [ 472.096136] </TASK> [ 472.096136] Modules linked in: [ 472.096136] CR2: 0000000000000158 [ 472.096136] ---[ end trace 0000000000000000 ]--- [ 472.096136] RIP: 0010:mutex_lock+0x88/0xc0 [ 472.096136] Code: be 08 00 00 00 e8 f8 23 1f fd 4c 89 f7 be 08 00 00 00 e8 eb 23 1f fd 42 80 3c 23 00 74 08 48 88 [ 472.096136] RSP: 0018:ffff88800744fc78 EFLAGS: 00000246 [ 472.096136] RAX: 0000000000000000 RBX: 1ffff11000e89f8f RCX: ffffffff8457c865 [ 472.096136] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88800744fc78 [ 472.096136] RBP: 0000000000000158 R08: ffff88800744fc7f R09: 1ffff11000e89f8f [ 472.132932] R10: dffffc0000000000 R11: ffffed1000e89f90 R12: dffffc0000000000 [ 472.132932] R13: 0000000000000158 R14: ffff88800744fc78 R15: ffff888007405a00 [ 472.132932] FS: 0000000000000000(0000) GS:ffff88806d200000(0000) knlGS:0000000000000000 [ 472.132932] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 472.132932] CR2: 0000000000000158 CR3: 000000000da32000 CR4: 00000000000006f0 [ 472.132932] Kernel panic - not syncing: Fatal exception [ 472.132932] Kernel Offset: disabled [ 472.132932] ---[ end Kernel panic - not syncing: Fatal exception ]--- Add a check to judge whether the conn is null in l2cap_chan_timeout() in order to mitigate the bug. Fixes: 3df91ea20e74 ("Bluetooth: Revert to mutexes from RCU list") Signed-off-by: Duoming Zhou <duoming(a)zju.edu.cn> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/bluetooth/l2cap_core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index b705cb3..c084533 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -426,6 +426,9 @@ static void l2cap_chan_timeout(struct work_struct *work) BT_DBG("chan %p state %s", chan, state_to_string(chan->state)); + if (!conn) + return; + mutex_lock(&conn->chan_lock); l2cap_chan_lock(chan); -- 2.9.5

2 1

[PATCH OLK-5.10] Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
by Zhang Changzhong 03 Jun '24

03 Jun '24

From: Duoming Zhou <duoming(a)zju.edu.cn> mainline inclusion from mainline-v6.9 commit adf0398cee86643b8eacde95f17d073d022f782c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9OZAK CVE: CVE-2024-27399 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a race condition between l2cap_chan_timeout() and l2cap_chan_del(). When we use l2cap_chan_del() to delete the channel, the chan->conn will be set to null. But the conn could be dereferenced again in the mutex_lock() of l2cap_chan_timeout(). As a result the null pointer dereference bug will happen. The KASAN report triggered by POC is shown below: [ 472.074580] ================================================================== [ 472.075284] BUG: KASAN: null-ptr-deref in mutex_lock+0x68/0xc0 [ 472.075308] Write of size 8 at addr 0000000000000158 by task kworker/0:0/7 [ 472.075308] [ 472.075308] CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.9.0-rc5-00356-g78c0094a146b #36 [ 472.075308] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu4 [ 472.075308] Workqueue: events l2cap_chan_timeout [ 472.075308] Call Trace: [ 472.075308] <TASK> [ 472.075308] dump_stack_lvl+0x137/0x1a0 [ 472.075308] print_report+0x101/0x250 [ 472.075308] ? __virt_addr_valid+0x77/0x160 [ 472.075308] ? mutex_lock+0x68/0xc0 [ 472.075308] kasan_report+0x139/0x170 [ 472.075308] ? mutex_lock+0x68/0xc0 [ 472.075308] kasan_check_range+0x2c3/0x2e0 [ 472.075308] mutex_lock+0x68/0xc0 [ 472.075308] l2cap_chan_timeout+0x181/0x300 [ 472.075308] process_one_work+0x5d2/0xe00 [ 472.075308] worker_thread+0xe1d/0x1660 [ 472.075308] ? pr_cont_work+0x5e0/0x5e0 [ 472.075308] kthread+0x2b7/0x350 [ 472.075308] ? pr_cont_work+0x5e0/0x5e0 [ 472.075308] ? kthread_blkcg+0xd0/0xd0 [ 472.075308] ret_from_fork+0x4d/0x80 [ 472.075308] ? kthread_blkcg+0xd0/0xd0 [ 472.075308] ret_from_fork_asm+0x11/0x20 [ 472.075308] </TASK> [ 472.075308] ================================================================== [ 472.094860] Disabling lock debugging due to kernel taint [ 472.096136] BUG: kernel NULL pointer dereference, address: 0000000000000158 [ 472.096136] #PF: supervisor write access in kernel mode [ 472.096136] #PF: error_code(0x0002) - not-present page [ 472.096136] PGD 0 P4D 0 [ 472.096136] Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI [ 472.096136] CPU: 0 PID: 7 Comm: kworker/0:0 Tainted: G B 6.9.0-rc5-00356-g78c0094a146b #36 [ 472.096136] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu4 [ 472.096136] Workqueue: events l2cap_chan_timeout [ 472.096136] RIP: 0010:mutex_lock+0x88/0xc0 [ 472.096136] Code: be 08 00 00 00 e8 f8 23 1f fd 4c 89 f7 be 08 00 00 00 e8 eb 23 1f fd 42 80 3c 23 00 74 08 48 88 [ 472.096136] RSP: 0018:ffff88800744fc78 EFLAGS: 00000246 [ 472.096136] RAX: 0000000000000000 RBX: 1ffff11000e89f8f RCX: ffffffff8457c865 [ 472.096136] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88800744fc78 [ 472.096136] RBP: 0000000000000158 R08: ffff88800744fc7f R09: 1ffff11000e89f8f [ 472.096136] R10: dffffc0000000000 R11: ffffed1000e89f90 R12: dffffc0000000000 [ 472.096136] R13: 0000000000000158 R14: ffff88800744fc78 R15: ffff888007405a00 [ 472.096136] FS: 0000000000000000(0000) GS:ffff88806d200000(0000) knlGS:0000000000000000 [ 472.096136] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 472.096136] CR2: 0000000000000158 CR3: 000000000da32000 CR4: 00000000000006f0 [ 472.096136] Call Trace: [ 472.096136] <TASK> [ 472.096136] ? __die_body+0x8d/0xe0 [ 472.096136] ? page_fault_oops+0x6b8/0x9a0 [ 472.096136] ? kernelmode_fixup_or_oops+0x20c/0x2a0 [ 472.096136] ? do_user_addr_fault+0x1027/0x1340 [ 472.096136] ? _printk+0x7a/0xa0 [ 472.096136] ? mutex_lock+0x68/0xc0 [ 472.096136] ? add_taint+0x42/0xd0 [ 472.096136] ? exc_page_fault+0x6a/0x1b0 [ 472.096136] ? asm_exc_page_fault+0x26/0x30 [ 472.096136] ? mutex_lock+0x75/0xc0 [ 472.096136] ? mutex_lock+0x88/0xc0 [ 472.096136] ? mutex_lock+0x75/0xc0 [ 472.096136] l2cap_chan_timeout+0x181/0x300 [ 472.096136] process_one_work+0x5d2/0xe00 [ 472.096136] worker_thread+0xe1d/0x1660 [ 472.096136] ? pr_cont_work+0x5e0/0x5e0 [ 472.096136] kthread+0x2b7/0x350 [ 472.096136] ? pr_cont_work+0x5e0/0x5e0 [ 472.096136] ? kthread_blkcg+0xd0/0xd0 [ 472.096136] ret_from_fork+0x4d/0x80 [ 472.096136] ? kthread_blkcg+0xd0/0xd0 [ 472.096136] ret_from_fork_asm+0x11/0x20 [ 472.096136] </TASK> [ 472.096136] Modules linked in: [ 472.096136] CR2: 0000000000000158 [ 472.096136] ---[ end trace 0000000000000000 ]--- [ 472.096136] RIP: 0010:mutex_lock+0x88/0xc0 [ 472.096136] Code: be 08 00 00 00 e8 f8 23 1f fd 4c 89 f7 be 08 00 00 00 e8 eb 23 1f fd 42 80 3c 23 00 74 08 48 88 [ 472.096136] RSP: 0018:ffff88800744fc78 EFLAGS: 00000246 [ 472.096136] RAX: 0000000000000000 RBX: 1ffff11000e89f8f RCX: ffffffff8457c865 [ 472.096136] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88800744fc78 [ 472.096136] RBP: 0000000000000158 R08: ffff88800744fc7f R09: 1ffff11000e89f8f [ 472.132932] R10: dffffc0000000000 R11: ffffed1000e89f90 R12: dffffc0000000000 [ 472.132932] R13: 0000000000000158 R14: ffff88800744fc78 R15: ffff888007405a00 [ 472.132932] FS: 0000000000000000(0000) GS:ffff88806d200000(0000) knlGS:0000000000000000 [ 472.132932] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 472.132932] CR2: 0000000000000158 CR3: 000000000da32000 CR4: 00000000000006f0 [ 472.132932] Kernel panic - not syncing: Fatal exception [ 472.132932] Kernel Offset: disabled [ 472.132932] ---[ end Kernel panic - not syncing: Fatal exception ]--- Add a check to judge whether the conn is null in l2cap_chan_timeout() in order to mitigate the bug. Fixes: 3df91ea20e74 ("Bluetooth: Revert to mutexes from RCU list") Signed-off-by: Duoming Zhou <duoming(a)zju.edu.cn> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/bluetooth/l2cap_core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index cf78a48..8ac9adb 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -435,6 +435,9 @@ static void l2cap_chan_timeout(struct work_struct *work) BT_DBG("chan %p state %s", chan, state_to_string(chan->state)); + if (!conn) + return; + mutex_lock(&conn->chan_lock); /* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling * this work. No need to call l2cap_chan_hold(chan) here again. -- 2.9.5

2 1

[PATCH OLK-6.6] fix mlock in OLK-6.6
by Wupeng Ma 03 Jun '24

03 Jun '24

From: Ma Wupeng <mawupeng1(a)huawei.com> While testing mlock, we have a problem if the len of mlock is ULONG_MAX. The return value of mlock is zero. But nothing will be locked since the len in do_mlock overflows to zero due to the following code in mlock: len = PAGE_ALIGN(len + (offset_in_page(start))); The same problem happens in munlock. Fix it by return -EINVAL if len overflows. Ma Wupeng (1): mm/mlock: return EINVAL for illegal user memory range in mlock mm/mlock.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) -- 2.25.1

2 2

[PATCH openEuler-22.03-LTS-SP1] rpmsg: virtio: Free driver_override when rpmsg_remove()
by Yu Liao 03 Jun '24

03 Jun '24

From: Xiaolei Wang <xiaolei.wang(a)windriver.com> stable inclusion from stable-v5.10.210 commit 69ca89d80f2c8a1f5af429b955637beea7eead30 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9I7 CVE: CVE-2023-52670 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d5362c37e1f8a40096452fc201c30e705750e687 upstream. Free driver_override when rpmsg_remove(), otherwise the following memory leak will occur: unreferenced object 0xffff0000d55d7080 (size 128): comm "kworker/u8:2", pid 56, jiffies 4294893188 (age 214.272s) hex dump (first 32 bytes): 72 70 6d 73 67 5f 6e 73 00 00 00 00 00 00 00 00 rpmsg_ns........ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000009c94c9c1>] __kmem_cache_alloc_node+0x1f8/0x320 [<000000002300d89b>] __kmalloc_node_track_caller+0x44/0x70 [<00000000228a60c3>] kstrndup+0x4c/0x90 [<0000000077158695>] driver_set_override+0xd0/0x164 [<000000003e9c4ea5>] rpmsg_register_device_override+0x98/0x170 [<000000001c0c89a8>] rpmsg_ns_register_device+0x24/0x30 [<000000008bbf8fa2>] rpmsg_probe+0x2e0/0x3ec [<00000000e65a68df>] virtio_dev_probe+0x1c0/0x280 [<00000000443331cc>] really_probe+0xbc/0x2dc [<00000000391064b1>] __driver_probe_device+0x78/0xe0 [<00000000a41c9a5b>] driver_probe_device+0xd8/0x160 [<000000009c3bd5df>] __device_attach_driver+0xb8/0x140 [<0000000043cd7614>] bus_for_each_drv+0x7c/0xd4 [<000000003b929a36>] __device_attach+0x9c/0x19c [<00000000a94e0ba8>] device_initial_probe+0x14/0x20 [<000000003c999637>] bus_probe_device+0xa0/0xac Signed-off-by: Xiaolei Wang <xiaolei.wang(a)windriver.com> Fixes: b0b03b811963 ("rpmsg: Release rpmsg devices in backends") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20231215020049.78750-1-xiaolei.wang@windriver.com Signed-off-by: Mathieu Poirier <mathieu.poirier(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- drivers/rpmsg/virtio_rpmsg_bus.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c index 4ef2fe3e65ac..89cc0d6598b4 100644 --- a/drivers/rpmsg/virtio_rpmsg_bus.c +++ b/drivers/rpmsg/virtio_rpmsg_bus.c @@ -387,6 +387,7 @@ static void virtio_rpmsg_release_device(struct device *dev) struct rpmsg_device *rpdev = to_rpmsg_device(dev); struct virtio_rpmsg_channel *vch = to_virtio_rpmsg_channel(rpdev); + kfree(rpdev->driver_override); kfree(vch); } -- 2.25.1

2 1

[PATCH OLK-5.10] rpmsg: virtio: Free driver_override when rpmsg_remove()
by Yu Liao 03 Jun '24

03 Jun '24

From: Xiaolei Wang <xiaolei.wang(a)windriver.com> stable inclusion from stable-v5.10.210 commit 69ca89d80f2c8a1f5af429b955637beea7eead30 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9I7 CVE: CVE-2023-52670 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d5362c37e1f8a40096452fc201c30e705750e687 upstream. Free driver_override when rpmsg_remove(), otherwise the following memory leak will occur: unreferenced object 0xffff0000d55d7080 (size 128): comm "kworker/u8:2", pid 56, jiffies 4294893188 (age 214.272s) hex dump (first 32 bytes): 72 70 6d 73 67 5f 6e 73 00 00 00 00 00 00 00 00 rpmsg_ns........ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000009c94c9c1>] __kmem_cache_alloc_node+0x1f8/0x320 [<000000002300d89b>] __kmalloc_node_track_caller+0x44/0x70 [<00000000228a60c3>] kstrndup+0x4c/0x90 [<0000000077158695>] driver_set_override+0xd0/0x164 [<000000003e9c4ea5>] rpmsg_register_device_override+0x98/0x170 [<000000001c0c89a8>] rpmsg_ns_register_device+0x24/0x30 [<000000008bbf8fa2>] rpmsg_probe+0x2e0/0x3ec [<00000000e65a68df>] virtio_dev_probe+0x1c0/0x280 [<00000000443331cc>] really_probe+0xbc/0x2dc [<00000000391064b1>] __driver_probe_device+0x78/0xe0 [<00000000a41c9a5b>] driver_probe_device+0xd8/0x160 [<000000009c3bd5df>] __device_attach_driver+0xb8/0x140 [<0000000043cd7614>] bus_for_each_drv+0x7c/0xd4 [<000000003b929a36>] __device_attach+0x9c/0x19c [<00000000a94e0ba8>] device_initial_probe+0x14/0x20 [<000000003c999637>] bus_probe_device+0xa0/0xac Signed-off-by: Xiaolei Wang <xiaolei.wang(a)windriver.com> Fixes: b0b03b811963 ("rpmsg: Release rpmsg devices in backends") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20231215020049.78750-1-xiaolei.wang@windriver.com Signed-off-by: Mathieu Poirier <mathieu.poirier(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- drivers/rpmsg/virtio_rpmsg_bus.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c index 4ef2fe3e65ac..89cc0d6598b4 100644 --- a/drivers/rpmsg/virtio_rpmsg_bus.c +++ b/drivers/rpmsg/virtio_rpmsg_bus.c @@ -387,6 +387,7 @@ static void virtio_rpmsg_release_device(struct device *dev) struct rpmsg_device *rpdev = to_rpmsg_device(dev); struct virtio_rpmsg_channel *vch = to_virtio_rpmsg_channel(rpdev); + kfree(rpdev->driver_override); kfree(vch); } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] rpmsg: virtio: Free driver_override when rpmsg_remove()
by Yu Liao 03 Jun '24

03 Jun '24

From: Xiaolei Wang <xiaolei.wang(a)windriver.com> stable inclusion from stable-v4.19.307 commit 229ce47cbfdc7d3a9415eb676abbfb77d676cb08 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9I7 CVE: CVE-2023-52670 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit d5362c37e1f8a40096452fc201c30e705750e687 upstream. Free driver_override when rpmsg_remove(), otherwise the following memory leak will occur: unreferenced object 0xffff0000d55d7080 (size 128): comm "kworker/u8:2", pid 56, jiffies 4294893188 (age 214.272s) hex dump (first 32 bytes): 72 70 6d 73 67 5f 6e 73 00 00 00 00 00 00 00 00 rpmsg_ns........ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000009c94c9c1>] __kmem_cache_alloc_node+0x1f8/0x320 [<000000002300d89b>] __kmalloc_node_track_caller+0x44/0x70 [<00000000228a60c3>] kstrndup+0x4c/0x90 [<0000000077158695>] driver_set_override+0xd0/0x164 [<000000003e9c4ea5>] rpmsg_register_device_override+0x98/0x170 [<000000001c0c89a8>] rpmsg_ns_register_device+0x24/0x30 [<000000008bbf8fa2>] rpmsg_probe+0x2e0/0x3ec [<00000000e65a68df>] virtio_dev_probe+0x1c0/0x280 [<00000000443331cc>] really_probe+0xbc/0x2dc [<00000000391064b1>] __driver_probe_device+0x78/0xe0 [<00000000a41c9a5b>] driver_probe_device+0xd8/0x160 [<000000009c3bd5df>] __device_attach_driver+0xb8/0x140 [<0000000043cd7614>] bus_for_each_drv+0x7c/0xd4 [<000000003b929a36>] __device_attach+0x9c/0x19c [<00000000a94e0ba8>] device_initial_probe+0x14/0x20 [<000000003c999637>] bus_probe_device+0xa0/0xac Signed-off-by: Xiaolei Wang <xiaolei.wang(a)windriver.com> Fixes: b0b03b811963 ("rpmsg: Release rpmsg devices in backends") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20231215020049.78750-1-xiaolei.wang@windriver.com Signed-off-by: Mathieu Poirier <mathieu.poirier(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- drivers/rpmsg/virtio_rpmsg_bus.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c index 664f957012cd..aab990339051 100644 --- a/drivers/rpmsg/virtio_rpmsg_bus.c +++ b/drivers/rpmsg/virtio_rpmsg_bus.c @@ -381,6 +381,7 @@ static void virtio_rpmsg_release_device(struct device *dev) struct rpmsg_device *rpdev = to_rpmsg_device(dev); struct virtio_rpmsg_channel *vch = to_virtio_rpmsg_channel(rpdev); + kfree(rpdev->driver_override); kfree(vch); } -- 2.25.1

2 1

[PATCH v3 OLK-5.10 0/6] Add support for l0
by Wupeng Ma 03 Jun '24

03 Jun '24

From: Ma Wupeng <mawupeng1(a)huawei.com> Add support for l3t & l0. Last Level Cache driver for platforms such Kunpeng 920. This provides interfaces to enable LLC cache lockdown. L0 driver for platforms such Kunpeng 920. This provides interfaces to for user to alloc and lock memory. Changelog since v1: - return -EINVAL if sccl_to_node_id return err. - code refactoring in hisi_lockdown.c Changelog since v2: - code cleanup in hisi_lockdown.c Ma Wupeng (6): export symbol alloc_contig_pages arm64: export cpu_logical_map hisi: l3t: Add L3 cache driver for hisi mm/mempolicy: Add and export get_page_policy_node hisi: l0: Add support for l0 arm64: config: Enable hisi l3t & l0 by default arch/arm64/configs/openeuler_defconfig | 2 + arch/arm64/kernel/setup.c | 1 + drivers/soc/hisilicon/Kconfig | 18 ++ drivers/soc/hisilicon/Makefile | 3 + drivers/soc/hisilicon/hisi_l0.c | 173 ++++++++++++++++ drivers/soc/hisilicon/hisi_l3t.h | 46 +++++ drivers/soc/hisilicon/hisi_lockdown.c | 140 +++++++++++++ drivers/soc/hisilicon/l3t.c | 273 +++++++++++++++++++++++++ include/linux/mempolicy.h | 4 + mm/mempolicy.c | 24 +++ mm/page_alloc.c | 1 + 11 files changed, 685 insertions(+) create mode 100644 drivers/soc/hisilicon/hisi_l0.c create mode 100644 drivers/soc/hisilicon/hisi_l3t.h create mode 100644 drivers/soc/hisilicon/hisi_lockdown.c create mode 100644 drivers/soc/hisilicon/l3t.c -- 2.25.1

2 7

[openeuler:openEuler-1.0-LTS 16810/22640] drivers/misc/uacce/.tmp_uacce.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 03 Jun '24

03 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 432ff1555c2d2bd585c63b2f2c797ddcc05efbb1 commit: 451823febcb610969f048556cedc41b5e08fafb1 [16810/22640] UACCE backport from mainline config: x86_64-buildonly-randconfig-001-20240603 (https://download.01.org/0day-ci/archive/20240603/202406031659.4McCaYnA-lkp@…) compiler: gcc-10 (Ubuntu 10.5.0-1ubuntu1) 10.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240603/202406031659.4McCaYnA-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406031659.4McCaYnA-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/misc/uacce/uacce.c: In function 'numa_distance_show': drivers/misc/uacce/uacce.c:1032:16: warning: unused variable 'uacce' [-Wunused-variable] 1032 | struct uacce *uacce = UACCE_FROM_CDEV_ATTR(dev); | ^~~~~ drivers/misc/uacce/uacce.c: In function 'node_id_show': drivers/misc/uacce/uacce.c:1046:16: warning: unused variable 'uacce' [-Wunused-variable] 1046 | struct uacce *uacce = UACCE_FROM_CDEV_ATTR(dev); | ^~~~~ drivers/misc/uacce/uacce.c:60: warning: Function parameter or member 'dev' not described in 'dev_to_uacce' drivers/misc/uacce/uacce.c:81: warning: Function parameter or member 'uacce' not described in 'uacce_hw_err_isolate' drivers/misc/uacce/uacce.c:140: warning: Function parameter or member 'q' not described in 'uacce_wake_up' >> drivers/misc/uacce/.tmp_uacce.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/7] arm64 mpam fix patch
by Yu Liao 03 Jun '24

03 Jun '24

Some bugfix patches to address mpam issues. Yu Liao (7): mpam/resctrl: Fix a deadlock due to inaccurate reference mpam/resctrl: Clean up unused function parameter in mkdir path mpam/resctrl: Clean up resctrl_group_rmdir_[ctrl/mon]() mpam/resctrl: Fix use-after-free due to inaccurate refcount of rdtgroup arm64/mpam: change allocation mode from GFP_KERNEL to GFP_NOWAIT arm64/mpam: Fix wrong seconds to jiffies conversion arm64/mpam: Fix softlockup when reading mondata arch/arm64/kernel/mpam/mpam_ctrlmon.c | 3 ++ arch/arm64/kernel/mpam/mpam_resctrl.c | 6 +-- fs/resctrlfs.c | 57 ++++++++++----------------- 3 files changed, 27 insertions(+), 39 deletions(-) -- 2.33.0

2 8

[PATCH openEuler-1.0-LTS] scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
by Ye Bin 03 Jun '24

03 Jun '24

From: Justin Tee <justin.tee(a)broadcom.com> mainline inclusion from mainline-v6.9-rc2 commit ded20192dff31c91cef2a04f7e20e60e9bb887d3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U211 CVE: CVE-2024-36924 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- lpfc_worker_wake_up() calls the lpfc_work_done() routine, which takes the hbalock. Thus, lpfc_worker_wake_up() should not be called while holding the hbalock to avoid potential deadlock. Signed-off-by: Justin Tee <justin.tee(a)broadcom.com> Link: https://lore.kernel.org/r/20240305200503.57317-7-justintee8345@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Conflicts: drivers/scsi/lpfc/lpfc_hbadisc.c drivers/scsi/lpfc/lpfc_sli.c [fix context diff] Signed-off-by: Ye Bin <yebin(a)huaweicloud.com> --- drivers/scsi/lpfc/lpfc_els.c | 20 ++++++++++---------- drivers/scsi/lpfc/lpfc_hbadisc.c | 2 ++ drivers/scsi/lpfc/lpfc_sli.c | 2 +- 3 files changed, 13 insertions(+), 11 deletions(-) diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c index 7398350b08b4..a6eae7c31bf3 100644 --- a/drivers/scsi/lpfc/lpfc_els.c +++ b/drivers/scsi/lpfc/lpfc_els.c @@ -3173,23 +3173,23 @@ lpfc_els_retry_delay(struct timer_list *t) unsigned long flags; struct lpfc_work_evt *evtp = &ndlp->els_retry_evt; + /* Hold a node reference for outstanding queued work */ + if (!lpfc_nlp_get(ndlp)) + return; + spin_lock_irqsave(&phba->hbalock, flags); if (!list_empty(&evtp->evt_listp)) { spin_unlock_irqrestore(&phba->hbalock, flags); + lpfc_nlp_put(ndlp); return; } - /* We need to hold the node by incrementing the reference - * count until the queued work is done - */ - evtp->evt_arg1 = lpfc_nlp_get(ndlp); - if (evtp->evt_arg1) { - evtp->evt = LPFC_EVT_ELS_RETRY; - list_add_tail(&evtp->evt_listp, &phba->work_list); - lpfc_worker_wake_up(phba); - } + evtp->evt_arg1 = ndlp; + evtp->evt = LPFC_EVT_ELS_RETRY; + list_add_tail(&evtp->evt_listp, &phba->work_list); spin_unlock_irqrestore(&phba->hbalock, flags); - return; + + lpfc_worker_wake_up(phba); } /** diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c index 8be1c0b4e2a8..4949f4870c8a 100644 --- a/drivers/scsi/lpfc/lpfc_hbadisc.c +++ b/drivers/scsi/lpfc/lpfc_hbadisc.c @@ -183,7 +183,9 @@ lpfc_dev_loss_tmo_callbk(struct fc_rport *rport) if (evtp->evt_arg1) { evtp->evt = LPFC_EVT_DEV_LOSS; list_add_tail(&evtp->evt_listp, &phba->work_list); + spin_unlock_irq(&phba->hbalock); lpfc_worker_wake_up(phba); + return; } spin_unlock_irq(&phba->hbalock); diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c index 86d31fe324b4..89340a74d1b5 100644 --- a/drivers/scsi/lpfc/lpfc_sli.c +++ b/drivers/scsi/lpfc/lpfc_sli.c @@ -1104,9 +1104,9 @@ lpfc_set_rrq_active(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp, empty = list_empty(&phba->active_rrq_list); list_add_tail(&rrq->list, &phba->active_rrq_list); phba->hba_flag |= HBA_RRQ_ACTIVE; + spin_unlock_irqrestore(&phba->hbalock, iflags); if (empty) lpfc_worker_wake_up(phba); - spin_unlock_irqrestore(&phba->hbalock, iflags); return 0; out: spin_unlock_irqrestore(&phba->hbalock, iflags); -- 2.31.1

2 1

[PATCH v2 OLK-5.10 0/6] Add support for l0
by Wupeng Ma 03 Jun '24

03 Jun '24

From: Ma Wupeng <mawupeng1(a)huawei.com> Add support for l3t & l0. Last Level Cache driver for platforms such Kunpeng 920. This provides interfaces to enable LLC cache lockdown. L0 driver for platforms such Kunpeng 920. This provides interfaces to for user to alloc and lock memory. Changelog since v1: - return -EINVAL if sccl_to_node_id return err. - code refactoring in hisi_lockdown.c Ma Wupeng (6): export symbol alloc_contig_pages arm64: export cpu_logical_map hisi: l3t: Add L3 cache driver for hisi mm/mempolicy: Add and export get_page_policy_node hisi: l0: Add support for l0 arm64: config: Enable hisi l3t & l0 by default arch/arm64/configs/openeuler_defconfig | 2 + arch/arm64/kernel/setup.c | 1 + drivers/soc/hisilicon/Kconfig | 18 ++ drivers/soc/hisilicon/Makefile | 3 + drivers/soc/hisilicon/hisi_l0.c | 173 ++++++++++++++++ drivers/soc/hisilicon/hisi_l3t.h | 46 +++++ drivers/soc/hisilicon/hisi_lockdown.c | 142 +++++++++++++ drivers/soc/hisilicon/l3t.c | 273 +++++++++++++++++++++++++ include/linux/mempolicy.h | 4 + mm/mempolicy.c | 24 +++ mm/page_alloc.c | 1 + 11 files changed, 687 insertions(+) create mode 100644 drivers/soc/hisilicon/hisi_l0.c create mode 100644 drivers/soc/hisilicon/hisi_l3t.h create mode 100644 drivers/soc/hisilicon/hisi_lockdown.c create mode 100644 drivers/soc/hisilicon/l3t.c -- 2.25.1

2 7

2024

2023

2022

2021

2020

2019

Kernel