- Kernel - mailweb.openeuler.org

[PATCH openEuler-22.09] Add openEuler header script for LoongArch
by Zheng Zengkai 13 Sep '22

13 Sep '22

Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- add-openeuler-head_loongarch.py | 39 +++++++++++++++++++ modify_message_loongarch.py | 62 ++++++++++++++++++++++++++++++ usage | 68 +++++++++++++++++++++++++++++++++ 3 files changed, 169 insertions(+) create mode 100755 add-openeuler-head_loongarch.py create mode 100755 modify_message_loongarch.py create mode 100644 usage diff --git a/add-openeuler-head_loongarch.py b/add-openeuler-head_loongarch.py new file mode 100755 index 000000000000..8219f6b6d8d2 --- /dev/null +++ b/add-openeuler-head_loongarch.py @@ -0,0 +1,39 @@ +#!/usr/local/bin/python3 + +import argparse +import sys +import os +import textwrap + +dir = os.path.split(os.path.realpath(__file__))[0] + +def parser_arg(): + parser = argparse.ArgumentParser( + formatter_class=argparse.RawDescriptionHelpFormatter, + description=textwrap.dedent('''\ + Use git rebase to add header for commits on current branch + Note: + Make sure modify_message_loonarch.py be in the same dir + ''')) + + parser.add_argument('-n', type=str, default="", help='add head to last n patch') + parser.add_argument('--bugzilla', type=str, help='bugzilla id', required=True) + return parser.parse_args() + +def main(): + args = parser_arg() + + if args.n == "": + args.n = os.popen("git log --oneline origin/openEuler-22.09..HEAD | wc -l").readline().strip("\n") + + command ="git rebase --onto HEAD~" + args.n + " HEAD~" + args.n + " --exec \"" + command += dir + "/modify_message_loongarch.py " + command += " --bugzilla " + args.bugzilla + " " + command += "\"" + print(command) + os.system(command) + +if __name__ == "__main__": + # execute only if run as a script + main() + diff --git a/modify_message_loongarch.py b/modify_message_loongarch.py new file mode 100755 index 000000000000..6853178794f7 --- /dev/null +++ b/modify_message_loongarch.py @@ -0,0 +1,62 @@ +#!/usr/local/bin/python3 + +import argparse +import sys +import os +import re + +def parser_arg(): + parser = argparse.ArgumentParser(description='add head to last patch') + parser.add_argument('--bugzilla', type=str, help='bugzilla id', required=True) + return parser.parse_args() + +args = parser_arg() + +def add_head_loongarch(title): + head = [ + "LoongArch inclusion\n", + "category: feature\n", + "bugzilla: " + args.bugzilla + "\n", + "\n", + "--------------------------------\n", + "\n", + ] + return head + +def add_head(): + MSG = ".git/TEMP_COMMIT_MSG" + message = os.popen("git log -n 1 --pretty=%B").readlines() + find = 0 + + title = message[0].strip("\n"); + + # there is areadly a head + if title[0] == "[": + return + + if find == 0: + head = add_head_loongarch(title) + if head: + find = 1 + + if message[1] == "\t\n": + post = 1; + else: + post = 2; + + message[post:post] = head + + f = open(MSG, 'w') + for line in message: + f.write(line) + f.close() + + os.system("git commit --amend -F " + MSG) + +def main(): + add_head() + return 0 + +if __name__ == "__main__": + # execute only if run as a script + main() diff --git a/usage b/usage new file mode 100644 index 000000000000..97c9bd7e05da --- /dev/null +++ b/usage @@ -0,0 +1,68 @@ +Usage: +./add-openeuler-head_loongarch.py -n=2 --bugzilla=https://gitee.com/openeuler/kernel/issues/I5OHOB + +-n to specify the number of patches to add header to. + +before adding header: + +commit f0f6daca3f4677e3aa2817e204e2281d0d999614 +Author: Hongchen Zhang <zhanghongchen(a)loongson.cn> +Date: Thu Sep 8 14:32:38 2022 +0800 + + irqchip: fix phytium 2500 compile error + + commit 75378552d2ee ("APCI: irq: Add support for multiple GSI domains") + changed the parameter type,fix it accordingly. + + Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> + +commit 6c3213c6068534e84e65cf1f2aff0ed18810cc4b +Author: Hongchen Zhang <zhanghongchen(a)loongson.cn> +Date: Wed Sep 7 13:24:03 2022 +0800 + + LoongArch: defconfig: add openeuler default config + + add openeuler default config for LoongArch,the difference with + loongson3_defconfig is following: + CONFIG_DEBUG_INFO=y + CONFIG_MODULE_SIG=y + + Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> + +After adding header: + +commit 94e56df31f6c6b8177687b7f7db6362d62183cd5 (HEAD -> openEuler-22.09) +Author: Hongchen Zhang <zhanghongchen(a)loongson.cn> +Date: Thu Sep 8 14:32:38 2022 +0800 + + irqchip: fix phytium 2500 compile error + + LoongArch inclusion + category: feature + bugzilla: https://gitee.com/openeuler/kernel/issues/I5OHOB + + -------------------------------- + + commit 75378552d2ee ("APCI: irq: Add support for multiple GSI domains") + changed the parameter type,fix it accordingly. + + Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> + +commit 7e7e79233dce5cef575c35ab40b67982919eb1ca +Author: Hongchen Zhang <zhanghongchen(a)loongson.cn> +Date: Wed Sep 7 13:24:03 2022 +0800 + + LoongArch: defconfig: add openeuler default config + + LoongArch inclusion + category: feature + bugzilla: https://gitee.com/openeuler/kernel/issues/I5OHOB + + -------------------------------- + + add openeuler default config for LoongArch,the difference with + loongson3_defconfig is following: + CONFIG_DEBUG_INFO=y + CONFIG_MODULE_SIG=y + + Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> -- 2.20.1

1 0

[PATCH openEuler-22.09 0/6] tools/bpftool: Add BTF_KIND_FLOAT support
by Zheng Zengkai 08 Sep '22

08 Sep '22

Some BPF programs compiled on s390 fail to load, because s390 arch-specific linux headers contain float and double types. Introduce support for such types by representing them using the new BTF_KIND_FLOAT. This series deals with libbpf, bpftool, in-kernel BTF parser as well as selftests and documentation. Ilya Leoshkevich (6): tools/bpftool: Add BTF_KIND_FLOAT support selftests/bpf: Use the 25th bit in the "invalid BTF_INFO" test bpf: Add BTF_KIND_FLOAT support selftest/bpf: Add BTF_KIND_FLOAT tests selftests/bpf: Add BTF_KIND_FLOAT to the existing deduplication tests bpf: Document BTF_KIND_FLOAT in btf.rst Documentation/bpf/btf.rst | 17 +- kernel/bpf/btf.c | 83 ++++++++- tools/bpf/bpftool/btf.c | 8 + tools/bpf/bpftool/btf_dumper.c | 1 + tools/testing/selftests/bpf/btf_helpers.c | 4 + tools/testing/selftests/bpf/prog_tests/btf.c | 176 +++++++++++++++++-- tools/testing/selftests/bpf/test_btf.h | 3 + 7 files changed, 275 insertions(+), 17 deletions(-) -- 2.20.1

1 6

[OLK-5.10,0/3] Fix CVE-2022-2586
by Lu Wei 07 Sep '22

07 Sep '22

Thadeu Lima de Souza Cascardo (3): netfilter: nf_tables: do not allow SET_ID to refer to another table netfilter: nf_tables: do not allow CHAIN_ID to refer to another table netfilter: nf_tables: do not allow RULE_ID to refer to another chain net/netfilter/nf_tables_api.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) -- 2.31.1

1 3

[PATCH openEuler-5.10-LTS 1/3] netfilter: nf_tables: do not allow SET_ID to refer to another table
by Zheng Zengkai 07 Sep '22

07 Sep '22

From: Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> mainline inclusion from mainline-v6.0-rc1 commit 470ee20e069a6d05ae549f7d0ef2bdbcee6a81b2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5MEZD CVE: CVE-2022-2586 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When doing lookups for sets on the same batch by using its ID, a set from a different table can be used. Then, when the table is removed, a reference to the set may be kept after the set is freed, leading to a potential use-after-free. When looking for sets by ID, use the table that was used for the lookup by name, and only return sets belonging to that same table. This fixes CVE-2022-2586, also reported as ZDI-CAN-17470. Reported-by: Team Orca of Sea Security (@seasecresponse) Fixes: 958bee14d071 ("netfilter: nf_tables: use new transaction infrastructure to handle sets") Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> conflict: net/netfilter/nf_tables_api.c Signed-off-by: Lu Wei <luwei32(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- net/netfilter/nf_tables_api.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 560a93aad5b6..7b0497da2d94 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -3638,6 +3638,7 @@ static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table, } static struct nft_set *nft_set_lookup_byid(const struct net *net, + const struct nft_table *table, const struct nlattr *nla, u8 genmask) { struct nft_trans *trans; @@ -3648,6 +3649,7 @@ static struct nft_set *nft_set_lookup_byid(const struct net *net, struct nft_set *set = nft_trans_set(trans); if (id == nft_trans_set_id(trans) && + set->table == table && nft_active_genmask(set, genmask)) return set; } @@ -3668,7 +3670,7 @@ struct nft_set *nft_set_lookup_global(const struct net *net, if (!nla_set_id) return set; - set = nft_set_lookup_byid(net, nla_set_id, genmask); + set = nft_set_lookup_byid(net, table, nla_set_id, genmask); } return set; } -- 2.20.1

1 2

[PATCH openEuler-1.0-LTS 00/64] linux-4.19.y inclusion
by Yongqiang Liu 07 Sep '22

07 Sep '22

*** BLURB HERE *** Chen Zhongjin (2): profiling: fix shift too large makes kernel panic kprobes: Forbid probing on trampoline and BPF code areas Dan Carpenter (1): kfifo: fix kfifo_to_user() return type David Howells (1): vfs: Check the truncate maximum size in inode_newsize_ok() Duoming Zhou (1): mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release Eric Dumazet (1): tcp: fix over estimation in sk_forced_mem_schedule() Eric Whitney (1): ext4: fix extent status tree race in writeback error recovery path Hector Martin (1): locking/atomic: Make test_and_*_bit() ordered on failure Ilpo Järvinen (1): serial: 8250_dw: Store LSR into lsr_saved_flags in dw8250_tx_wait_empty() Jason A. Donenfeld (1): fs: check FMODE_LSEEK to control internal pipe splicing Johan Hovold (1): x86/pmem: Fix platform-device leak in error path Kiselev, Oleg (1): ext4: avoid resizing to a partial cluster size Kuniyuki Iwashima (36): ip: Fix data-races around sysctl_ip_fwd_use_pmtu. ip: Fix data-races around sysctl_ip_nonlocal_bind. ip: Fix a data-race around sysctl_fwmark_reflect. tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept. tcp: Fix data-races around sysctl_tcp_mtu_probing. tcp: Fix a data-race around sysctl_tcp_probe_threshold. tcp: Fix a data-race around sysctl_tcp_probe_interval. igmp: Fix data-races around sysctl_igmp_llm_reports. igmp: Fix a data-race around sysctl_igmp_max_memberships. tcp: Fix data-races around sysctl_tcp_reordering. tcp: Fix data-races around some timeout sysctl knobs. tcp: Fix a data-race around sysctl_tcp_notsent_lowat. tcp: Fix a data-race around sysctl_tcp_tw_reuse. tcp: Fix data-races around sysctl_tcp_fastopen. tcp: Fix a data-race around sysctl_tcp_early_retrans. tcp: Fix data-races around sysctl_tcp_recovery. tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts. tcp: Fix data-races around sysctl_tcp_slow_start_after_idle. tcp: Fix a data-race around sysctl_tcp_retrans_collapse. tcp: Fix a data-race around sysctl_tcp_stdurg. tcp: Fix a data-race around sysctl_tcp_rfc1337. tcp: Fix data-races around sysctl_tcp_max_reordering. tcp: Fix data-races around sysctl_tcp_dsack. tcp: Fix a data-race around sysctl_tcp_app_win. tcp: Fix a data-race around sysctl_tcp_adv_win_scale. tcp: Fix a data-race around sysctl_tcp_frto. tcp: Fix a data-race around sysctl_tcp_nometrics_save. tcp: Fix a data-race around sysctl_tcp_challenge_ack_limit. net: ping6: Fix memleak in ipv6_renew_options(). igmp: Fix data-races around sysctl_igmp_qrv. tcp: Fix a data-race around sysctl_tcp_min_tso_segs. tcp: Fix a data-race around sysctl_tcp_min_rtt_wlen. tcp: Fix a data-race around sysctl_tcp_autocorking. tcp: Fix a data-race around sysctl_tcp_invalid_ratelimit. tcp: Fix a data-race around sysctl_tcp_comp_sack_delay_ns. tcp: Fix a data-race around sysctl_tcp_comp_sack_nr. Lukas Czerner (1): ext4: make sure ext4_append() always allocates new block Matthias May (1): geneve: do not use RT_TOS for IPv6 flowlabel Miaohe Lin (1): mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region Nicolas Saenz Julienne (1): nohz/full, sched/rt: Fix missed tick-reenabling bug in dequeue_task_rt() Theodore Ts'o (1): ext4: update s_overhead_clusters in the superblock during an on-line resize Trond Myklebust (2): NFSv4/pnfs: Fix a use-after-free bug in open SUNRPC: Reinitialise the backchannel request buffers before reuse Uwe Kleine-König (1): mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()'s error path Vincent Mailhol (1): can: error: specify the values of data[5..7] of CAN error frames Wang Cheng (1): mm/mempolicy: fix uninit-value in mpol_rebind_policy() Xiu Jianfeng (1): selinux: Add boundary check in put_entry() Yang Xu (1): fs: Add missing umask strip in vfs_tmpfile Yang Yingliang (1): bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe() Yonglong Li (1): tcp: make retransmitted SKB fit into the send window Zhang Xianwei (1): NFSv4.1: RECLAIM_COMPLETE must handle EACCES huhai (1): ACPI: LPSS: Fix missing check in register_device_clock() Documentation/atomic_bitops.txt | 2 +- arch/x86/kernel/pmem.c | 7 ++++- drivers/acpi/acpi_lpss.c | 3 ++ drivers/bus/hisi_lpc.c | 10 +++--- drivers/mtd/devices/st_spi_fsm.c | 8 +++-- drivers/mtd/sm_ftl.c | 2 +- drivers/net/geneve.c | 3 +- drivers/tty/serial/8250/8250_dw.c | 3 ++ fs/attr.c | 2 ++ fs/ext4/inode.c | 7 +++++ fs/ext4/namei.c | 16 ++++++++++ fs/ext4/resize.c | 11 +++++++ fs/namei.c | 2 ++ fs/nfs/nfs4proc.c | 14 ++++++--- fs/splice.c | 10 +++--- include/asm-generic/bitops/atomic.h | 6 ---- include/linux/kfifo.h | 2 +- include/net/inet_sock.h | 5 +-- include/net/ip.h | 4 +-- include/net/tcp.h | 11 ++++--- include/uapi/linux/can/error.h | 5 ++- kernel/kprobes.c | 3 +- kernel/profile.c | 7 +++++ kernel/sched/rt.c | 15 +++++---- mm/mempolicy.c | 2 +- mm/mmap.c | 1 - net/ipv4/af_inet.c | 2 +- net/ipv4/igmp.c | 47 +++++++++++++++++------------ net/ipv4/route.c | 2 +- net/ipv4/tcp.c | 12 +++++--- net/ipv4/tcp_fastopen.c | 4 +-- net/ipv4/tcp_input.c | 39 ++++++++++++++---------- net/ipv4/tcp_ipv4.c | 2 +- net/ipv4/tcp_metrics.c | 5 +-- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/tcp_output.c | 46 +++++++++++++++++----------- net/ipv4/tcp_recovery.c | 6 ++-- net/ipv4/tcp_timer.c | 14 ++++----- net/ipv6/ping.c | 6 ++++ net/sctp/protocol.c | 2 +- net/sunrpc/backchannel_rqst.c | 14 +++++++++ security/selinux/ss/policydb.h | 2 ++ 42 files changed, 240 insertions(+), 126 deletions(-) -- 2.25.1

1 64

[PATCH openEuler-1.0-LTS 00/13] ACPI and block bugfix from mainline
by Yongqiang Liu 07 Sep '22

07 Sep '22

Chunguang Xu (1): block: fix the problem of io_ticks becoming smaller Dan Carpenter (1): acpi/nfit: improve bounds checking for 'func' Erik Kaneda (2): ACPICA: Do not increment operation_region reference counts for field units ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1 Francesco Pollicino (1): block, bfq: save & resume weight on a queue merge/split Jiasheng Jiang (1): ACPI: APD: Check for NULL pointer after calling devm_ioremap() Mark Langsdorf (2): ACPI: custom_method: fix a possible memory leak ACPI: custom_method: fix potential use-after-free issue Maximilian Luz (1): ACPICA: Fix exception code class checks Qinglang Miao (1): ACPI: configfs: add missing check after configfs_register_default_group() Robin Murphy (1): ACPI/IORT: Check node revision for PMCG resources Tuan Phan (1): ACPI/IORT: Fix PMCG node single ID mapping handling zhengbin (1): blk-mq: Fix memory leak in blk_mq_init_allocated_queue error handling block/bfq-iosched.c | 2 ++ block/bfq-iosched.h | 9 +++++++++ block/bio.c | 2 +- block/blk-mq.c | 9 ++++++--- drivers/acpi/acpi_apd.c | 2 ++ drivers/acpi/acpi_configfs.c | 7 ++++++- drivers/acpi/acpica/dsfield.c | 2 +- drivers/acpi/acpica/dswload.c | 21 +++++++++++++++++++++ drivers/acpi/acpica/exprep.c | 4 ---- drivers/acpi/acpica/utdelete.c | 6 +----- drivers/acpi/arm64/iort.c | 19 ++++++++++++++++--- drivers/acpi/custom_method.c | 4 +++- drivers/acpi/nfit/core.c | 7 ++++--- drivers/acpi/nfit/nfit.h | 1 + include/acpi/acexcep.h | 10 +++++----- 15 files changed, 78 insertions(+), 27 deletions(-) -- 2.25.1

1 13

[PATCH openEuler-1.0-LTS 0/4] fix openEuler-1.0-LTS
by tangbin 07 Sep '22

07 Sep '22

When use openEuler-1.0-LTS kernel in euler22.03, we found it unable to compile and boot, thus fix it. Andy Lutomirski (1): x86/entry/64: Don't compile ignore_sysret if 32-bit emulation is enabled Aristeu Rozanski (1): EDAC: skx_common: downgrade message importance on missing PCI device Borislav Petkov (1): x86: Fix early boot crash on gcc-10, third try Josh Poimboeuf (1): objtool: Don't fail on missing symbol table arch/x86/entry/entry_64.S | 6 ++++++ arch/x86/include/asm/stackprotector.h | 7 ++++++- arch/x86/kernel/smpboot.c | 8 ++++++++ arch/x86/xen/smp_pv.c | 1 + drivers/edac/skx_common.c | 2 +- include/linux/compiler.h | 6 ++++++ init/main.c | 2 ++ tools/objtool/elf.c | 7 +++++-- 8 files changed, 35 insertions(+), 4 deletions(-) -- 2.18.4

1 4

[PATCH openEuler-1.0-LTS 1/3] usb: gadget: function: printer: fix use-after-free in __lock_acquire
by Yongqiang Liu 07 Sep '22

07 Sep '22

From: Zqiang <qiang.zhang(a)windriver.com> stable inclusion from stable-v4.19.154 commit cedb0187b8ba929c3f76f28e6bc25804d65f8a54 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5PB1E CVE: CVE-2020-27784 --------------------------- [ Upstream commit e8d5f92b8d30bb4ade76494490c3c065e12411b1 ] Fix this by increase object reference count. BUG: KASAN: use-after-free in __lock_acquire+0x3fd4/0x4180 kernel/locking/lockdep.c:3831 Read of size 8 at addr ffff8880683b0018 by task syz-executor.0/3377 CPU: 1 PID: 3377 Comm: syz-executor.0 Not tainted 5.6.11 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xce/0x128 lib/dump_stack.c:118 print_address_description.constprop.4+0x21/0x3c0 mm/kasan/report.c:374 __kasan_report+0x131/0x1b0 mm/kasan/report.c:506 kasan_report+0x12/0x20 mm/kasan/common.c:641 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:135 __lock_acquire+0x3fd4/0x4180 kernel/locking/lockdep.c:3831 lock_acquire+0x127/0x350 kernel/locking/lockdep.c:4488 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x35/0x50 kernel/locking/spinlock.c:159 printer_ioctl+0x4a/0x110 drivers/usb/gadget/function/f_printer.c:723 vfs_ioctl fs/ioctl.c:47 [inline] ksys_ioctl+0xfb/0x130 fs/ioctl.c:763 __do_sys_ioctl fs/ioctl.c:772 [inline] __se_sys_ioctl fs/ioctl.c:770 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:770 do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4531a9 Code: ed 60 fc ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 bb 60 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fd14ad72c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000073bfa8 RCX: 00000000004531a9 RDX: fffffffffffffff9 RSI: 000000000000009e RDI: 0000000000000003 RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004bbd61 R13: 00000000004d0a98 R14: 00007fd14ad736d4 R15: 00000000ffffffff Allocated by task 2393: save_stack+0x21/0x90 mm/kasan/common.c:72 set_track mm/kasan/common.c:80 [inline] __kasan_kmalloc.constprop.3+0xa7/0xd0 mm/kasan/common.c:515 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:529 kmem_cache_alloc_trace+0xfa/0x2d0 mm/slub.c:2813 kmalloc include/linux/slab.h:555 [inline] kzalloc include/linux/slab.h:669 [inline] gprinter_alloc+0xa1/0x870 drivers/usb/gadget/function/f_printer.c:1416 usb_get_function+0x58/0xc0 drivers/usb/gadget/functions.c:61 config_usb_cfg_link+0x1ed/0x3e0 drivers/usb/gadget/configfs.c:444 configfs_symlink+0x527/0x11d0 fs/configfs/symlink.c:202 vfs_symlink+0x33d/0x5b0 fs/namei.c:4201 do_symlinkat+0x11b/0x1d0 fs/namei.c:4228 __do_sys_symlinkat fs/namei.c:4242 [inline] __se_sys_symlinkat fs/namei.c:4239 [inline] __x64_sys_symlinkat+0x73/0xb0 fs/namei.c:4239 do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 3368: save_stack+0x21/0x90 mm/kasan/common.c:72 set_track mm/kasan/common.c:80 [inline] kasan_set_free_info mm/kasan/common.c:337 [inline] __kasan_slab_free+0x135/0x190 mm/kasan/common.c:476 kasan_slab_free+0xe/0x10 mm/kasan/common.c:485 slab_free_hook mm/slub.c:1444 [inline] slab_free_freelist_hook mm/slub.c:1477 [inline] slab_free mm/slub.c:3034 [inline] kfree+0xf7/0x410 mm/slub.c:3995 gprinter_free+0x49/0xd0 drivers/usb/gadget/function/f_printer.c:1353 usb_put_function+0x38/0x50 drivers/usb/gadget/functions.c:87 config_usb_cfg_unlink+0x2db/0x3b0 drivers/usb/gadget/configfs.c:485 configfs_unlink+0x3b9/0x7f0 fs/configfs/symlink.c:250 vfs_unlink+0x287/0x570 fs/namei.c:4073 do_unlinkat+0x4f9/0x620 fs/namei.c:4137 __do_sys_unlink fs/namei.c:4184 [inline] __se_sys_unlink fs/namei.c:4182 [inline] __x64_sys_unlink+0x42/0x50 fs/namei.c:4182 do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff8880683b0000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 24 bytes inside of 1024-byte region [ffff8880683b0000, ffff8880683b0400) The buggy address belongs to the page: page:ffffea0001a0ec00 refcount:1 mapcount:0 mapping:ffff88806c00e300 index:0xffff8880683b1800 compound_mapcount: 0 flags: 0x100000000010200(slab|head) raw: 0100000000010200 0000000000000000 0000000600000001 ffff88806c00e300 raw: ffff8880683b1800 000000008010000a 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Reported-by: Kyungtae Kim <kt0755(a)gmail.com> Signed-off-by: Zqiang <qiang.zhang(a)windriver.com> Signed-off-by: Felipe Balbi <balbi(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wei Li <liwei391(a)huawei.com> Reviewed-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/usb/gadget/function/f_printer.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c index 9c7ed2539ff7..8ed1295d7e35 100644 --- a/drivers/usb/gadget/function/f_printer.c +++ b/drivers/usb/gadget/function/f_printer.c @@ -31,6 +31,7 @@ #include <linux/types.h> #include <linux/ctype.h> #include <linux/cdev.h> +#include <linux/kref.h> #include <asm/byteorder.h> #include <linux/io.h> @@ -64,7 +65,7 @@ struct printer_dev { struct usb_gadget *gadget; s8 interface; struct usb_ep *in_ep, *out_ep; - + struct kref kref; struct list_head rx_reqs; /* List of free RX structs */ struct list_head rx_reqs_active; /* List of Active RX xfers */ struct list_head rx_buffers; /* List of completed xfers */ @@ -218,6 +219,13 @@ static inline struct usb_endpoint_descriptor *ep_desc(struct usb_gadget *gadget, /*-------------------------------------------------------------------------*/ +static void printer_dev_free(struct kref *kref) +{ + struct printer_dev *dev = container_of(kref, struct printer_dev, kref); + + kfree(dev); +} + static struct usb_request * printer_req_alloc(struct usb_ep *ep, unsigned len, gfp_t gfp_flags) { @@ -348,6 +356,7 @@ printer_open(struct inode *inode, struct file *fd) spin_unlock_irqrestore(&dev->lock, flags); + kref_get(&dev->kref); DBG(dev, "printer_open returned %x\n", ret); return ret; } @@ -365,6 +374,7 @@ printer_close(struct inode *inode, struct file *fd) dev->printer_status &= ~PRINTER_SELECTED; spin_unlock_irqrestore(&dev->lock, flags); + kref_put(&dev->kref, printer_dev_free); DBG(dev, "printer_close\n"); return 0; @@ -1350,7 +1360,8 @@ static void gprinter_free(struct usb_function *f) struct f_printer_opts *opts; opts = container_of(f->fi, struct f_printer_opts, func_inst); - kfree(dev); + + kref_put(&dev->kref, printer_dev_free); mutex_lock(&opts->lock); --opts->refcnt; mutex_unlock(&opts->lock); @@ -1419,6 +1430,7 @@ static struct usb_function *gprinter_alloc(struct usb_function_instance *fi) return ERR_PTR(-ENOMEM); } + kref_init(&dev->kref); ++opts->refcnt; dev->minor = opts->minor; dev->pnp_string = opts->pnp_string; -- 2.25.1

1 2

[PATCH openEuler-5.10 01/14] tty: drivers/tty/, stop using tty_schedule_flip()
by Zheng Zengkai 06 Sep '22

06 Sep '22

From: Jiri Slaby <jslaby(a)suse.cz> stable inclusion from stable-v5.10.134 commit 6a81848252869d929354a879e08807c932444929 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5A5Y1 CVE: CVE-2022-1462 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5f6a85158ccacc3f09744b3aafe8b11ab3b6c6f6 upstream. Since commit a9c3f68f3cd8d (tty: Fix low_latency BUG) in 2014, tty_flip_buffer_push() is only a wrapper to tty_schedule_flip(). We are going to remove the latter (as it is used less), so call the former in drivers/tty/. Cc: Vladimir Zapolskiy <vz(a)mleia.com> Reviewed-by: Johan Hovold <johan(a)kernel.org> Signed-off-by: Jiri Slaby <jslaby(a)suse.cz> Link: https://lore.kernel.org/r/20211122111648.30379-2-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/tty/cyclades.c | 6 +++--- drivers/tty/goldfish.c | 2 +- drivers/tty/moxa.c | 4 ++-- drivers/tty/serial/lpc32xx_hs.c | 2 +- drivers/tty/vt/keyboard.c | 6 +++--- drivers/tty/vt/vt.c | 2 +- 6 files changed, 11 insertions(+), 11 deletions(-) diff --git a/drivers/tty/cyclades.c b/drivers/tty/cyclades.c index 097266342e5e..4bcaab250676 100644 --- a/drivers/tty/cyclades.c +++ b/drivers/tty/cyclades.c @@ -556,7 +556,7 @@ static void cyy_chip_rx(struct cyclades_card *cinfo, int chip, } info->idle_stats.recv_idle = jiffies; } - tty_schedule_flip(port); + tty_flip_buffer_push(port); /* end of service */ cyy_writeb(info, CyRIR, save_xir & 0x3f); @@ -996,7 +996,7 @@ static void cyz_handle_rx(struct cyclades_port *info) mod_timer(&info->rx_full_timer, jiffies + 1); #endif info->idle_stats.recv_idle = jiffies; - tty_schedule_flip(&info->port); + tty_flip_buffer_push(&info->port); /* Update rx_get */ cy_writel(&buf_ctrl->rx_get, new_rx_get); @@ -1172,7 +1172,7 @@ static void cyz_handle_cmd(struct cyclades_card *cinfo) if (delta_count) wake_up_interruptible(&info->port.delta_msr_wait); if (special_count) - tty_schedule_flip(&info->port); + tty_flip_buffer_push(&info->port); } } diff --git a/drivers/tty/goldfish.c b/drivers/tty/goldfish.c index c8c5cdfc5e19..ed0f3a7b8fe5 100644 --- a/drivers/tty/goldfish.c +++ b/drivers/tty/goldfish.c @@ -151,7 +151,7 @@ static irqreturn_t goldfish_tty_interrupt(int irq, void *dev_id) address = (unsigned long)(void *)buf; goldfish_tty_rw(qtty, address, count, 0); - tty_schedule_flip(&qtty->port); + tty_flip_buffer_push(&qtty->port); return IRQ_HANDLED; } diff --git a/drivers/tty/moxa.c b/drivers/tty/moxa.c index f9f14104bd2c..d6528f3bb9b9 100644 --- a/drivers/tty/moxa.c +++ b/drivers/tty/moxa.c @@ -1385,7 +1385,7 @@ static int moxa_poll_port(struct moxa_port *p, unsigned int handle, if (inited && !tty_throttled(tty) && MoxaPortRxQueue(p) > 0) { /* RX */ MoxaPortReadData(p); - tty_schedule_flip(&p->port); + tty_flip_buffer_push(&p->port); } } else { clear_bit(EMPTYWAIT, &p->statusflags); @@ -1410,7 +1410,7 @@ static int moxa_poll_port(struct moxa_port *p, unsigned int handle, if (tty && (intr & IntrBreak) && !I_IGNBRK(tty)) { /* BREAK */ tty_insert_flip_char(&p->port, 0, TTY_BREAK); - tty_schedule_flip(&p->port); + tty_flip_buffer_push(&p->port); } if (intr & IntrLine) diff --git a/drivers/tty/serial/lpc32xx_hs.c b/drivers/tty/serial/lpc32xx_hs.c index b5898c932036..a9802308ff60 100644 --- a/drivers/tty/serial/lpc32xx_hs.c +++ b/drivers/tty/serial/lpc32xx_hs.c @@ -344,7 +344,7 @@ static irqreturn_t serial_lpc32xx_interrupt(int irq, void *dev_id) LPC32XX_HSUART_IIR(port->membase)); port->icount.overrun++; tty_insert_flip_char(tport, 0, TTY_OVERRUN); - tty_schedule_flip(tport); + tty_flip_buffer_push(tport); } /* Data received? */ diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c index 78acc270e39a..aa0026a9839c 100644 --- a/drivers/tty/vt/keyboard.c +++ b/drivers/tty/vt/keyboard.c @@ -311,7 +311,7 @@ int kbd_rate(struct kbd_repeat *rpt) static void put_queue(struct vc_data *vc, int ch) { tty_insert_flip_char(&vc->port, ch, 0); - tty_schedule_flip(&vc->port); + tty_flip_buffer_push(&vc->port); } static void puts_queue(struct vc_data *vc, char *cp) @@ -320,7 +320,7 @@ static void puts_queue(struct vc_data *vc, char *cp) tty_insert_flip_char(&vc->port, *cp, 0); cp++; } - tty_schedule_flip(&vc->port); + tty_flip_buffer_push(&vc->port); } static void applkey(struct vc_data *vc, int key, char mode) @@ -565,7 +565,7 @@ static void fn_inc_console(struct vc_data *vc) static void fn_send_intr(struct vc_data *vc) { tty_insert_flip_char(&vc->port, 0, TTY_BREAK); - tty_schedule_flip(&vc->port); + tty_flip_buffer_push(&vc->port); } static void fn_scroll_forw(struct vc_data *vc) diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 0a6336d54a65..30fc2a60c352 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -1834,7 +1834,7 @@ static void csi_m(struct vc_data *vc) static void respond_string(const char *p, size_t len, struct tty_port *port) { tty_insert_flip_string(port, p, len); - tty_schedule_flip(port); + tty_flip_buffer_push(port); } static void cursor_report(struct vc_data *vc, struct tty_struct *tty) -- 2.20.1

1 13

[PATCH openEuler-5.10 00/44] Backport 5.10.120 LTS
by Zheng Zengkai 06 Sep '22

06 Sep '22

Backport 5.10.120 LTS patches from upstream. git cherry-pick v5.10.119..v5.10.120~1 -s Already merged(-8): ea62d169b6e7 netfilter: nf_tables: disallow non-stateful expression in sets earlier 57d01bcae704 io_uring: don't re-import iovecs from callbacks 8adb751d294e io_uring: fix using under-expanded iters 72464fd2b4b7 xfs: fix the forward progress assertion in xfs_iwalk_run_callbacks a9e7f19a5577 xfs: fix an ABBA deadlock in xfs_renam 2728d95c6c95 xfs: Fix CIL throttle hang when CIL space used going backwards c0aff1faf66b netfilter: nf_tables: sanitize nft_set_desc_concat_parse() 3d8fc6e28f32 KVM: x86: avoid calling x86 emulator without a decoded instruction Skiped(-1)： 45d97f70da4d xfs: show the proper user quota options Context conflict: 630192aa4523 lib/crypto: add prompts back to crypto libraries 8df42bcd364c dm verity: set DM_TARGET_IMMUTABLE feature flag KABI fixed(+1): pipe: fix kabi for poll_usage in struct pipe_inode_info Total patches: 52 - 8 - 1 + 1= 44 Akira Yokosawa (1): docs: submitting-patches: Fix crossref to 'The canonical patch format' Al Viro (1): percpu_ref_init(): clean ->percpu_count_ref on failure Alex Elder (1): net: ipa: compute proper aggregation limit Chuck Lever (1): NFSD: Fix possible sleep during nfsd4_release_lockowner() Dan Carpenter (1): dm integrity: fix error code in dm_integrity_ctr() Darrick J. Wong (1): xfs: detect overflows in bmbt records David Howells (1): pipe: Fix missing lock in pipe_resize_ring() Fabio Estevam (1): crypto: caam - fix i.MX6SX entropy delay value Florian Westphal (1): netfilter: conntrack: re-fetch conntrack after insertion Gustavo A. R. Silva (1): drm/i915: Fix -Wstringop-overflow warning in call to intel_read_wm_latency() IotaHydrae (1): pinctrl: sunxi: fix f1c100s uart2 function Joel Stanley (1): net: ftgmac100: Disable hardware checksum on AST2600 Jonathan Bakker (1): ARM: dts: s5pv210: Correct interrupt name for bluetooth in Aries Justin M. Forbes (1): lib/crypto: add prompts back to crypto libraries Kuniyuki Iwashima (1): pipe: make poll_usage boolean and annotate its access Lin Ma (1): nfc: pn533: Fix buggy cleanup order Liu Jian (1): bpf: Enlarge offset check value to INT_MAX in bpf_skb_{load,store}_bytes Marek Maślanka (1): HID: multitouch: Add support for Google Whiskers Touchpad Mariusz Tkaczyk (1): raid5: introduce MD_BROKEN Mika Westerberg (1): i2c: ismt: Provide a DMA buffer for Interrupt Cause Logging Mikulas Patocka (2): dm crypt: make printing of the key constant-time dm stats: add cond_resched when looping over entries Miri Korenblit (1): cfg80211: set custom regdomain after wiphy registration Nicolai Stange (4): crypto: drbg - prepare for more fine-grained tracking of seeding state crypto: drbg - track whether DRBG was seeded with !rng_is_initialized() crypto: drbg - move dynamic ->reseed_threshold adjustments to __drbg_seed() crypto: drbg - make reseeding from get_random_bytes() synchronous Paolo Bonzini (1): x86, kvm: use correct GFP flags for preemption disabled Piyush Malgujar (1): drivers: i2c: thunderx: Allow driver to work with ACPI defined TWSI controllers Sarthak Kukreti (1): dm verity: set DM_TARGET_IMMUTABLE feature flag Sean Christopherson (1): x86/kvm: Alloc dummy async #PF token outside of raw spinlock Stefan Mahnke-Hartmann (1): tpm: Fix buffer access in tpm2_get_tpm_pt() Stephen Brennan (1): assoc_array: Fix BUG_ON during garbage collect Steven Rostedt (1): Bluetooth: hci_qca: Use del_timer_sync() before freeing Sultan Alsawaf (1): zsmalloc: fix races between asynchronous zspage free and page migration Tadeusz Struk (1): exfat: check if cluster num is valid Tao Jin (1): HID: multitouch: add quirks to enable Lenovo X12 trackpoint Thomas Bartschies (1): net: af_key: check encryption module availability consistency Trond Myklebust (1): NFS: Memory allocation failures are not server fatal errors Vitaly Chikunov (1): crypto: ecrdsa - Fix incorrect use of vli_cmp Xiaomeng Tong (1): KVM: PPC: Book3S HV: fix incorrect NULL check on list iterator Xiu Jianfeng (1): tpm: ibmvtpm: Correct the return value in tpm_ibmvtpm_probe() Yuntao Wang (1): bpf: Fix potential array overflow in bpf_trampoline_get_progs() Zheng Zengkai (1): pipe: fix kabi for poll_usage in struct pipe_inode_info Documentation/process/submitting-patches.rst | 2 +- arch/arm/boot/dts/s5pv210-aries.dtsi | 2 +- arch/powerpc/kvm/book3s_hv_uvmem.c | 8 +- arch/x86/kernel/kvm.c | 41 ++++--- crypto/Kconfig | 2 - crypto/drbg.c | 110 +++++++----------- crypto/ecrdsa.c | 8 +- drivers/bluetooth/hci_qca.c | 4 +- drivers/char/random.c | 2 - drivers/char/tpm/tpm2-cmd.c | 11 +- drivers/char/tpm/tpm_ibmvtpm.c | 1 + drivers/crypto/caam/ctrl.c | 18 +++ drivers/gpu/drm/i915/intel_pm.c | 2 +- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-multitouch.c | 9 ++ drivers/i2c/busses/i2c-ismt.c | 14 +++ drivers/i2c/busses/i2c-thunderx-pcidrv.c | 1 + drivers/md/dm-crypt.c | 14 ++- drivers/md/dm-integrity.c | 2 - drivers/md/dm-stats.c | 8 ++ drivers/md/dm-verity-target.c | 1 + drivers/md/raid5.c | 47 ++++---- drivers/net/ethernet/faraday/ftgmac100.c | 5 + drivers/net/ipa/ipa_endpoint.c | 4 +- drivers/nfc/pn533/pn533.c | 5 +- drivers/pinctrl/sunxi/pinctrl-suniv-f1c100s.c | 2 +- fs/exfat/balloc.c | 8 +- fs/exfat/exfat_fs.h | 8 ++ fs/exfat/fatent.c | 8 -- fs/nfs/internal.h | 1 + fs/nfsd/nfs4state.c | 12 +- fs/pipe.c | 33 +++--- fs/xfs/libxfs/xfs_bmap.c | 5 + include/crypto/drbg.h | 10 +- include/linux/pipe_fs_i.h | 2 +- include/net/netfilter/nf_conntrack_core.h | 7 +- kernel/bpf/trampoline.c | 18 ++- lib/Kconfig | 2 + lib/assoc_array.c | 8 ++ lib/crypto/Kconfig | 17 ++- lib/percpu-refcount.c | 1 + mm/zsmalloc.c | 37 +++++- net/core/filter.c | 4 +- net/key/af_key.c | 6 +- net/wireless/core.c | 8 +- net/wireless/reg.c | 1 + 46 files changed, 328 insertions(+), 192 deletions(-) -- 2.20.1

1 44

2024

2023

2022

2021

2020

2019

Kernel