- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] dm thin: use refcount_t for thin_c reference counting
by Yongqiang Liu 08 Aug '22

08 Aug '22

From: John Pittman <jpittman(a)redhat.com> mainline inclusion from mainline-v4.20-rc1 commit 22d4c291f58752d14efb8a185b772a3fc3e947d2 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5KSEX CVE: NA -------------------------------- The API surrounding refcount_t should be used in place of atomic_t when variables are being used as reference counters. It can potentially prevent reference counter overflows and use-after-free conditions. In the dm thin layer, one such example is tc->refcount. Change this from the atomic_t API to the refcount_t API to prevent mentioned conditions. Signed-off-by: John Pittman <jpittman(a)redhat.com> Signed-off-by: Mike Snitzer <snitzer(a)redhat.com> Signed-off-by: Luo Meng <luomeng12(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/md/dm-thin.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c index 2b6dd7a275eb..e352aa3fdfb0 100644 --- a/drivers/md/dm-thin.c +++ b/drivers/md/dm-thin.c @@ -355,7 +355,7 @@ struct thin_c { * Ensures the thin is not destroyed until the worker has finished * iterating the active_thins list. */ - atomic_t refcount; + refcount_t refcount; struct completion can_destroy; }; @@ -4100,12 +4100,12 @@ static struct target_type pool_target = { *--------------------------------------------------------------*/ static void thin_get(struct thin_c *tc) { - atomic_inc(&tc->refcount); + refcount_inc(&tc->refcount); } static void thin_put(struct thin_c *tc) { - if (atomic_dec_and_test(&tc->refcount)) + if (refcount_dec_and_test(&tc->refcount)) complete(&tc->can_destroy); } @@ -4255,7 +4255,7 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv) r = -EINVAL; goto bad; } - atomic_set(&tc->refcount, 1); + refcount_set(&tc->refcount, 1); init_completion(&tc->can_destroy); list_add_tail_rcu(&tc->list, &tc->pool->active_thins); spin_unlock_irqrestore(&tc->pool->lock, flags); -- 2.25.1

1 0

Kernel SIG 申报议题：英特尔Sapphire Rapids平台PMU新特性
by Jason Zeng 08 Aug '22

08 Aug '22

议题：英特尔Sapphire Rapids平台PMU新特性简介：主要介绍一下英特尔的新一代Sapphire Rapids平台上的PMU新特性，以及Linux的支持情况。

1 0

[PATCH openEuler-1.0-LTS 01/29] ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()
by Yongqiang Liu 08 Aug '22

08 Aug '22

From: Sergey Shtylyov <s.shtylyov(a)omp.ru> stable inclusion from stable-4.19.249 commit a810bd5af06977a847d1f202b22d7defd5c62497 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5I4FP CVE: NA -------------------------------- [ Upstream commit bf476fe22aa1851bab4728e0c49025a6a0bea307 ] In an unlikely (and probably wrong?) case that the 'ppi' parameter of ata_host_alloc_pinfo() points to an array starting with a NULL pointer, there's going to be a kernel oops as the 'pi' local variable won't get reassigned from the initial value of NULL. Initialize 'pi' instead to '&ata_dummy_port_info' to fix the possible kernel oops for good... Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. Signed-off-by: Sergey Shtylyov <s.shtylyov(a)omp.ru> Signed-off-by: Damien Le Moal <damien.lemoal(a)opensource.wdc.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/ata/libata-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c index 290ff99bf1d8..0bcdc5261480 100644 --- a/drivers/ata/libata-core.c +++ b/drivers/ata/libata-core.c @@ -6240,7 +6240,7 @@ struct ata_host *ata_host_alloc_pinfo(struct device *dev, const struct ata_port_info * const * ppi, int n_ports) { - const struct ata_port_info *pi; + const struct ata_port_info *pi = &ata_dummy_port_info; struct ata_host *host; int i, j; @@ -6248,7 +6248,7 @@ struct ata_host *ata_host_alloc_pinfo(struct device *dev, if (!host) return NULL; - for (i = 0, j = 0, pi = NULL; i < host->n_ports; i++) { + for (i = 0, j = 0; i < host->n_ports; i++) { struct ata_port *ap = host->ports[i]; if (ppi[j]) -- 2.25.1

1 28

[PATCH openEuler-1.0-LTS] ipv6/addrconf: fix a null-ptr-deref bug for ip6_ptr
by Yongqiang Liu 05 Aug '22

05 Aug '22

From: Ziyang Xuan <william.xuanziyang(a)huawei.com> mainline inclusion from mainline-v5.19 commit 85f0173df35e5462d89947135a6a5599c6c3ef6f category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5JW9C CVE: NA ------------------------------- Change net device's MTU to smaller than IPV6_MIN_MTU or unregister device while matching route. That may trigger null-ptr-deref bug for ip6_ptr probability as following. ========================================================= BUG: KASAN: null-ptr-deref in find_match.part.0+0x70/0x134 Read of size 4 at addr 0000000000000308 by task ping6/263 CPU: 2 PID: 263 Comm: ping6 Not tainted 5.19.0-rc7+ #14 Call trace: dump_backtrace+0x1a8/0x230 show_stack+0x20/0x70 dump_stack_lvl+0x68/0x84 print_report+0xc4/0x120 kasan_report+0x84/0x120 __asan_load4+0x94/0xd0 find_match.part.0+0x70/0x134 __find_rr_leaf+0x408/0x470 fib6_table_lookup+0x264/0x540 ip6_pol_route+0xf4/0x260 ip6_pol_route_output+0x58/0x70 fib6_rule_lookup+0x1a8/0x330 ip6_route_output_flags_noref+0xd8/0x1a0 ip6_route_output_flags+0x58/0x160 ip6_dst_lookup_tail+0x5b4/0x85c ip6_dst_lookup_flow+0x98/0x120 rawv6_sendmsg+0x49c/0xc70 inet_sendmsg+0x68/0x94 Reproducer as following: Firstly, prepare conditions: $ip netns add ns1 $ip netns add ns2 $ip link add veth1 type veth peer name veth2 $ip link set veth1 netns ns1 $ip link set veth2 netns ns2 $ip netns exec ns1 ip -6 addr add 2001:0db8:0:f101::1/64 dev veth1 $ip netns exec ns2 ip -6 addr add 2001:0db8:0:f101::2/64 dev veth2 $ip netns exec ns1 ifconfig veth1 up $ip netns exec ns2 ifconfig veth2 up $ip netns exec ns1 ip -6 route add 2000::/64 dev veth1 metric 1 $ip netns exec ns2 ip -6 route add 2001::/64 dev veth2 metric 1 Secondly, execute the following two commands in two ssh windows respectively: $ip netns exec ns1 sh $while true; do ip -6 addr add 2001:0db8:0:f101::1/64 dev veth1; ip -6 route add 2000::/64 dev veth1 metric 1; ping6 2000::2; done $ip netns exec ns1 sh $while true; do ip link set veth1 mtu 1000; ip link set veth1 mtu 1500; sleep 5; done It is because ip6_ptr has been assigned to NULL in addrconf_ifdown() firstly, then ip6_ignore_linkdown() accesses ip6_ptr directly without NULL check. cpu0 cpu1 fib6_table_lookup __find_rr_leaf addrconf_notify [ NETDEV_CHANGEMTU ] addrconf_ifdown RCU_INIT_POINTER(dev->ip6_ptr, NULL) find_match ip6_ignore_linkdown So we can add NULL check for ip6_ptr before using in ip6_ignore_linkdown() to fix the null-ptr-deref bug. Fixes: dcd1f572954f ("net/ipv6: Remove fib6_idev") Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://lore.kernel.org/r/20220728013307.656257-1-william.xuanziyang@huawei… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: include/net/addrconf.h net/ipv6/route.c Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/ipv6/route.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 8efb03cc6f24..31c285d0f8c3 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -655,6 +655,9 @@ static inline bool fib6_ignore_linkdown(const struct fib6_info *f6i) if (dev) { const struct inet6_dev *idev = __in6_dev_get(dev); + if (unlikely(!idev)) + return true; + rc = !!idev->cnf.ignore_routes_with_linkdown; } -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] io_uring: add missing item types for various requests
by Yongqiang Liu 05 Aug '22

05 Aug '22

From: Jens Axboe <axboe(a)kernel.dk> stable inclusion from stable-v5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5IM3T CVE: CVE-2022-2327 -------------------------------- Any read/write should grab current->nsproxy, denoted by IO_WQ_WORK_FILES as it refers to current->files as well, and connect and recv/recvmsg, send/sendmsg should grab current->fs which is denoted by IO_WQ_WORK_FS. No upstream commit exists for this issue. Reported-by: Bing-Jhong Billy Jheng <billy(a)starlabs.sg> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: 1. read/write already grab current->nsproxy, thus don't modified read/write related ops. 2. 'work_flags' doesn't exist, io_op_def is using field 'needs_fs' to decide if 'current->fs' should be grabbed. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/io_uring.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/io_uring.c b/fs/io_uring.c index 8a96b7df4112..d4e430b51098 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -816,6 +816,7 @@ static const struct io_op_def io_op_defs[] = { .async_ctx = 1, .needs_mm = 1, .needs_file = 1, + .needs_fs = 1, .unbound_nonreg_file = 1, .pollout = 1, }, @@ -864,12 +865,14 @@ static const struct io_op_def io_op_defs[] = { [IORING_OP_SEND] = { .needs_mm = 1, .needs_file = 1, + .needs_fs = 1, .unbound_nonreg_file = 1, .pollout = 1, }, [IORING_OP_RECV] = { .needs_mm = 1, .needs_file = 1, + .needs_fs = 1, .unbound_nonreg_file = 1, .pollin = 1, .buffer_select = 1, -- 2.25.1

1 0

[PATCH openEuler-22.09 00/20] Add programmable schedule feature for
by Zheng Zengkai 05 Aug '22

05 Aug '22

Add programmable schedule feature for openEuler-22.09. Chen Hui (12): sched: programmable: Add a tag for the task group sched: programmable: Add user interface of task group tag sched: programmable: Add a tag for the task sched: programmable: Add user interface of task tag sched: programmable: add bpf_sched_task_tag_of helper function sched: programmable: Add convenient helper functions to convert sched entity bpf: BPF samples support SCHED program type samples: bpf: Add bpf sched preempt sample program bpf:programmable: Add four helper functions to get cpu stat bpf:programmable: Add cpumask ops collection sched: programmable: Add lib for sched programmable sched: programmable: Add hook for select_task_rq_fair Guan Jing (2): sched: programmable: Add hook for entity_before samples: bpf: Add bpf sched pick task sample Hui Tang (3): bpf:programmable: Add helper func to check cpu share cache bpf:programmable: Add helper func to set cpus_ptr in task samples:bpf: Add samples for cfs select core Ren Zhijie (3): sched: programmable: add bpf_sched_tg_tag_of helper function sched: programmable: Add helpers to set tag of task or task_group sched: programmable: Add helper function for cpu topology. fs/proc/base.c | 65 ++++ include/linux/bpf_topology.h | 46 +++ include/linux/sched.h | 85 ++++++ include/linux/sched_hook_defs.h | 7 +- include/uapi/linux/bpf.h | 112 +++++++ init/init_task.c | 3 + kernel/bpf/helpers.c | 12 + kernel/bpf/verifier.c | 4 +- kernel/sched/Makefile | 3 +- kernel/sched/bpf_sched.c | 409 +++++++++++++++++++++++++ kernel/sched/bpf_topology.c | 99 ++++++ kernel/sched/core.c | 103 +++++++ kernel/sched/fair.c | 58 ++++ kernel/sched/sched.h | 8 + samples/bpf/Makefile | 9 + samples/bpf/bpf_load.c | 8 +- samples/bpf/sched_pick_task_kern.c | 62 ++++ samples/bpf/sched_pick_task_user.c | 92 ++++++ samples/bpf/sched_preempt_kern.c | 151 ++++++++++ samples/bpf/sched_preempt_user.c | 139 +++++++++ samples/bpf/sched_select_core_kern.c | 239 +++++++++++++++ samples/bpf/sched_select_core_user.c | 114 +++++++ scripts/bpf_helpers_doc.py | 20 ++ tools/include/uapi/linux/bpf.h | 112 +++++++ tools/lib/bpf/libbpf_sched.h | 435 +++++++++++++++++++++++++++ 25 files changed, 2389 insertions(+), 6 deletions(-) create mode 100644 include/linux/bpf_topology.h create mode 100644 kernel/sched/bpf_topology.c create mode 100644 samples/bpf/sched_pick_task_kern.c create mode 100644 samples/bpf/sched_pick_task_user.c create mode 100644 samples/bpf/sched_preempt_kern.c create mode 100644 samples/bpf/sched_preempt_user.c create mode 100644 samples/bpf/sched_select_core_kern.c create mode 100644 samples/bpf/sched_select_core_user.c create mode 100644 tools/lib/bpf/libbpf_sched.h -- 2.20.1

1 20

[PATCH openEuler-1.0-LTS 1/3] net: sched: sch_teql: fix null-pointer dereference
by Yongqiang Liu 05 Aug '22

05 Aug '22

From: Pavel Tikhomirov <ptikhomirov(a)virtuozzo.com> stable inclusion from stable-v4.19.187 commit a9a7488979a7d0abfd30bc32f370b8e0c124db33 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5JPWC CVE: NA -------------------------------- commit 1ffbc7ea91606e4abd10eb60de5367f1c86daf5e upstream. Reproduce: modprobe sch_teql tc qdisc add dev teql0 root teql0 This leads to (for instance in Centos 7 VM) OOPS: [ 532.366633] BUG: unable to handle kernel NULL pointer dereference at 00000000000000a8 [ 532.366733] IP: [<ffffffffc06124a8>] teql_destroy+0x18/0x100 [sch_teql] [ 532.366825] PGD 80000001376d5067 PUD 137e37067 PMD 0 [ 532.366906] Oops: 0000 [#1] SMP [ 532.366987] Modules linked in: sch_teql ... [ 532.367945] CPU: 1 PID: 3026 Comm: tc Kdump: loaded Tainted: G ------------ T 3.10.0-1062.7.1.el7.x86_64 #1 [ 532.368041] Hardware name: Virtuozzo KVM, BIOS 1.11.0-2.vz7.2 04/01/2014 [ 532.368125] task: ffff8b7d37d31070 ti: ffff8b7c9fdbc000 task.ti: ffff8b7c9fdbc000 [ 532.368224] RIP: 0010:[<ffffffffc06124a8>] [<ffffffffc06124a8>] teql_destroy+0x18/0x100 [sch_teql] [ 532.368320] RSP: 0018:ffff8b7c9fdbf8e0 EFLAGS: 00010286 [ 532.368394] RAX: ffffffffc0612490 RBX: ffff8b7cb1565e00 RCX: ffff8b7d35ba2000 [ 532.368476] RDX: ffff8b7d35ba2000 RSI: 0000000000000000 RDI: ffff8b7cb1565e00 [ 532.368557] RBP: ffff8b7c9fdbf8f8 R08: ffff8b7d3fd1f140 R09: ffff8b7d3b001600 [ 532.368638] R10: ffff8b7d3b001600 R11: ffffffff84c7d65b R12: 00000000ffffffd8 [ 532.368719] R13: 0000000000008000 R14: ffff8b7d35ba2000 R15: ffff8b7c9fdbf9a8 [ 532.368800] FS: 00007f6a4e872740(0000) GS:ffff8b7d3fd00000(0000) knlGS:0000000000000000 [ 532.368885] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 532.368961] CR2: 00000000000000a8 CR3: 00000001396ee000 CR4: 00000000000206e0 [ 532.369046] Call Trace: [ 532.369159] [<ffffffff84c8192e>] qdisc_create+0x36e/0x450 [ 532.369268] [<ffffffff846a9b49>] ? ns_capable+0x29/0x50 [ 532.369366] [<ffffffff849afde2>] ? nla_parse+0x32/0x120 [ 532.369442] [<ffffffff84c81b4c>] tc_modify_qdisc+0x13c/0x610 [ 532.371508] [<ffffffff84c693e7>] rtnetlink_rcv_msg+0xa7/0x260 [ 532.372668] [<ffffffff84907b65>] ? sock_has_perm+0x75/0x90 [ 532.373790] [<ffffffff84c69340>] ? rtnl_newlink+0x890/0x890 [ 532.374914] [<ffffffff84c8da7b>] netlink_rcv_skb+0xab/0xc0 [ 532.376055] [<ffffffff84c63708>] rtnetlink_rcv+0x28/0x30 [ 532.377204] [<ffffffff84c8d400>] netlink_unicast+0x170/0x210 [ 532.378333] [<ffffffff84c8d7a8>] netlink_sendmsg+0x308/0x420 [ 532.379465] [<ffffffff84c2f3a6>] sock_sendmsg+0xb6/0xf0 [ 532.380710] [<ffffffffc034a56e>] ? __xfs_filemap_fault+0x8e/0x1d0 [xfs] [ 532.381868] [<ffffffffc034a75c>] ? xfs_filemap_fault+0x2c/0x30 [xfs] [ 532.383037] [<ffffffff847ec23a>] ? __do_fault.isra.61+0x8a/0x100 [ 532.384144] [<ffffffff84c30269>] ___sys_sendmsg+0x3e9/0x400 [ 532.385268] [<ffffffff847f3fad>] ? handle_mm_fault+0x39d/0x9b0 [ 532.386387] [<ffffffff84d88678>] ? __do_page_fault+0x238/0x500 [ 532.387472] [<ffffffff84c31921>] __sys_sendmsg+0x51/0x90 [ 532.388560] [<ffffffff84c31972>] SyS_sendmsg+0x12/0x20 [ 532.389636] [<ffffffff84d8dede>] system_call_fastpath+0x25/0x2a [ 532.390704] [<ffffffff84d8de21>] ? system_call_after_swapgs+0xae/0x146 [ 532.391753] Code: 00 00 00 00 00 00 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 66 66 66 66 90 55 48 89 e5 41 55 41 54 53 48 8b b7 48 01 00 00 48 89 fb <48> 8b 8e a8 00 00 00 48 85 c9 74 43 48 89 ca eb 0f 0f 1f 80 00 [ 532.394036] RIP [<ffffffffc06124a8>] teql_destroy+0x18/0x100 [sch_teql] [ 532.395127] RSP <ffff8b7c9fdbf8e0> [ 532.396179] CR2: 00000000000000a8 Null pointer dereference happens on master->slaves dereference in teql_destroy() as master is null-pointer. When qdisc_create() calls teql_qdisc_init() it imediately fails after check "if (m->dev == dev)" because both devices are teql0, and it does not set qdisc_priv(sch)->m leaving it zero on error path, then qdisc_create() imediately calls teql_destroy() which does not expect zero master pointer and we get OOPS. Fixes: 87b60cfacf9f ("net_sched: fix error recovery at qdisc creation") Signed-off-by: Pavel Tikhomirov <ptikhomirov(a)virtuozzo.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/sched/sch_teql.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c index 7ed53124069c..163364124691 100644 --- a/net/sched/sch_teql.c +++ b/net/sched/sch_teql.c @@ -138,6 +138,9 @@ teql_destroy(struct Qdisc *sch) struct teql_sched_data *dat = qdisc_priv(sch); struct teql_master *master = dat->m; + if (!master) + return; + prev = master->slaves; if (prev) { do { -- 2.25.1

1 2

[PATCH openEuler-22.09 0/4] add exec hugetlb support
by Zheng Zengkai 05 Aug '22

05 Aug '22

Some applications has large code and data segment, and this causes high TLB miss when page size is 4K. Mapping these apps into hugetlbfs will boost their performance. A userspace tool libhugetlbfs can do this but it seems to stopped development since 2020, and it does not support debugging. Tmpfs supports transparent hugepage, but it will be split into small pages during copy-on-write. Userspace hotpatch will do mprotect on code segment and trigger pmd split, and some users think performance degradation after hotpatch is unacceptable. This patch set implements hugetlb support in exec, and solved the debugging issue. --- v5: mark new Kconfigs default n and add sysctl knob v4: rebase to 5.10.0-107.0.0 v3: add MAP_FILE_HUGETLB v2: fix kabi Liu Zixian (4): hugetlb: support private file map elf: support hugetlb map enable elf huge map by default fs: add sysctl knob for exec_hugetlb arch/arm64/configs/openeuler_defconfig | 2 + arch/x86/configs/openeuler_defconfig | 2 + fs/Kconfig | 24 ++++++ fs/binfmt_elf.c | 115 +++++++++++++++++++++++++ fs/exec.c | 4 + fs/proc/task_mmu.c | 5 ++ include/linux/elf.h | 4 + include/linux/mm_types.h | 4 + include/uapi/asm-generic/mman-common.h | 1 + include/uapi/linux/elf.h | 1 + kernel/events/core.c | 7 ++ kernel/fork.c | 5 ++ kernel/sysctl.c | 11 +++ mm/hugetlb.c | 25 ++++++ mm/mmap.c | 20 +++++ mm/util.c | 40 +++++++++ 16 files changed, 270 insertions(+) -- 2.20.1

1 4

[PATCH openEuler-5.10 01/20] md: add io accounting for raid0 and raid5
by Zheng Zengkai 04 Aug '22

04 Aug '22

From: Guoqing Jiang <jgq516(a)gmail.com> mainline inclusion from mainline-v5.14-rc1 commit 10764815ff4728d2c57da677cd5d3dd6f446cf5f category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I587H6 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------- We introduce a new bioset (io_acct_set) for raid0 and raid5 since they don't own clone infrastructure to accounting io. And the bioset is added to mddev instead of to raid0 and raid5 layer, because with this way, we can put common functions to md.h and reuse them in raid0 and raid5. Also struct md_io_acct is added accordingly which includes io start_time, the origin bio and cloned bio. Then we can call bio_{start,end}_io_acct to get related io status. Signed-off-by: Guoqing Jiang <jiangguoqing(a)kylinos.cn> Signed-off-by: Song Liu <song(a)kernel.org> Conflict: drivers/md/md.c drivers/md/md.h Signed-off-by: Zhang Wensheng <zhangwensheng5(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/md/md.c | 52 ++++++++++++++++++++++++++++++++++++++++++---- drivers/md/md.h | 8 +++++++ drivers/md/raid0.c | 3 +++ drivers/md/raid5.c | 9 ++++++++ 4 files changed, 68 insertions(+), 4 deletions(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index a299fda5b0e9..10d9a8bed604 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -2361,7 +2361,8 @@ int md_integrity_register(struct mddev *mddev) bdev_get_integrity(reference->bdev)); pr_debug("md: data integrity enabled on %s\n", mdname(mddev)); - if (bioset_integrity_create(&mddev->bio_set, BIO_POOL_SIZE)) { + if (bioset_integrity_create(&mddev->bio_set, BIO_POOL_SIZE) || + bioset_integrity_create(&mddev->io_acct_set, BIO_POOL_SIZE)) { pr_err("md: failed to create integrity pool for %s\n", mdname(mddev)); return -EINVAL; @@ -5597,6 +5598,7 @@ static void md_free(struct kobject *ko) bioset_exit(&mddev->bio_set); bioset_exit(&mddev->sync_set); + bioset_exit(&mddev->io_acct_set); kfree(mddev); } @@ -5885,7 +5887,13 @@ int md_run(struct mddev *mddev) if (!bioset_initialized(&mddev->sync_set)) { err = bioset_init(&mddev->sync_set, BIO_POOL_SIZE, 0, BIOSET_NEED_BVECS); if (err) - return err; + goto exit_bio_set; + } + if (!bioset_initialized(&mddev->io_acct_set)) { + err = bioset_init(&mddev->io_acct_set, BIO_POOL_SIZE, + offsetof(struct md_io_acct, bio_clone), 0); + if (err) + goto exit_sync_set; } spin_lock(&pers_lock); @@ -6013,6 +6021,7 @@ int md_run(struct mddev *mddev) blk_queue_flag_set(QUEUE_FLAG_NONROT, mddev->queue); else blk_queue_flag_clear(QUEUE_FLAG_NONROT, mddev->queue); + blk_queue_flag_set(QUEUE_FLAG_IO_STAT, mddev->queue); } if (pers->sync_request) { if (mddev->kobj.sd && @@ -6062,8 +6071,11 @@ int md_run(struct mddev *mddev) module_put(pers->owner); md_bitmap_destroy(mddev); abort: - bioset_exit(&mddev->bio_set); + bioset_exit(&mddev->io_acct_set); +exit_sync_set: bioset_exit(&mddev->sync_set); +exit_bio_set: + bioset_exit(&mddev->bio_set); return err; } EXPORT_SYMBOL_GPL(md_run); @@ -6288,6 +6300,7 @@ void md_stop(struct mddev *mddev) __md_stop(mddev); bioset_exit(&mddev->bio_set); bioset_exit(&mddev->sync_set); + bioset_exit(&mddev->io_acct_set); } EXPORT_SYMBOL_GPL(md_stop); @@ -8571,9 +8584,40 @@ void md_write_end(struct mddev *mddev) roundup(jiffies, mddev->safemode_delay) + mddev->safemode_delay); } - EXPORT_SYMBOL(md_write_end); +static void md_end_io_acct(struct bio *bio) +{ + struct md_io_acct *md_io_acct = bio->bi_private; + struct bio *orig_bio = md_io_acct->orig_bio; + + orig_bio->bi_status = bio->bi_status; + + bio_end_io_acct(orig_bio, md_io_acct->start_time); + bio_put(bio); + bio_endio(orig_bio); +} + +/* used by personalities (raid0 and raid5) to account io stats */ +void md_account_bio(struct mddev *mddev, struct bio **bio) +{ + struct md_io_acct *md_io_acct; + struct bio *clone; + + if (!blk_queue_io_stat((*bio)->bi_disk->queue)) + return; + + clone = bio_clone_fast(*bio, GFP_NOIO, &mddev->io_acct_set); + md_io_acct = container_of(clone, struct md_io_acct, bio_clone); + md_io_acct->orig_bio = *bio; + md_io_acct->start_time = bio_start_io_acct(*bio); + + clone->bi_end_io = md_end_io_acct; + clone->bi_private = md_io_acct; + *bio = clone; +} +EXPORT_SYMBOL_GPL(md_account_bio); + /* md_allow_write(mddev) * Calling this ensures that the array is marked 'active' so that writes * may proceed without blocking. It is important to call this before diff --git a/drivers/md/md.h b/drivers/md/md.h index 85177d068322..20c16cfdd6bb 100644 --- a/drivers/md/md.h +++ b/drivers/md/md.h @@ -491,6 +491,7 @@ struct mddev { struct bio_set sync_set; /* for sync operations like * metadata and bitmap writes */ + struct bio_set io_acct_set; /* for raid0 and raid5 io accounting */ /* Generic flush handling. * The last to finish preflush schedules a worker to submit @@ -687,6 +688,12 @@ struct md_thread { void *private; }; +struct md_io_acct { + struct bio *orig_bio; + unsigned long start_time; + struct bio bio_clone; +}; + #define THREAD_WAKEUP 0 static inline void safe_put_page(struct page *p) @@ -716,6 +723,7 @@ extern void md_write_end(struct mddev *mddev); extern void md_done_sync(struct mddev *mddev, int blocks, int ok); extern void md_error(struct mddev *mddev, struct md_rdev *rdev); extern void md_finish_reshape(struct mddev *mddev); +void md_account_bio(struct mddev *mddev, struct bio **bio); extern bool __must_check md_flush_request(struct mddev *mddev, struct bio *bio); extern void md_super_write(struct mddev *mddev, struct md_rdev *rdev, diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c index 35843df15b5e..0312b192106a 100644 --- a/drivers/md/raid0.c +++ b/drivers/md/raid0.c @@ -556,6 +556,9 @@ static bool raid0_make_request(struct mddev *mddev, struct bio *bio) bio = split; } + if (bio->bi_pool != &mddev->bio_set) + md_account_bio(mddev, &bio); + orig_sector = sector; zone = find_zone(mddev->private, &sector); switch (conf->layout) { diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c index c82953a3299e..35dacc6e754f 100644 --- a/drivers/md/raid5.c +++ b/drivers/md/raid5.c @@ -5487,6 +5487,7 @@ static struct bio *chunk_aligned_read(struct mddev *mddev, struct bio *raid_bio) sector_t sector = raid_bio->bi_iter.bi_sector; unsigned chunk_sects = mddev->chunk_sectors; unsigned sectors = chunk_sects - (sector & (chunk_sects-1)); + struct r5conf *conf = mddev->private; if (sectors < bio_sectors(raid_bio)) { struct r5conf *conf = mddev->private; @@ -5496,6 +5497,9 @@ static struct bio *chunk_aligned_read(struct mddev *mddev, struct bio *raid_bio) raid_bio = split; } + if (raid_bio->bi_pool != &conf->bio_split) + md_account_bio(mddev, &raid_bio); + if (!raid5_read_one_chunk(mddev, raid_bio)) return raid_bio; @@ -5775,6 +5779,7 @@ static bool raid5_make_request(struct mddev *mddev, struct bio * bi) DEFINE_WAIT(w); bool do_prepare; bool do_flush = false; + bool do_clone = false; if (unlikely(bi->bi_opf & REQ_PREFLUSH)) { int ret = log_handle_flush_request(conf, bi); @@ -5803,6 +5808,7 @@ static bool raid5_make_request(struct mddev *mddev, struct bio * bi) if (rw == READ && mddev->degraded == 0 && mddev->reshape_position == MaxSector) { bi = chunk_aligned_read(mddev, bi); + do_clone = true; if (!bi) return true; } @@ -5817,6 +5823,9 @@ static bool raid5_make_request(struct mddev *mddev, struct bio * bi) last_sector = bio_end_sector(bi); bi->bi_next = NULL; + if (!do_clone) + md_account_bio(mddev, &bi); + prepare_to_wait(&conf->wait_for_overlap, &w, TASK_UNINTERRUPTIBLE); for (; logical_sector < last_sector; logical_sector += RAID5_STRIPE_SECTORS(conf)) { int previous; -- 2.20.1

1 19

[PATCH openEuler-5.10 00/64] Backport 5.10.115 LTS
by Zheng Zengkai 04 Aug '22

04 Aug '22

Backport 5.10.115 LTS patches from upstream. git cherry-pick v5.10.114..v5.10.115~1 -s Complicts: Already merged(4): 8a9e7c64f4a0 nfc: replace improper check device_is_registered() in netlink related functions 1961c5a688ed nfc: nfcmrvl: main: reorder destructive operations in nfcmrvl_nci_unregister_dev to avoid bugs 879b075a9a36 NFC: netlink: fix sleep in atomic bug when firmware download timeout a439819f4797 block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern Rejected(2): hinic driver drops related file in the patch: 475237e807a2 hinic: fix bug of wq out of bound access build failed due to reject of patch "845f44ce3d9f1 net/sched: flower: fix parsing of ethertype following VLAN header": d8338a7a0957 net/mlx5e: Don't match double-vlan packets if cvlan is not set Total patches: 70 - 4 - 2 = 64 Andreas Larsson (2): can: grcan: grcan_probe(): fix broken system id check for errata workaround needs can: grcan: only use the NAPI poll budget for RX Andrei Lalaev (1): gpiolib: of: fix bounds check for 'gpio-reserved-ranges' Armin Wolf (1): hwmon: (adt7470) Fix warning on module removal Aya Levin (1): net/mlx5: Fix slab-out-of-bounds while reading resource dump menu Brian Norris (1): mmc: core: Set HS clock speed before sending HS CMD13 Cheng Xu (1): RDMA/siw: Fix a condition race issue in MPA request processing Chengfeng Ye (1): firewire: fix potential uaf in outbound_phy_packet_callback() Codrin Ciubotariu (1): ASoC: dmaengine: Restore NULL prepare_slave_config() callback Daniel Hellstrom (1): can: grcan: use ofdev->dev when allocating DMA memory David Stevens (1): iommu/vt-d: Calculate mask for non-aligned flushes Duoming Zhou (1): can: grcan: grcan_close(): fix deadlock Eric Dumazet (1): net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter() Filipe Manana (1): btrfs: always log symlinks in full mode Frederic Weisbecker (2): rcu: Fix callbacks processing time limit retaining cond_resched() rcu: Apply callbacks processing time limit only on softirq Harry Wentland (1): drm/amd/display: Avoid reading audio pattern past AUDIO_CHANNELS_COUNT Helge Deller (1): parisc: Merge model and model name into one line in /proc/cpuinfo Ido Schimmel (1): selftests: mirror_gre_bridge_1q: Avoid changing PVID while interface is operational Jakob Koschel (1): firewire: remove check of list iterator against head past the loop body Jan Höppner (2): s390/dasd: Fix read for ESE with blksize < 4k s390/dasd: Fix read inconsistency for ESE DASD devices Jann Horn (1): selftests/seccomp: Don't call read() on TTY from background pgrp Kyle Huey (1): KVM: x86/svm: Account for family 17h event renumberings in amd_pmc_perf_hw_id Maciej W. Rozycki (1): MIPS: Fix CP0 counter erratum detection for R4k CPUs Mark Brown (5): ASoC: da7219: Fix change notifications for tone generator frequency ASoC: wm8958: Fix change notifications for DSP controls ASoC: meson: Fix event generation for AUI ACODEC mux ASoC: meson: Fix event generation for G12A tohdmi mux ASoC: meson: Fix event generation for AUI CODEC mux Mark Zhang (1): net/mlx5e: Fix the calling of update_buffer_lossy() API Michael Chan (1): bnxt_en: Fix unnecessary dropping of RX packets Mike Snitzer (1): dm: interlock pending dm_io and dm_wait_for_bios_completion Moshe Shemesh (1): net/mlx5: Avoid double clear or set of sync reset requested Moshe Tal (1): net/mlx5e: Fix trust state reset in reload Niels Dossche (1): firewire: core: extend card->lock in fw_core_handle_bus_reset Oliver Hartkopp (1): can: isotp: remove re-binding of bound socket Pali Rohár (2): PCI: aardvark: Clear all MSIs at setup PCI: aardvark: Fix reading MSI interrupt number Paolo Bonzini (2): KVM: x86: Do not change ICR on write to APIC_SELF_IPI KVM: x86/mmu: avoid NULL-pointer dereference on page freeing bugs Paul Blakey (1): net/mlx5e: CT: Fix queued up restore put() executing after relevant ft release Puyou Lu (1): gpio: pca953x: fix irq_stat not updated when irq is disabled (irq_mask not set) Ricky WU (1): mmc: rtsx: add 74 Clocks in power on flow Sandipan Das (1): kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has architectural PMU Sergey Shtylyov (1): smsc911x: allow using IRQ0 Shaik Sajida Bhanu (1): mmc: sdhci-msm: Reset GCC_SDCC_BCR register for SDHC Shravya Kumbham (1): net: emaclite: Add error handling for of_address_to_resource() Somnath Kotur (1): bnxt_en: Fix possible bnxt_open() failure caused by wrong RFS flag Stefan Haberland (2): s390/dasd: fix data corruption for ESE devices s390/dasd: prevent double format of tracks for ESE devices Takashi Sakamoto (1): ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes Tan Tee Min (1): net: stmmac: disable Split Header (SPH) for Intel platforms Thomas Pfaff (1): genirq: Synchronize interrupt thread startup Trond Myklebust (2): Revert "SUNRPC: attempt AF_LOCAL connect on setup" NFSv4: Don't invalidate inode attributes on delegation return Vladimir Oltean (1): selftests: ocelot: tc_flower_chains: specify conform-exceed action for policer Wanpeng Li (2): x86/kvm: Preserve BSP MSR_KVM_POLL_CONTROL across suspend/resume KVM: LAPIC: Enable timer posted-interrupt only when mwait/hlt is advertised Yang Yingliang (4): net: ethernet: mediatek: add missing of_node_put() in mtk_sgmii_init() net: dsa: mt7530: add missing of_node_put() in mt7530_setup() net: stmmac: dwmac-sun8i: add missing of_node_put() in sun8i_dwmac_register_mdio_mux() net: cpsw: add missing of_node_put() in cpsw_probe_dt() Zihao Wang (1): ALSA: hda/realtek: Add quirk for Yoga Duet 7 13ITL6 speakers arch/mips/include/asm/timex.h | 8 ++-- arch/mips/kernel/time.c | 11 ++--- arch/parisc/kernel/processor.c | 3 +- arch/x86/kernel/kvm.c | 13 ++++++ arch/x86/kvm/cpuid.c | 5 ++ arch/x86/kvm/lapic.c | 10 ++-- arch/x86/kvm/mmu/mmu.c | 2 + arch/x86/kvm/svm/pmu.c | 28 +++++++++-- drivers/firewire/core-card.c | 3 ++ drivers/firewire/core-cdev.c | 4 +- drivers/firewire/core-topology.c | 9 ++-- drivers/firewire/core-transaction.c | 30 ++++++------ drivers/firewire/sbp2.c | 13 +++--- drivers/gpio/gpio-pca953x.c | 4 +- drivers/gpio/gpiolib-of.c | 2 +- .../gpu/drm/amd/display/dc/core/dc_link_dp.c | 2 +- drivers/hwmon/adt7470.c | 4 +- drivers/infiniband/sw/siw/siw_cm.c | 7 +-- drivers/iommu/intel/iommu.c | 27 +++++++++-- drivers/md/dm.c | 8 +++- drivers/mmc/core/mmc.c | 23 ++++++++-- drivers/mmc/host/rtsx_pci_sdmmc.c | 31 +++++++++---- drivers/mmc/host/sdhci-msm.c | 42 +++++++++++++++++ drivers/net/can/grcan.c | 46 ++++++++++--------- drivers/net/dsa/mt7530.c | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 13 ++++-- drivers/net/ethernet/mediatek/mtk_sgmii.c | 1 + .../mellanox/mlx5/core/diag/rsc_dump.c | 31 ++++++++++--- .../mellanox/mlx5/core/en/port_buffer.c | 4 +- .../ethernet/mellanox/mlx5/core/en/tc_ct.c | 4 ++ .../ethernet/mellanox/mlx5/core/en_dcbnl.c | 10 ++++ .../ethernet/mellanox/mlx5/core/fw_reset.c | 28 +++++++---- drivers/net/ethernet/smsc/smsc911x.c | 2 +- .../net/ethernet/stmicro/stmmac/dwmac-intel.c | 1 + .../net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 1 + .../net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- drivers/net/ethernet/ti/cpsw_new.c | 5 +- drivers/net/ethernet/xilinx/xilinx_emaclite.c | 15 ++++-- drivers/pci/controller/pci-aardvark.c | 16 +++---- drivers/s390/block/dasd.c | 18 ++++++-- drivers/s390/block/dasd_eckd.c | 28 ++++++++--- drivers/s390/block/dasd_int.h | 14 ++++++ fs/btrfs/tree-log.c | 14 +++++- fs/nfs/nfs4proc.c | 12 ++++- include/linux/stmmac.h | 1 + kernel/irq/internals.h | 2 + kernel/irq/irqdesc.c | 2 + kernel/irq/manage.c | 39 ++++++++++++---- kernel/rcu/tree.c | 32 +++++++------ net/can/isotp.c | 22 ++------- net/ipv4/igmp.c | 9 ++-- net/sunrpc/xprtsock.c | 3 -- sound/firewire/fireworks/fireworks_hwdep.c | 1 + sound/pci/hda/patch_realtek.c | 1 + sound/soc/codecs/da7219.c | 14 ++++-- sound/soc/codecs/wm8958-dsp2.c | 8 ++-- sound/soc/meson/aiu-acodec-ctrl.c | 2 +- sound/soc/meson/aiu-codec-ctrl.c | 2 +- sound/soc/meson/g12a-tohdmitx.c | 2 +- sound/soc/soc-generic-dmaengine-pcm.c | 6 +-- .../drivers/net/ocelot/tc_flower_chains.sh | 2 +- .../net/forwarding/mirror_gre_bridge_1q.sh | 3 ++ tools/testing/selftests/seccomp/seccomp_bpf.c | 10 ++-- 63 files changed, 501 insertions(+), 215 deletions(-) -- 2.20.1

1 64