- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
by Yongqiang Liu 03 Aug '22

03 Aug '22

From: Pavel Skripkin <paskripkin(a)gmail.com> mainline inclusion from linux-next commit 0ac4827f78c7ffe8eef074bc010e7e34bc22f533 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I58DFB CVE: CVE-2022-1679 -------------------------------- Syzbot reported use-after-free Read in ath9k_hif_usb_rx_cb() [0]. The problem was in incorrect htc_handle->drv_priv initialization. Probable call trace which can trigger use-after-free: ath9k_htc_probe_device() /* htc_handle->drv_priv = priv; */ ath9k_htc_wait_for_target() <--- Failed ieee80211_free_hw() <--- priv pointer is freed <IRQ> ... ath9k_hif_usb_rx_cb() ath9k_hif_usb_rx_stream() RX_STAT_INC() <--- htc_handle->drv_priv access In order to not add fancy protection for drv_priv we can move htc_handle->drv_priv initialization at the end of the ath9k_htc_probe_device() and add helper macro to make all *_STAT_* macros NULL safe, since syzbot has reported related NULL deref in that macros [1] Link: https://syzkaller.appspot.com/bug?id=6ead44e37afb6866ac0c7dd121b4ce07cb665f… [0] Link: https://syzkaller.appspot.com/bug?id=b8101ffcec107c0567a0cd8acbbacec91e9ee8… [1] Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") Reported-and-tested-by: syzbot+03110230a11411024147(a)syzkaller.appspotmail.com Reported-and-tested-by: syzbot+c6dde1f690b60e0b9fbe(a)syzkaller.appspotmail.com Signed-off-by: Pavel Skripkin <paskripkin(a)gmail.com> Acked-by: Toke Høiland-Jørgensen <toke(a)toke.dk> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://lore.kernel.org/r/d57bbedc857950659bfacac0ab48790c1eda00c8.16551457… Signed-off-by: Xu Jia <xujia39(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/net/wireless/ath/ath9k/htc.h | 10 +++++----- drivers/net/wireless/ath/ath9k/htc_drv_init.c | 3 ++- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h index 9f64e32381f9..81107100e368 100644 --- a/drivers/net/wireless/ath/ath9k/htc.h +++ b/drivers/net/wireless/ath/ath9k/htc.h @@ -325,11 +325,11 @@ static inline struct ath9k_htc_tx_ctl *HTC_SKB_CB(struct sk_buff *skb) } #ifdef CONFIG_ATH9K_HTC_DEBUGFS - -#define TX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.tx_stats.c++) -#define TX_STAT_ADD(c, a) (hif_dev->htc_handle->drv_priv->debug.tx_stats.c += a) -#define RX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c++) -#define RX_STAT_ADD(c, a) (hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c += a) +#define __STAT_SAFE(expr) (hif_dev->htc_handle->drv_priv ? (expr) : 0) +#define TX_STAT_INC(c) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.tx_stats.c++) +#define TX_STAT_ADD(c, a) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.tx_stats.c += a) +#define RX_STAT_INC(c) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c++) +#define RX_STAT_ADD(c, a) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c += a) #define CAB_STAT_INC priv->debug.tx_stats.cab_queued++ #define TX_QSTAT_INC(q) (priv->debug.tx_stats.queue_stats[q]++) diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c index 214c68269a69..e3a6f48dbd8c 100644 --- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c +++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c @@ -945,7 +945,6 @@ int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev, priv->hw = hw; priv->htc = htc_handle; priv->dev = dev; - htc_handle->drv_priv = priv; SET_IEEE80211_DEV(hw, priv->dev); ret = ath9k_htc_wait_for_target(priv); @@ -966,6 +965,8 @@ int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev, if (ret) goto err_init; + htc_handle->drv_priv = priv; + return 0; err_init: -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] Revert "iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping()"
by Yongqiang Liu 03 Aug '22

03 Aug '22

From: Zhang Zekun <zhangzekun11(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187358, https://gitee.com/openeuler/kernel/issues/I5KD2A CVE: NA --------------------------------- This reverts commit 75624b5bc0485778aef9f46ebbf5e5df3c0d054c. This patch could cause double-free problem, when 'irqdomain' is failed to add, in which case, irq_domain_free_fwnode(fn) will be called twice. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/iommu/intel_irq_remapping.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c index 276005451914..967450bd421a 100644 --- a/drivers/iommu/intel_irq_remapping.c +++ b/drivers/iommu/intel_irq_remapping.c @@ -539,7 +539,7 @@ static int intel_setup_irq_remapping(struct intel_iommu *iommu) irq_domain_free_fwnode(fn); if (!iommu->ir_domain) { pr_err("IR%d: failed to allocate irqdomain\n", iommu->seq_id); - goto out_free_fwnode; + goto out_free_bitmap; } iommu->ir_msi_domain = arch_create_remap_msi_irq_domain(iommu->ir_domain, @@ -563,7 +563,7 @@ static int intel_setup_irq_remapping(struct intel_iommu *iommu) if (dmar_enable_qi(iommu)) { pr_err("Failed to enable queued invalidation\n"); - goto out_free_ir_domain; + goto out_free_bitmap; } } @@ -587,14 +587,6 @@ static int intel_setup_irq_remapping(struct intel_iommu *iommu) return 0; -out_free_ir_domain: - if (iommu->ir_msi_domain) - irq_domain_remove(iommu->ir_msi_domain); - iommu->ir_msi_domain = NULL; - irq_domain_remove(iommu->ir_domain); - iommu->ir_domain = NULL; -out_free_fwnode: - irq_domain_free_fwnode(fn); out_free_bitmap: kfree(bitmap); out_free_pages: -- 2.25.1

1 0

[PATCH openEuler-5.10-LTS 01/20] md: add io accounting for raid0 and raid5
by Zheng Zengkai 02 Aug '22

02 Aug '22

From: Guoqing Jiang <jgq516(a)gmail.com> mainline inclusion from mainline-v5.14-rc1 commit 10764815ff4728d2c57da677cd5d3dd6f446cf5f category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I587H6 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------- We introduce a new bioset (io_acct_set) for raid0 and raid5 since they don't own clone infrastructure to accounting io. And the bioset is added to mddev instead of to raid0 and raid5 layer, because with this way, we can put common functions to md.h and reuse them in raid0 and raid5. Also struct md_io_acct is added accordingly which includes io start_time, the origin bio and cloned bio. Then we can call bio_{start,end}_io_acct to get related io status. Signed-off-by: Guoqing Jiang <jiangguoqing(a)kylinos.cn> Signed-off-by: Song Liu <song(a)kernel.org> Conflict: drivers/md/md.c drivers/md/md.h Signed-off-by: Zhang Wensheng <zhangwensheng5(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/md/md.c | 52 ++++++++++++++++++++++++++++++++++++++++++---- drivers/md/md.h | 8 +++++++ drivers/md/raid0.c | 3 +++ drivers/md/raid5.c | 9 ++++++++ 4 files changed, 68 insertions(+), 4 deletions(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index a299fda5b0e9..10d9a8bed604 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -2361,7 +2361,8 @@ int md_integrity_register(struct mddev *mddev) bdev_get_integrity(reference->bdev)); pr_debug("md: data integrity enabled on %s\n", mdname(mddev)); - if (bioset_integrity_create(&mddev->bio_set, BIO_POOL_SIZE)) { + if (bioset_integrity_create(&mddev->bio_set, BIO_POOL_SIZE) || + bioset_integrity_create(&mddev->io_acct_set, BIO_POOL_SIZE)) { pr_err("md: failed to create integrity pool for %s\n", mdname(mddev)); return -EINVAL; @@ -5597,6 +5598,7 @@ static void md_free(struct kobject *ko) bioset_exit(&mddev->bio_set); bioset_exit(&mddev->sync_set); + bioset_exit(&mddev->io_acct_set); kfree(mddev); } @@ -5885,7 +5887,13 @@ int md_run(struct mddev *mddev) if (!bioset_initialized(&mddev->sync_set)) { err = bioset_init(&mddev->sync_set, BIO_POOL_SIZE, 0, BIOSET_NEED_BVECS); if (err) - return err; + goto exit_bio_set; + } + if (!bioset_initialized(&mddev->io_acct_set)) { + err = bioset_init(&mddev->io_acct_set, BIO_POOL_SIZE, + offsetof(struct md_io_acct, bio_clone), 0); + if (err) + goto exit_sync_set; } spin_lock(&pers_lock); @@ -6013,6 +6021,7 @@ int md_run(struct mddev *mddev) blk_queue_flag_set(QUEUE_FLAG_NONROT, mddev->queue); else blk_queue_flag_clear(QUEUE_FLAG_NONROT, mddev->queue); + blk_queue_flag_set(QUEUE_FLAG_IO_STAT, mddev->queue); } if (pers->sync_request) { if (mddev->kobj.sd && @@ -6062,8 +6071,11 @@ int md_run(struct mddev *mddev) module_put(pers->owner); md_bitmap_destroy(mddev); abort: - bioset_exit(&mddev->bio_set); + bioset_exit(&mddev->io_acct_set); +exit_sync_set: bioset_exit(&mddev->sync_set); +exit_bio_set: + bioset_exit(&mddev->bio_set); return err; } EXPORT_SYMBOL_GPL(md_run); @@ -6288,6 +6300,7 @@ void md_stop(struct mddev *mddev) __md_stop(mddev); bioset_exit(&mddev->bio_set); bioset_exit(&mddev->sync_set); + bioset_exit(&mddev->io_acct_set); } EXPORT_SYMBOL_GPL(md_stop); @@ -8571,9 +8584,40 @@ void md_write_end(struct mddev *mddev) roundup(jiffies, mddev->safemode_delay) + mddev->safemode_delay); } - EXPORT_SYMBOL(md_write_end); +static void md_end_io_acct(struct bio *bio) +{ + struct md_io_acct *md_io_acct = bio->bi_private; + struct bio *orig_bio = md_io_acct->orig_bio; + + orig_bio->bi_status = bio->bi_status; + + bio_end_io_acct(orig_bio, md_io_acct->start_time); + bio_put(bio); + bio_endio(orig_bio); +} + +/* used by personalities (raid0 and raid5) to account io stats */ +void md_account_bio(struct mddev *mddev, struct bio **bio) +{ + struct md_io_acct *md_io_acct; + struct bio *clone; + + if (!blk_queue_io_stat((*bio)->bi_disk->queue)) + return; + + clone = bio_clone_fast(*bio, GFP_NOIO, &mddev->io_acct_set); + md_io_acct = container_of(clone, struct md_io_acct, bio_clone); + md_io_acct->orig_bio = *bio; + md_io_acct->start_time = bio_start_io_acct(*bio); + + clone->bi_end_io = md_end_io_acct; + clone->bi_private = md_io_acct; + *bio = clone; +} +EXPORT_SYMBOL_GPL(md_account_bio); + /* md_allow_write(mddev) * Calling this ensures that the array is marked 'active' so that writes * may proceed without blocking. It is important to call this before diff --git a/drivers/md/md.h b/drivers/md/md.h index 85177d068322..20c16cfdd6bb 100644 --- a/drivers/md/md.h +++ b/drivers/md/md.h @@ -491,6 +491,7 @@ struct mddev { struct bio_set sync_set; /* for sync operations like * metadata and bitmap writes */ + struct bio_set io_acct_set; /* for raid0 and raid5 io accounting */ /* Generic flush handling. * The last to finish preflush schedules a worker to submit @@ -687,6 +688,12 @@ struct md_thread { void *private; }; +struct md_io_acct { + struct bio *orig_bio; + unsigned long start_time; + struct bio bio_clone; +}; + #define THREAD_WAKEUP 0 static inline void safe_put_page(struct page *p) @@ -716,6 +723,7 @@ extern void md_write_end(struct mddev *mddev); extern void md_done_sync(struct mddev *mddev, int blocks, int ok); extern void md_error(struct mddev *mddev, struct md_rdev *rdev); extern void md_finish_reshape(struct mddev *mddev); +void md_account_bio(struct mddev *mddev, struct bio **bio); extern bool __must_check md_flush_request(struct mddev *mddev, struct bio *bio); extern void md_super_write(struct mddev *mddev, struct md_rdev *rdev, diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c index 35843df15b5e..0312b192106a 100644 --- a/drivers/md/raid0.c +++ b/drivers/md/raid0.c @@ -556,6 +556,9 @@ static bool raid0_make_request(struct mddev *mddev, struct bio *bio) bio = split; } + if (bio->bi_pool != &mddev->bio_set) + md_account_bio(mddev, &bio); + orig_sector = sector; zone = find_zone(mddev->private, &sector); switch (conf->layout) { diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c index c82953a3299e..35dacc6e754f 100644 --- a/drivers/md/raid5.c +++ b/drivers/md/raid5.c @@ -5487,6 +5487,7 @@ static struct bio *chunk_aligned_read(struct mddev *mddev, struct bio *raid_bio) sector_t sector = raid_bio->bi_iter.bi_sector; unsigned chunk_sects = mddev->chunk_sectors; unsigned sectors = chunk_sects - (sector & (chunk_sects-1)); + struct r5conf *conf = mddev->private; if (sectors < bio_sectors(raid_bio)) { struct r5conf *conf = mddev->private; @@ -5496,6 +5497,9 @@ static struct bio *chunk_aligned_read(struct mddev *mddev, struct bio *raid_bio) raid_bio = split; } + if (raid_bio->bi_pool != &conf->bio_split) + md_account_bio(mddev, &raid_bio); + if (!raid5_read_one_chunk(mddev, raid_bio)) return raid_bio; @@ -5775,6 +5779,7 @@ static bool raid5_make_request(struct mddev *mddev, struct bio * bi) DEFINE_WAIT(w); bool do_prepare; bool do_flush = false; + bool do_clone = false; if (unlikely(bi->bi_opf & REQ_PREFLUSH)) { int ret = log_handle_flush_request(conf, bi); @@ -5803,6 +5808,7 @@ static bool raid5_make_request(struct mddev *mddev, struct bio * bi) if (rw == READ && mddev->degraded == 0 && mddev->reshape_position == MaxSector) { bi = chunk_aligned_read(mddev, bi); + do_clone = true; if (!bi) return true; } @@ -5817,6 +5823,9 @@ static bool raid5_make_request(struct mddev *mddev, struct bio * bi) last_sector = bio_end_sector(bi); bi->bi_next = NULL; + if (!do_clone) + md_account_bio(mddev, &bi); + prepare_to_wait(&conf->wait_for_overlap, &w, TASK_UNINTERRUPTIBLE); for (; logical_sector < last_sector; logical_sector += RAID5_STRIPE_SECTORS(conf)) { int previous; -- 2.20.1

1 19

[PATCH openEuler-5.10-LTS 00/64] Backport 5.10.115 LTS
by Zheng Zengkai 02 Aug '22

02 Aug '22

Backport 5.10.115 LTS patches from upstream. git cherry-pick v5.10.114..v5.10.115~1 -s Complicts: Already merged(4): 8a9e7c64f4a0 nfc: replace improper check device_is_registered() in netlink related functions 1961c5a688ed nfc: nfcmrvl: main: reorder destructive operations in nfcmrvl_nci_unregister_dev to avoid bugs 879b075a9a36 NFC: netlink: fix sleep in atomic bug when firmware download timeout a439819f4797 block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern Rejected(2): hinic driver drops related file in the patch: 475237e807a2 hinic: fix bug of wq out of bound access build failed due to reject of patch "845f44ce3d9f1 net/sched: flower: fix parsing of ethertype following VLAN header": d8338a7a0957 net/mlx5e: Don't match double-vlan packets if cvlan is not set Total patches: 70 - 4 - 2 = 64 Andreas Larsson (2): can: grcan: grcan_probe(): fix broken system id check for errata workaround needs can: grcan: only use the NAPI poll budget for RX Andrei Lalaev (1): gpiolib: of: fix bounds check for 'gpio-reserved-ranges' Armin Wolf (1): hwmon: (adt7470) Fix warning on module removal Aya Levin (1): net/mlx5: Fix slab-out-of-bounds while reading resource dump menu Brian Norris (1): mmc: core: Set HS clock speed before sending HS CMD13 Cheng Xu (1): RDMA/siw: Fix a condition race issue in MPA request processing Chengfeng Ye (1): firewire: fix potential uaf in outbound_phy_packet_callback() Codrin Ciubotariu (1): ASoC: dmaengine: Restore NULL prepare_slave_config() callback Daniel Hellstrom (1): can: grcan: use ofdev->dev when allocating DMA memory David Stevens (1): iommu/vt-d: Calculate mask for non-aligned flushes Duoming Zhou (1): can: grcan: grcan_close(): fix deadlock Eric Dumazet (1): net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter() Filipe Manana (1): btrfs: always log symlinks in full mode Frederic Weisbecker (2): rcu: Fix callbacks processing time limit retaining cond_resched() rcu: Apply callbacks processing time limit only on softirq Harry Wentland (1): drm/amd/display: Avoid reading audio pattern past AUDIO_CHANNELS_COUNT Helge Deller (1): parisc: Merge model and model name into one line in /proc/cpuinfo Ido Schimmel (1): selftests: mirror_gre_bridge_1q: Avoid changing PVID while interface is operational Jakob Koschel (1): firewire: remove check of list iterator against head past the loop body Jan Höppner (2): s390/dasd: Fix read for ESE with blksize < 4k s390/dasd: Fix read inconsistency for ESE DASD devices Jann Horn (1): selftests/seccomp: Don't call read() on TTY from background pgrp Kyle Huey (1): KVM: x86/svm: Account for family 17h event renumberings in amd_pmc_perf_hw_id Maciej W. Rozycki (1): MIPS: Fix CP0 counter erratum detection for R4k CPUs Mark Brown (5): ASoC: da7219: Fix change notifications for tone generator frequency ASoC: wm8958: Fix change notifications for DSP controls ASoC: meson: Fix event generation for AUI ACODEC mux ASoC: meson: Fix event generation for G12A tohdmi mux ASoC: meson: Fix event generation for AUI CODEC mux Mark Zhang (1): net/mlx5e: Fix the calling of update_buffer_lossy() API Michael Chan (1): bnxt_en: Fix unnecessary dropping of RX packets Mike Snitzer (1): dm: interlock pending dm_io and dm_wait_for_bios_completion Moshe Shemesh (1): net/mlx5: Avoid double clear or set of sync reset requested Moshe Tal (1): net/mlx5e: Fix trust state reset in reload Niels Dossche (1): firewire: core: extend card->lock in fw_core_handle_bus_reset Oliver Hartkopp (1): can: isotp: remove re-binding of bound socket Pali Rohár (2): PCI: aardvark: Clear all MSIs at setup PCI: aardvark: Fix reading MSI interrupt number Paolo Bonzini (2): KVM: x86: Do not change ICR on write to APIC_SELF_IPI KVM: x86/mmu: avoid NULL-pointer dereference on page freeing bugs Paul Blakey (1): net/mlx5e: CT: Fix queued up restore put() executing after relevant ft release Puyou Lu (1): gpio: pca953x: fix irq_stat not updated when irq is disabled (irq_mask not set) Ricky WU (1): mmc: rtsx: add 74 Clocks in power on flow Sandipan Das (1): kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has architectural PMU Sergey Shtylyov (1): smsc911x: allow using IRQ0 Shaik Sajida Bhanu (1): mmc: sdhci-msm: Reset GCC_SDCC_BCR register for SDHC Shravya Kumbham (1): net: emaclite: Add error handling for of_address_to_resource() Somnath Kotur (1): bnxt_en: Fix possible bnxt_open() failure caused by wrong RFS flag Stefan Haberland (2): s390/dasd: fix data corruption for ESE devices s390/dasd: prevent double format of tracks for ESE devices Takashi Sakamoto (1): ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes Tan Tee Min (1): net: stmmac: disable Split Header (SPH) for Intel platforms Thomas Pfaff (1): genirq: Synchronize interrupt thread startup Trond Myklebust (2): Revert "SUNRPC: attempt AF_LOCAL connect on setup" NFSv4: Don't invalidate inode attributes on delegation return Vladimir Oltean (1): selftests: ocelot: tc_flower_chains: specify conform-exceed action for policer Wanpeng Li (2): x86/kvm: Preserve BSP MSR_KVM_POLL_CONTROL across suspend/resume KVM: LAPIC: Enable timer posted-interrupt only when mwait/hlt is advertised Yang Yingliang (4): net: ethernet: mediatek: add missing of_node_put() in mtk_sgmii_init() net: dsa: mt7530: add missing of_node_put() in mt7530_setup() net: stmmac: dwmac-sun8i: add missing of_node_put() in sun8i_dwmac_register_mdio_mux() net: cpsw: add missing of_node_put() in cpsw_probe_dt() Zihao Wang (1): ALSA: hda/realtek: Add quirk for Yoga Duet 7 13ITL6 speakers arch/mips/include/asm/timex.h | 8 ++-- arch/mips/kernel/time.c | 11 ++--- arch/parisc/kernel/processor.c | 3 +- arch/x86/kernel/kvm.c | 13 ++++++ arch/x86/kvm/cpuid.c | 5 ++ arch/x86/kvm/lapic.c | 10 ++-- arch/x86/kvm/mmu/mmu.c | 2 + arch/x86/kvm/svm/pmu.c | 28 +++++++++-- drivers/firewire/core-card.c | 3 ++ drivers/firewire/core-cdev.c | 4 +- drivers/firewire/core-topology.c | 9 ++-- drivers/firewire/core-transaction.c | 30 ++++++------ drivers/firewire/sbp2.c | 13 +++--- drivers/gpio/gpio-pca953x.c | 4 +- drivers/gpio/gpiolib-of.c | 2 +- .../gpu/drm/amd/display/dc/core/dc_link_dp.c | 2 +- drivers/hwmon/adt7470.c | 4 +- drivers/infiniband/sw/siw/siw_cm.c | 7 +-- drivers/iommu/intel/iommu.c | 27 +++++++++-- drivers/md/dm.c | 8 +++- drivers/mmc/core/mmc.c | 23 ++++++++-- drivers/mmc/host/rtsx_pci_sdmmc.c | 31 +++++++++---- drivers/mmc/host/sdhci-msm.c | 42 +++++++++++++++++ drivers/net/can/grcan.c | 46 ++++++++++--------- drivers/net/dsa/mt7530.c | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 13 ++++-- drivers/net/ethernet/mediatek/mtk_sgmii.c | 1 + .../mellanox/mlx5/core/diag/rsc_dump.c | 31 ++++++++++--- .../mellanox/mlx5/core/en/port_buffer.c | 4 +- .../ethernet/mellanox/mlx5/core/en/tc_ct.c | 4 ++ .../ethernet/mellanox/mlx5/core/en_dcbnl.c | 10 ++++ .../ethernet/mellanox/mlx5/core/fw_reset.c | 28 +++++++---- drivers/net/ethernet/smsc/smsc911x.c | 2 +- .../net/ethernet/stmicro/stmmac/dwmac-intel.c | 1 + .../net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 1 + .../net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- drivers/net/ethernet/ti/cpsw_new.c | 5 +- drivers/net/ethernet/xilinx/xilinx_emaclite.c | 15 ++++-- drivers/pci/controller/pci-aardvark.c | 16 +++---- drivers/s390/block/dasd.c | 18 ++++++-- drivers/s390/block/dasd_eckd.c | 28 ++++++++--- drivers/s390/block/dasd_int.h | 14 ++++++ fs/btrfs/tree-log.c | 14 +++++- fs/nfs/nfs4proc.c | 12 ++++- include/linux/stmmac.h | 1 + kernel/irq/internals.h | 2 + kernel/irq/irqdesc.c | 2 + kernel/irq/manage.c | 39 ++++++++++++---- kernel/rcu/tree.c | 32 +++++++------ net/can/isotp.c | 22 ++------- net/ipv4/igmp.c | 9 ++-- net/sunrpc/xprtsock.c | 3 -- sound/firewire/fireworks/fireworks_hwdep.c | 1 + sound/pci/hda/patch_realtek.c | 1 + sound/soc/codecs/da7219.c | 14 ++++-- sound/soc/codecs/wm8958-dsp2.c | 8 ++-- sound/soc/meson/aiu-acodec-ctrl.c | 2 +- sound/soc/meson/aiu-codec-ctrl.c | 2 +- sound/soc/meson/g12a-tohdmitx.c | 2 +- sound/soc/soc-generic-dmaengine-pcm.c | 6 +-- .../drivers/net/ocelot/tc_flower_chains.sh | 2 +- .../net/forwarding/mirror_gre_bridge_1q.sh | 3 ++ tools/testing/selftests/seccomp/seccomp_bpf.c | 10 ++-- 63 files changed, 501 insertions(+), 215 deletions(-) -- 2.20.1

1 64

[PATCH openEuler-5.10-LTS 000/121] Backport 5.10.114 LTS
by Zheng Zengkai 02 Aug '22

02 Aug '22

Backport 5.10.114 LTS patches from upstream. git cherry-pick v5.10.113..v5.10.114~1 -s Complicts: Already merged(4): 54c028cfc496 floppy: disable FDRAWCMD by default e3ec78d82d48 net: hns3: modify the return code of hclge_get_ring_chain_from_mbx 929c30c02de4 net: hns3: add validity check for message data length 9eb25e00f59b net: hns3: add return value for mailbox handling in PF Implementation changed(already merged, use mainline version b98535d09179, 1): 585ef03c9e79 ext4: fix bug_on in start_this_handle during umount filesystem Defered(3, kabi changed): 3c464db03c12 tcp: ensure to use the most recently sent skb when filling the rate sample 6f2bf9c5ddfe mtd: fix 'part' field data corruption in mtd_info 616d354fb9e8 hex2bin: make the function hex_to_bin constant-time Total patches: 129 - 4 - 1 - 3 = 121 Adam Ford (2): ARM: dts: am3517-evm: Fix misc pinmuxing ARM: dts: logicpd-som-lv: Fix wrong pinmuxing on OMAP35 Alexey Kardashevskiy (1): powerpc/perf: Fix 32bit compile Baruch Siach (1): net: phy: marvell10g: fix return value on error Borislav Petkov (1): x86/cpu: Load microcode during restore_processor_state() Bruno Thomsen (1): USB: serial: cp210x: add PIDs for Kamstrup USB Meter Reader Chao Song (1): ASoC: Intel: soc-acpi: correct device endpoints for max98373 Christian Hewitt (2): arm64: dts: meson: remove CPU opps below 1GHz for G12B boards arm64: dts: meson: remove CPU opps below 1GHz for SM1 boards Christophe JAILLET (1): bus: sunxi-rsb: Fix the return value of sunxi_rsb_device_create() Chuanhong Guo (1): mtd: rawnand: fix ecc parameters for mt7622 Claudiu Beznea (1): ARM: dts: at91: sama5d4_xplained: fix pinctrl phandle name Damien Le Moal (2): zonefs: Fix management of open zones zonefs: Clear inode information flags on inode creation Dan Vacura (1): usb: gadget: uvc: Fix crash when encoding data for usb request Daniel Starke (13): tty: n_gsm: fix restart handling via CLD command tty: n_gsm: fix decoupled mux resource tty: n_gsm: fix mux cleanup after unregister tty device tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2 tty: n_gsm: fix malformed counter for out of frame data tty: n_gsm: fix insufficient txframe size tty: n_gsm: fix wrong DLCI release order tty: n_gsm: fix missing explicit ldisc flush tty: n_gsm: fix wrong command retry handling tty: n_gsm: fix wrong command frame length field encoding tty: n_gsm: fix reset fifo race condition tty: n_gsm: fix incorrect UA handling tty: n_gsm: fix software flow control handling Daniele Palmas (1): USB: serial: option: add Telit 0x1057, 0x1058, 0x1075 compositions Dany Madden (1): Revert "ibmvnic: Add ethtool private flag for driver-defined queue limits" David Yat Sin (1): drm/amdkfd: Fix GWS queue count Dinh Nguyen (1): net: ethernet: stmmac: fix write to sgmii_adapter_base Duoming Zhou (1): drivers: net: hippi: Fix deadlock in rr_close() Eric Dumazet (2): tcp: fix potential xmit stalls caused by TCP_NOTSENT_LOWAT tcp: make sure treq->af_specific is initialized Evan Green (1): xhci: Enable runtime PM on second Alderlake controller Eyal Birger (1): bpf, lwt: Fix crash when using bpf_skb_set_tunnel_key() from bpf_xmit lwt hook Fabio Estevam (2): ARM: dts: imx6qdl-apalis: Fix sgtl5000 detection issue arm64: dts: imx8mn-ddr4-evk: Describe the 32.768 kHz PMIC clock Fawzi Khaber (1): iio: imu: inv_icm42600: Fix I2C init possible nack Florian Westphal (1): netfilter: nft_socket: only do sk lookups when indev is available Francesco Ruggeri (1): tcp: md5: incorrect tcp_header_len for incoming connections Geert Uytterhoeven (1): memory: renesas-rpc-if: Fix HF/OSPI data transfer in Manual Mode Greg Kroah-Hartman (1): lightnvm: disable the subsystem Guo Ren (1): riscv: patch_text: Fixup last cpu should be master H. Nikolaus Schaller (1): ARM: dts: Fix mmc order for omap3-gta04 Hangyu Hua (1): usb: misc: fix improper handling of refcount in uss720_probe() Heikki Krogerus (2): usb: typec: ucsi: Fix reuse of completion structure usb: typec: ucsi: Fix role swapping Henry Lin (1): xhci: stop polling roothubs after shutdown Imre Deak (1): drm/i915: Fix SEL_FETCH_PLANE_*(PIPE_B+) register addresses Johan Hovold (1): serial: imx: fix overrun interrupts in DMA mode Jonathan Lemon (1): net: bcmgenet: hide status block before TX timestamping Kees Cook (2): USB: serial: whiteheat: fix heap overflow in WHITEHEAT_GET_DTR_RTS thermal: int340x: Fix attr.show callback prototype Krzysztof Kozlowski (2): pinctrl: samsung: fix missing GPIOLIB on ARM64 Exynos config phy: samsung: exynos5250-sata: fix missing device put in probe error paths Leon Romanovsky (1): ixgbe: ensure IPsec VF<->PF compatibility Lijun Pan (1): ibmvnic: fix miscellaneous checks Luca Ceresoli (1): pinctrl: rockchip: fix RK3308 pinmux bits Lv Ruyi (1): pinctrl: pistachio: fix use of irq_of_parse_and_map() Maciej W. Rozycki (2): serial: 8250: Also set sticky MCR bits in console restoration serial: 8250: Correct the clock for EndRun PTP/1588 PCIe device Macpaul Lin (1): usb: mtu3: fix USB 3.0 dual-role-switch from device to host Manish Chopra (1): bnx2x: fix napi API usage sequence Marek Vasut (2): pinctrl: stm32: Do not call stm32_gpio_get() for edge triggered IRQs in EOI pinctrl: stm32: Keep pinctrl block clock enabled when LEVEL IRQ requested Mark Brown (1): ARM: dts: at91: Map MCLK for wm8731 on at91sam9g20ek Martin Blumenstingl (1): net: dsa: lantiq_gswip: Don't set GSWIP_MII_CFG_RMII_CLK Mathias Nyman (1): xhci: increase usb U3 -> U0 link resume timeout from 100ms to 500ms Max Krummenacher (1): ARM: dts: imx6ull-colibri: fix vqmmc regulator Maxim Mikityanskiy (1): tls: Skip tls_append_frag on zero copy size Miaoqian Lin (8): phy: samsung: Fix missing of_node_put() in exynos_sata_phy_probe ARM: OMAP2+: Fix refcount leak in omap_gic_of_init phy: ti: omap-usb2: Fix error handling in omap_usb2_enable_clocks phy: mapphone-mdm6600: Fix PM error handling in phy_mdm6600_probe phy: ti: Add missing pm_runtime_disable() in serdes_am654_probe mtd: rawnand: Fix return value check of wait_for_completion_timeout net: dsa: Add missing of_node_put() in dsa_port_link_register_of drm/amd/display: Fix memory leak in dcn21_clock_source_create Michael Hennerich (1): iio: dac: ad5446: Fix read_raw not returning set value Mikulas Patocka (2): hex2bin: fix access beyond string end x86: __memcpy_flushcache: fix wrong alignment if size > 2^32 Namhyung Kim (3): perf symbol: Pass is_kallsyms to symbols__fixup_end() perf symbol: Update symbols__fixup_end() perf symbol: Remove arch__symbols__fixup_end() Nikolay Aleksandrov (1): wireguard: device: check for metadata_dst with skb_valid_dst() Oliver Neukum (2): USB: quirks: add a Realtek card reader USB: quirks: add STRING quirk for VCOM device Pablo Neira Ayuso (1): netfilter: nft_set_rbtree: overlap detection with element re-addition after deletion Pavel Skripkin (1): video: fbdev: udlfb: properly check endpoint type Pawel Laszczak (1): usb: cdns3: Fix issue for clear halt endpoint Peilin Ye (3): ip_gre: Make o_seqno start from 0 in native mode ip6_gre: Make o_seqno start from 0 in native mode ip_gre, ip6_gre: Fix race condition on o_seqno in collect_md mode Pengcheng Yang (2): ipvs: correctly print the memory size of ip_vs_conn_tab tcp: fix F-RTO may not work correctly when receiving DSACK Ronnie Sahlberg (1): cifs: destage any unwritten data to the server before calling copychunk_write Sean Anderson (1): usb: phy: generic: Get the vbus supply Slark Xiao (1): USB: serial: option: add support for Cinterion MV32-WA/MV32-WB Sven Peter (1): usb: dwc3: Try usb-role-switch first in dwc3_drd_init Tejun Heo (1): iocost: don't reset the inuse weight of under-weighted debtors Thinh Nguyen (3): usb: dwc3: core: Fix tx/rx threshold settings usb: dwc3: core: Only handle soft-reset in DCTL usb: dwc3: gadget: Return proper request status Thomas Gleixner (1): x86/pci/xen: Disable PCI/MSI[-X] masking for XEN_HVM guests Tong Zhang (1): iio:imu:bmi160: disable regulator in error path Tony Lindgren (1): bus: ti-sysc: Make omap3 gpt12 quirk handling SoC specific Vijayavardhan Vennapusa (1): usb: gadget: configfs: clear deactivation flag in configfs_composite_unbind() Wang Qing (1): arch_topology: Do not set llc_sibling if llc_id is invalid Weitao Wang (1): USB: Fix xhci event ring dequeue pointer ERDP update issue Xiaobing Luo (1): cpufreq: fix memory leak in sun50i_cpufreq_nvmem_probe Xin Long (1): sctp: check asoc strreset_chunk in sctp_generate_reconf_event Yang Yingliang (2): clk: sunxi: sun9i-mmc: check return value after calling platform_get_resource() net: fec: add missing of_node_put() in fec_enet_init_stop_mode() YueHaibing (1): pinctrl: mediatek: moore: Fix build error Zheyu Ma (2): iio: magnetometer: ak8975: Fix the error handling in ak8975_power_on() ASoC: wm8731: Disable the regulator when probing fails Zizhuang Deng (1): iio: dac: ad5592r: Fix the missing return value. Zqiang (1): kasan: prevent cpu_quarantine corruption when CPU offline and cache shrink occur at same time liuyacan (1): net/smc: sync err code when tcp connection was refused arch/arm/boot/dts/am3517-evm.dts | 45 +++- arch/arm/boot/dts/am3517-som.dtsi | 9 + arch/arm/boot/dts/at91-sama5d4_xplained.dts | 4 +- arch/arm/boot/dts/at91sam9g20ek_common.dtsi | 6 + arch/arm/boot/dts/imx6qdl-apalis.dtsi | 10 +- arch/arm/boot/dts/imx6ull-colibri.dtsi | 2 +- .../boot/dts/logicpd-som-lv-35xx-devkit.dts | 15 ++ .../boot/dts/logicpd-som-lv-37xx-devkit.dts | 15 ++ arch/arm/boot/dts/logicpd-som-lv.dtsi | 15 -- arch/arm/boot/dts/omap3-gta04.dtsi | 2 + arch/arm/mach-exynos/Kconfig | 1 - arch/arm/mach-omap2/omap4-common.c | 2 + .../boot/dts/amlogic/meson-g12b-a311d.dtsi | 40 ---- .../boot/dts/amlogic/meson-g12b-s922x.dtsi | 40 ---- arch/arm64/boot/dts/amlogic/meson-sm1.dtsi | 20 -- .../boot/dts/freescale/imx8mn-ddr4-evk.dts | 4 + arch/powerpc/perf/Makefile | 4 +- arch/riscv/kernel/patch.c | 2 +- arch/x86/include/asm/microcode.h | 2 + arch/x86/kernel/cpu/microcode/core.c | 6 +- arch/x86/lib/usercopy_64.c | 2 +- arch/x86/pci/xen.c | 6 +- arch/x86/power/cpu.c | 10 +- block/blk-iocost.c | 12 +- drivers/base/arch_topology.c | 2 +- drivers/bus/sunxi-rsb.c | 2 + drivers/bus/ti-sysc.c | 16 +- drivers/clk/sunxi/clk-sun9i-mmc.c | 2 + drivers/cpufreq/sun50i-cpufreq-nvmem.c | 4 +- .../drm/amd/amdkfd/kfd_device_queue_manager.c | 83 ++++---- .../drm/amd/display/dc/dcn21/dcn21_resource.c | 1 + drivers/gpu/drm/i915/i915_reg.h | 2 +- drivers/iio/dac/ad5446.c | 2 +- drivers/iio/dac/ad5592r-base.c | 2 +- drivers/iio/imu/bmi160/bmi160_core.c | 20 +- .../iio/imu/inv_icm42600/inv_icm42600_i2c.c | 15 +- drivers/iio/magnetometer/ak8975.c | 1 + drivers/lightnvm/Kconfig | 2 +- drivers/memory/renesas-rpc-if.c | 60 ++++-- drivers/mtd/nand/raw/mtk_ecc.c | 12 +- drivers/mtd/nand/raw/sh_flctl.c | 14 +- drivers/net/dsa/lantiq_gswip.c | 3 - .../net/ethernet/broadcom/bnx2x/bnx2x_main.c | 9 +- .../net/ethernet/broadcom/genet/bcmgenet.c | 7 + drivers/net/ethernet/freescale/fec_main.c | 2 +- drivers/net/ethernet/ibm/ibmvnic.c | 144 ++++--------- drivers/net/ethernet/ibm/ibmvnic.h | 6 - .../net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 3 +- .../ethernet/stmicro/stmmac/dwmac-socfpga.c | 12 +- drivers/net/hippi/rrunner.c | 2 + drivers/net/phy/marvell10g.c | 2 +- drivers/net/wireguard/device.c | 3 +- drivers/phy/motorola/phy-mapphone-mdm6600.c | 3 +- drivers/phy/samsung/phy-exynos5250-sata.c | 21 +- drivers/phy/ti/phy-am654-serdes.c | 2 +- drivers/phy/ti/phy-omap-usb2.c | 2 +- drivers/pinctrl/mediatek/Kconfig | 1 + drivers/pinctrl/pinctrl-pistachio.c | 6 +- drivers/pinctrl/pinctrl-rockchip.c | 45 ++-- drivers/pinctrl/samsung/Kconfig | 11 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 23 ++- .../intel/int340x_thermal/int3400_thermal.c | 4 +- drivers/tty/n_gsm.c | 194 ++++++++++-------- drivers/tty/serial/8250/8250_pci.c | 8 +- drivers/tty/serial/8250/8250_port.c | 2 +- drivers/tty/serial/imx.c | 2 +- drivers/usb/cdns3/gadget.c | 7 +- drivers/usb/core/quirks.c | 6 + drivers/usb/dwc3/core.c | 11 +- drivers/usb/dwc3/drd.c | 11 +- drivers/usb/dwc3/gadget.c | 31 ++- drivers/usb/gadget/configfs.c | 2 + drivers/usb/gadget/function/uvc_queue.c | 2 + drivers/usb/host/xhci-hub.c | 2 +- drivers/usb/host/xhci-pci.c | 4 +- drivers/usb/host/xhci-ring.c | 2 + drivers/usb/host/xhci.c | 11 + drivers/usb/misc/uss720.c | 3 +- drivers/usb/mtu3/mtu3_dr.c | 6 +- drivers/usb/phy/phy-generic.c | 7 + drivers/usb/serial/cp210x.c | 2 + drivers/usb/serial/option.c | 12 ++ drivers/usb/serial/whiteheat.c | 5 +- drivers/usb/typec/ucsi/ucsi.c | 24 ++- drivers/video/fbdev/udlfb.c | 14 +- fs/cifs/smb2ops.c | 8 + fs/zonefs/super.c | 46 ++++- include/memory/renesas-rpc-if.h | 1 + include/net/ip6_tunnel.h | 2 +- include/net/ip_tunnels.h | 2 +- include/net/tcp.h | 2 + lib/hexdump.c | 9 +- mm/kasan/quarantine.c | 7 + net/core/lwt_bpf.c | 7 +- net/dsa/port.c | 2 + net/ipv4/ip_gre.c | 12 +- net/ipv4/syncookies.c | 8 +- net/ipv4/tcp_input.c | 15 +- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/tcp_output.c | 1 + net/ipv6/ip6_gre.c | 16 +- net/ipv6/syncookies.c | 3 +- net/netfilter/ipvs/ip_vs_conn.c | 2 +- net/netfilter/nft_set_rbtree.c | 6 +- net/netfilter/nft_socket.c | 52 +++-- net/sctp/sm_sideeffect.c | 4 + net/smc/af_smc.c | 2 + net/tls/tls_device.c | 12 +- sound/soc/codecs/wm8731.c | 19 +- .../intel/common/soc-acpi-intel-tgl-match.c | 4 +- tools/perf/arch/arm64/util/Build | 1 - tools/perf/arch/arm64/util/machine.c | 27 --- tools/perf/arch/s390/util/machine.c | 16 -- tools/perf/util/symbol-elf.c | 2 +- tools/perf/util/symbol.c | 37 +++- tools/perf/util/symbol.h | 3 +- 116 files changed, 886 insertions(+), 637 deletions(-) delete mode 100644 tools/perf/arch/arm64/util/machine.c -- 2.20.1

1 121

【会议通知】 SPR: Add core PMU support for SPR KABI问题讨论，时间：2022-08-02 15:30-17:00(UTC+08:00)，
by Meeting Book 02 Aug '22

02 Aug '22

会议主题 Subject Intel SPR: Add core PMU support for SPR KABI问题讨论会议时间 Time 2022-08-02 15:30-17:00 (UTC+08:00)Beijing 会议地点 Location Welink视频会议 Welink Video Meeting 加入会议(External)<https://meeting.huaweicloud.com:36443/#/j/98677767> 会议ID Meeting ID 98677767 召集人 Convener 郑增凯提示 Tips 请点击会议链接加入会议,首次使用请在入会界面根据提示下载并安装客户端后输入ID入会。 Click the meeting link to join the meeting. For the first time, download and install the client as prompted and enter the ID to join the meeting

1 0

[PATCH openEuler-22.09] openeuler_defconfig: enable CONFIG_BPF_SCHED for x86
by Zheng Zengkai 02 Aug '22

02 Aug '22

From: Ren Zhijie <renzhijie2(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5F6X6 CVE: NA -------------------------------- Enable CONFIG_BPF_SCHED for x86 by default. Signed-off-by: Ren Zhijie <renzhijie2(a)huawei.com> --- arch/x86/configs/openeuler_defconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index f013c7b95881..bc9d7ee3812c 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -235,6 +235,7 @@ CONFIG_KALLSYMS_ALL=y CONFIG_KALLSYMS_ABSOLUTE_PERCPU=y CONFIG_KALLSYMS_BASE_RELATIVE=y # CONFIG_BPF_LSM is not set +CONFIG_BPF_SCHED=y CONFIG_BPF_SYSCALL=y CONFIG_ARCH_WANT_DEFAULT_BPF_JIT=y CONFIG_BPF_JIT_ALWAYS_ON=y -- 2.20.1

1 0

[PATCH openEuler-1.0-LTS 1/3] fbmem: Check virtual screen sizes in fb_set_var()
by Yongqiang Liu 01 Aug '22

01 Aug '22

From: Helge Deller <deller(a)gmx.de> mainline inclusion from mainline-v5.19-rc6 commit 6c11df58fd1ac0aefcb3b227f72769272b939e56 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5IQ4M CVE: CVE-2021-33655 -------------------------------- Verify that the fbdev or drm driver correctly adjusted the virtual screen sizes. On failure report the failing driver and reject the screen size change. Signed-off-by: Helge Deller <deller(a)gmx.de> Reviewed-by: Geert Uytterhoeven <geert(a)linux-m68k.org> Cc: stable(a)vger.kernel.org # v5.4+ Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Conflicts: drivers/video/fbdev/core/fbmem.c Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/video/fbdev/core/fbmem.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c index c48f083d522a..43a446416843 100644 --- a/drivers/video/fbdev/core/fbmem.c +++ b/drivers/video/fbdev/core/fbmem.c @@ -996,6 +996,16 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var) if (ret) goto done; + /* verify that virtual resolution >= physical resolution */ + if (var->xres_virtual < var->xres || + var->yres_virtual < var->yres) { + pr_warn("WARNING: fbcon: Driver '%s' missed to adjust virtual screen size (%ux%u vs. %ux%u)\n", + info->fix.id, + var->xres_virtual, var->yres_virtual, + var->xres, var->yres); + return -EINVAL; + } + if ((var->activate & FB_ACTIVATE_MASK) == FB_ACTIVATE_NOW) { struct fb_var_screeninfo old_var; struct fb_videomode mode; -- 2.25.1

1 2

[PATCH openEuler-1.0-LTS] xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in xfrm_bundle_lookup()
by Yongqiang Liu 01 Aug '22

01 Aug '22

From: Hangyu Hua <hbh25y(a)gmail.com> stable inclusion from stable-v4.19.254 commit fdb4fba1ba8512fa579a9d091dcb6c410f82f96a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5JMHA CVE: CVE-2022-36879 -------------------------------- [ Upstream commit f85daf0e725358be78dfd208dea5fd665d8cb901 ] xfrm_policy_lookup() will call xfrm_pol_hold_rcu() to get a refcount of pols[0]. This refcount can be dropped in xfrm_expand_policies() when xfrm_expand_policies() return error. pols[0]'s refcount is balanced in here. But xfrm_bundle_lookup() will also call xfrm_pols_put() with num_pols == 1 to drop this refcount when xfrm_expand_policies() return error. This patch also fix an illegal address access. pols[0] will save a error point when xfrm_policy_lookup fails. This lead to xfrm_pols_put to resolve an illegal address in xfrm_bundle_lookup's error path. Fix these by setting num_pols = 0 in xfrm_expand_policies()'s error path. Fixes: 80c802f3073e ("xfrm: cache bundles instead of policies for outgoing flows") Signed-off-by: Hangyu Hua <hbh25y(a)gmail.com> Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/xfrm/xfrm_policy.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index e9aea82f370d..408e3f34d16c 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -1703,8 +1703,10 @@ static int xfrm_expand_policies(const struct flowi *fl, u16 family, *num_xfrms = 0; return 0; } - if (IS_ERR(pols[0])) + if (IS_ERR(pols[0])) { + *num_pols = 0; return PTR_ERR(pols[0]); + } *num_xfrms = pols[0]->xfrm_nr; @@ -1719,6 +1721,7 @@ static int xfrm_expand_policies(const struct flowi *fl, u16 family, if (pols[1]) { if (IS_ERR(pols[1])) { xfrm_pols_put(pols, *num_pols); + *num_pols = 0; return PTR_ERR(pols[1]); } (*num_pols)++; -- 2.25.1

1 0

[PATCH openEuler-22.03-LTS] xfs: fix comment for start time value of inode with bigtime enabled
by Xiaole He 01 Aug '22

01 Aug '22

From: Xiaole He <hexiaole1994(a)126.com> mainline inclusion from mainline-for-next commit fdbae121b4369fe49eb5f8efbd23604ab4c50116 category: doc -------------------------------- The 'ctime', 'mtime', and 'atime' for inode is the type of 'xfs_timestamp_t', which is a 64-bit type: /* fs/xfs/libxfs/xfs_format.h begin */ typedef __be64 xfs_timestamp_t; /* fs/xfs/libxfs/xfs_format.h end */ When the 'bigtime' feature is disabled, this 64-bit type is splitted into two parts of 32-bit, one part is encoded for seconds since 1970-01-01 00:00:00 UTC, the other part is encoded for nanoseconds above the seconds, this two parts are the type of 'xfs_legacy_timestamp' and the min and max time value of this type are defined as macros 'XFS_LEGACY_TIME_MIN' and 'XFS_LEGACY_TIME_MAX': /* fs/xfs/libxfs/xfs_format.h begin */ struct xfs_legacy_timestamp { __be32 t_sec; /* timestamp seconds */ __be32 t_nsec; /* timestamp nanoseconds */ }; #define XFS_LEGACY_TIME_MIN ((int64_t)S32_MIN) #define XFS_LEGACY_TIME_MAX ((int64_t)S32_MAX) /* fs/xfs/libxfs/xfs_format.h end */ /* include/linux/limits.h begin */ #define U32_MAX ((u32)~0U) #define S32_MAX ((s32)(U32_MAX >> 1)) #define S32_MIN ((s32)(-S32_MAX - 1)) /* include/linux/limits.h end */ 'XFS_LEGACY_TIME_MIN' is the min time value of the 'xfs_legacy_timestamp', that is -(2^31) seconds relative to the 1970-01-01 00:00:00 UTC, it can be converted to human-friendly time value by 'date' command: /* command begin */ [root@~]# date --utc -d '@0' +'%Y-%m-%d %H:%M:%S' 1970-01-01 00:00:00 [root@~]# date --utc -d "@`echo '-(2^31)'|bc`" +'%Y-%m-%d %H:%M:%S' 1901-12-13 20:45:52 [root@~]# /* command end */ When 'bigtime' feature is enabled, this 64-bit type becomes a 64-bit nanoseconds counter, with the start time value is the min time value of 'xfs_legacy_timestamp'(start time means the value of 64-bit nanoseconds counter is 0). We have already caculated the min time value of 'xfs_legacy_timestamp', that is 1901-12-13 20:45:52 UTC, but the comment for the start time value of inode with 'bigtime' feature enabled writes the value is 1901-12-31 20:45:52 UTC: /* fs/xfs/libxfs/xfs_format.h begin */ /* * XFS Timestamps * ============== * When the bigtime feature is enabled, ondisk inode timestamps become an * unsigned 64-bit nanoseconds counter. This means that the bigtime inode * timestamp epoch is the start of the classic timestamp range, which is * Dec 31 20:45:52 UTC 1901. ... ... */ /* fs/xfs/libxfs/xfs_format.h end */ That is a typo, and this patch corrects the typo, from 'Dec 31' to 'Dec 13'. Suggested-by: Darrick J. Wong <djwong(a)kernel.org> Signed-off-by: Xiaole He <hexiaole(a)kylinos.cn> Reviewed-by: Darrick J. Wong <djwong(a)kernel.org> Signed-off-by: Darrick J. Wong <djwong(a)kernel.org> --- fs/xfs/libxfs/xfs_format.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/xfs/libxfs/xfs_format.h b/fs/xfs/libxfs/xfs_format.h index dd764da08f6f..8faa2a6069e6 100644 --- a/fs/xfs/libxfs/xfs_format.h +++ b/fs/xfs/libxfs/xfs_format.h @@ -870,7 +870,7 @@ struct xfs_agfl { * When the bigtime feature is enabled, ondisk inode timestamps become an * unsigned 64-bit nanoseconds counter. This means that the bigtime inode * timestamp epoch is the start of the classic timestamp range, which is - * Dec 31 20:45:52 UTC 1901. Because the epochs are not the same, callers + * Dec 13 20:45:52 UTC 1901. Because the epochs are not the same, callers * /must/ use the bigtime conversion functions when encoding and decoding raw * timestamps. */ -- 2.27.0

1 0