- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] Adding support for PxSCT.LPM setting based on actual LPM circumstances
by LeoLiuoc 26 Apr '22

26 Apr '22

zhaoxin inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I54V27 CVE: NA ---------------------------------------------------------------- In AHCI spec, PhyRdy Change Interrupt cannot coexist with Link Power Management (LPM). While LPM driver would disable PhyRdy Change interrupt without checking whether HBA supports LPM or not before enabling it. Therefore, if enabling LPM from LPM driver by default, we can not disable it from BIOS without influence Hotplug out capability. Signed-off-by: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> --- drivers/ata/ahci.c | 11 +++++++++++ drivers/ata/libata-eh.c | 7 +++++++ include/linux/libata.h | 3 +++ 3 files changed, 21 insertions(+) diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c index ebb2bfd4ab0a..8ed2f42b85fd 100644 --- a/drivers/ata/ahci.c +++ b/drivers/ata/ahci.c @@ -1855,6 +1855,17 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) else dev_info(&pdev->dev, "SSS flag set, parallel bus scan disabled\n"); + if (pdev->vendor == PCI_VENDOR_ID_ZHAOXIN) { + if (hpriv->cap & HOST_CAP_PART) + host->flags |= ATA_HOST_PART; + + if (hpriv->cap & HOST_CAP_SSC) + host->flags |= ATA_HOST_SSC; + + if (hpriv->cap2 & HOST_CAP2_SDS) + host->flags |= ATA_HOST_DEVSLP; + } + if (pi.flags & ATA_FLAG_EM) ahci_reset_em(host); diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c index ccc80ff57eb2..e4e0e6d94741 100644 --- a/drivers/ata/libata-eh.c +++ b/drivers/ata/libata-eh.c @@ -3448,6 +3448,8 @@ static int ata_eh_set_lpm(struct ata_link *link, enum ata_lpm_policy policy, struct ata_device **r_failed_dev) { struct ata_port *ap = ata_is_host_link(link) ? link->ap : NULL; + struct device *device = ap->host->dev; + struct pci_dev *pdev = (!device || !dev_is_pci(device)) ? NULL : to_pci_dev(device); struct ata_eh_context *ehc = &link->eh_context; struct ata_device *dev, *link_dev = NULL, *lpm_dev = NULL; enum ata_lpm_policy old_policy = link->lpm_policy; @@ -3456,6 +3458,11 @@ static int ata_eh_set_lpm(struct ata_link *link, enum ata_lpm_policy policy, unsigned int err_mask; int rc; + /* if controller does not support lpm, then sets no LPM flags */ + if ((pdev && pdev->vendor == PCI_VENDOR_ID_ZHAOXIN) && + !(ap->host->flags & (ATA_HOST_PART | ATA_HOST_SSC | ATA_HOST_DEVSLP))) + link->flags |= ATA_LFLAG_NO_LPM; + /* if the link or host doesn't do LPM, noop */ if ((link->flags & ATA_LFLAG_NO_LPM) || (ap && !ap->ops->set_lpm)) return 0; diff --git a/include/linux/libata.h b/include/linux/libata.h index dc164b7ebbb0..1cec68e5b104 100644 --- a/include/linux/libata.h +++ b/include/linux/libata.h @@ -276,6 +276,9 @@ enum { ATA_HOST_STARTED = (1 << 1), /* Host started */ ATA_HOST_PARALLEL_SCAN = (1 << 2), /* Ports on this host can be scanned in parallel */ ATA_HOST_IGNORE_ATA = (1 << 3), /* Ignore ATA devices on this host. */ + ATA_HOST_PART = (1 << 4), /* Host support partial. */ + ATA_HOST_SSC = (1 << 5), /* Host support slumber. */ + ATA_HOST_DEVSLP = (1 << 6), /* Host support devslp. */ /* bits 24:31 of host->flags are reserved for LLD specific flags */ -- 2.20.1

1 0

[PATCH openEuler-1.0-LTS] XHCI:Fix some device identify fail when enable xHCI runtime suspend
by LeoLiuoc 26 Apr '22

26 Apr '22

zhaoxin inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I54V16 CVE: NA ---------------------------------------------------------------- If plug out device form xhci with runtime suspend enabled. On the one hand, driver will disconnect this device and send disabled slot command to xhci. On the other hand, without no device connect to xhci, PM core will call xhci suspend function to let xhci go to D3 to save power. However there is a temporal competition to get xhci lock between disable slot command interrupt and xhci suspend. If xhci suspend function get xhci lock first, then this function will clear xhci command ring. It will get error command trb when driver to handle disable slot command interrupt. This is a serious error for driver and driver will cleanup xhci. So，any device connect to this xhci port again will not be recognized. In order to fix this issues, we let disable slot command interrupt ISR to get xhci lock first. So, add a delay in xhci suspend function before to get xhci lock. Signed-off-by: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> --- drivers/usb/host/xhci-pci.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c index 238a32cc311c..4c2376a4c1d6 100644 --- a/drivers/usb/host/xhci-pci.c +++ b/drivers/usb/host/xhci-pci.c @@ -223,6 +223,9 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) xhci->quirks |= XHCI_ZHAOXIN_HOST; } + if (pdev->vendor == PCI_VENDOR_ID_ZHAOXIN) + xhci->quirks |= XHCI_SUSPEND_DELAY; + /* See https://bugzilla.kernel.org/show_bug.cgi?id=79511 */ if (pdev->vendor == PCI_VENDOR_ID_VIA && pdev->device == 0x3432) -- 2.20.1

1 0

[PATCH openEuler-1.0-LTS] EHCI: Clear wakeup signal locked in S0, state when device plug in
by LeoLiuoc 26 Apr '22

26 Apr '22

zhaoxin inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I54V1P CVE: NA ---------------------------------------------------------------- If we plug in a LS/FS device on USB2 port of EHCI, it will latch a wakeup signal in EHCI internal. This is a bug of EHCI for Some project of ZhaoXin. If enable EHCI runtime suspend and no device attach. PM core will let EHCI go to D3 to save power. However, once EHCI go to D3, it will release wakeup signal that latched on device connect to port during S0. Which will generate a SCI interrupt and bring EHCI to D0. But without device connect, EHCI will go to D3 again. So, there is suspend-resume loop and generate SCI interrupt Continuously. In order to fix this issues, we need to clear the wakeup signal latched in EHCI when EHCI suspend function is called. Signed-off-by: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> --- drivers/pci/pci-driver.c | 6 +++++- drivers/usb/host/ehci-hcd.c | 21 +++++++++++++++++++++ drivers/usb/host/ehci-pci.c | 4 ++++ drivers/usb/host/ehci.h | 1 + 4 files changed, 31 insertions(+), 1 deletion(-) diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c index 45c3a78d6004..9329f4881d42 100644 --- a/drivers/pci/pci-driver.c +++ b/drivers/pci/pci-driver.c @@ -513,7 +513,11 @@ static int pci_restore_standard_config(struct pci_dev *pci_dev) } pci_restore_state(pci_dev); - pci_pme_restore(pci_dev); + if (!(pci_dev->vendor == PCI_VENDOR_ID_ZHAOXIN && + pci_dev->device == 0x3104 && + (pci_dev->revision & 0xf0) == 0x90 && + pci_dev->class == PCI_CLASS_SERIAL_USB_EHCI)) + pci_pme_restore(pci_dev); return 0; } diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c index 8608ac513fb7..0daa6d98f9b9 100644 --- a/drivers/usb/host/ehci-hcd.c +++ b/drivers/usb/host/ehci-hcd.c @@ -1110,6 +1110,27 @@ int ehci_suspend(struct usb_hcd *hcd, bool do_wakeup) return -EBUSY; } + /* Clear wakeup signal locked in S0 state when device plug in */ + if (ehci->zx_wakeup_clear == 1) { + u32 __iomem *reg = &ehci->regs->port_status[4]; + u32 t1 = ehci_readl(ehci, reg); + + t1 &= (u32)~0xf0000; + t1 |= PORT_TEST_FORCE; + ehci_writel(ehci, t1, reg); + t1 = ehci_readl(ehci, reg); + usleep_range(1000, 2000); + t1 &= (u32)~0xf0000; + ehci_writel(ehci, t1, reg); + usleep_range(1000, 2000); + t1 = ehci_readl(ehci, reg); + ehci_writel(ehci, t1 | PORT_CSC, reg); + udelay(500); + t1 = ehci_readl(ehci, &ehci->regs->status); + ehci_writel(ehci, t1 & STS_PCD, &ehci->regs->status); + ehci_readl(ehci, &ehci->regs->status); + } + return 0; } EXPORT_SYMBOL_GPL(ehci_suspend); diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c index baae879dbddd..357dc140e914 100644 --- a/drivers/usb/host/ehci-pci.c +++ b/drivers/usb/host/ehci-pci.c @@ -216,6 +216,10 @@ static int ehci_pci_setup(struct usb_hcd *hcd) ehci_info(ehci, "applying MosChip frame-index workaround\n"); ehci->frame_index_bug = 1; break; + case PCI_VENDOR_ID_ZHAOXIN: + if (pdev->device == 0x3104 && (pdev->revision & 0xf0) == 0x90) + ehci->zx_wakeup_clear = 1; + break; } /* optional debug port, normally in the first BAR */ diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h index c8e9a48e1d51..9625b6030757 100644 --- a/drivers/usb/host/ehci.h +++ b/drivers/usb/host/ehci.h @@ -218,6 +218,7 @@ struct ehci_hcd { /* one per controller */ unsigned frame_index_bug:1; /* MosChip (AKA NetMos) */ unsigned need_oc_pp_cycle:1; /* MPC834X port power */ unsigned imx28_write_fix:1; /* For Freescale i.MX28 */ + unsigned zx_wakeup_clear:1; /* required for usb32 quirk */ #define OHCI_CTRL_HCFS (3 << 6) -- 2.20.1

1 0

[PATCH openEuler-1.0-LTS] rtc: Fix set RTC time delay 500ms on some Zhaoxin SOCs
by LeoLiuoc 26 Apr '22

26 Apr '22

zhaoxin inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I54V04 CVE: NA ---------------------------------------------------------------- When the RTC divider is changed from reset to an operating time base, the first update cycle should be 500ms later. But on some Zhaoxin SOCs, this first update cycle is one second later. So set RTC time on these Zhaoxin SOCs will causing 500ms delay. Skip setup RTC divider on these SOCs in mc146818_set_time to fix it. Signed-off-by: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> --- drivers/rtc/rtc-mc146818-lib.c | 26 +++++++++++++++++++++++--- 1 file changed, 23 insertions(+), 3 deletions(-) diff --git a/drivers/rtc/rtc-mc146818-lib.c b/drivers/rtc/rtc-mc146818-lib.c index 2f1772a358ca..1a866ebbbe62 100644 --- a/drivers/rtc/rtc-mc146818-lib.c +++ b/drivers/rtc/rtc-mc146818-lib.c @@ -7,6 +7,23 @@ #include <linux/acpi.h> #endif +#ifdef CONFIG_X86 +static inline bool follow_mc146818_divider_reset(void) +{ + if ((boot_cpu_data.x86_vendor == X86_VENDOR_CENTAUR || + boot_cpu_data.x86_vendor == X86_VENDOR_ZHAOXIN) && + (boot_cpu_data.x86 <= 7 && boot_cpu_data.x86_model <= 59)) { + return false; + } + return true; +} +#else +static inline bool follow_mc146818_divider_reset(void) +{ + return true; +} +#endif + /* * Returns true if a clock update is in progress */ @@ -170,8 +187,10 @@ int mc146818_set_time(struct rtc_time *time) save_control = CMOS_READ(RTC_CONTROL); CMOS_WRITE((save_control|RTC_SET), RTC_CONTROL); - save_freq_select = CMOS_READ(RTC_FREQ_SELECT); - CMOS_WRITE((save_freq_select|RTC_DIV_RESET2), RTC_FREQ_SELECT); + if (follow_mc146818_divider_reset()) { + save_freq_select = CMOS_READ(RTC_FREQ_SELECT); + CMOS_WRITE((save_freq_select|RTC_DIV_RESET2), RTC_FREQ_SELECT); + } #ifdef CONFIG_MACH_DECSTATION CMOS_WRITE(real_yrs, RTC_DEC_YEAR); @@ -189,7 +208,8 @@ int mc146818_set_time(struct rtc_time *time) #endif CMOS_WRITE(save_control, RTC_CONTROL); - CMOS_WRITE(save_freq_select, RTC_FREQ_SELECT); + if (follow_mc146818_divider_reset()) + CMOS_WRITE(save_freq_select, RTC_FREQ_SELECT); spin_unlock_irqrestore(&rtc_lock, flags); -- 2.20.1

1 0

[PATCH openEuler-5.10 01/10] mtd: phram: Fix error return code in phram_setup()
by Zheng Zengkai 24 Apr '22

24 Apr '22

From: Yu Kuai <yukuai3(a)huawei.com> mainline inclusion from mainline-v5.14-rc1 commit da1e6fe563e62801fa033255f68c0bb9bf8c2c69 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I53BBP backport: openEuler-22.03-LTS Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Return a negative error code from the error handling case instead of 0, as done elsewhere in this function. Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Signed-off-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Link: https://lore.kernel.org/linux-mtd/20210408133812.1209798-1-yukuai3@huawei.c… Signed-off-by: Yi Yang <yiyang13(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/mtd/devices/phram.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/mtd/devices/phram.c b/drivers/mtd/devices/phram.c index aa88558c7edb..d7d17a4b61f5 100644 --- a/drivers/mtd/devices/phram.c +++ b/drivers/mtd/devices/phram.c @@ -270,6 +270,7 @@ static int phram_setup(const char *val) if (len == 0 || erasesize == 0 || erasesize > len || erasesize > UINT_MAX || rem) { parse_err("illegal erasesize or len\n"); + ret = -EINVAL; goto error; } -- 2.20.1

1 9

[PATCH openEuler-5.10 01/28] af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register
by Zheng Zengkai 21 Apr '22

21 Apr '22

From: Haimin Zhang <tcs_kernel(a)tencent.com> stable inclusion from stable-v5.10.110 commit 8d3f4ad43054619379ccc697cfcbdb2c266800d8 category: bugfix bugzilla: 186606, https://gitee.com/src-openeuler/kernel/issues/I53SSV CVE: CVE-2022-1353 -------------------------------- [ Upstream commit 9a564bccb78a76740ea9d75a259942df8143d02c ] Add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register to initialize the buffer of supp_skb to fix a kernel-info-leak issue. 1) Function pfkey_register calls compose_sadb_supported to request a sk_buff. 2) compose_sadb_supported calls alloc_sbk to allocate a sk_buff, but it doesn't zero it. 3) If auth_len is greater 0, then compose_sadb_supported treats the memory as a struct sadb_supported and begins to initialize. But it just initializes the field sadb_supported_len and field sadb_supported_exttype without field sadb_supported_reserved. Reported-by: TCS Robot <tcs_robot(a)tencent.com> Signed-off-by: Haimin Zhang <tcs_kernel(a)tencent.com> Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xu Jia <xujia39(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- net/key/af_key.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/key/af_key.c b/net/key/af_key.c index ef9b4ac03e7b..b95684b8903e 100644 --- a/net/key/af_key.c +++ b/net/key/af_key.c @@ -1703,7 +1703,7 @@ static int pfkey_register(struct sock *sk, struct sk_buff *skb, const struct sad xfrm_probe_algs(); - supp_skb = compose_sadb_supported(hdr, GFP_KERNEL); + supp_skb = compose_sadb_supported(hdr, GFP_KERNEL | __GFP_ZERO); if (!supp_skb) { if (hdr->sadb_msg_satype != SADB_SATYPE_UNSPEC) pfk->registered &= ~(1<<hdr->sadb_msg_satype); -- 2.20.1

1 27

[PATCH openEuler-5.10 01/29] spi: hisi-kunpeng: Add debugfs support
by Zheng Zengkai 19 Apr '22

19 Apr '22

From: Jay Fang <f.fangjian(a)huawei.com> mainline inclusion from mainline-v5.14-rc1 commit 2b2142f247eb category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4UR1H CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ----------------------------------------------------------------------- This patch uses debugfs_regset32 interface to create the registers dump file. Use it instead of creating a generic debugfs file with manually written read callback function. With these entries, users can check all the SPI controller registers during run time. Signed-off-by: Jay Fang <f.fangjian(a)huawei.com> Link: https://lore.kernel.org/r/1622789718-13977-1-git-send-email-f.fangjian@huaw… Signed-off-by: Mark Brown <broonie(a)kernel.org> Reviewed-by: Jay Fang <f.fangjian(a)huawei.com> Acked-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/spi/spi-hisi-kunpeng.c | 51 +++++++++++++++++++++++++++++++++- 1 file changed, 50 insertions(+), 1 deletion(-) diff --git a/drivers/spi/spi-hisi-kunpeng.c b/drivers/spi/spi-hisi-kunpeng.c index 3f986ba1c328..58b823a16fc4 100644 --- a/drivers/spi/spi-hisi-kunpeng.c +++ b/drivers/spi/spi-hisi-kunpeng.c @@ -9,6 +9,7 @@ #include <linux/acpi.h> #include <linux/bitfield.h> +#include <linux/debugfs.h> #include <linux/delay.h> #include <linux/err.h> #include <linux/interrupt.h> @@ -126,6 +127,7 @@ struct hisi_spi { void __iomem *regs; int irq; u32 fifo_len; /* depth of the FIFO buffer */ + u16 bus_num; /* Current message transfer state info */ const void *tx; @@ -133,8 +135,49 @@ struct hisi_spi { void *rx; unsigned int rx_len; u8 n_bytes; /* current is a 1/2/4 bytes op */ + + struct dentry *debugfs; + struct debugfs_regset32 regset; +}; + +#define HISI_SPI_DBGFS_REG(_name, _off) \ +{ \ + .name = _name, \ + .offset = _off, \ +} + +static const struct debugfs_reg32 hisi_spi_regs[] = { + HISI_SPI_DBGFS_REG("CSCR", HISI_SPI_CSCR), + HISI_SPI_DBGFS_REG("CR", HISI_SPI_CR), + HISI_SPI_DBGFS_REG("ENR", HISI_SPI_ENR), + HISI_SPI_DBGFS_REG("FIFOC", HISI_SPI_FIFOC), + HISI_SPI_DBGFS_REG("IMR", HISI_SPI_IMR), + HISI_SPI_DBGFS_REG("DIN", HISI_SPI_DIN), + HISI_SPI_DBGFS_REG("DOUT", HISI_SPI_DOUT), + HISI_SPI_DBGFS_REG("SR", HISI_SPI_SR), + HISI_SPI_DBGFS_REG("RISR", HISI_SPI_RISR), + HISI_SPI_DBGFS_REG("ISR", HISI_SPI_ISR), + HISI_SPI_DBGFS_REG("ICR", HISI_SPI_ICR), + HISI_SPI_DBGFS_REG("VERSION", HISI_SPI_VERSION), }; +static int hisi_spi_debugfs_init(struct hisi_spi *hs) +{ + char name[32]; + + snprintf(name, 32, "hisi_spi%d", hs->bus_num); + hs->debugfs = debugfs_create_dir(name, NULL); + if (!hs->debugfs) + return -ENOMEM; + + hs->regset.regs = hisi_spi_regs; + hs->regset.nregs = ARRAY_SIZE(hisi_spi_regs); + hs->regset.base = hs->regs; + debugfs_create_regset32("registers", 0400, hs->debugfs, &hs->regset); + + return 0; +} + static u32 hisi_spi_busy(struct hisi_spi *hs) { return readl(hs->regs + HISI_SPI_SR) & SR_BUSY; @@ -424,6 +467,7 @@ static int hisi_spi_probe(struct platform_device *pdev) hs = spi_controller_get_devdata(master); hs->dev = dev; hs->irq = irq; + hs->bus_num = pdev->id; hs->regs = devm_platform_ioremap_resource(pdev, 0); if (IS_ERR(hs->regs)) @@ -446,7 +490,7 @@ static int hisi_spi_probe(struct platform_device *pdev) master->use_gpio_descriptors = true; master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_CS_HIGH | SPI_LOOP; master->bits_per_word_mask = SPI_BPW_RANGE_MASK(4, 32); - master->bus_num = pdev->id; + master->bus_num = hs->bus_num; master->setup = hisi_spi_setup; master->cleanup = hisi_spi_cleanup; master->transfer_one = hisi_spi_transfer_one; @@ -462,6 +506,9 @@ static int hisi_spi_probe(struct platform_device *pdev) return ret; } + if (hisi_spi_debugfs_init(hs)) + dev_info(dev, "failed to create debugfs dir\n"); + ret = spi_register_controller(master); if (ret) { dev_err(dev, "failed to register spi master, ret=%d\n", ret); @@ -478,7 +525,9 @@ static int hisi_spi_probe(struct platform_device *pdev) static int hisi_spi_remove(struct platform_device *pdev) { struct spi_controller *master = platform_get_drvdata(pdev); + struct hisi_spi *hs = spi_controller_get_devdata(master); + debugfs_remove_recursive(hs->debugfs); spi_unregister_controller(master); return 0; -- 2.20.1

1 28

[PATCH openEuler-5.10 00/12] Backport CVE fix patches
by Zheng Zengkai 19 Apr '22

19 Apr '22

Backport following CVE fix patches: CVE-2022-1055: 04c2a47ffb13c net: sched: fix use-after-free in tc_new_tfilter() CVE-2022-23036: 6b1775f26a2d xen/grant-table: add gnttab_try_end_foreign_access() abf1fd5919d6 xen/blkfront: don't use gnttab_query_foreign_access() for mapped status CVE-2022-23037: 31185df7e2b1d xen/netfront: don't use gnttab_query_foreign_access() for mapped status CVE-2022-23038: 33172ab50a535 xen/scsifront: don't use gnttab_query_foreign_access() for mapped status CVE-2022-23039: d3b6372c5881 xen/gntalloc: don't use gnttab_query_foreign_access() CVE-2022-23040: 3777ea7bac31 xen/xenbus: don't let xenbus_grant_ring() remove grants in error case CVE-2022-23041: 5cadd4bb1d7f xen/9p: use alloc/free_pages_exact() b0576cc9c6b8 xen/pvcalls: use alloc/free_pages_exact() 42baefac638f xen/gnttab: fix gnttab_end_foreign_access() without page specified CVE-2022-23042: 66e3531b33ee5 xen/netfront: react properly to failing gnttab_end_foreign_access_ref() Eric Dumazet (1): net: sched: fix use-after-free in tc_new_tfilter() Juergen Gross (11): xen/xenbus: don't let xenbus_grant_ring() remove grants in error case xen/grant-table: add gnttab_try_end_foreign_access() xen/blkfront: don't use gnttab_query_foreign_access() for mapped status xen/netfront: don't use gnttab_query_foreign_access() for mapped status xen/scsifront: don't use gnttab_query_foreign_access() for mapped status xen/gntalloc: don't use gnttab_query_foreign_access() xen: remove gnttab_query_foreign_access() xen/9p: use alloc/free_pages_exact() xen/pvcalls: use alloc/free_pages_exact() xen/gnttab: fix gnttab_end_foreign_access() without page specified xen/netfront: react properly to failing gnttab_end_foreign_access_ref() drivers/block/xen-blkfront.c | 63 +++++++++++++++----------- drivers/net/xen-netfront.c | 54 ++++++++++++++--------- drivers/scsi/xen-scsifront.c | 3 +- drivers/xen/gntalloc.c | 25 +++-------- drivers/xen/grant-table.c | 71 ++++++++++++++++-------------- drivers/xen/pvcalls-front.c | 8 ++-- drivers/xen/xenbus/xenbus_client.c | 24 +++++----- include/xen/grant_table.h | 19 +++++++- net/9p/trans_xen.c | 14 +++--- net/sched/cls_api.c | 11 +++-- 10 files changed, 162 insertions(+), 130 deletions(-) -- 2.20.1

1 12

[PATCH openEuler-5.10 00/22] Backport 5.10.93 LTS patches
by Zheng Zengkai 19 Apr '22

19 Apr '22

Backport 5.10.93 LTS patches from upstream. Conflicts: already merged(git am --skip): 7f4308792a vfs: fs_context: fix up param length parsing in legacy_parse_param Arie Geiger (1): ALSA: hda/realtek: Add speaker fixup for some Yoga 15ITL5 devices Arnd Bergmann (1): mtd: fixup CFI on ixp4xx Baole Fang (1): ALSA: hda/realtek: Add quirk for Legion Y9000X 2020 Bart Kroon (1): ALSA: hda: ALC287: Add Lenovo IdeaPad Slim 9i 14ITL5 speaker quirk Christian Brauner (1): 9p: only copy valid iattrs in 9P2000.L setattr implementation Christian Lachner (1): ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master after reboot from Windows Christophe JAILLET (1): orangefs: Fix the size of a memory allocation in orangefs_bufmap_alloc() Eric Farman (1): KVM: s390: Clarify SIGP orders versus STOP/RESTART Javier Martinez Canillas (1): video: vga16fb: Only probe for EGA and VGA 16 color graphic cards Johan Hovold (4): media: uvcvideo: fix division by zero at stream start firmware: qemu_fw_cfg: fix sysfs information leak firmware: qemu_fw_cfg: fix NULL-pointer deref on duplicate entries firmware: qemu_fw_cfg: fix kobject leak in probe error path Larry Finger (1): rtlwifi: rtl8192cu: Fix WARNING when calling local_irq_restore() with interrupts enabled Nathan Chancellor (1): kbuild: Add $(KBUILD_HOSTLDFLAGS) to 'has_libelf' test NeilBrown (1): devtmpfs regression fix: reconfigure on each mount Nicholas Piggin (1): powerpc/pseries: Get entry and uaccess flush required bits from H_GET_CPU_CHARACTERISTICS Sean Christopherson (2): perf: Protect perf_guest_cbs with RCU KVM: x86: Register Processor Trace interrupt hook iff PT enabled in guest Stephen Boyd (1): remoteproc: qcom: pil_info: Don't memcpy_toio more than is provided Takashi Iwai (1): ALSA: hda/realtek: Re-order quirk entries for Lenovo Wei Wang (1): KVM: x86: remove PMU FIXED_CTR3 from msrs_to_save_all Makefile | 2 +- arch/arm/kernel/perf_callchain.c | 17 ++++--- arch/arm64/kernel/perf_callchain.c | 18 ++++--- arch/csky/kernel/perf_callchain.c | 6 ++- arch/nds32/kernel/perf_event_cpu.c | 17 ++++--- arch/powerpc/include/asm/hvcall.h | 2 + arch/powerpc/platforms/pseries/setup.c | 6 +++ arch/riscv/kernel/perf_callchain.c | 7 ++- arch/s390/kvm/interrupt.c | 7 +++ arch/s390/kvm/kvm-s390.c | 9 +++- arch/s390/kvm/kvm-s390.h | 1 + arch/s390/kvm/sigp.c | 28 ++++++++++ arch/x86/events/core.c | 17 ++++--- arch/x86/events/intel/core.c | 9 ++-- arch/x86/include/asm/kvm_host.h | 1 + arch/x86/kvm/vmx/vmx.c | 1 + arch/x86/kvm/x86.c | 7 ++- drivers/base/devtmpfs.c | 7 +++ drivers/firmware/qemu_fw_cfg.c | 20 +++----- drivers/media/usb/uvc/uvc_video.c | 4 ++ drivers/mtd/chips/Kconfig | 2 + drivers/mtd/maps/Kconfig | 2 +- .../wireless/realtek/rtlwifi/rtl8192cu/hw.c | 1 + drivers/remoteproc/qcom_pil_info.c | 2 +- drivers/video/fbdev/vga16fb.c | 24 +++++++++ fs/9p/vfs_inode_dotl.c | 29 +++++++---- fs/orangefs/orangefs-bufmap.c | 7 ++- fs/super.c | 4 +- include/linux/fs_context.h | 2 + include/linux/perf_event.h | 13 ++++- kernel/events/core.c | 13 +++-- sound/pci/hda/patch_realtek.c | 51 +++++++++++++++++-- 32 files changed, 264 insertions(+), 72 deletions(-) -- 2.20.1

1 22

[PATCH openEuler-5.10 00/23] Backport 5.10.92 LTS patches
by Zheng Zengkai 19 Apr '22

19 Apr '22

Backport 5.10.92 LTS patches from upstream. Conflicts: already merged(git am --skip): 35ab8c9085b0a bpf: Fix out of bounds access from invalid *_or_null type verification Aaron Ma (2): Bluetooth: btusb: Add support for Foxconn MT7922A Bluetooth: btusb: Add support for Foxconn QCA 0xe0d0 Adrian Hunter (1): mmc: sdhci-pci: Add PCI ID for Intel ADL Alan Stern (2): USB: core: Fix bug in resuming hub's handling of wakeup requests USB: Fix "slab-out-of-bounds Write" bug in usb_hcd_poll_rh_status Andy Shevchenko (1): mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe() Arnd Bergmann (1): staging: greybus: fix stack size warning with UBSAN Brian Silverman (1): can: gs_usb: gs_can_start_xmit(): zero-initialize hf->{flags,reserved} Daniel Borkmann (1): veth: Do not record rx queue hint in veth_xmit Dominik Brodowski (1): random: fix crash on multiple early calls to add_bootloader_randomness() Eric Biggers (2): random: fix data race on crng_node_pool random: fix data race on crng init time Frederic Weisbecker (1): workqueue: Fix unbind_workers() VS wq_worker_running() race Johan Hovold (1): Bluetooth: bfusb: fix division by zero in send path Marc Kleine-Budde (2): can: gs_usb: fix use of uninitialized variable, detach device on reception of invalid USB data can: isotp: convert struct tpcon::{idx,len} to unsigned int Mark-YW.Chen (1): Bluetooth: btusb: fix memory leak in btusb_mtk_submit_wmt_recv_urb() Nathan Chancellor (2): staging: wlan-ng: Avoid bitwise vs logical OR warning in hfa384x_usb_throttlefn() drm/i915: Avoid bitwise vs logical OR warning in snb_wm_latency_quirk() Paul Cercueil (1): ARM: dts: exynos: Fix BCM4330 Bluetooth reset polarity in I9100 Ricardo Ribalda (1): media: Revert "media: uvcvideo: Set unique vdev name based in type" Sven Eckelmann (1): ath11k: Fix buffer overflow when scanning with extraie Zijun Hu (1): Bluetooth: btusb: Add two more Bluetooth parts for WCN6855 arch/arm/boot/dts/exynos4210-i9100.dts | 2 +- drivers/bluetooth/bfusb.c | 3 + drivers/bluetooth/btusb.c | 22 +++++ drivers/char/random.c | 117 +++++++++++++---------- drivers/gpu/drm/i915/intel_pm.c | 6 +- drivers/media/usb/uvc/uvc_driver.c | 7 +- drivers/mfd/intel-lpss-acpi.c | 7 +- drivers/mmc/host/sdhci-pci-core.c | 1 + drivers/mmc/host/sdhci-pci.h | 1 + drivers/net/can/usb/gs_usb.c | 5 +- drivers/net/veth.c | 1 - drivers/net/wireless/ath/ath11k/wmi.c | 6 +- drivers/staging/greybus/audio_topology.c | 92 +++++++++--------- drivers/staging/wlan-ng/hfa384x_usb.c | 22 ++--- drivers/usb/core/hcd.c | 9 +- drivers/usb/core/hub.c | 2 +- kernel/workqueue.c | 9 ++ net/can/isotp.c | 4 +- 18 files changed, 190 insertions(+), 126 deletions(-) -- 2.20.1

1 23

2024

2023

2022

2021

2020

2019

Kernel