- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] jbd2: speed up jbd2_transaction_committed()
by Zhang Yi 20 May '24

20 May '24

hulk inclusion category: performance bugzilla: https://gitee.com/openeuler/kernel/issues/I9QSJ5 CVE: NA -------------------------------- jbd2_transaction_committed() is used to check whether a transaction with the given tid has already committed, it holds j_state_lock in read mode and check the tid of current running transaction and committing transaction, but holding the j_state_lock is expensive. We have already stored the sequence number of the most recently committed transaction in journal t->j_commit_sequence, we could do this check by comparing it with the given tid instead. If the given tid isn't smaller than j_commit_sequence, we can ensure that the given transaction has been committed. That way we could drop the expensive lock and achieve about 10% ~ 20% performance gains in concurrent DIOs on may virtual machine with 100G ramdisk. fio -filename=/mnt/foo -direct=1 -iodepth=10 -rw=$rw -ioengine=libaio \ -bs=4k -size=10G -numjobs=10 -runtime=60 -overwrite=1 -name=test \ -group_reporting Before: overwrite IOPS=88.2k, BW=344MiB/s read IOPS=95.7k, BW=374MiB/s rand overwrite IOPS=98.7k, BW=386MiB/s randread IOPS=102k, BW=397MiB/s After: overwrite IOPS=105k, BW=410MiB/s read IOPS=112k, BW=436MiB/s rand overwrite IOPS=104k, BW=404MiB/s randread IOPS=111k, BW=432MiB/s CC: Dave Chinner <david(a)fromorbit.com> Suggested-by: Dave Chinner <david(a)fromorbit.com> Link: https://lore.kernel.org/linux-ext4/ZjILCPNZRHeazSqV@dread.disaster.area/ Signed-off-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> --- fs/jbd2/commit.c | 2 +- fs/jbd2/journal.c | 12 +----------- 2 files changed, 2 insertions(+), 12 deletions(-) diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c index 5e122586e06e..8244cab17688 100644 --- a/fs/jbd2/commit.c +++ b/fs/jbd2/commit.c @@ -1108,7 +1108,7 @@ void jbd2_journal_commit_transaction(journal_t *journal) commit_transaction->t_state = T_COMMIT_CALLBACK; J_ASSERT(commit_transaction == journal->j_committing_transaction); - journal->j_commit_sequence = commit_transaction->t_tid; + WRITE_ONCE(journal->j_commit_sequence, commit_transaction->t_tid); journal->j_committing_transaction = NULL; commit_time = ktime_to_ns(ktime_sub(ktime_get(), start_time)); diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c index 19c69229ac6e..fc4c7a2bf6d5 100644 --- a/fs/jbd2/journal.c +++ b/fs/jbd2/journal.c @@ -789,17 +789,7 @@ EXPORT_SYMBOL(jbd2_fc_end_commit_fallback); /* Return 1 when transaction with given tid has already committed. */ int jbd2_transaction_committed(journal_t *journal, tid_t tid) { - int ret = 1; - - read_lock(&journal->j_state_lock); - if (journal->j_running_transaction && - journal->j_running_transaction->t_tid == tid) - ret = 0; - if (journal->j_committing_transaction && - journal->j_committing_transaction->t_tid == tid) - ret = 0; - read_unlock(&journal->j_state_lock); - return ret; + return tid_geq(READ_ONCE(journal->j_commit_sequence), tid); } EXPORT_SYMBOL(jbd2_transaction_committed); -- 2.39.2

2 1

[openeuler:OLK-6.6 9619/9669] kernel/dma/contiguous.c:228:13: error: 'is_zhaoxin_kh40000' undeclared
by kernel test robot 20 May '24

20 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: bb74bc369fd2ab5f41a32c4ddc2e23bc76c3c550 commit: 4332dbb07181359cccca3ba757ef54e434fb1296 [9619/9669] Add kh40000_direct_dma_ops for KH-40000 platform config: x86_64-buildonly-randconfig-002-20240520 (https://download.01.org/0day-ci/archive/20240520/202405202102.9bImbUvA-lkp@…) compiler: gcc-11 (Ubuntu 11.4.0-4ubuntu1) 11.4.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240520/202405202102.9bImbUvA-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405202102.9bImbUvA-lkp@intel.com/ All errors (new ones prefixed by >>): kernel/dma/contiguous.c: In function 'dma_contiguous_reserve': >> kernel/dma/contiguous.c:228:13: error: 'is_zhaoxin_kh40000' undeclared (first use in this function) 228 | if (is_zhaoxin_kh40000) | ^~~~~~~~~~~~~~~~~~ kernel/dma/contiguous.c:228:13: note: each undeclared identifier is reported only once for each function it appears in vim +/is_zhaoxin_kh40000 +228 kernel/dma/contiguous.c 208 209 /** 210 * dma_contiguous_reserve() - reserve area(s) for contiguous memory handling 211 * @limit: End address of the reserved memory (optional, 0 for any). 212 * 213 * This function reserves memory from early allocator. It should be 214 * called by arch specific code once the early allocator (memblock or bootmem) 215 * has been activated and all other subsystems have already allocated/reserved 216 * memory. 217 */ 218 void __init dma_contiguous_reserve(phys_addr_t limit) 219 { 220 phys_addr_t selected_size = 0; 221 phys_addr_t selected_base = 0; 222 phys_addr_t selected_limit = limit; 223 bool fixed = false; 224 225 dma_numa_cma_reserve(); 226 227 #if defined(CONFIG_X86_64) && defined(CONFIG_PCI) > 228 if (is_zhaoxin_kh40000) 229 return; 230 #endif 231 pr_debug("%s(limit %08lx)\n", __func__, (unsigned long)limit); 232 233 if (size_cmdline != -1) { 234 selected_size = size_cmdline; 235 selected_base = base_cmdline; 236 selected_limit = min_not_zero(limit_cmdline, limit); 237 if (base_cmdline + size_cmdline == limit_cmdline) 238 fixed = true; 239 } else { 240 #ifdef CONFIG_CMA_SIZE_SEL_MBYTES 241 selected_size = size_bytes; 242 #elif defined(CONFIG_CMA_SIZE_SEL_PERCENTAGE) 243 selected_size = cma_early_percent_memory(); 244 #elif defined(CONFIG_CMA_SIZE_SEL_MIN) 245 selected_size = min(size_bytes, cma_early_percent_memory()); 246 #elif defined(CONFIG_CMA_SIZE_SEL_MAX) 247 selected_size = max(size_bytes, cma_early_percent_memory()); 248 #endif 249 } 250 251 if (selected_size && !dma_contiguous_default_area) { 252 pr_debug("%s: reserving %ld MiB for global area\n", __func__, 253 (unsigned long)selected_size / SZ_1M); 254 255 dma_contiguous_reserve_area(selected_size, selected_base, 256 selected_limit, 257 &dma_contiguous_default_area, 258 fixed); 259 } 260 } 261 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 9619/9669] arch/x86/kernel/zhaoxin_kh40000.c:87:33: error: call to undeclared function 'iommu_get_dma_domain'; ISO C99 and later do not support implicit function declarations
by kernel test robot 20 May '24

20 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: bb74bc369fd2ab5f41a32c4ddc2e23bc76c3c550 commit: 4332dbb07181359cccca3ba757ef54e434fb1296 [9619/9669] Add kh40000_direct_dma_ops for KH-40000 platform config: x86_64-buildonly-randconfig-001-20240520 (https://download.01.org/0day-ci/archive/20240520/202405202027.XOiN2dDz-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240520/202405202027.XOiN2dDz-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405202027.XOiN2dDz-lkp@intel.com/ All errors (new ones prefixed by >>): arch/x86/kernel/zhaoxin_kh40000.c:47:30: warning: bitwise or with non-zero value always evaluates to true [-Wtautological-bitwise-compare] 47 | if (ZHAOXIN_P2CW_NODE_CHECK | zhaoxin_patch_code) | ~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~ >> arch/x86/kernel/zhaoxin_kh40000.c:87:33: error: call to undeclared function 'iommu_get_dma_domain'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 87 | struct iommu_domain *domain = iommu_get_dma_domain(dev); | ^ arch/x86/kernel/zhaoxin_kh40000.c:87:33: note: did you mean 'iommu_is_dma_domain'? include/linux/iommu.h:273:20: note: 'iommu_is_dma_domain' declared here 273 | static inline bool iommu_is_dma_domain(struct iommu_domain *domain) | ^ >> arch/x86/kernel/zhaoxin_kh40000.c:87:24: error: incompatible integer to pointer conversion initializing 'struct iommu_domain *' with an expression of type 'int' [-Wint-conversion] 87 | struct iommu_domain *domain = iommu_get_dma_domain(dev); | ^ ~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning and 2 errors generated. -- >> kernel/dma/contiguous.c:228:6: error: use of undeclared identifier 'is_zhaoxin_kh40000' 228 | if (is_zhaoxin_kh40000) | ^ 1 error generated. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for CRYPTO_CRC32C_INTEL Depends on [n]: CRYPTO [=y] && !KMSAN [=y] && X86 [=y] Selected by [y]: - ISCSI_TARGET [=y] && TARGET_CORE [=y] && INET [=y] && X86 [=y] vim +/iommu_get_dma_domain +87 arch/x86/kernel/zhaoxin_kh40000.c 64 65 static void kh40000_sync_single_dma_for_cpu(struct device *dev, dma_addr_t paddr, 66 enum dma_data_direction dir, bool is_iommu) 67 { 68 u8 vid; 69 struct pci_dev *pci; 70 u64 dma_mask = *dev->dma_mask; 71 72 /* check direction */ 73 if ((dir != DMA_FROM_DEVICE) && (dir != DMA_BIDIRECTIONAL)) 74 return; 75 76 /* check dma capability */ 77 if (dma_mask <= DMA_BIT_MASK(32)) 78 return; 79 80 /* check device type */ 81 pci = kh40000_get_pci_dev(dev); 82 if (pci == NULL) 83 return; 84 85 /* get real physical address */ 86 if (is_iommu) { > 87 struct iommu_domain *domain = iommu_get_dma_domain(dev); 88 89 paddr = iommu_iova_to_phys(domain, paddr); 90 if (!paddr) 91 return; 92 } 93 94 /* check node or not */ 95 if ((zhaoxin_patch_code & ZHAOXIN_P2CW_NODE_CHECK) 96 && pfn_to_nid(PFN_DOWN(paddr)) == dev_to_node(dev)) 97 return; 98 99 /* flush data by one pci read cycle */ 100 pci_read_config_byte(pci, PCI_VENDOR_ID, &vid); 101 } 102 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 9639/9669] drivers/iommu/iommu.c:1141:undefined reference to `iova_reserve_domain_addr'
by kernel test robot 20 May '24

20 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: bb74bc369fd2ab5f41a32c4ddc2e23bc76c3c550 commit: 40c9fc02b0564bbcbc3fc6e14f3aea3639f0afa6 [9639/9669] iommu/vt-d: Add support for detecting ACPI namespace device in RMRR config: x86_64-randconfig-161-20240520 (https://download.01.org/0day-ci/archive/20240520/202405202025.9w8wgmwQ-lkp@…) compiler: gcc-7 (Ubuntu 7.5.0-6ubuntu2) 7.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240520/202405202025.9w8wgmwQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405202025.9w8wgmwQ-lkp@intel.com/ All errors (new ones prefixed by >>): ld: drivers/iommu/iommu.o: in function `iommu_create_device_direct_mappings': >> drivers/iommu/iommu.c:1141:(.text+0x263a): undefined reference to `iova_reserve_domain_addr' vim +1141 drivers/iommu/iommu.c 1085 1086 static int iommu_create_device_direct_mappings(struct iommu_domain *domain, 1087 struct device *dev) 1088 { 1089 struct iommu_resv_region *entry; 1090 struct list_head mappings; 1091 unsigned long pg_size; 1092 int ret = 0; 1093 1094 pg_size = domain->pgsize_bitmap ? 1UL << __ffs(domain->pgsize_bitmap) : 0; 1095 INIT_LIST_HEAD(&mappings); 1096 1097 if (WARN_ON_ONCE(iommu_is_dma_domain(domain) && !pg_size)) 1098 return -EINVAL; 1099 1100 iommu_get_resv_regions(dev, &mappings); 1101 1102 /* We need to consider overlapping regions for different devices */ 1103 list_for_each_entry(entry, &mappings, list) { 1104 dma_addr_t start, end, addr; 1105 size_t map_size = 0; 1106 1107 if (entry->type == IOMMU_RESV_DIRECT) 1108 dev->iommu->require_direct = 1; 1109 1110 if ((entry->type != IOMMU_RESV_DIRECT && 1111 entry->type != IOMMU_RESV_DIRECT_RELAXABLE) || 1112 !iommu_is_dma_domain(domain)) 1113 continue; 1114 1115 start = ALIGN(entry->start, pg_size); 1116 end = ALIGN(entry->start + entry->length, pg_size); 1117 1118 for (addr = start; addr <= end; addr += pg_size) { 1119 phys_addr_t phys_addr; 1120 1121 if (addr == end) 1122 goto map_end; 1123 1124 phys_addr = iommu_iova_to_phys(domain, addr); 1125 if (!phys_addr) { 1126 map_size += pg_size; 1127 continue; 1128 } 1129 1130 map_end: 1131 if (map_size) { 1132 ret = iommu_map(domain, addr - map_size, 1133 addr - map_size, map_size, 1134 entry->prot, GFP_KERNEL); 1135 if (ret) 1136 goto out; 1137 map_size = 0; 1138 } 1139 } 1140 if (apply_zhaoxin_dmar_acpi_a_behavior()) > 1141 iova_reserve_domain_addr(domain, start, end); 1142 } 1143 1144 if (!list_empty(&mappings) && iommu_is_dma_domain(domain)) 1145 iommu_flush_iotlb_all(domain); 1146 1147 out: 1148 iommu_put_resv_regions(dev, &mappings); 1149 1150 return ret; 1151 } 1152 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 00/61] mm/page_onwer: support recording and
by Jinjiang Tu 20 May '24

20 May '24

Support page_owner_module feature. Akira Yokosawa (2): docs: vm/page_owner: use literal blocks for param description docs: vm/page_owner: tweak literal block in STANDARD FORMAT SPECIFIERS Charan Teja Kalla (2): mm: fix use-after free of page_ext after race with memory-offline mm/page_exit: fix kernel doc warning in page_ext_put() Chen Xiao (1): docs: mm/page_owner: fix spelling mistakes Chongxi Zhao (1): tools/vm/page_owner_sort.c: support sorting pid and time Eric Dumazet (1): mm/page_owner: use strscpy() instead of strlcpy() Haowen Bai (1): tools/vm/page_owner: support debug log to avoid huge log print Hyeonggon Yoo (1): mm/page_owner: record single timestamp value for high order allocations Jiajian Ye (9): tools/vm/page_owner_sort.c: add a security check tools/vm/page_owner_sort.c: support sorting by tgid and update documentation tools/vm/page_owner_sort: fix three trivival places tools/vm/page_owner_sort: support for sorting by task command name tools/vm/page_owner_sort.c: support for selecting by PID, TGID or task command name tools/vm/page_owner_sort.c: support for user-defined culling rules tools/vm/page_owner_sort.c: use fprintf() to send error messages to stderr tools/vm/page_owner_sort.c: support for multi-value selection in single argument tools/vm/page_owner_sort.c: support sorting blocks by multiple keys Jianlin Lv (1): tools/vm/page_owner_sort: free memory before exit Jinjiang Tu (11): mm/page_owner: support identifying pages allocated by modules mm/page_owner: support filtering by modules when dumping page_owner mm/page_owner: show top modules allocating pages when oom occurred mm/page_owner: support configuring the num of modules to dump mm/page_owner: supporting showing the module statistics via debugfs mm/page_owner: record leaked module into individual list Documentation: update page_owner document for module statistics tools/vm/page_owner_sort: support for selecting by module name tools/vm/page_owner_sort: support for culling by module name tools/vm/page_owner_sort: support sorting by module name Documentation: update document for page_owner_sort tool Jonathan Corbet (1): docs: fix RST error in vm/page_owner.rst Sean Anderson (2): tools/vm/page_owner_sort.c: sort by stacktrace before culling tools/vm/page_owner_sort.c: support sorting by stack trace Sergei Trofimovich (1): mm: page_owner: detect page_owner recursion via task_struct Shenghong Han (2): tools/vm/page_owner_sort.c: two trivial fixes Documentation/vm/page_owner.rst: update the documentation Steve Chou (1): tools/mm/page_owner_sort.c: fix TGID output when cull=tg is used Tang Bin (1): tools/vm/page_owner_sort.c: check malloc() return Ting Liu (1): mm: make some vars and functions static or __init Vijayanand Jitta (2): lib: stackdepot: add support to disable stack depot lib: stackdepot: fix ignoring return value warning Ville Syrjälä (1): drm/i915: Fix oops due to missing stack depot Vlastimil Babka (3): lib/stackdepot: allow optional init and stack_table allocation by kvmalloc() lib/stackdepot: allow requesting early initialization dynamically lib/stackdepot: replace CONFIG_STACK_HASH_ORDER with automatic sizing Waiman Long (3): mm/page_owner: use scnprintf() to avoid excessive buffer overrun check mm/page_owner: print memcg information mm/page_owner: record task command name Yinan Zhang (3): tools/vm/page_owner_sort.c: add switch between culling by stacktrace and txt tools/vm/page_owner_sort.c: remove -c option doc/vm/page_owner.rst: remove content related to -c option Yixuan Cao (7): mm/page_owner.c: record tgid tools/vm/page_owner_sort.c: delete invalid duplicate code tools/vm/page_owner_sort.c: fix the instructions for use tools/vm/page_owner_sort.c: provide allocator labelling and update --cull and --sort options tools/vm/page_owner_sort.c: avoid repeated judgments tools/vm/page_owner_sort.c: adjust the indent in is_need() tools/vm/page_owner_sort: fix -f option Yogesh Lal (1): lib: stackdepot: add support to configure STACK_HASH_SIZE Zhenhua Huang (1): mm/page_owner.c: remove redundant drain_all_pages Zhenliang Wei (1): tools/vm/page_owner_sort.c: count and sort by mem .../admin-guide/kernel-parameters.txt | 6 + Documentation/vm/page_owner.rst | 129 ++- drivers/gpu/drm/drm_dp_mst_topology.c | 1 + drivers/gpu/drm/drm_mm.c | 4 + drivers/gpu/drm/i915/intel_runtime_pm.c | 1 + include/linux/page_ext.h | 17 +- include/linux/page_idle.h | 34 +- include/linux/sched.h | 3 + include/linux/stackdepot.h | 34 +- init/main.c | 9 +- lib/Kconfig | 4 + lib/Kconfig.kasan | 4 +- lib/stackdepot.c | 126 ++- mm/Kconfig.debug | 9 + mm/Makefile | 1 + mm/page_ext.c | 108 ++- mm/page_owner.c | 209 ++-- mm/page_owner.h | 71 ++ mm/page_owner_module.c | 402 ++++++++ tools/vm/page_owner_sort.c | 904 +++++++++++++++++- 20 files changed, 1927 insertions(+), 149 deletions(-) create mode 100644 mm/page_owner.h create mode 100644 mm/page_owner_module.c -- 2.25.1

2 62

[PATCH OLK-6.6 0/2] memcg_swap_qos: Backport two bugfix
by Liu Shixin 20 May '24

20 May '24

Backport two bugfix for memcg_swap_qos feature. Liu Shixin (2): memcg: fix incorrect value of sysctl_memcg_swap_qos_stat mm/swapfile: fix infinite loop in get_swap_pages after set memory.swapfile mm/memcontrol.c | 28 +++++++++++++++++++--------- mm/swapfile.c | 8 +++----- 2 files changed, 22 insertions(+), 14 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 00/10] Introduce NUMA isolation and consolidation
by Hui Tang 20 May '24

20 May '24

Introduce NUMA isolation and consolidation. Guan Jing (1): sched: Add can_migrate_task hook Hui Tang (9): sched: Introduce CONFIG_TASK_PLACEMENT_BY_CPU_RANGE sched: Some fixes for select_rq hook bpf:programmable: Add nodemask operation collection sched: Introduce task relationship by net and memory bpf:programmable: Add helper to get memory and net relationship sched: Add ioctl to get relationship sched: Update numa group preferred node periodically bpf:programmable: Add helper to set preferred node sched: Introduce CONFIG_QOS_SCHED_NUMA_ICON fs/exec.c | 2 + include/linux/sched.h | 58 +++- include/linux/sched/relationship.h | 202 +++++++++++++ include/linux/sched_hook_defs.h | 4 + include/uapi/linux/bpf.h | 50 ++++ include/uapi/linux/sched_ctrl.h | 57 ++++ init/Kconfig | 28 ++ init/init_task.c | 3 + kernel/fork.c | 13 + kernel/sched/Makefile | 2 + kernel/sched/bpf_sched.c | 149 ++++++++++ kernel/sched/core.c | 7 + kernel/sched/debug.c | 2 + kernel/sched/fair.c | 302 ++++++++++++++++++-- kernel/sched/numa_icon.c | 144 ++++++++++ kernel/sched/numa_icon.h | 43 +++ kernel/sched/relationship.c | 436 +++++++++++++++++++++++++++++ kernel/sched/relationship_ioctl.c | 142 ++++++++++ kernel/sched/sched.h | 2 + scripts/bpf_helpers_doc.py | 12 + tools/include/uapi/linux/bpf.h | 50 ++++ tools/lib/bpf/libbpf_sched.h | 160 ++++++++++- 22 files changed, 1843 insertions(+), 25 deletions(-) create mode 100644 include/linux/sched/relationship.h create mode 100644 include/uapi/linux/sched_ctrl.h create mode 100644 kernel/sched/numa_icon.c create mode 100644 kernel/sched/numa_icon.h create mode 100644 kernel/sched/relationship.c create mode 100644 kernel/sched/relationship_ioctl.c -- 2.34.1

2 11

[PATCH OLK-5.10] irqchip/gic-v3-its: Prevent double free on error
by Liu Mingrui 20 May '24

20 May '24

From: Guanrui Huang <guanrui.huang(a)linux.alibaba.com> stable inclusion from stable-v5.10.216 commit aa44d21574751a7d6bca892eb8e0e9ac68372e52 category: bugfix bugzilla: 189928 CVE: CVE-2024-35847 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c26591afd33adce296c022e3480dea4282b7ef91 upstream. The error handling path in its_vpe_irq_domain_alloc() causes a double free when its_vpe_init() fails after successfully allocating at least one interrupt. This happens because its_vpe_irq_domain_free() frees the interrupts along with the area bitmap and the vprop_page and its_vpe_irq_domain_alloc() subsequently frees the area bitmap and the vprop_page again. Fix this by unconditionally invoking its_vpe_irq_domain_free() which handles all cases correctly and by removing the bitmap/vprop_page freeing from its_vpe_irq_domain_alloc(). [ tglx: Massaged change log ] Fixes: 7d75bbb4bc1a ("irqchip/gic-v3-its: Add VPE irq domain allocation/teardown") Signed-off-by: Guanrui Huang <guanrui.huang(a)linux.alibaba.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Reviewed-by: Marc Zyngier <maz(a)kernel.org> Reviewed-by: Zenghui Yu <yuzenghui(a)huawei.com> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240418061053.96803-2-guanrui.huang@linux.alibab… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/irqchip/irq-gic-v3-its.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index 806359f3376a..8a716da480b0 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -5210,13 +5210,8 @@ static int its_vpe_irq_domain_alloc(struct irq_domain *domain, unsigned int virq set_bit(i, bitmap); } - if (err) { - if (i > 0) - its_vpe_irq_domain_free(domain, virq, i); - - its_lpi_free(bitmap, base, nr_ids); - its_free_prop_table(vprop_page); - } + if (err) + its_vpe_irq_domain_free(domain, virq, i); return err; } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function
by Luo Gengkun 20 May '24

20 May '24

From: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> mainline inclusion from mainline-v6.8-rc1 commit ce3e112e7ae854249d8755906acc5f27e1542114 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9GI CVE: CVE-2023-52694 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- With tpd12s015_remove() marked with __exit this function is discarded when the driver is compiled as a built-in. The result is that when the driver unbinds there is no cleanup done which results in resource leakage or worse. Fixes: cff5e6f7e83f ("drm/bridge: Add driver for the TI TPD12S015 HDMI level shifter") Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de> Link: https://patchwork.freedesktop.org/patch/msgid/20231102165640.3307820-19-u.k… Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/gpu/drm/bridge/ti-tpd12s015.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/bridge/ti-tpd12s015.c b/drivers/gpu/drm/bridge/ti-tpd12s015.c index e0e015243a60..b588fea12502 100644 --- a/drivers/gpu/drm/bridge/ti-tpd12s015.c +++ b/drivers/gpu/drm/bridge/ti-tpd12s015.c @@ -179,7 +179,7 @@ static int tpd12s015_probe(struct platform_device *pdev) return 0; } -static int __exit tpd12s015_remove(struct platform_device *pdev) +static int tpd12s015_remove(struct platform_device *pdev) { struct tpd12s015_device *tpd = platform_get_drvdata(pdev); @@ -197,7 +197,7 @@ MODULE_DEVICE_TABLE(of, tpd12s015_of_match); static struct platform_driver tpd12s015_driver = { .probe = tpd12s015_probe, - .remove = __exit_p(tpd12s015_remove), + .remove = tpd12s015_remove, .driver = { .name = "tpd12s015", .of_match_table = tpd12s015_of_match, -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] irqchip/gic-v3-its: Prevent double free on error
by Liu Mingrui 20 May '24

20 May '24

From: Guanrui Huang <guanrui.huang(a)linux.alibaba.com> stable inclusion from stable-v5.10.216 commit aa44d21574751a7d6bca892eb8e0e9ac68372e52 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9HX CVE: CVE-2024-35847 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c26591afd33adce296c022e3480dea4282b7ef91 upstream. The error handling path in its_vpe_irq_domain_alloc() causes a double free when its_vpe_init() fails after successfully allocating at least one interrupt. This happens because its_vpe_irq_domain_free() frees the interrupts along with the area bitmap and the vprop_page and its_vpe_irq_domain_alloc() subsequently frees the area bitmap and the vprop_page again. Fix this by unconditionally invoking its_vpe_irq_domain_free() which handles all cases correctly and by removing the bitmap/vprop_page freeing from its_vpe_irq_domain_alloc(). [ tglx: Massaged change log ] Fixes: 7d75bbb4bc1a ("irqchip/gic-v3-its: Add VPE irq domain allocation/teardown") Signed-off-by: Guanrui Huang <guanrui.huang(a)linux.alibaba.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Reviewed-by: Marc Zyngier <maz(a)kernel.org> Reviewed-by: Zenghui Yu <yuzenghui(a)huawei.com> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240418061053.96803-2-guanrui.huang@linux.alibab… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/irqchip/irq-gic-v3-its.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index 71e1689a32e7..1f157bf54ce1 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -3509,13 +3509,8 @@ static int its_vpe_irq_domain_alloc(struct irq_domain *domain, unsigned int virq set_bit(i, bitmap); } - if (err) { - if (i > 0) - its_vpe_irq_domain_free(domain, virq, i); - - its_lpi_free(bitmap, base, nr_ids); - its_free_prop_table(vprop_page); - } + if (err) + its_vpe_irq_domain_free(domain, virq, i); return err; } -- 2.25.1

2 1