- Kernel - mailweb.openeuler.org

[PATCH openEuler-20.09 00/23] CVE for openEuler 20.09
by Cheng Jian 16 Mar '21

16 Mar '21

CVE for openEuler 20.09 Chris Leech (2): scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE scsi: iscsi: Verify lengths on passthrough PDUs Jan Beulich (10): Xen/x86: don't bail early from clear_foreign_p2m_mapping() Xen/x86: also check kernel mapping in set_foreign_p2m_mapping() Xen/gntdev: correct dev_bus_addr handling in gntdev_map_grant_pages() Xen/gntdev: correct error checking in gntdev_map_grant_pages() xen-blkback: don't "handle" error by BUG() xen-netback: don't "handle" error by BUG() xen-scsiback: don't "handle" error by BUG() xen-blkback: fix error handling in xen_blkbk_map() Xen/gnttab: handle p2m update errors on a per-slot basis xen-netback: respect gnttab_map_refs()'s return value Joe Perches (1): sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output Lee Duncan (1): scsi: iscsi: Restrict sessions and handles to admin capabilities Miklos Szeredi (6): ovl: pass correct flags for opening real directory ovl: switch to mounter creds in readdir ovl: verify permissions in ovl_path_open() ovl: call secutiry hook in ovl_real_ioctl() ovl: check permission to open real file ovl: do not fail because of O_NOATIME Stefano Stabellini (1): xen/arm: don't ignore return errors from set_phys_to_machine Wenchao Hao (1): virtio-blk: modernize sysfs attribute creation Yang Yingliang (1): sysfs: fix kabi broken when add sysfs_emit and sysfs_emit_at Documentation/filesystems/sysfs.txt | 8 +- arch/arm/xen/p2m.c | 33 ++++++- arch/x86/xen/p2m.c | 59 ++++++++--- drivers/block/virtio_blk.c | 67 +++++++------ drivers/block/xen-blkback/blkback.c | 30 +++--- drivers/net/xen-netback/netback.c | 10 +- drivers/scsi/libiscsi.c | 148 ++++++++++++++-------------- drivers/scsi/scsi_transport_iscsi.c | 38 +++++-- drivers/xen/gntdev.c | 37 +++---- drivers/xen/xen-scsiback.c | 4 +- fs/overlayfs/file.c | 28 ++++-- fs/overlayfs/readdir.c | 37 +++++-- fs/overlayfs/util.c | 27 ++++- fs/sysfs/file.c | 55 +++++++++++ include/linux/sysfs.h | 16 +++ include/xen/grant_table.h | 1 + security/security.c | 1 + 17 files changed, 419 insertions(+), 180 deletions(-) -- 2.25.1

2 24

[PATCH openEuler-1.0-LTS 00/32] CVE in March for 20.03
by Cheng Jian 15 Mar '21

15 Mar '21

CVE-2021-27365 CVE-2021-27363 CVE-2021-27364 Chris Leech (2): scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE scsi: iscsi: Verify lengths on passthrough PDUs Christoph Hellwig (1): mm/swapfile.c: fix a comment in sys_swapon() Darrick J. Wong (2): mm: set S_SWAPFILE on blockdev swap devices vfs: don't allow writes to swap files Domenico Andreoli (1): hibernate: Allow uswsusp to write to swap Jan Beulich (10): Xen/x86: don't bail early from clear_foreign_p2m_mapping() Xen/x86: also check kernel mapping in set_foreign_p2m_mapping() Xen/gntdev: correct dev_bus_addr handling in gntdev_map_grant_pages() Xen/gntdev: correct error checking in gntdev_map_grant_pages() xen-blkback: don't "handle" error by BUG() xen-netback: don't "handle" error by BUG() xen-scsiback: don't "handle" error by BUG() xen-blkback: fix error handling in xen_blkbk_map() Xen/gnttab: handle p2m update errors on a per-slot basis xen-netback: respect gnttab_map_refs()'s return value Joe Perches (1): sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output Lee Duncan (1): scsi: iscsi: Restrict sessions and handles to admin capabilities Miaohe Lin (1): mm/swapfile.c: fix potential memory leak in sys_swapon Miklos Szeredi (6): ovl: pass correct flags for opening real directory ovl: switch to mounter creds in readdir ovl: verify permissions in ovl_path_open() ovl: call secutiry hook in ovl_real_ioctl() ovl: check permission to open real file ovl: do not fail because of O_NOATIME Naohiro Aota (1): mm/swapfile.c: move inode_lock out of claim_swapfile Stefano Stabellini (1): xen/arm: don't ignore return errors from set_phys_to_machine Wenchao Hao (2): nvme: register ns_id attributes as default sysfs groups virtio-blk: modernize sysfs attribute creation Yang Yingliang (1): sysfs: fix kabi broken when add sysfs_emit and sysfs_emit_at Ye Bin (1): ext4: Fix not report exception message when mount with errors=continue zhangyi (F) (1): block_dump: remove block_dump feature when dirting inode Documentation/filesystems/sysfs.txt | 8 +- arch/arm/xen/p2m.c | 33 ++++++- arch/x86/xen/p2m.c | 59 ++++++++--- drivers/block/virtio_blk.c | 67 +++++++------ drivers/block/xen-blkback/blkback.c | 30 +++--- drivers/net/xen-netback/netback.c | 10 +- drivers/nvme/host/core.c | 20 ++-- drivers/nvme/host/lightnvm.c | 105 +++++++++----------- drivers/nvme/host/multipath.c | 11 +-- drivers/nvme/host/nvme.h | 10 +- drivers/scsi/libiscsi.c | 148 ++++++++++++++-------------- drivers/scsi/scsi_transport_iscsi.c | 38 +++++-- drivers/xen/gntdev.c | 37 +++---- drivers/xen/xen-scsiback.c | 4 +- fs/block_dev.c | 5 + fs/ext4/super.c | 6 +- fs/fs-writeback.c | 25 ----- fs/overlayfs/file.c | 28 ++++-- fs/overlayfs/readdir.c | 37 +++++-- fs/overlayfs/util.c | 27 ++++- fs/sysfs/file.c | 55 +++++++++++ include/linux/fs.h | 11 +++ include/linux/sysfs.h | 16 +++ include/xen/grant_table.h | 1 + mm/filemap.c | 3 + mm/memory.c | 4 + mm/mmap.c | 8 +- mm/swapfile.c | 72 ++++++++------ security/security.c | 1 + 29 files changed, 552 insertions(+), 327 deletions(-) -- 2.25.1

1 32

[PATCH openEuler-21.03 v1] arm64: Uninstall cpu park after cpu up
by sangyan＠huawei.com 12 Mar '21

12 Mar '21

From: Sang Yan <sangyan(a)huawei.com> hulk inclusion category: feature bugzilla: 48159 CVE: N/A ------------------------------ One cpu in PARK state could not come up in this case: CPU 0 | CPU 1 boot_secondary(cpu 1) | --> write_park_exit(cpu 1) | | cpu uping from PARK | ... uninstall_cpu_park() | --> memset to 0 park text | | ... | Exception in memory !! wait for cpu up | Cpu 1 uping from PARK may trap into exception while cpu 0 clear cpu 1's park text memory. This uninstall_cpu_park should be after waiting for cpu up. Signed-off-by: Sang Yan <sangyan(a)huawei.com> --- arch/arm64/kernel/smp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c index d7b750a..fb6007d 100644 --- a/arch/arm64/kernel/smp.c +++ b/arch/arm64/kernel/smp.c @@ -300,15 +300,15 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle) return ret; } -#ifdef CONFIG_ARM64_CPU_PARK - uninstall_cpu_park(cpu); -#endif /* * CPU was successfully started, wait for it to come online or * time out. */ wait_for_completion_timeout(&cpu_running, msecs_to_jiffies(5000)); +#ifdef CONFIG_ARM64_CPU_PARK + uninstall_cpu_park(cpu); +#endif if (cpu_online(cpu)) return 0; -- 2.9.5

2 1

[PATCH OLK-5.10 v1] arm64: Uninstall cpu park after cpu up
by sangyan＠huawei.com 12 Mar '21

12 Mar '21

From: Sang Yan <sangyan(a)huawei.com> hulk inclusion category: feature bugzilla: 48159 CVE: N/A ------------------------------ One cpu in PARK state could not come up in this case: CPU 0 | CPU 1 boot_secondary(cpu 1) | --> write_park_exit(cpu 1) | | cpu uping from PARK | ... uninstall_cpu_park() | --> memset to 0 park text | | ... | Exception in memory !! wait for cpu up | Cpu 1 uping from PARK may trap into exception while cpu 0 clear cpu 1's park text memory. This uninstall_cpu_park should be after waiting for cpu up. Signed-off-by: Sang Yan <sangyan(a)huawei.com> --- arch/arm64/kernel/smp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c index d7b750a..fb6007d 100644 --- a/arch/arm64/kernel/smp.c +++ b/arch/arm64/kernel/smp.c @@ -300,15 +300,15 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle) return ret; } -#ifdef CONFIG_ARM64_CPU_PARK - uninstall_cpu_park(cpu); -#endif /* * CPU was successfully started, wait for it to come online or * time out. */ wait_for_completion_timeout(&cpu_running, msecs_to_jiffies(5000)); +#ifdef CONFIG_ARM64_CPU_PARK + uninstall_cpu_park(cpu); +#endif if (cpu_online(cpu)) return 0; -- 2.9.5

1 0

[PATCH openEuler-21.03 v2] park: Reserve park mem before kexec reserved
by sangyan＠huawei.com 12 Mar '21

12 Mar '21

From: Sang Yan <sangyan(a)huawei.com> hulk inclusion category: feature bugzilla: 48159 CVE: N/A ------------------------------ reserve_crashkernel or reserve_quick_kexec may find one sutiable memory region and reserves it, which address of the region is not fixed. As a result, cpu park reserves memory could be failed while specified address used by crashkernel or quickkexec. So, move reserve_park_mem before reserve_crashkernel and reserve_quick_kexec. Signed-off-by: Sang Yan <sangyan(a)huawei.com> Reviewed-by: Jing Xiangfeng <jingxiangfeng(a)huawei.com> --- arch/arm64/mm/init.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c index b343744..dbcc801 100644 --- a/arch/arm64/mm/init.c +++ b/arch/arm64/mm/init.c @@ -497,16 +497,25 @@ void __init arm64_memblock_init(void) else arm64_dma32_phys_limit = PHYS_MASK + 1; + /* + * Reserve park memory before crashkernel and quick kexec. + * Because park memory must be specified by address, but + * crashkernel and quickkexec may be specified by memory length, + * then find one sutiable memory region to reserve. + * + * So reserve park memory firstly is better, but it may cause + * crashkernel or quickkexec reserving failed. + */ +#ifdef CONFIG_ARM64_CPU_PARK + reserve_park_mem(); +#endif + reserve_crashkernel(); #ifdef CONFIG_QUICK_KEXEC reserve_quick_kexec(); #endif -#ifdef CONFIG_ARM64_CPU_PARK - reserve_park_mem(); -#endif - reserve_pin_memory_res(); reserve_elfcorehdr(); -- 2.9.5

1 0

[PATCH openEuler-21.03 v4 1/2] arm64: Add memmap parameter and register pmem
by Zhuling 12 Mar '21

12 Mar '21

From: ZhuLing <zhuling8(a)huawei.com> hulk inclusion category: feature bugzilla: 48159 CVE: NA Register pmem in arm64: Use memmap(memmap=nn[KMG]!ss[KMG]) reserve memory and e820(driver/nvdimm/e820.c) function to register persistent memory in arm64. when the kernel restart or update, the data in PMEM will not be lost and can be loaded faster. this is a general features. driver/nvdimm/e820.c: The function of this file is scan "iomem_resource" and take advantage of nvdimm resource discovery mechanism by registering a resource named "Persistent Memory (legacy)", this function doesn't depend on architecture. We will push the feature to linux kernel community and discuss to modify the file name. because people have a mistaken notion that the e820.c is depend on x86. If you want use this features, you need do as follows: 1.Reserve memory: add memmap to reserve memory in grub.cfg memmap=nn[KMG]!ss[KMG] exp:memmap=100K!0x1a0000000. 2.Insmod nd_e820.ko: modprobe nd_e820. 3.Check pmem device in /dev exp: /dev/pmem0 Signed-off-by: ZhuLing <zhuling8(a)huawei.com> Signed-off-by: Sang Yan <sangyan(a)huawei.com> Acked-by: Hanjun Guo <guohanjun(a)huawei.com> --- arch/arm64/Kconfig | 21 +++++++++ arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/pmem.c | 35 ++++++++++++++ arch/arm64/kernel/setup.c | 10 ++++ arch/arm64/mm/init.c | 97 ++++++++++++++++++++++++++++++++++++++ drivers/nvdimm/Kconfig | 5 ++ drivers/nvdimm/Makefile | 2 +- 7 files changed, 170 insertions(+), 1 deletion(-) create mode 100644 arch/arm64/kernel/pmem.c diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index c451137ab..326f26d40 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -360,6 +360,27 @@ config ARM64_CPU_PARK config ARCH_HAS_CPU_RELAX def_bool y +config ARM64_PMEM_RESERVE + bool "Reserve memory for persistent storage" + default n + help + Use memmap=nn[KMG]!ss[KMG](memmap=100K!0x1a0000000) reserve + memory for persistent storage. + + Say y here to enable this feature. + +config ARM64_PMEM_LEGACY_DEVICE + bool "Create persistent storage" + depends on BLK_DEV + depends on LIBNVDIMM + select ARM64_PMEM_RESERVE + help + Use reserved memory for persistent storage when the kernel + restart or update. the data in PMEM will not be lost and + can be loaded faster. + + Say y if unsure. + source "arch/arm64/Kconfig.platforms" menu "Kernel Features" diff --git a/arch/arm64/kernel/Makefile b/arch/arm64/kernel/Makefile index 967cb3c6d..be996f3c1 100644 --- a/arch/arm64/kernel/Makefile +++ b/arch/arm64/kernel/Makefile @@ -67,6 +67,7 @@ obj-$(CONFIG_ARM64_PTR_AUTH) += pointer_auth.o obj-$(CONFIG_SHADOW_CALL_STACK) += scs.o obj-$(CONFIG_ARM64_MTE) += mte.o obj-$(CONFIG_MPAM) += mpam/ +obj-$(CONFIG_ARM64_PMEM_LEGACY_DEVICE) += pmem.o obj-y += vdso/ probes/ obj-$(CONFIG_COMPAT_VDSO) += vdso32/ diff --git a/arch/arm64/kernel/pmem.c b/arch/arm64/kernel/pmem.c new file mode 100644 index 000000000..16eaf706f --- /dev/null +++ b/arch/arm64/kernel/pmem.c @@ -0,0 +1,35 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright(c) 2021 Huawei Technologies Co., Ltd + * + * Derived from x86 and arm64 implement PMEM. + */ +#include <linux/platform_device.h> +#include <linux/init.h> +#include <linux/ioport.h> +#include <linux/module.h> + +static int found(struct resource *res, void *data) +{ + return 1; +} + +static int __init register_e820_pmem(void) +{ + struct platform_device *pdev; + int rc; + + rc = walk_iomem_res_desc(IORES_DESC_PERSISTENT_MEMORY_LEGACY, + IORESOURCE_MEM, 0, -1, NULL, found); + if (rc <= 0) + return 0; + + /* + * See drivers/nvdimm/e820.c for the implementation, this is + * simply here to trigger the module to load on demand. + */ + pdev = platform_device_alloc("e820_pmem", -1); + + return platform_device_add(pdev); +} +device_initcall(register_e820_pmem); diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c index 5e282d31a..84c71c88d 100644 --- a/arch/arm64/kernel/setup.c +++ b/arch/arm64/kernel/setup.c @@ -57,6 +57,10 @@ static int num_standard_resources; static struct resource *standard_resources; +#ifdef CONFIG_ARM64_PMEM_RESERVE +extern struct resource pmem_res; +#endif + phys_addr_t __fdt_pointer __initdata; /* @@ -270,6 +274,12 @@ static void __init request_standard_resources(void) request_resource(res, &pin_memory_resource); #endif } + +#ifdef CONFIG_ARM64_PMEM_RESERVE + if (pmem_res.end && pmem_res.start) + request_resource(&iomem_resource, &pmem_res); +#endif + } static int __init reserve_memblock_reserved_regions(void) diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c index b3437440d..f22faea1a 100644 --- a/arch/arm64/mm/init.c +++ b/arch/arm64/mm/init.c @@ -66,6 +66,18 @@ EXPORT_SYMBOL(memstart_addr); phys_addr_t arm64_dma_phys_limit __ro_after_init; phys_addr_t arm64_dma32_phys_limit __ro_after_init; +static unsigned long long pmem_size, pmem_start; + +#ifdef CONFIG_ARM64_PMEM_RESERVE +struct resource pmem_res = { + .name = "Persistent Memory (legacy)", + .start = 0, + .end = 0, + .flags = IORESOURCE_MEM, + .desc = IORES_DESC_PERSISTENT_MEMORY_LEGACY +}; +#endif + #ifndef CONFIG_KEXEC_CORE static void __init reserve_crashkernel(void) { @@ -378,6 +390,87 @@ static int __init reserve_park_mem(void) } #endif +static int __init is_mem_valid(unsigned long long mem_size, unsigned long long mem_start) +{ + if (!memblock_is_region_memory(mem_start, mem_size)) { + pr_warn("cannot reserve mem: region is not memory!\n"); + return -EINVAL; + } + + if (memblock_is_region_reserved(mem_start, mem_size)) { + pr_warn("cannot reserve mem: region overlaps reserved memory!\n"); + return -EINVAL; + } + + if (!IS_ALIGNED(mem_start, SZ_2M)) { + pr_warn("cannot reserve mem: base address is not 2MB aligned!\n"); + return -EINVAL; + } + + return 0; +} + +static int __init parse_memmap_one(char *p) +{ + char *oldp; + phys_addr_t start_at, mem_size; + + if (!p) + return -EINVAL; + + oldp = p; + mem_size = memparse(p, &p); + if (p == oldp) + return -EINVAL; + + if (!mem_size) + return -EINVAL; + + mem_size = PAGE_ALIGN(mem_size); + + if (*p == '!') { + start_at = memparse(p+1, &p); + + if (is_mem_valid(mem_size, start_at) != 0) + return -EINVAL; + + pr_info("pmem reserved: 0x%016llx - 0x%016llx (%lld MB)\n", + start_at, start_at + mem_size, mem_size >> 20); + pmem_start = start_at; + pmem_size = mem_size; + } else + pr_info("Unrecognized memmap option, please check the parameter.\n"); + + return *p == '\0' ? 0 : -EINVAL; +} + +static int __init parse_memmap_opt(char *str) +{ + while (str) { + char *k = strchr(str, ','); + + if (k) + *k++ = 0; + + parse_memmap_one(str); + str = k; + } + + return 0; +} +early_param("memmap", parse_memmap_opt); + +#ifdef CONFIG_ARM64_PMEM_RESERVE +static void __init reserve_pmem(void) +{ + memblock_remove(pmem_start, pmem_size); + pr_info("pmem reserved: 0x%016llx - 0x%016llx (%lld MB)\n", + pmem_start, pmem_start + pmem_size, pmem_size >> 20); + pmem_res.start = pmem_start; + pmem_res.end = pmem_start + pmem_size - 1; +} +#endif + void __init arm64_memblock_init(void) { const s64 linear_region_size = BIT(vabits_actual - 1); @@ -511,6 +604,10 @@ void __init arm64_memblock_init(void) reserve_elfcorehdr(); +#ifdef CONFIG_ARM64_PMEM_RESERVE + reserve_pmem(); +#endif + high_memory = __va(memblock_end_of_DRAM() - 1) + 1; dma_contiguous_reserve(arm64_dma32_phys_limit); diff --git a/drivers/nvdimm/Kconfig b/drivers/nvdimm/Kconfig index b7d1eb38b..ce4de7526 100644 --- a/drivers/nvdimm/Kconfig +++ b/drivers/nvdimm/Kconfig @@ -132,3 +132,8 @@ config NVDIMM_TEST_BUILD infrastructure. endif + +config PMEM_LEGACY + tristate "Pmem_legacy" + select X86_PMEM_LEGACY if X86 + select ARM64_PMEM_LEGACY_DEVICE if ARM64 diff --git a/drivers/nvdimm/Makefile b/drivers/nvdimm/Makefile index 29203f3d3..6f8dc9242 100644 --- a/drivers/nvdimm/Makefile +++ b/drivers/nvdimm/Makefile @@ -3,7 +3,7 @@ obj-$(CONFIG_LIBNVDIMM) += libnvdimm.o obj-$(CONFIG_BLK_DEV_PMEM) += nd_pmem.o obj-$(CONFIG_ND_BTT) += nd_btt.o obj-$(CONFIG_ND_BLK) += nd_blk.o -obj-$(CONFIG_X86_PMEM_LEGACY) += nd_e820.o +obj-$(CONFIG_PMEM_LEGACY) += nd_e820.o obj-$(CONFIG_OF_PMEM) += of_pmem.o obj-$(CONFIG_VIRTIO_PMEM) += virtio_pmem.o nd_virtio.o -- 2.19.1

1 1

[PATCH v2] arm: keep the original function for non-RPi
by Zheng Zengkai 11 Mar '21

11 Mar '21

raspberrypi inclusion category: feature bugzilla: 50432 ------------------------------ This patch adjusts following arch arm related patches for raspberry pi on non-Raspberry Pi platforms, using specific config CONFIG_OPENEULER_RASPBERRYPI to distinguish them: d5c13edbd8 Improve __copy_to_user and __copy_from_user performance 97145d2a6a Update vfpmodule.c bffc462cbd Main bcm2708/bcm2709 linux port 588cfce788 cache: export clean and invalidate 41cd350cca ARM: Activate FIQs to avoid __irq_startup warnings 90607c7aaf ARM: proc-v7: Force misalignment of early stmia ee46d0fadf reboot: Use power off rather than busy spinning when halt is requested Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- arch/arm/include/asm/string.h | 2 ++ arch/arm/include/asm/uaccess.h | 2 ++ arch/arm/kernel/fiq.c | 4 ++++ arch/arm/kernel/reboot.c | 6 ++++++ arch/arm/lib/Makefile | 15 +++++++++++++++ arch/arm/lib/copy_from_user.S | 6 ++++++ arch/arm/lib/uaccess_with_memcpy.c | 22 +++++++++++++++++++++- arch/arm/mm/cache-v6.S | 8 ++++++++ arch/arm/mm/cache-v7.S | 8 ++++++++ arch/arm/mm/proc-v6.S | 8 ++++++++ arch/arm/mm/proc-v7.S | 8 ++++++++ arch/arm/vfp/vfpmodule.c | 26 ++++++++++++++++++++++++++ 12 files changed, 114 insertions(+), 1 deletion(-) diff --git a/arch/arm/include/asm/string.h b/arch/arm/include/asm/string.h index c22d5869e7b6..3c4ae6b3c3a6 100644 --- a/arch/arm/include/asm/string.h +++ b/arch/arm/include/asm/string.h @@ -45,10 +45,12 @@ static inline void *memset64(uint64_t *p, uint64_t v, __kernel_size_t n) return __memset64(p, v, n * 8, v >> 32); } +#ifdef CONFIG_OPENEULER_RASPBERRYPI #ifdef CONFIG_BCM2835_FAST_MEMCPY #define __HAVE_ARCH_MEMCMP extern int memcmp(const void *, const void *, size_t); #endif +#endif /* * For files that are not instrumented (e.g. mm/slub.c) we diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h index f24d3fabccd6..0d8cba7a9dde 100644 --- a/arch/arm/include/asm/uaccess.h +++ b/arch/arm/include/asm/uaccess.h @@ -516,8 +516,10 @@ do { \ extern unsigned long __must_check arm_copy_from_user(void *to, const void __user *from, unsigned long n); +#ifdef CONFIG_OPENEULER_RASPBERRYPI extern unsigned long __must_check __copy_from_user_std(void *to, const void __user *from, unsigned long n); +#endif static inline unsigned long __must_check raw_copy_from_user(void *to, const void __user *from, unsigned long n) diff --git a/arch/arm/kernel/fiq.c b/arch/arm/kernel/fiq.c index c3fe7d3cf482..8116f1e52e1b 100644 --- a/arch/arm/kernel/fiq.c +++ b/arch/arm/kernel/fiq.c @@ -56,7 +56,9 @@ static unsigned long dfl_fiq_insn; static struct pt_regs dfl_fiq_regs; +#ifdef CONFIG_OPENEULER_RASPBERRYPI extern int irq_activate(struct irq_desc *desc); +#endif /* Default reacquire function * - we always relinquish FIQ control @@ -142,8 +144,10 @@ static int fiq_start; void enable_fiq(int fiq) { +#ifdef CONFIG_OPENEULER_RASPBERRYPI struct irq_desc *desc = irq_to_desc(fiq + fiq_start); irq_activate(desc); +#endif enable_irq(fiq + fiq_start); } diff --git a/arch/arm/kernel/reboot.c b/arch/arm/kernel/reboot.c index 63373adab475..ffb170568dcc 100644 --- a/arch/arm/kernel/reboot.c +++ b/arch/arm/kernel/reboot.c @@ -102,7 +102,13 @@ void machine_shutdown(void) */ void machine_halt(void) { +#ifdef CONFIG_OPENEULER_RASPBERRYPI machine_power_off(); +#else /* !CONFIG_OPENEULER_RASPBERRYPI */ + local_irq_disable(); + smp_send_stop(); + while (1); +#endif } /* diff --git a/arch/arm/lib/Makefile b/arch/arm/lib/Makefile index 8271cde92dec..63820a487d4b 100644 --- a/arch/arm/lib/Makefile +++ b/arch/arm/lib/Makefile @@ -5,6 +5,7 @@ # Copyright (C) 1995-2000 Russell King # +ifeq ($(CONFIG_OPENEULER_RASPBERRYPI),y) lib-y := changebit.o csumipv6.o csumpartial.o \ csumpartialcopy.o csumpartialcopyuser.o clearbit.o \ delay.o delay-loop.o findbit.o memchr.o \ @@ -15,6 +16,18 @@ lib-y := changebit.o csumipv6.o csumpartial.o \ ucmpdi2.o lib1funcs.o div64.o \ io-readsb.o io-writesb.o io-readsl.o io-writesl.o \ call_with_stack.o bswapsdi2.o +else +lib-y := changebit.o csumipv6.o csumpartial.o \ + csumpartialcopy.o csumpartialcopyuser.o clearbit.o \ + delay.o delay-loop.o findbit.o memchr.o memcpy.o \ + memmove.o memset.o setbit.o \ + strchr.o strrchr.o \ + testchangebit.o testclearbit.o testsetbit.o \ + ashldi3.o ashrdi3.o lshrdi3.o muldi3.o \ + ucmpdi2.o lib1funcs.o div64.o \ + io-readsb.o io-writesb.o io-readsl.o io-writesl.o \ + call_with_stack.o bswapsdi2.o +endif mmu-y := clear_user.o copy_page.o getuser.o putuser.o \ copy_from_user.o copy_to_user.o @@ -25,6 +38,7 @@ else lib-y += backtrace.o endif +ifeq ($(CONFIG_OPENEULER_RASPBERRYPI),y) # Choose optimised implementations for Raspberry Pi ifeq ($(CONFIG_BCM2835_FAST_MEMCPY),y) CFLAGS_uaccess_with_memcpy.o += -DCOPY_FROM_USER_THRESHOLD=1600 @@ -34,6 +48,7 @@ ifeq ($(CONFIG_BCM2835_FAST_MEMCPY),y) else lib-y += memcpy.o memmove.o memset.o endif +endif # using lib_ here won't override already available weak symbols obj-$(CONFIG_UACCESS_WITH_MEMCPY) += uaccess_with_memcpy.o diff --git a/arch/arm/lib/copy_from_user.S b/arch/arm/lib/copy_from_user.S index ab7bf28dbec0..3f83d8b18b0d 100644 --- a/arch/arm/lib/copy_from_user.S +++ b/arch/arm/lib/copy_from_user.S @@ -107,8 +107,12 @@ .text +#ifdef CONFIG_OPENEULER_RASPBERRYPI ENTRY(__copy_from_user_std) WEAK(arm_copy_from_user) +#else +ENTRY(arm_copy_from_user) +#endif #ifdef CONFIG_CPU_SPECTRE get_thread_info r3 ldr r3, [r3, #TI_ADDR_LIMIT] @@ -118,7 +122,9 @@ WEAK(arm_copy_from_user) #include "copy_template.S" ENDPROC(arm_copy_from_user) +#ifdef CONFIG_OPENEULER_RASPBERRYPI ENDPROC(__copy_from_user_std) +#endif .pushsection .text.fixup,"ax" .align 0 diff --git a/arch/arm/lib/uaccess_with_memcpy.c b/arch/arm/lib/uaccess_with_memcpy.c index b483e5713039..ab15ed7f599a 100644 --- a/arch/arm/lib/uaccess_with_memcpy.c +++ b/arch/arm/lib/uaccess_with_memcpy.c @@ -19,6 +19,7 @@ #include <asm/current.h> #include <asm/page.h> +#ifdef CONFIG_OPENEULER_RASPBERRYPI #ifndef COPY_FROM_USER_THRESHOLD #define COPY_FROM_USER_THRESHOLD 64 #endif @@ -26,6 +27,7 @@ #ifndef COPY_TO_USER_THRESHOLD #define COPY_TO_USER_THRESHOLD 64 #endif +#endif static int pin_page_for_write(const void __user *_addr, pte_t **ptep, spinlock_t **ptlp) @@ -51,7 +53,11 @@ pin_page_for_write(const void __user *_addr, pte_t **ptep, spinlock_t **ptlp) return 0; pmd = pmd_offset(pud, addr); +#ifdef CONFIG_OPENEULER_RASPBERRYPI if (unlikely(pmd_none(*pmd) || pmd_bad(*pmd))) +#else + if (unlikely(pmd_none(*pmd))) +#endif return 0; /* @@ -94,6 +100,7 @@ pin_page_for_write(const void __user *_addr, pte_t **ptep, spinlock_t **ptlp) return 1; } +#ifdef CONFIG_OPENEULER_RASPBERRYPI static int pin_page_for_read(const void __user *_addr, pte_t **ptep, spinlock_t **ptlp) { @@ -132,8 +139,13 @@ pin_page_for_read(const void __user *_addr, pte_t **ptep, spinlock_t **ptlp) return 1; } +#endif +#ifdef CONFIG_OPENEULER_RASPBERRYPI unsigned long noinline +#else +static unsigned long noinline +#endif __copy_to_user_memcpy(void __user *to, const void *from, unsigned long n) { unsigned long ua_flags; @@ -186,6 +198,7 @@ __copy_to_user_memcpy(void __user *to, const void *from, unsigned long n) return n; } +#ifdef CONFIG_OPENEULER_RASPBERRYPI unsigned long noinline __copy_from_user_memcpy(void *to, const void __user *from, unsigned long n) { @@ -236,6 +249,7 @@ __copy_from_user_memcpy(void *to, const void __user *from, unsigned long n) out: return n; } +#endif unsigned long arm_copy_to_user(void __user *to, const void *from, unsigned long n) @@ -247,7 +261,11 @@ arm_copy_to_user(void __user *to, const void *from, unsigned long n) * With frame pointer disabled, tail call optimization kicks in * as well making this test almost invisible. */ +#ifdef CONFIG_OPENEULER_RASPBERRYPI if (n < COPY_TO_USER_THRESHOLD) { +#else + if (n < 64) { +#endif unsigned long ua_flags = uaccess_save_and_enable(); n = __copy_to_user_std(to, from, n); uaccess_restore(ua_flags); @@ -258,6 +276,7 @@ arm_copy_to_user(void __user *to, const void *from, unsigned long n) return n; } +#ifdef CONFIG_OPENEULER_RASPBERRYPI unsigned long __must_check arm_copy_from_user(void *to, const void __user *from, unsigned long n) { @@ -283,7 +302,8 @@ arm_copy_from_user(void *to, const void __user *from, unsigned long n) #endif return n; } - +#endif + static unsigned long noinline __clear_user_memset(void __user *addr, unsigned long n) { diff --git a/arch/arm/mm/cache-v6.S b/arch/arm/mm/cache-v6.S index 868011801521..614d4ff2a760 100644 --- a/arch/arm/mm/cache-v6.S +++ b/arch/arm/mm/cache-v6.S @@ -198,7 +198,11 @@ ENTRY(v6_flush_kern_dcache_area) * - start - virtual start address of region * - end - virtual end address of region */ +#ifdef CONFIG_OPENEULER_RASPBERRYPI ENTRY(v6_dma_inv_range) +#else /* !CONFIG_OPENEULER_RASPBERRYPI */ +v6_dma_inv_range: +#endif #ifdef CONFIG_DMA_CACHE_RWFO ldrb r2, [r0] @ read for ownership strb r2, [r0] @ write for ownership @@ -243,7 +247,11 @@ ENTRY(v6_dma_inv_range) * - start - virtual start address of region * - end - virtual end address of region */ +#ifdef CONFIG_OPENEULER_RASPBERRYPI ENTRY(v6_dma_clean_range) +#else /* !CONFIG_OPENEULER_RASPBERRYPI */ +v6_dma_clean_range: +#endif bic r0, r0, #D_CACHE_LINE_SIZE - 1 1: #ifdef CONFIG_DMA_CACHE_RWFO diff --git a/arch/arm/mm/cache-v7.S b/arch/arm/mm/cache-v7.S index 536df5db66e4..58df59734e40 100644 --- a/arch/arm/mm/cache-v7.S +++ b/arch/arm/mm/cache-v7.S @@ -363,8 +363,12 @@ ENDPROC(v7_flush_kern_dcache_area) * - start - virtual start address of region * - end - virtual end address of region */ +#ifdef CONFIG_OPENEULER_RASPBERRYPI ENTRY(b15_dma_inv_range) ENTRY(v7_dma_inv_range) +#else /* !CONFIG_OPENEULER_RASPBERRYPI */ +v7_dma_inv_range: +#endif dcache_line_size r2, r3 sub r3, r2, #1 tst r0, r3 @@ -394,8 +398,12 @@ ENDPROC(v7_dma_inv_range) * - start - virtual start address of region * - end - virtual end address of region */ +#ifdef CONFIG_OPENEULER_RASPBERRYPI ENTRY(b15_dma_clean_range) ENTRY(v7_dma_clean_range) +#else /* !CONFIG_OPENEULER_RASPBERRYPI */ +v7_dma_clean_range: +#endif dcache_line_size r2, r3 sub r3, r2, #1 bic r0, r0, r3 diff --git a/arch/arm/mm/proc-v6.S b/arch/arm/mm/proc-v6.S index b3a2fce22eac..b651eaa1ee40 100644 --- a/arch/arm/mm/proc-v6.S +++ b/arch/arm/mm/proc-v6.S @@ -71,6 +71,7 @@ ENDPROC(cpu_v6_reset) * IRQs are already disabled. */ +#ifdef CONFIG_OPENEULER_RASPBERRYPI /* See jira SW-5991 for details of this workaround */ ENTRY(cpu_v6_do_idle) .align 5 @@ -84,6 +85,13 @@ ENTRY(cpu_v6_do_idle) nop bne 1b ret lr +#else /* !CONFIG_OPENEULER_RASPBERRYPI */ +ENTRY(cpu_v6_do_idle) + mov r1, #0 + mcr p15, 0, r1, c7, c10, 4 @ DWB - WFI may enter a low-power mode + mcr p15, 0, r1, c7, c0, 4 @ wait for interrupt + ret lr +#endif ENTRY(cpu_v6_dcache_clean_area) 1: mcr p15, 0, r0, c7, c10, 1 @ clean D entry diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S index 3e77e8982df3..ef0e00249515 100644 --- a/arch/arm/mm/proc-v7.S +++ b/arch/arm/mm/proc-v7.S @@ -287,8 +287,10 @@ __v7_ca17mp_setup: mov r10, #0 1: adr r0, __v7_setup_stack_ptr ldr r12, [r0] +#ifdef CONFIG_OPENEULER_RASPBERRYPI tst r12, #0x1f addeq r12, r12, #4 +#endif add r12, r12, r0 @ the local stack stmia r12, {r1-r6, lr} @ v7_invalidate_l1 touches r0-r6 bl v7_invalidate_l1 @@ -476,8 +478,10 @@ __v7_setup: adr r0, __v7_setup_stack_ptr ldr r12, [r0] add r12, r12, r0 @ the local stack +#ifdef CONFIG_OPENEULER_RASPBERRYPI tst r12, #0x1f addeq r12, r12, #4 +#endif stmia r12, {r1-r6, lr} @ v7_invalidate_l1 touches r0-r6 bl v7_invalidate_l1 ldmia r12, {r1-r6, lr} @@ -561,7 +565,11 @@ ENDPROC(__v7_setup) .bss .align 2 __v7_setup_stack: +#ifdef CONFIG_OPENEULER_RASPBERRYPI .space 4 * 8 @ 7 registers + 1 spare +#else /* !CONFIG_OPENEULER_RASPBERRYPI */ + .space 4 * 7 @ 7 registers +#endif __INITDATA diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c index 1e2dcf81aefa..f7238e00db7c 100644 --- a/arch/arm/vfp/vfpmodule.c +++ b/arch/arm/vfp/vfpmodule.c @@ -176,11 +176,16 @@ static int vfp_notifier(struct notifier_block *self, unsigned long cmd, void *v) * case the thread migrates to a different CPU. The * restoring is done lazily. */ +#ifdef CONFIG_OPENEULER_RASPBERRYPI if ((fpexc & FPEXC_EN) && vfp_current_hw_state[cpu]) { /* vfp_save_state oopses on VFP11 if EX bit set */ fmxr(FPEXC, fpexc & ~FPEXC_EX); vfp_save_state(vfp_current_hw_state[cpu], fpexc); } +#else /* !CONFIG_OPENEULER_RASPBERRYPI */ + if ((fpexc & FPEXC_EN) && vfp_current_hw_state[cpu]) + vfp_save_state(vfp_current_hw_state[cpu], fpexc); +#endif #endif /* @@ -457,16 +462,22 @@ static int vfp_pm_suspend(void) /* if vfp is on, then save state for resumption */ if (fpexc & FPEXC_EN) { pr_debug("%s: saving vfp state\n", __func__); +#ifdef CONFIG_OPENEULER_RASPBERRYPI /* vfp_save_state oopses on VFP11 if EX bit set */ fmxr(FPEXC, fpexc & ~FPEXC_EX); +#endif vfp_save_state(&ti->vfpstate, fpexc); /* disable, just in case */ fmxr(FPEXC, fmrx(FPEXC) & ~FPEXC_EN); } else if (vfp_current_hw_state[ti->cpu]) { #ifndef CONFIG_SMP +#ifdef CONFIG_OPENEULER_RASPBERRYPI /* vfp_save_state oopses on VFP11 if EX bit set */ fmxr(FPEXC, (fpexc & ~FPEXC_EX) | FPEXC_EN); +#else /* !CONFIG_OPENEULER_RASPBERRYPI */ + fmxr(FPEXC, fpexc | FPEXC_EN); +#endif vfp_save_state(vfp_current_hw_state[ti->cpu], fpexc); fmxr(FPEXC, fpexc); #endif @@ -529,8 +540,12 @@ void vfp_sync_hwstate(struct thread_info *thread) /* * Save the last VFP state on this CPU. */ +#ifdef CONFIG_OPENEULER_RASPBERRYPI /* vfp_save_state oopses on VFP11 if EX bit set */ fmxr(FPEXC, (fpexc & ~FPEXC_EX) | FPEXC_EN); +#else /* !CONFIG_OPENEULER_RASPBERRYPI */ + fmxr(FPEXC, fpexc | FPEXC_EN); +#endif vfp_save_state(&thread->vfpstate, fpexc | FPEXC_EN); fmxr(FPEXC, fpexc); } @@ -596,7 +611,9 @@ int vfp_restore_user_hwstate(struct user_vfp *ufp, struct user_vfp_exc *ufp_exc) struct thread_info *thread = current_thread_info(); struct vfp_hard_struct *hwstate = &thread->vfpstate.hard; unsigned long fpexc; +#ifdef CONFIG_OPENEULER_RASPBERRYPI u32 fpsid = fmrx(FPSID); +#endif /* Disable VFP to avoid corrupting the new thread state. */ vfp_flush_hwstate(thread); @@ -619,11 +636,16 @@ int vfp_restore_user_hwstate(struct user_vfp *ufp, struct user_vfp_exc *ufp_exc) /* Ensure the VFP is enabled. */ fpexc |= FPEXC_EN; +#ifdef CONFIG_OPENEULER_RASPBERRYPI /* Mask FPXEC_EX and FPEXC_FP2V if not required by VFP arch */ if ((fpsid & FPSID_ARCH_MASK) != (1 << FPSID_ARCH_BIT)) { /* Ensure FPINST2 is invalid and the exception flag is cleared. */ fpexc &= ~(FPEXC_EX | FPEXC_FP2V); } +#else /* !CONFIG_OPENEULER_RASPBERRYPI */ + /* Ensure FPINST2 is invalid and the exception flag is cleared. */ + fpexc &= ~(FPEXC_EX | FPEXC_FP2V); +#endif hwstate->fpexc = fpexc; @@ -738,8 +760,12 @@ void kernel_neon_begin(void) cpu = get_cpu(); fpexc = fmrx(FPEXC) | FPEXC_EN; +#ifdef CONFIG_OPENEULER_RASPBERRYPI /* vfp_save_state oopses on VFP11 if EX bit set */ fmxr(FPEXC, fpexc & ~FPEXC_EX); +#else /* !CONFIG_OPENEULER_RASPBERRYPI */ + fmxr(FPEXC, fpexc); +#endif /* * Save the userland NEON/VFP state. Under UP, -- 2.20.1

2 1

[PATCH openEuler-1.0-LTS] sysctl: control if check validity of freelist and connector debug by sysctl
by Cheng Jian 11 Mar '21

11 Mar '21

From: Yang Yingliang <yangyingliang(a)huawei.com> hulk inclusion category: bugfix bugzilla: 47452 CVE: NA ------------------------------------------------- Change control methods of check validity of freelist and connector debug to sysctl. Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Cheng Jian <cj.chengjian(a)huawei.com> --- drivers/connector/connector.c | 1 + include/linux/slab.h | 4 --- kernel/sysctl.c | 20 +++++++++++ mm/slub.c | 63 ++++++++++++++--------------------- 4 files changed, 46 insertions(+), 42 deletions(-) diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c index a8df9ecbf42b..b5cdd0b99736 100644 --- a/drivers/connector/connector.c +++ b/drivers/connector/connector.c @@ -42,6 +42,7 @@ MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_CONNECTOR); static struct cn_dev cdev; static int cn_already_initialized; +int sysctl_connector_debug = 0; /* * Sends mult (multiple) cn_msg at a time. diff --git a/include/linux/slab.h b/include/linux/slab.h index 1ab5fd97dec8..d6393413ef09 100644 --- a/include/linux/slab.h +++ b/include/linux/slab.h @@ -24,8 +24,6 @@ */ /* DEBUG: Perform (expensive) checks on alloc/free */ #define SLAB_CONSISTENCY_CHECKS ((slab_flags_t __force)0x00000100U) -/* Check if freelist is valid */ -#define SLAB_NO_FREELIST_CHECKS ((slab_flags_t __force)0x00000200U) /* DEBUG: Red zone objs in a cache */ #define SLAB_RED_ZONE ((slab_flags_t __force)0x00000400U) /* DEBUG: Poison objects */ @@ -113,8 +111,6 @@ #define SLAB_KASAN 0 #endif -#define SLAB_CONNECTOR_DEBUG ((slab_flags_t __force)0x10000000U) - /* The following flags affect the page allocator grouping pages by mobility */ /* Objects are reclaimable */ #define SLAB_RECLAIM_ACCOUNT ((slab_flags_t __force)0x00020000U) diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 665c9e2a8802..c921ee10615a 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -1245,6 +1245,7 @@ static struct ctl_table kern_table[] = { { } }; +extern int sysctl_isolate_corrupted_freelist; static struct ctl_table vm_table[] = { { .procname = "overcommit_memory", @@ -1714,6 +1715,15 @@ static struct ctl_table vm_table[] = { .extra2 = (void *)&mmap_rnd_compat_bits_max, }, #endif + { + .procname = "isolate_corrupted_freelist", + .data = &sysctl_isolate_corrupted_freelist, + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_dointvec_minmax, + .extra1 = &zero, + .extra2 = &one, + }, { } }; @@ -1925,6 +1935,7 @@ static struct ctl_table fs_table[] = { { } }; +extern int sysctl_connector_debug; static struct ctl_table debug_table[] = { #ifdef CONFIG_SYSCTL_EXCEPTION_TRACE { @@ -1946,6 +1957,15 @@ static struct ctl_table debug_table[] = { .extra2 = &one, }, #endif + { + .procname = "connector-debug", + .data = &sysctl_connector_debug, + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_dointvec_minmax, + .extra1 = &zero, + .extra2 = &one, + }, { } }; diff --git a/mm/slub.c b/mm/slub.c index ee0d18699bde..2301c04353d0 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -1221,30 +1221,6 @@ static noinline int free_debug_processing( return ret; } -/* - * Check if the next object in freechain is - * valid, then isolate the corrupted freelist. - */ -int isolate_cnt = 0; -static bool isolate_corrupted_freelist(struct kmem_cache *s, struct page *page, - void **freelist, void *next) -{ - if (!(slub_debug & SLAB_NO_FREELIST_CHECKS) && - (!check_valid_pointer(s, page, next))) { - /* Need caller make sure freelist is not NULL */ - *freelist = NULL; - isolate_cnt++; - - slab_fix(s, "Freelist corrupt,isolate corrupted freechain."); - pr_info("freelist=%lx object=%lx, page->base=%lx, page->objects=%u, objsize=%u, s->offset=%d page:%llx\n", - (long)freelist, (long)next, (long)page_address(page), page->objects, s->size, s->offset, (u64)page); - - return true; - } - - return false; -} - static int __init setup_slub_debug(char *str) { slub_debug = DEBUG_DEFAULT_FLAGS; @@ -1291,14 +1267,6 @@ static int __init setup_slub_debug(char *str) case 'a': slub_debug |= SLAB_FAILSLAB; break; - case 'n': - slub_debug |= SLAB_NO_FREELIST_CHECKS; - pr_info("Freelist pointer check disabled."); - break; - case 'd': - slub_debug |= SLAB_CONNECTOR_DEBUG; - pr_info("Connector debug enabled.\n"); - break; case 'o': /* * Avoid enabling debugging on caches if its minimum @@ -1311,8 +1279,6 @@ static int __init setup_slub_debug(char *str) *str); } } - if (!(slub_debug & SLAB_NO_FREELIST_CHECKS)) - pr_info("Freelist pointer check enabled."); check_slabs: if (*str == ',') @@ -1380,12 +1346,33 @@ static bool freelist_corrupted(struct kmem_cache *s, struct page *page, { return false; } +#endif /* CONFIG_SLUB_DEBUG */ + +extern int sysctl_connector_debug; +/* + * Check if the next object in freechain is + * valid, then isolate the corrupted freelist. + */ +int isolate_cnt = 0; +int sysctl_isolate_corrupted_freelist = 1; static bool isolate_corrupted_freelist(struct kmem_cache *s, struct page *page, - void **freelist, void *nextfree) + void **freelist, void *next) { + if (sysctl_isolate_corrupted_freelist && + (!check_valid_pointer(s, page, next))) { + /* Need caller make sure freelist is not NULL */ + *freelist = NULL; + isolate_cnt++; + + slab_fix(s, "Freelist corrupt,isolate corrupted freechain."); + pr_info("freelist=%lx object=%lx, page->base=%lx, page->objects=%u, objsize=%u, s->offset=%d page:%llx\n", + (long)freelist, (long)next, (long)page_address(page), page->objects, s->size, s->offset, (u64)page); + + return true; + } + return false; } -#endif /* CONFIG_SLUB_DEBUG */ /* * Hooks for other subsystems that check memory allocations. In a typical @@ -2798,7 +2785,7 @@ static __always_inline void *slab_alloc_node(struct kmem_cache *s, if (unlikely(gfpflags & __GFP_ZERO) && object) memset(object, 0, s->object_size); - if ((slub_debug & SLAB_CONNECTOR_DEBUG) && + if (sysctl_connector_debug && unlikely(gfpflags & __GFP_CONNECTOR) && object) { if (s->object_size == 512) memset(object + 504, 0xad, 8); @@ -4015,7 +4002,7 @@ void kfree(const void *x) __free_pages(page, compound_order(page)); return; } - if ((slub_debug & SLAB_CONNECTOR_DEBUG) && + if (sysctl_connector_debug && unlikely(page->slab_cache->object_size == 512)) { u64 *tail = (u64 *)(x + 504); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 00/82] bugfix for 20.03 at 202102
by Cheng Jian 11 Mar '21

11 Mar '21

bugfix for 20.03 at 202102 Alexey Gladkov (1): moduleparam: Save information about built-in modules in separate file Amir Goldstein (1): ovl: skip getxattr of security labels Aurelien Aptel (1): cifs: report error instead of invalid when revalidating a dentry fails Baptiste Lepers (1): udp: Prevent reuseport_select_sock from reading uninitialized socks Byron Stanoszek (1): tmpfs: restore functionality of nr_inodes=0 Chris Down (2): tmpfs: per-superblock i_ino support tmpfs: support 64-bit inums per-sb Christian Brauner (1): sysctl: handle overflow in proc_get_long Cong Wang (1): af_key: relax availability checks for skb size calculation Dave Wysochanski (2): SUNRPC: Move simple_get_bytes and simple_get_netobj into private header SUNRPC: Handle 0 length opaque XDR object data properly Dong Kai (1): livepatch/core: Fix jump_label_apply_nops called multi times Edwin Peer (1): net: watchdog: hold device global xmit lock during tx disable Eric Biggers (1): fs: fix lazytime expiration handling in __writeback_single_inode() Eric Dumazet (1): net_sched: gen_estimator: support large ewma log Eyal Birger (1): xfrm: fix disable_xfrm sysctl when used on xfrm interfaces Florian Westphal (1): netfilter: conntrack: skip identical origin tuple in same zone only Gaurav Kohli (1): tracing: Fix race in trace_open and buffer resize call Gustavo A. R. Silva (1): smb3: Fix out-of-bounds bug in SMB2_negotiate() Hugh Dickins (1): mm: thp: fix MADV_REMOVE deadlock on shmem THP Jakub Kicinski (1): net: sit: unregister_netdevice on newlink's error path Jan Kara (1): writeback: Drop I_DIRTY_TIME_EXPIRE Jozsef Kadlecsik (1): netfilter: xt_recent: Fix attempt to update deleted entry Liangyan (1): ovl: fix dentry leak in ovl_get_redirect Lin Feng (1): bfq-iosched: Revert "bfq: Fix computation of shallow depth" Marc Zyngier (1): genirq/msi: Activate Multi-MSI early when MSI_FLAG_ACTIVATE_EARLY is set Martin K. Petersen (2): scsi: sd: block: Fix regressions in read-only block device handling scsi: sd: block: Fix kabi change by 'scsi: sd: block: Fix regressions in read-only block device handling' Martin Willi (1): vrf: Fix fast path output packet handling with async Netfilter rules Masami Hiramatsu (1): tracing/kprobe: Fix to support kretprobe events on unloaded modules Miklos Szeredi (4): proc/mounts: add cursor ovl: perform vfs_getxattr() with mounter creds cap: fix conversions on getxattr ovl: expand warning in ovl_d_real() Mikulas Patocka (1): dm integrity: conditionally disable "recalculate" feature Ming Lei (4): scsi: core: Run queue in case of I/O resource contention failure scsi: core: Only re-run queue in scsi_end_request() if device queue is busy block: don't hold q->sysfs_lock in elevator_init_mq blk-mq: don't hold q->sysfs_lock in blk_mq_map_swqueue Muchun Song (4): mm: hugetlbfs: fix cannot migrate the fallocated HugeTLB page mm: hugetlb: fix a race between freeing and dissolving the page mm: hugetlb: fix a race between isolating and freeing page mm: hugetlb: remove VM_BUG_ON_PAGE from page_huge_active NeilBrown (1): net: fix iteration for sctp transport seq_files Ondrej Jirman (1): brcmfmac: Loading the correct firmware for brcm43456 Pablo Neira Ayuso (1): netfilter: nft_dynset: add timeout extension to template Pavel Begunkov (1): list: introduce list_for_each_continue() Pengcheng Yang (1): tcp: fix TLP timer not set when CA_STATE changes from DISORDER to OPEN Peter Zijlstra (2): kthread: Extract KTHREAD_IS_PER_CPU workqueue: Restrict affinity change to rescuer Roi Dayan (1): net/mlx5: Fix memory leak on flow table creation error flow Roman Gushchin (1): memblock: do not start bottom-up allocations with kernel_end Sabyrzhan Tasbolatov (1): net/rds: restrict iovecs length for RDS_CMSG_RDMA_ARGS Shmulik Ladkani (1): xfrm: Fix oops in xfrm_replay_advance_bmp Steven Rostedt (VMware) (3): fgraph: Initialize tracing_graph_pause at task creation tracing: Do not count ftrace events in top level enable output tracing: Check length before giving out the filter buffer Sven Auhagen (1): netfilter: flowtable: fix tcp and udp header checksum update Vadim Fedorenko (1): net: ip_tunnel: fix mtu calculation Wang Hai (1): Revert "mm/slub: fix a memory leak in sysfs_slab_add()" Wang ShaoBo (1): kretprobe: Avoid re-registration of the same kretprobe earlier Willem de Bruijn (1): esp: avoid unneeded kmap_atomic call Xiao Ni (1): md: Set prev_flush_start and flush_bio in an atomic way Yang Yingliang (3): sysctl/mm: fix compile error when CONFIG_SLUB is disabled config: disable config TMPFS_INODE64 by default connector: change GFP_CONNECTOR to bit-31 Ye Bin (3): scsi: sd: block: Fix read-only flag residuals when partition table change Revert "scsi: sd: block: Fix read-only flag residuals when partition table change" Revert "scsi: sg: fix memory leak in sg_build_indirect" Yonglong Liu (4): net: hns3: adds support for setting pf max tx rate via sysfs net: hns3: update hns3 version to 1.9.38.10 net: hns3: fix 'ret' may be used uninitialized problem net: hns3: update hns3 version to 1.9.38.11 Yufen Yu (1): scsi: fix kabi for scsi_device Zhang Xiaoxu (1): proc/mounts: Fix kabi broken liubo (3): etmem: add etmem-scan feature etmem: add etmem-swap feature config: Enable the config option of the etmem feature shiyongbang (3): gpu: hibmc: Fix erratic display during startup stage. gpu: hibmc: Use drm get pci dev api. gpu: hibmc: Fix stuck when switch GUI to text. zhangyi (F) (1): ext4: find old entry again if failed to rename whiteout .gitignore | 1 + Documentation/device-mapper/dm-integrity.txt | 7 + Documentation/dontdiff | 1 + Documentation/filesystems/tmpfs.txt | 17 + Documentation/kbuild/kbuild.txt | 5 + Makefile | 2 + arch/arm64/configs/hulk_defconfig | 3 + arch/arm64/configs/openeuler_defconfig | 2 + arch/x86/configs/hulk_defconfig | 2 + arch/x86/configs/openeuler_defconfig | 2 + block/bfq-iosched.c | 8 +- block/blk-mq.c | 7 - block/elevator.c | 14 +- block/genhd.c | 33 +- block/ioctl.c | 4 + block/partition-generic.c | 7 +- drivers/connector/connector.c | 6 +- .../gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c | 68 +- .../gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h | 2 + .../gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c | 1 + drivers/md/dm-integrity.c | 24 +- drivers/md/md.c | 2 + drivers/net/ethernet/hisilicon/hns3/Makefile | 3 +- drivers/net/ethernet/hisilicon/hns3/hnae3.h | 10 +- .../hns3/hns3_cae/hns3_cae_version.h | 2 +- .../net/ethernet/hisilicon/hns3/hns3_enet.h | 2 +- .../hns3_extension/hns3pf/hclge_main_it.c | 33 + .../hns3/hns3_extension/hns3pf/hclge_sysfs.c | 140 +++ .../hns3/hns3_extension/hns3pf/hclge_sysfs.h | 14 + .../hisilicon/hns3/hns3pf/hclge_main.c | 17 + .../hisilicon/hns3/hns3pf/hclge_main.h | 7 +- .../hisilicon/hns3/hns3vf/hclgevf_main.h | 2 +- .../net/ethernet/mellanox/mlx5/core/fs_core.c | 1 + drivers/net/vrf.c | 92 +- .../broadcom/brcm80211/brcmfmac/sdio.c | 4 +- drivers/scsi/scsi_lib.c | 59 +- drivers/scsi/sg.c | 6 +- fs/Kconfig | 21 + fs/cifs/dir.c | 22 +- fs/cifs/smb2pdu.h | 2 +- fs/ext4/inode.c | 2 +- fs/ext4/namei.c | 29 +- fs/fs-writeback.c | 36 +- fs/hugetlbfs/inode.c | 3 +- fs/mount.h | 17 +- fs/namespace.c | 119 +- fs/overlayfs/copy_up.c | 15 +- fs/overlayfs/dir.c | 2 +- fs/overlayfs/inode.c | 2 + fs/overlayfs/super.c | 13 +- fs/proc/Makefile | 2 + fs/proc/base.c | 4 + fs/proc/etmem_scan.c | 1046 +++++++++++++++++ fs/proc/etmem_scan.h | 132 +++ fs/proc/etmem_swap.c | 102 ++ fs/proc/internal.h | 2 + fs/proc/task_mmu.c | 117 ++ fs/proc_namespace.c | 4 +- fs/xfs/xfs_trans_inode.c | 4 +- include/asm-generic/vmlinux.lds.h | 1 + include/linux/fs.h | 16 +- include/linux/genhd.h | 5 + include/linux/gfp.h | 8 +- include/linux/hugetlb.h | 3 + include/linux/kprobes.h | 2 +- include/linux/kthread.h | 3 + include/linux/list.h | 10 + include/linux/mm_types.h | 18 + include/linux/module.h | 1 + include/linux/moduleparam.h | 12 +- include/linux/mount.h | 4 +- include/linux/msi.h | 6 + include/linux/netdevice.h | 2 + include/linux/shmem_fs.h | 3 + include/linux/sunrpc/xdr.h | 3 +- include/linux/swap.h | 5 + include/net/tcp.h | 2 +- include/scsi/scsi_device.h | 3 +- include/trace/events/writeback.h | 1 - init/init_task.c | 3 +- kernel/irq/msi.c | 44 +- kernel/kprobes.c | 36 +- kernel/kthread.c | 27 +- kernel/livepatch/core.c | 20 +- kernel/smpboot.c | 1 + kernel/sysctl.c | 6 + kernel/trace/ftrace.c | 2 - kernel/trace/ring_buffer.c | 4 + kernel/trace/trace.c | 2 +- kernel/trace/trace_events.c | 3 +- kernel/trace/trace_kprobe.c | 4 +- kernel/workqueue.c | 9 +- lib/Kconfig | 11 + mm/huge_memory.c | 37 +- mm/hugetlb.c | 48 +- mm/memblock.c | 49 +- mm/pagewalk.c | 1 + mm/shmem.c | 133 ++- mm/slub.c | 14 +- mm/vmscan.c | 112 ++ mm/vmstat.c | 4 + net/core/gen_estimator.c | 11 +- net/core/sock_reuseport.c | 2 +- net/ipv4/esp4.c | 7 +- net/ipv4/ip_tunnel.c | 16 +- net/ipv4/tcp_input.c | 10 +- net/ipv4/tcp_recovery.c | 5 +- net/ipv6/esp6.c | 7 +- net/ipv6/sit.c | 5 +- net/key/af_key.c | 6 +- net/netfilter/nf_conntrack_core.c | 3 +- net/netfilter/nf_flow_table_core.c | 4 +- net/netfilter/nft_dynset.c | 4 +- net/netfilter/xt_recent.c | 12 +- net/rds/rdma.c | 3 + net/sctp/proc.c | 16 +- net/sunrpc/auth_gss/auth_gss.c | 30 +- net/sunrpc/auth_gss/auth_gss_internal.h | 45 + net/sunrpc/auth_gss/gss_krb5_mech.c | 31 +- net/xfrm/xfrm_input.c | 2 +- net/xfrm/xfrm_policy.c | 4 +- scripts/link-vmlinux.sh | 3 + security/commoncap.c | 67 +- virt/kvm/kvm_main.c | 6 + 124 files changed, 2817 insertions(+), 466 deletions(-) create mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3_extension/hns3pf/hclge_sysfs.c create mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3_extension/hns3pf/hclge_sysfs.h create mode 100644 fs/proc/etmem_scan.c create mode 100644 fs/proc/etmem_scan.h create mode 100644 fs/proc/etmem_swap.c create mode 100644 net/sunrpc/auth_gss/auth_gss_internal.h -- 2.25.1

1 82

[PATCH 01/82] list: introduce list_for_each_continue()
by Cheng Jian 11 Mar '21

11 Mar '21

From: Pavel Begunkov <asml.silence(a)gmail.com> mainline inclusion from mainline-v5.6-rc1 commit 28ca0d6d39ab1d01c86762c82a585b7cedd2920c category: bugfix bugzilla: 35619 CVE: NA -------------------------------- As other *continue() helpers, this continues iteration from a given position. Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Reviewed-by: zhangyi (F) <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/list.h | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/include/linux/list.h b/include/linux/list.h index de04cc5ed536..0e540581d52c 100644 --- a/include/linux/list.h +++ b/include/linux/list.h @@ -455,6 +455,16 @@ static inline void list_splice_tail_init(struct list_head *list, #define list_for_each(pos, head) \ for (pos = (head)->next; pos != (head); pos = pos->next) +/** + * list_for_each_continue - continue iteration over a list + * @pos: the &struct list_head to use as a loop cursor. + * @head: the head for your list. + * + * Continue to iterate over a list, continuing after the current position. + */ +#define list_for_each_continue(pos, head) \ + for (pos = pos->next; pos != (head); pos = pos->next) + /** * list_for_each_prev - iterate over a list backwards * @pos: the &struct list_head to use as a loop cursor. -- 2.25.1

1 11

2025

2024

2023

2022

2021

2020

2019

Kernel