- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] lib/iov_iter: initialize "flags" in new pipe_buffer
by Laibin Qiu 14 Mar '22

14 Mar '22

From: Max Kellermann <max.kellermann(a)ionos.com> mainline inclusion from mainline-v5.17-rc6 commit 9d2231c5d74e13b2a0546fee6737ee4446017903 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4X1GI?from=project-issue CVE: NA -------------------------------- The functions copy_page_to_iter_pipe() and push_pipe() can both allocate a new pipe_buffer, but the "flags" member initializer is missing. Fixes: 241699cd72a8 ("new iov_iter flavour: pipe-backed") To: Alexander Viro <viro(a)zeniv.linux.org.uk> To: linux-fsdevel(a)vger.kernel.org To: linux-kernel(a)vger.kernel.org Cc: stable(a)vger.kernel.org Signed-off-by: Max Kellermann <max.kellermann(a)ionos.com> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- lib/iov_iter.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/iov_iter.c b/lib/iov_iter.c index 25668139fc1f..b80320956caf 100644 --- a/lib/iov_iter.c +++ b/lib/iov_iter.c @@ -506,6 +506,7 @@ static size_t copy_page_to_iter_pipe(struct page *page, size_t offset, size_t by return 0; pipe->nrbufs++; buf->ops = &page_cache_pipe_buf_ops; + buf->flags = 0; get_page(buf->page = page); buf->offset = offset; buf->len = bytes; @@ -630,6 +631,7 @@ static size_t push_pipe(struct iov_iter *i, size_t size, break; pipe->nrbufs++; pipe->bufs[idx].ops = &default_pipe_buf_ops; + pipe->bufs[idx].flags = 0; pipe->bufs[idx].page = page; pipe->bufs[idx].offset = 0; if (left <= PAGE_SIZE) { -- 2.22.0

1 0

[PATCH openEuler-1.0-LTS 0/3] bugfix for memory reliable
by Laibin Qiu 14 Mar '22

14 Mar '22

fix zoneref mapping problem and disable memory reliable if kdump is in progress. Reliable memory used by shmem will be accurate if swap is enabled. Changelog since v1: - update ac->preferred_zoneref - add patch on shmem in reliable_fb_find_zone Ma Wupeng (3): mm: disable memory reliable when kdump is in progress mm: fix zoneref mapping problem in memory reliable mm: Count reliable shmem used based on NR_SHMEM mm/filemap.c | 5 ++++- mm/khugepaged.c | 2 ++ mm/mem_reliable.c | 6 ++++++ mm/migrate.c | 5 +++++ mm/page_alloc.c | 25 ++++++++++++------------- mm/shmem.c | 7 ++----- 6 files changed, 31 insertions(+), 19 deletions(-) -- 2.22.0

1 3

[PATCH openEuler-1.0-LTS 1/2] mm: fix unable to use reliable memory in page cache
by Laibin Qiu 14 Mar '22

14 Mar '22

From: Chen Wandun <chenwandun(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4SK3S CVE: NA ---------------------------------------------- It is inaccurate when accumulate percpu variable without lock, it will result in pagecache_reliable_pages to be negative in sometime, and will prevent pagecache using reliable memory. For more accurate statistic, replace percpu variable by percpu_counter. The additional percpu_counter will be access in alloc_pages, the init of these two percpu_conter is too late in late_initcall, allocations that use alloc_pages should have to check if the two counter has been inited, that will introduce latency, in order to sovle this, init the two percpu_counter in advance. Signed-off-by: Chen Wandun <chenwandun(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- include/linux/mem_reliable.h | 17 +++++----- mm/mem_reliable.c | 62 ++++++++++++++++++------------------ mm/page_alloc.c | 5 +++ 3 files changed, 45 insertions(+), 39 deletions(-) diff --git a/include/linux/mem_reliable.h b/include/linux/mem_reliable.h index ba5d41edbc44..c4f954340ea7 100644 --- a/include/linux/mem_reliable.h +++ b/include/linux/mem_reliable.h @@ -21,8 +21,9 @@ extern bool shmem_reliable; extern struct percpu_counter reliable_shmem_used_nr_page; extern bool pagecache_use_reliable_mem; DECLARE_PER_CPU(long, nr_reliable_buddy_pages); -DECLARE_PER_CPU(long, pagecache_reliable_pages); -DECLARE_PER_CPU(long, anon_reliable_pages); + +extern struct percpu_counter pagecache_reliable_pages; +extern struct percpu_counter anon_reliable_pages; extern unsigned long nr_reliable_reserve_pages __read_mostly; extern long shmem_reliable_nr_page __read_mostly; @@ -43,6 +44,7 @@ extern void reliable_lru_add(enum lru_list lru, struct page *page, extern void page_cache_prepare_alloc(gfp_t *gfp); extern void reliable_lru_add_batch(int zid, enum lru_list lru, int val); +extern bool mem_reliable_counter_initialized(void); static inline bool mem_reliable_is_enabled(void) { @@ -81,13 +83,10 @@ static inline void reliable_page_counter(struct page *page, static inline bool reliable_mem_limit_check(unsigned long nr_page) { - int cpu; - long num = 0; + s64 num; - for_each_possible_cpu(cpu) { - num += per_cpu(pagecache_reliable_pages, cpu); - num += per_cpu(anon_reliable_pages, cpu); - } + num = percpu_counter_read_positive(&pagecache_reliable_pages); + num += percpu_counter_read_positive(&anon_reliable_pages); return num + nr_page <= task_reliable_limit / PAGE_SIZE; } @@ -184,6 +183,8 @@ static inline void reliable_lru_add(enum lru_list lru, static inline void page_cache_prepare_alloc(gfp_t *gfp) {} static inline void reliable_lru_add_batch(int zid, enum lru_list lru, int val) {} + +static inline bool mem_reliable_counter_initialized(void) { return false; } #endif #endif diff --git a/mm/mem_reliable.c b/mm/mem_reliable.c index 62df78657ff9..033af716610f 100644 --- a/mm/mem_reliable.c +++ b/mm/mem_reliable.c @@ -34,12 +34,18 @@ unsigned long nr_reliable_reserve_pages = MEM_RELIABLE_RESERVE_MIN / PAGE_SIZE; long shmem_reliable_nr_page = LONG_MAX; bool pagecache_use_reliable_mem __read_mostly = true; -DEFINE_PER_CPU(long, pagecache_reliable_pages); -DEFINE_PER_CPU(long, anon_reliable_pages); +struct percpu_counter pagecache_reliable_pages; +struct percpu_counter anon_reliable_pages; static unsigned long zero; static unsigned long reliable_pagecache_max_bytes = ULONG_MAX; +bool mem_reliable_counter_initialized(void) +{ + return likely(percpu_counter_initialized(&pagecache_reliable_pages)) && + likely((percpu_counter_initialized(&anon_reliable_pages))); +} + bool mem_reliable_status(void) { return mem_reliable_is_enabled(); @@ -66,9 +72,9 @@ void reliable_lru_add_batch(int zid, enum lru_list lru, int val) if (zid < ZONE_MOVABLE && zid >= 0) { if (is_file_lru(lru)) - this_cpu_add(pagecache_reliable_pages, val); + percpu_counter_add(&pagecache_reliable_pages, val); else if (is_anon_lru(lru)) - this_cpu_add(anon_reliable_pages, val); + percpu_counter_add(&anon_reliable_pages, val); } } @@ -78,14 +84,14 @@ void reliable_lru_add(enum lru_list lru, struct page *page, int val) return; if (is_file_lru(lru)) - this_cpu_add(pagecache_reliable_pages, val); + percpu_counter_add(&pagecache_reliable_pages, val); else if (is_anon_lru(lru)) - this_cpu_add(anon_reliable_pages, val); + percpu_counter_add(&anon_reliable_pages, val); else if (lru == LRU_UNEVICTABLE) { if (PageAnon(page)) - this_cpu_add(anon_reliable_pages, val); + percpu_counter_add(&anon_reliable_pages, val); else - this_cpu_add(pagecache_reliable_pages, val); + percpu_counter_add(&pagecache_reliable_pages, val); } } @@ -188,21 +194,20 @@ static void show_val_kb(struct seq_file *m, const char *s, unsigned long num) void reliable_report_meminfo(struct seq_file *m) { bool pagecache_enabled = pagecache_reliable_is_enabled(); - long nr_pagecache_pages = 0; - long nr_anon_pages = 0; + s64 nr_pagecache_pages = 0; + s64 nr_anon_pages = 0; long nr_buddy_pages = 0; int cpu; if (!mem_reliable_is_enabled()) return; - for_each_possible_cpu(cpu) { + for_each_possible_cpu(cpu) nr_buddy_pages += per_cpu(nr_reliable_buddy_pages, cpu); - nr_anon_pages += per_cpu(anon_reliable_pages, cpu); - if (pagecache_enabled) - nr_pagecache_pages += - per_cpu(pagecache_reliable_pages, cpu); - } + + nr_anon_pages = percpu_counter_sum_positive(&anon_reliable_pages); + if (pagecache_enabled) + nr_pagecache_pages = percpu_counter_sum_positive(&pagecache_reliable_pages); show_val_kb(m, "ReliableTotal: ", total_reliable_mem_sz() >> PAGE_SHIFT); @@ -445,8 +450,7 @@ static struct ctl_table reliable_dir_table[] = { void page_cache_prepare_alloc(gfp_t *gfp) { - long nr_reliable = 0; - int cpu; + s64 nr_reliable = 0; if (!mem_reliable_is_enabled()) return; @@ -454,11 +458,7 @@ void page_cache_prepare_alloc(gfp_t *gfp) if (!pagecache_reliable_is_enabled()) goto no_reliable; - for_each_possible_cpu(cpu) - nr_reliable += this_cpu_read(pagecache_reliable_pages); - - if (nr_reliable < 0) - goto no_reliable; + nr_reliable = percpu_counter_read_positive(&pagecache_reliable_pages); if (nr_reliable > reliable_pagecache_max_bytes >> PAGE_SHIFT) goto no_reliable; @@ -480,9 +480,12 @@ static int __init reliable_sysctl_init(void) return -1; } + percpu_counter_init(&pagecache_reliable_pages, 0, GFP_KERNEL); + percpu_counter_init(&anon_reliable_pages, 0, GFP_KERNEL); + return 0; } -late_initcall(reliable_sysctl_init); +arch_initcall(reliable_sysctl_init); #else static void mem_reliable_ctrl_bit_disabled(int idx) {} #endif @@ -515,21 +518,18 @@ static void mem_reliable_feature_disable(int idx) void reliable_show_mem_info(void) { - int cpu; - long num = 0; + s64 num = 0; if (!mem_reliable_is_enabled()) return; - for_each_possible_cpu(cpu) { - num += per_cpu(anon_reliable_pages, cpu); - num += per_cpu(pagecache_reliable_pages, cpu); - } + num += percpu_counter_sum_positive(&anon_reliable_pages); + num += percpu_counter_sum_positive(&pagecache_reliable_pages); pr_info("ReliableTotal: %lu kB", total_reliable_mem_sz() >> 10); pr_info("ReliableUsed: %lu kB", used_reliable_mem_sz() >> 10); pr_info("task_reliable_limit: %lu kB", task_reliable_limit >> 10); - pr_info("reliable_user_used: %ld kB", num << (PAGE_SHIFT - 10)); + pr_info("reliable_user_used: %lld kB", num << (PAGE_SHIFT - 10)); } void mem_reliable_out_of_memory(gfp_t gfp_mask, unsigned int order, diff --git a/mm/page_alloc.c b/mm/page_alloc.c index fd4354d9ebad..dab62d1d3a6e 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -4674,6 +4674,11 @@ static inline bool prepare_before_alloc(gfp_t *gfp_mask, unsigned int order) * allocation trigger task_reliable_limit */ if (is_global_init(current)) { + if (!mem_reliable_counter_initialized()) { + *gfp_mask |= ___GFP_RELIABILITY; + return true; + } + if (reliable_mem_limit_check(1 << order) && mem_reliable_watermark_ok(1 << order)) *gfp_mask |= ___GFP_RELIABILITY; -- 2.22.0

1 1

openEuler kernel 双周例会&技术分享
by openEuler conference 14 Mar '22

14 Mar '22

您好！ Kernel SIG 邀请您参加 2022-03-18 14:00 召开的ZOOM会议(自动录制) 会议主题：openEuler kernel 双周例会&技术分享会议内容： openEuler kernel 技术分享：内核中断子系统介绍会议链接：https://us06web.zoom.us/j/82640076508?pwd=MktwWWxWR3ZqNFF4SlgwdGhwNlNDZz09 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the ZOOM conference(auto recording) will be held at 2022-03-18 14:00, The subject of the conference is openEuler kernel 双周例会&技术分享, Summary: openEuler kernel 技术分享：内核中断子系统介绍 You can join the meeting at https://us06web.zoom.us/j/82640076508?pwd=MktwWWxWR3ZqNFF4SlgwdGhwNlNDZz09. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS] nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION
by Laibin Qiu 14 Mar '22

14 Mar '22

From: Jordy Zomer <jordy(a)pwning.systems> mainline inclusion from mainline-v5.17-rc1 commit 4fbcc1a4cb20fe26ad0225679c536c80f1648221 category: bugfix bugzilla: 186393 CVE: CVE-2022-26490 ------------------------------------------------- It appears that there are some buffer overflows in EVT_TRANSACTION. This happens because the length parameters that are passed to memcpy come directly from skb->data and are not guarded in any way. Signed-off-by: Jordy Zomer <jordy(a)pwning.systems> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)canonical.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Huang Guobin <huangguobin4(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- drivers/nfc/st21nfca/se.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/nfc/st21nfca/se.c b/drivers/nfc/st21nfca/se.c index fd967a38a94a..ced3c20d6453 100644 --- a/drivers/nfc/st21nfca/se.c +++ b/drivers/nfc/st21nfca/se.c @@ -332,6 +332,11 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host, return -ENOMEM; transaction->aid_len = skb->data[1]; + + /* Checking if the length of the AID is valid */ + if (transaction->aid_len > sizeof(transaction->aid)) + return -EINVAL; + memcpy(transaction->aid, &skb->data[2], transaction->aid_len); @@ -341,6 +346,11 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host, return -EPROTO; transaction->params_len = skb->data[transaction->aid_len + 3]; + + /* Total size is allocated (skb->len - 2) minus fixed array members */ + if (transaction->params_len > ((skb->len - 2) - sizeof(struct nfc_evt_transaction))) + return -EINVAL; + memcpy(transaction->params, skb->data + transaction->aid_len + 4, transaction->params_len); -- 2.22.0

1 0

[PATCH openEuler-1.0-LTS 00/55] linux stable inclusion
by Laibin Qiu 14 Mar '22

14 Mar '22

form Linux 4.19.222 to Linux 4.19.227. some patch with conflicts haven't inclusion yet: 8a8908cb82568 fuse: fix live lock in fuse_iget() 1e1bb4933f1fa fuse: fix bad inode bd6e97e2b6f59 veth: Do not record rx queue hint in veth_xmit 1c3564fca0e7b xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate f9dfa44be0fb5 f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr() 9c6159ee8fc9d net: accept UFOv6 packages in virtio_net_hdr_to_skb 57f93eaff49df block, bfq: fix use after free in bfq_bfqq_expire 99ada24490c34 block, bfq: fix queue removal from weights tree 7d0efcc69c75a block, bfq: fix decrement of num_active_groups e867d620470af block, bfq: fix asymmetric scenarios detection e4cd53c650bef block, bfq: improve asymmetric scenarios detection they will be sent with fixed conflicts by the analyser. Andrew Cooper (1): x86/pkey: Fix undefined behaviour with PKRU_WD_BIT Andrey Ryabinin (1): cputime, cpuacct: Include guest time in user time in cpuacct.stat Antoine Tenart (1): net-sysfs: update the queue counts in the unregistration path Antony Antony (2): xfrm: interface with if_id 0 should return error xfrm: state and policy should fail if XFRMA_IF_ID 0 Arnd Bergmann (1): dmaengine: pxa/mmp: stop referencing config->slave_id Bart Van Assche (1): scsi: ufs: Fix race conditions related to driver data Chen Jun (1): tpm: add request_locality before write TPM_INT_ENABLE Chengfeng Ye (1): crypto: qce - fix uaf on qce_ahash_register_one Christoph Hellwig (1): scsi: sr: Don't use GFP_DMA Coco Li (1): udp: using datalen to cap ipv6 udp max gso segments David Ahern (4): ipv6: Check attribute length for RTA_GATEWAY in multipath route ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route ipv6: Continue processing multipath route even if gateway attribute is invalid ipv6: Do cleanup if attribute validation fails in multipath route Doyle, Patrick (1): mtd: nand: bbt: Fix corner case in bad block table handling Eric Dumazet (3): xfrm: fix a small bug in xfrm_sa_len() af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress netns: add schedule point in ops_exit_list() Fernando Fernandez Mancera (1): bonding: fix ad_actor_system option setting to default Florian Westphal (1): netfilter: bridge: add support for pppoe filtering Gang Li (1): shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode Hector Martin (1): iommu/io-pgtable-arm: Fix table descriptor paddr formatting Jan Kara (4): ext4: avoid trim error on fs with small groups ext4: make sure to reset inode lockdep class when quota enabling fails ext4: make sure quota gets properly shutdown on error select: Fix indefinitely sleeping task in poll_schedule_timeout() Joe Thornber (2): dm btree: add a defensive bounds check to insert_at() dm space map common: add bounds check to sm_ll_lookup_bitmap() Kyeong Yoo (1): jffs2: GC deadlock reading a page that is used in jffs2_write_begin() Li Hua (1): sched/rt: Try to restart rt period timer when rt runtime exceeded Lino Sanfilippo (1): serial: amba-pl011: do not request memory region twice Lixiaokeng (1): scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown() Lizhi Hou (1): tty: serial: uartlite: allow 64 bit address Lukas Wunner (1): serial: Fix incorrect rs485 polarity on uart open Luís Henriques (1): ext4: set csum seed in tmp inode while migrating to extents Marek Vasut (1): crypto: stm32/crc32 - Fix kernel BUG triggered in probe() Muchun Song (1): net: fix use-after-free in tw_timer_handler Naveen N. Rao (2): tracing: Fix check for trace_percpu_buffer validity in get_trace_buf() tracing: Tag trace_percpu_buffer as a percpu pointer Nicolas Toromanoff (1): crypto: stm32/cryp - fix double pm exit Paolo Abeni (1): bpf: Do not WARN in bpf_warn_invalid_xdp_action() Pavel Skripkin (1): net: mcs7830: handle usb read errors properly Rafael J. Wysocki (2): ACPICA: Utilities: Avoid deleting the same object twice in a row ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() Suresh Kumar (1): net: bonding: debug: avoid printing debug logs when bond is not notifying peers Thadeu Lima de Souza Cascardo (2): ipmi: bail out if init_srcu_struct fails ipmi: fix initialization when workqueue allocation fails Theodore Ts'o (1): ext4: don't use the orphan list when migrating an inode Thomas Gleixner (1): can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet Tom Rix (1): selinux: initialize proto variable in selinux_ip_postroute_compat() Willem de Bruijn (1): net: skip virtio_net_hdr_set_proto if protocol already set William Zhao (1): ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate Wu Bo (1): ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module Xin Xiong (1): netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check() Documentation/networking/bonding.txt | 11 +- arch/x86/include/asm/pgtable.h | 4 +- drivers/acpi/acpica/exoparg1.c | 3 +- drivers/acpi/acpica/utdelete.c | 1 + drivers/char/ipmi/ipmi_msghandler.c | 21 ++- drivers/char/tpm/tpm_tis_core.c | 8 + drivers/crypto/qce/sha.c | 2 +- drivers/crypto/stm32/stm32-cryp.c | 2 - drivers/crypto/stm32/stm32_crc32.c | 4 +- drivers/dma/mmp_pdma.c | 6 - drivers/dma/pxa_dma.c | 7 - drivers/iommu/io-pgtable-arm.c | 9 +- drivers/md/persistent-data/dm-btree.c | 8 +- .../md/persistent-data/dm-space-map-common.c | 5 + drivers/mtd/nand/bbt.c | 2 +- drivers/net/bonding/bond_main.c | 6 +- drivers/net/bonding/bond_options.c | 2 +- drivers/net/usb/mcs7830.c | 12 +- drivers/scsi/libiscsi.c | 6 +- drivers/scsi/sr.c | 2 +- drivers/scsi/sr_vendor.c | 4 +- drivers/scsi/ufs/tc-dwc-g210-pci.c | 1 - drivers/scsi/ufs/ufshcd-pltfrm.c | 2 - drivers/scsi/ufs/ufshcd.c | 7 + drivers/tty/serial/amba-pl011.c | 27 +-- drivers/tty/serial/serial_core.c | 4 +- drivers/tty/serial/uartlite.c | 2 +- fs/ext4/ioctl.c | 2 - fs/ext4/mballoc.c | 8 + fs/ext4/migrate.c | 23 ++- fs/ext4/super.c | 23 ++- fs/jffs2/file.c | 40 +++-- fs/select.c | 63 +++---- include/linux/virtio_net.h | 3 + kernel/sched/cputime.c | 4 +- kernel/sched/rt.c | 23 ++- kernel/trace/trace.c | 6 +- mm/shmem.c | 37 +++-- net/bridge/br_netfilter_hooks.c | 7 +- net/can/bcm.c | 156 ++++++------------ net/core/filter.c | 6 +- net/core/net-sysfs.c | 3 + net/core/net_namespace.c | 4 +- net/ipv4/af_inet.c | 10 +- net/ipv4/netfilter/ipt_CLUSTERIP.c | 5 +- net/ipv6/ip6_vti.c | 2 + net/ipv6/route.c | 28 +++- net/ipv6/udp.c | 2 +- net/unix/garbage.c | 14 +- net/unix/scm.c | 6 +- net/xfrm/xfrm_interface.c | 14 +- net/xfrm/xfrm_user.c | 23 ++- security/selinux/hooks.c | 2 +- 53 files changed, 375 insertions(+), 307 deletions(-) -- 2.22.0

1 55

subscribe
by chinayanlei2002 12 Mar '22

12 Mar '22

1 0

[PATCH openEuler-5.10 1/3] net/hinic: Fix null pointer dereference in hinic_physical_port_id
by Zheng Zengkai 11 Mar '22

11 Mar '22

From: Chiqijun <chiqijun(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I4XF98 CVE: NA ----------------------------------------------------------------------- The hinic driver currently generates a NULL pointer dereference when performing the hinicadm tool command during device probe. This is because the hinicadm process accesses the NULL hwif pointer in the hwdev which have not been allocated in probe. Fix this by checking the initialization state of device before accessing it. Signed-off-by: Chiqijun <chiqijun(a)huawei.com> Reviewed-by: Wangxiaoyun <cloud.wangxiaoyun(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/net/ethernet/huawei/hinic/hinic_lld.c | 30 ++++++++++++++----- 1 file changed, 22 insertions(+), 8 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic/hinic_lld.c b/drivers/net/ethernet/huawei/hinic/hinic_lld.c index bea0c7ef51e8..9d39da0c76d4 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_lld.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_lld.c @@ -801,8 +801,7 @@ static bool __is_pcidev_match_chip_name(const char *ifname, if (dev->init_state < HINIC_INIT_STATE_HW_PART_INITED) return false; } else { - if (dev->init_state >= - HINIC_INIT_STATE_HW_PART_INITED && + if (dev->init_state < HINIC_INIT_STATE_HW_PART_INITED || hinic_func_type(dev->hwdev) != type) return false; } @@ -1153,6 +1152,10 @@ void *hinic_get_ppf_hwdev_by_pdev(struct pci_dev *pdev) chip_node = pci_adapter->chip_node; lld_dev_hold(); list_for_each_entry(dev, &chip_node->func_list, node) { + if (test_bit(HINIC_FUNC_IN_REMOVE, &dev->flag) || + dev->init_state < HINIC_INIT_STATE_HW_IF_INITED) + continue; + if (dev->hwdev && hinic_func_type(dev->hwdev) == TYPE_PPF) { lld_dev_put(); return dev->hwdev; @@ -1365,6 +1368,10 @@ int hinic_get_pf_id(void *hwdev, u32 port_id, u32 *pf_id, u32 *isvalid) lld_dev_hold(); list_for_each_entry(dev, &chip_node->func_list, node) { + if (test_bit(HINIC_FUNC_IN_REMOVE, &dev->flag) || + dev->init_state < HINIC_INIT_STATE_HWDEV_INITED) + continue; + if (hinic_physical_port_id(dev->hwdev) == port_id) { *pf_id = hinic_global_func_id(dev->hwdev); *isvalid = 1; @@ -1852,7 +1859,8 @@ static void send_event_to_all_pf(struct hinic_pcidev *dev, lld_dev_hold(); list_for_each_entry(des_dev, &dev->chip_node->func_list, node) { - if (test_bit(HINIC_FUNC_IN_REMOVE, &des_dev->flag)) + if (test_bit(HINIC_FUNC_IN_REMOVE, &des_dev->flag) || + des_dev->init_state < HINIC_INIT_STATE_HW_IF_INITED) continue; if (hinic_func_type(des_dev->hwdev) == TYPE_VF) @@ -1870,7 +1878,8 @@ static void send_event_to_dst_pf(struct hinic_pcidev *dev, u16 func_id, lld_dev_hold(); list_for_each_entry(des_dev, &dev->chip_node->func_list, node) { - if (test_bit(HINIC_FUNC_IN_REMOVE, &des_dev->flag)) + if (test_bit(HINIC_FUNC_IN_REMOVE, &des_dev->flag) || + des_dev->init_state < HINIC_INIT_STATE_HW_IF_INITED) continue; if (hinic_func_type(des_dev->hwdev) == TYPE_VF) @@ -2637,8 +2646,11 @@ static void slave_host_init_delay_work(struct work_struct *work) /* Make sure the PPF must be the first one */ lld_dev_hold(); list_for_each_entry(ppf_pcidev, &chip_node->func_list, node) { - if (ppf_pcidev && - hinic_func_type(ppf_pcidev->hwdev) == TYPE_PPF) { + if (test_bit(HINIC_FUNC_IN_REMOVE, &ppf_pcidev->flag) || + ppf_pcidev->init_state < HINIC_INIT_STATE_HW_IF_INITED) + continue; + + if (hinic_func_type(ppf_pcidev->hwdev) == TYPE_PPF) { found = 1; break; } @@ -2872,7 +2884,8 @@ int hinic_register_micro_log(struct hinic_micro_log_info *micro_log_info) lld_dev_hold(); list_for_each_entry(chip_node, &g_hinic_chip_list, node) { list_for_each_entry(dev, &chip_node->func_list, node) { - if (test_bit(HINIC_FUNC_IN_REMOVE, &dev->flag)) + if (test_bit(HINIC_FUNC_IN_REMOVE, &dev->flag) || + dev->init_state < HINIC_INIT_STATE_HW_IF_INITED) continue; if (hinic_func_type(dev->hwdev) == TYPE_PPF) { @@ -2902,7 +2915,8 @@ void hinic_unregister_micro_log(struct hinic_micro_log_info *micro_log_info) lld_dev_hold(); list_for_each_entry(chip_node, &g_hinic_chip_list, node) { list_for_each_entry(dev, &chip_node->func_list, node) { - if (test_bit(HINIC_FUNC_IN_REMOVE, &dev->flag)) + if (test_bit(HINIC_FUNC_IN_REMOVE, &dev->flag) || + dev->init_state < HINIC_INIT_STATE_HW_IF_INITED) continue; if (hinic_func_type(dev->hwdev) == TYPE_PPF) -- 2.20.1

1 2

[PATCH openEuler-1.0-LTS 1/3] net: hns3: fix pf vlan filter out of work after self test
by Laibin Qiu 11 Mar '22

11 Mar '22

From: Yonglong Liu <liuyonglong(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4W90Z CVE: NA ---------------------------- After a self test, the vlan filter of PF is wrongly closed, cause the vlan filter out of work. The second parameter of enable_vlan_filter() must pass true, and in enable_vlan_filter(), it will decide whether to open or keep the status of vlan filter. Fixes: 79549957e66f ("Revert: net: hns3: adds support for extended VLAN mode and 'QOS' in vlan 802.1Q protocol.") Signed-off-by: Yonglong Liu <liuyonglong(a)huawei.com> Reviewed-by: li yongxin <liyongxin1(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c index ef870da7a8a4..be771c75e37e 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c @@ -395,8 +395,7 @@ static void hns3_self_test(struct net_device *ndev, #if IS_ENABLED(CONFIG_VLAN_8021Q) if (dis_vlan_filter) - h->ae_algo->ops->enable_vlan_filter(h, - ndev->flags & IFF_PROMISC); + h->ae_algo->ops->enable_vlan_filter(h, true); #endif if (if_running) -- 2.22.0

1 2

[PATCH openEuler-1.0-LTS] arm64: acpi: fix UBSAN warning
by Laibin Qiu 11 Mar '22

11 Mar '22

From: Nick Desaulniers <ndesaulniers(a)google.com> mainline inclusion from mainline-v5.8-rc1 commit a194c33f45f83068ef13bf1d16e26d4ca3ecc098 category: bugfix bugzilla: 89150 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Will reported a UBSAN warning: UBSAN: null-ptr-deref in arch/arm64/kernel/smp.c:596:6 member access within null pointer of type 'struct acpi_madt_generic_interrupt' CPU: 0 PID: 0 Comm: swapper Not tainted 5.7.0-rc6-00124-g96bc42ff0a82 #1 Call trace: dump_backtrace+0x0/0x384 show_stack+0x28/0x38 dump_stack+0xec/0x174 handle_null_ptr_deref+0x134/0x174 __ubsan_handle_type_mismatch_v1+0x84/0xa4 acpi_parse_gic_cpu_interface+0x60/0xe8 acpi_parse_entries_array+0x288/0x498 acpi_table_parse_entries_array+0x178/0x1b4 acpi_table_parse_madt+0xa4/0x110 acpi_parse_and_init_cpus+0x38/0x100 smp_init_cpus+0x74/0x258 setup_arch+0x350/0x3ec start_kernel+0x98/0x6f4 This is from the use of the ACPI_OFFSET in arch/arm64/include/asm/acpi.h. Replace its use with offsetof from include/linux/stddef.h which should implement the same logic using __builtin_offsetof, so that UBSAN wont warn. Reported-by: Will Deacon <will(a)kernel.org> Suggested-by: Ard Biesheuvel <ardb(a)kernel.org> Signed-off-by: Nick Desaulniers <ndesaulniers(a)google.com> Reviewed-by: Jeremy Linton <jeremy.linton(a)arm.com> Acked-by: Lorenzo Pieralisi <lorenzo.pieralisi(a)arm.com> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/lkml/20200521100952.GA5360@willie-the-truck/ Link: https://lore.kernel.org/r/20200608203818.189423-1-ndesaulniers@google.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: linyujun <linyujun809(a)huawei.com> Reviewed-by: chenlifu <chenlifu(a)huawei.com> Reviewed-by: He Ying <heying24(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- arch/arm64/include/asm/acpi.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/arch/arm64/include/asm/acpi.h b/arch/arm64/include/asm/acpi.h index f364115ac2ef..348f12447ecd 100644 --- a/arch/arm64/include/asm/acpi.h +++ b/arch/arm64/include/asm/acpi.h @@ -15,6 +15,7 @@ #include <linux/efi.h> #include <linux/memblock.h> #include <linux/psci.h> +#include <linux/stddef.h> #include <asm/cputype.h> #include <asm/io.h> @@ -33,14 +34,14 @@ * is therefore used to delimit the MADT GICC structure minimum length * appropriately. */ -#define ACPI_MADT_GICC_MIN_LENGTH ACPI_OFFSET( \ +#define ACPI_MADT_GICC_MIN_LENGTH offsetof( \ struct acpi_madt_generic_interrupt, efficiency_class) #define BAD_MADT_GICC_ENTRY(entry, end) \ (!(entry) || (entry)->header.length < ACPI_MADT_GICC_MIN_LENGTH || \ (unsigned long)(entry) + (entry)->header.length > (end)) -#define ACPI_MADT_GICC_SPE (ACPI_OFFSET(struct acpi_madt_generic_interrupt, \ +#define ACPI_MADT_GICC_SPE (offsetof(struct acpi_madt_generic_interrupt, \ spe_interrupt) + sizeof(u16)) /* Basic configuration for ACPI */ -- 2.22.0

1 0