- Kernel - mailweb.openeuler.org

[PATCH 000/145] backport stable-4.19.153
by Yang Yingliang 30 Oct '20

30 Oct '20

Alex Dewar (1): VMCI: check return value of get_user_pages_fast() for errors Arnd Bergmann (1): mtd: lpddr: fix excessive stack usage with clang Artem Savkov (1): pty: do tty_flip_buffer_push without port->lock in pty_write Arvind Sankar (1): x86/fpu: Allow multiple bits in clearcpuid= parameter Bryan O'Donoghue (1): wcn36xx: Fix reported 802.11n rx_highest rate wcn3660/wcn3680 Christophe JAILLET (5): crypto: ixp4xx - Fix the size used in a 'dma_free_coherent()' call ath10k: Fix the size used in a 'dma_free_coherent()' call in an error handling path mwifiex: Do not use GFP_KERNEL in atomic context staging: rtl8192u: Do not use GFP_KERNEL in atomic context scsi: qla4xxx: Fix an error handling path in 'qla4xxx_get_host_stats()' Colin Ian King (3): x86/events/amd/iommu: Fix sizeof mismatch video: fbdev: vga16fb: fix setting of pixclock because a pass-by-value error qtnfmac: fix resource leaks on unsupported iftype error return path Cong Wang (1): tipc: fix the skb_unshare() in tipc_buf_append() Dan Carpenter (8): ALSA: bebob: potential info leak in hwdep_read() cifs: remove bogus debug code ath6kl: prevent potential array overflow in ath6kl_add_new_sta() ath9k: Fix potential out of bounds in ath9k_htc_txcompletion_cb() HID: roccat: add bounds checking in kone_sysfs_write_settings() ath6kl: wmi: prevent a shift wrapping bug in ath6kl_wmi_delete_pstream_cmd() mfd: sm501: Fix leaks in probe() scsi: be2iscsi: Fix a theoretical leak in beiscsi_create_eqs() Darrick J. Wong (2): xfs: limit entries returned when counting fsmap records xfs: fix high key handling in the rt allocator's query_range function David Ahern (1): ipv4: Restore flowi4_oif update before call to xfrm_lookup_route David Wilder (2): ibmveth: Switch order of ibmveth_helper calls. ibmveth: Identify ingress large send packets. Davide Caratti (1): net/sched: act_tunnel_key: fix OOB write in case of IPv6 ERSPAN tunnels Defang Bo (1): nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME attribute in nfc_genl_fw_download() Dinghao Liu (4): EDAC/i5100: Fix error handling order in i5100_init_one() media: omap3isp: Fix memleak in isp_probe media: mx2_emmaprp: Fix memleak in emmaprp_probe video: fbdev: radeon: Fix memleak in radeonfb_pci_register Dmitry Torokhov (1): HID: hid-input: fix stylus battery reporting Emmanuel Grumbach (1): iwlwifi: mvm: split a print to avoid a WARNING in ROC Eran Ben Elisha (1): net/mlx5: Don't call timecounter cyc2time directly from 1PPS flow Eric Dumazet (2): icmp: randomize the global rate limiter quota: clear padding in v2r1_mem2diskdqb() Finn Thain (3): powerpc/tau: Use appropriate temperature sample interval powerpc/tau: Convert from timer to workqueue powerpc/tau: Remove duplicated set_thresholds() call Greg Kroah-Hartman (1): Linux 4.19.153 Guenter Roeck (1): hwmon: (pmbus/max34440) Fix status register reads for MAX344{51,60,61} Guillaume Tucker (1): ARM: 9007/1: l2c: fix prefetch bits init in L2X0_AUX_CTRL using DT values Hans de Goede (2): pwm: lpss: Fix off by one error in base_unit math in pwm_lpss_prepare() pwm: lpss: Add range limit check for the base_unit register value Heiner Kallweit (2): r8169: fix data corruption issue on RTL8402 r8169: fix operation under forced interrupt threading Herbert Xu (2): crypto: algif_aead - Do not set MAY_BACKLOG on the async path crypto: algif_skcipher - EBUSY on aio should be an error Håkon Bugge (2): IB/mlx4: Fix starvation in paravirt mux/demux IB/mlx4: Adjust delayed work when a dup is observed Jason Gunthorpe (2): RDMA/ucma: Fix locking for ctx->events_reported RDMA/ucma: Add missing locking around rdma_leave_multicast() Jian-Hong Pan (1): ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887 Johannes Berg (1): nl80211: fix non-split wiphy information John Donnelly (1): scsi: target: tcmu: Fix warning: 'page' may be used uninitialized Jonathan Lemon (1): mlx4: handle non-napi callers to napi_poll Julian Anastasov (1): ipvs: clear skb->tstamp in forwarding path Karsten Graul (1): net/smc: fix valid DMBE buffer sizes Krzysztof Kozlowski (1): EDAC/ti: Fix handling of platform_get_irq() error Laurent Pinchart (2): media: uvcvideo: Set media controller entity functions media: uvcvideo: Silence shift-out-of-bounds warning Libing Zhou (1): x86/nmi: Fix nmi_handle() duration miscalculation Linus Walleij (4): net: dsa: rtl8366: Check validity of passed VLANs net: dsa: rtl8366: Refactor VLAN/PVID init net: dsa: rtl8366: Skip PVID setting if not requested net: dsa: rtl8366rb: Support all 4096 VLANs Lorenzo Colitti (2): usb: gadget: f_ncm: fix ncm_bitrate for SuperSpeed and above. usb: gadget: u_ether: enable qmult on SuperSpeed Plus as well Maciej Żenczykowski (1): net/ipv4: always honour route mtu during forwarding Madhuparna Bhowmik (1): crypto: picoxcell - Fix potential race condition bug Marek Vasut (2): net: fec: Fix phy_device lookup for phy_reset_after_clk_enable() net: fec: Fix PHY init after phy_reset_after_clk_enable() Mark Salter (1): drivers/perf: xgene_pmu: Fix uninitialized resource struct Mark Tomlinson (1): mtd: mtdoops: Don't write panic data twice Michal Kalderon (2): RDMA/qedr: Fix use of uninitialized field RDMA/qedr: Fix inline size returned for iWARP Michał Mirosław (1): regulator: resolve supply after creating regulator Minas Harutyunyan (1): usb: dwc2: Fix INTR OUT transfers in DDMA mode. Nathan Chancellor (1): usb: dwc2: Fix parameter type in function pointer prototype Nathan Lynch (1): powerpc/pseries: explicitly reschedule during drmem_lmb list traversal Neal Cardwell (1): tcp: fix to update snd_wl1 in bulk receiver fast path Necip Fazil Yildiran (2): pinctrl: bcm: fix kconfig dependency warning when !GPIOLIB arc: plat-hsdk: fix kconfig dependency warning when !RESET_CONTROLLER Nicholas Mc Guire (2): powerpc/pseries: Fix missing of_node_put() in rng_init() powerpc/icp-hv: Fix missing of_node_put() in success path Ong Boon Leong (1): net: stmmac: use netif_tx_start|stop_all_queues() function Pablo Neira Ayuso (1): netfilter: nf_log: missing vlan offload tag and proto Pali Rohár (1): cpufreq: armada-37xx: Add missing MODULE_DEVICE_TABLE Qiushi Wu (7): media: rcar-vin: Fix a reference count leak. media: rockchip/rga: Fix a reference count leak. media: platform: fcp: Fix a reference count leak. media: camss: Fix a reference count leak. media: s5p-mfc: Fix a reference count leak media: stm32-dcmi: Fix a reference count leak media: ti-vpe: Fix a missing check and reference count leak Ralph Campbell (1): mm/memcg: fix device private memcg accounting Rohit Maheshwari (1): net/tls: sendfile fails with ktls offload Rohit kumar (2): ASoC: qcom: lpass-platform: fix memory leak ASoC: qcom: lpass-cpu: fix concurrency issue Samuel Holland (1): Bluetooth: hci_uart: Cancel init work before unregistering Sean Christopherson (1): KVM: x86/mmu: Commit zap of remaining invalid pages when recovering lpages Shyam Prasad N (1): cifs: Return the error from crypt_message when enc/dec key not found. Souptick Joarder (2): drivers/virt/fsl_hypervisor: Fix error handling path misc: mic: scif: Fix error handling path Srinivas Kandagatla (3): slimbus: core: check get_addr before removing laddr ida slimbus: core: do not enter to clock pause mode in core slimbus: qcom-ngd-ctrl: disable ngd in qmi server down callback Suravee Suthikulpanit (1): KVM: SVM: Initialize prev_ga_tag before use Suren Baghdasaryan (1): mm, oom_adj: don't loop through tasks in __set_oom_adj when not necessary Sylwester Nawrocki (1): media: Revert "media: exynos4-is: Add missed check for pinctrl_lookup_state()" Takashi Iwai (1): ALSA: seq: oss: Avoid mutex lock for a long-time ioctl Tero Kristo (1): crypto: omap-sham - fix digcnt register handling with export/import Thomas Gleixner (1): net: enic: Cure the enic api locking trainwreck Thomas Preston (2): pinctrl: mcp23s08: Fix mcp23x17_regmap initialiser pinctrl: mcp23s08: Fix mcp23x17 precious range Tianjia Zhang (3): crypto: mediatek - Fix wrong return value in mtk_desc_ring_alloc() scsi: qla2xxx: Fix wrong return value in qla_nvme_register_hba() scsi: csiostor: Fix wrong return value in csio_hw_prep_fw() Todd Kjos (1): binder: fix UAF when releasing todo list Tom Rix (8): media: tuner-simple: fix regression in simple_set_radio_freq media: m5mols: Check function pointer in m5mols_sensor_power media: tc358743: initialize variable media: tc358743: cleanup tc358743_cec_isr brcmfmac: check ndev pointer drm/gma500: fix error check video: fbdev: sis: fix null ptr dereference mwifiex: fix double free Tong Zhang (1): tty: serial: earlycon dependency Tyrel Datwyler (1): tty: hvcs: Don't NULL tty->driver_data until hvcs_cleanup() Vadim Pasternak (1): platform/x86: mlx-platform: Remove PSU EEPROM configuration Valentin Vidic (1): net: korina: fix kfree of rx/tx descriptor array Venkateswara Naralasetty (1): ath10k: provide survey info as accumulated data Vinay Kumar Yadav (3): chelsio/chtls: fix socket lock chelsio/chtls: correct netdevice for vlan interface chelsio/chtls: correct function return and return type Wilken Gottwalt (1): net: usb: qmi_wwan: add Cellient MPL200 card Xiaoliang Pang (1): cypto: mediatek - fix leaks in mtk_desc_ring_alloc Xie He (2): net: hdlc: In hdlc_rcv, check to make sure dev is an HDLC device net: hdlc_raw_eth: Clear the IFF_TX_SKB_SHARING flag after calling ether_setup Yonghong Song (1): net: fix pos incrementment in ipv6_route_seq_next dinghao.liu(a)zju.edu.cn (1): backlight: sky81452-backlight: Fix refcount imbalance on error Łukasz Stelmach (2): spi: spi-s3c64xx: swap s3c64xx_spi_set_cs() and s3c64xx_enable_datapath() spi: spi-s3c64xx: Check return values .../admin-guide/kernel-parameters.txt | 2 +- Documentation/networking/ip-sysctl.txt | 4 +- Makefile | 2 +- arch/arc/plat-hsdk/Kconfig | 1 + arch/arm/mm/cache-l2x0.c | 16 +- arch/powerpc/include/asm/drmem.h | 18 +- arch/powerpc/include/asm/reg.h | 2 +- arch/powerpc/kernel/tau_6xx.c | 55 ++-- arch/powerpc/platforms/pseries/rng.c | 1 + arch/powerpc/sysdev/xics/icp-hv.c | 1 + arch/x86/events/amd/iommu.c | 2 +- arch/x86/kernel/fpu/init.c | 30 +- arch/x86/kernel/nmi.c | 5 +- arch/x86/kvm/mmu.c | 1 + arch/x86/kvm/svm.c | 1 + crypto/algif_aead.c | 7 +- crypto/algif_skcipher.c | 2 +- drivers/android/binder.c | 35 +-- drivers/bluetooth/hci_ldisc.c | 1 + drivers/bluetooth/hci_serdev.c | 2 + drivers/cpufreq/armada-37xx-cpufreq.c | 6 + drivers/crypto/chelsio/chtls/chtls_cm.c | 3 + drivers/crypto/chelsio/chtls/chtls_io.c | 5 +- drivers/crypto/ixp4xx_crypto.c | 2 +- drivers/crypto/mediatek/mtk-platform.c | 8 +- drivers/crypto/omap-sham.c | 3 + drivers/crypto/picoxcell_crypto.c | 9 +- drivers/edac/i5100_edac.c | 11 +- drivers/edac/ti_edac.c | 3 +- drivers/gpu/drm/gma500/cdv_intel_dp.c | 2 +- drivers/hid/hid-input.c | 4 +- drivers/hid/hid-roccat-kone.c | 23 +- drivers/hwmon/pmbus/max34440.c | 3 - drivers/infiniband/core/ucma.c | 6 +- drivers/infiniband/hw/mlx4/cm.c | 3 + drivers/infiniband/hw/mlx4/mad.c | 34 ++- drivers/infiniband/hw/mlx4/mlx4_ib.h | 2 + drivers/infiniband/hw/qedr/main.c | 2 +- drivers/infiniband/hw/qedr/verbs.c | 2 +- drivers/media/i2c/m5mols/m5mols_core.c | 3 +- drivers/media/i2c/tc358743.c | 14 +- drivers/media/platform/exynos4-is/media-dev.c | 4 +- drivers/media/platform/mx2_emmaprp.c | 7 +- drivers/media/platform/omap3isp/isp.c | 6 +- .../media/platform/qcom/camss/camss-csiphy.c | 4 +- drivers/media/platform/rcar-fcp.c | 4 +- drivers/media/platform/rcar-vin/rcar-dma.c | 4 +- drivers/media/platform/rockchip/rga/rga-buf.c | 1 + drivers/media/platform/s5p-mfc/s5p_mfc_pm.c | 4 +- drivers/media/platform/stm32/stm32-dcmi.c | 4 +- drivers/media/platform/ti-vpe/vpe.c | 2 + drivers/media/tuners/tuner-simple.c | 5 +- drivers/media/usb/uvc/uvc_ctrl.c | 6 +- drivers/media/usb/uvc/uvc_entity.c | 35 +++ drivers/mfd/sm501.c | 8 +- drivers/misc/mic/scif/scif_rma.c | 4 +- drivers/misc/vmw_vmci/vmci_queue_pair.c | 10 +- drivers/mtd/lpddr/lpddr2_nvm.c | 35 ++- drivers/mtd/mtdoops.c | 11 +- drivers/net/dsa/realtek-smi.h | 4 +- drivers/net/dsa/rtl8366.c | 280 ++++++++++-------- drivers/net/dsa/rtl8366rb.c | 2 +- drivers/net/ethernet/cisco/enic/enic.h | 1 + drivers/net/ethernet/cisco/enic/enic_api.c | 6 + drivers/net/ethernet/cisco/enic/enic_main.c | 27 +- drivers/net/ethernet/freescale/fec_main.c | 35 ++- drivers/net/ethernet/ibm/ibmveth.c | 19 +- drivers/net/ethernet/korina.c | 3 +- drivers/net/ethernet/mellanox/mlx4/en_rx.c | 3 + drivers/net/ethernet/mellanox/mlx4/en_tx.c | 2 +- .../ethernet/mellanox/mlx5/core/lib/clock.c | 5 +- drivers/net/ethernet/realtek/r8169.c | 54 ++-- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 33 +-- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/wan/hdlc.c | 10 +- drivers/net/wan/hdlc_raw_eth.c | 1 + drivers/net/wireless/ath/ath10k/ce.c | 2 +- drivers/net/wireless/ath/ath10k/mac.c | 2 +- drivers/net/wireless/ath/ath6kl/main.c | 3 + drivers/net/wireless/ath/ath6kl/wmi.c | 5 + drivers/net/wireless/ath/ath9k/htc_hst.c | 2 + drivers/net/wireless/ath/wcn36xx/main.c | 2 +- .../broadcom/brcm80211/brcmfmac/core.c | 2 +- .../net/wireless/intel/iwlwifi/mvm/mac80211.c | 9 +- drivers/net/wireless/marvell/mwifiex/scan.c | 2 +- drivers/net/wireless/marvell/mwifiex/sdio.c | 2 + .../net/wireless/quantenna/qtnfmac/commands.c | 2 + drivers/perf/xgene_pmu.c | 32 +- drivers/pinctrl/bcm/Kconfig | 1 + drivers/pinctrl/pinctrl-mcp23s08.c | 24 +- drivers/platform/x86/mlx-platform.c | 15 +- drivers/pwm/pwm-lpss.c | 7 +- drivers/regulator/core.c | 21 +- drivers/scsi/be2iscsi/be_main.c | 4 +- drivers/scsi/csiostor/csio_hw.c | 2 +- drivers/scsi/qla2xxx/qla_nvme.c | 2 +- drivers/scsi/qla4xxx/ql4_os.c | 2 +- drivers/slimbus/core.c | 6 +- drivers/slimbus/qcom-ngd-ctrl.c | 4 + drivers/spi/spi-s3c64xx.c | 52 +++- .../staging/rtl8192u/ieee80211/ieee80211_rx.c | 2 +- drivers/target/target_core_user.c | 2 +- drivers/tty/hvc/hvcs.c | 14 +- drivers/tty/pty.c | 2 +- drivers/tty/serial/Kconfig | 1 + drivers/usb/dwc2/gadget.c | 40 ++- drivers/usb/dwc2/params.c | 2 +- drivers/usb/gadget/function/f_ncm.c | 6 +- drivers/usb/gadget/function/u_ether.c | 2 +- drivers/video/backlight/sky81452-backlight.c | 1 + drivers/video/fbdev/aty/radeon_base.c | 2 +- drivers/video/fbdev/sis/init.c | 11 +- drivers/video/fbdev/vga16fb.c | 14 +- drivers/virt/fsl_hypervisor.c | 17 +- fs/cifs/asn1.c | 16 +- fs/cifs/smb2ops.c | 2 +- fs/proc/base.c | 3 +- fs/quota/quota_v2.c | 1 + fs/xfs/libxfs/xfs_rtbitmap.c | 11 +- fs/xfs/xfs_fsmap.c | 3 + include/linux/oom.h | 1 + include/linux/sched/coredump.h | 1 + include/net/ip.h | 6 + include/net/netfilter/nf_log.h | 1 + kernel/fork.c | 21 ++ mm/memcontrol.c | 5 +- mm/oom_kill.c | 2 + net/ipv4/icmp.c | 7 +- net/ipv4/netfilter/nf_log_arp.c | 19 +- net/ipv4/netfilter/nf_log_ipv4.c | 6 +- net/ipv4/route.c | 4 +- net/ipv4/tcp_input.c | 2 + net/ipv6/ip6_fib.c | 4 +- net/ipv6/netfilter/nf_log_ipv6.c | 8 +- net/netfilter/ipvs/ip_vs_xmit.c | 6 + net/netfilter/nf_log_common.c | 12 + net/nfc/netlink.c | 2 +- net/sched/act_tunnel_key.c | 2 +- net/smc/smc_core.c | 2 +- net/tipc/msg.c | 3 +- net/tls/tls_device.c | 11 +- net/wireless/nl80211.c | 5 +- sound/core/seq/oss/seq_oss.c | 7 +- sound/firewire/bebob/bebob_hwdep.c | 3 +- sound/pci/hda/patch_realtek.c | 42 +++ sound/soc/qcom/lpass-cpu.c | 16 - sound/soc/qcom/lpass-platform.c | 3 +- 147 files changed, 968 insertions(+), 566 deletions(-) -- 2.25.1

1 145

openEuler 21.03 5.10 kernel defconfig review
by Xie XiuQi 30 Oct '20

30 Oct '20

openEuler 21.03 5.10 kernel defconfig 基于 openEuler 20.09 适配而来，请大家评审。有问题可以在下面 issue 中讨论： https://gitee.com/openeuler/kernel/issues/I22VGE

1 1

本次 kernel sig 例会无议题，本次会议取消，欢迎积极申报议题
by Xie XiuQi 29 Oct '20

29 Oct '20

本次 kernel sig 例会无议题，本次会议取消，欢迎积极申报议题

1 0

[PATCH openEuler-1.0-LTS 0/5] kvm: arm64: emulate ID registers
by Yang Yingliang 29 Oct '20

29 Oct '20

In AArch64, guest will read the same values of the ID regsiters with host. Both of them read the values from arm64_ftr_regs. This patch series add support to emulate and configure ID registers so that we can control the value of ID registers that guest read. Peng Liang (5): arm64: add a helper function to traverse arm64_ftr_regs kvm: arm64: emulate the ID registers kvm: arm64: make ID registers configurable kvm: arm64: add KVM_CAP_ARM_CPU_FEATURE extension kvm: fix compile error when including linux/kvm.h arch/arm64/include/asm/cpufeature.h | 2 + arch/arm64/include/asm/kvm_host.h | 2 + arch/arm64/kernel/cpufeature.c | 13 ++++++ arch/arm64/kvm/sys_regs.c | 71 ++++++++++++++++++++++------- include/uapi/linux/kvm.h | 13 ++++++ virt/kvm/arm/arm.c | 23 ++++++++++ 6 files changed, 107 insertions(+), 17 deletions(-) -- 2.25.1

1 5

[PATCH 1/5] khugepaged: do not stop collapse if less than half PTEs are referenced
by Yang Yingliang 29 Oct '20

29 Oct '20

From: "Kirill A. Shutemov" <kirill.shutemov(a)linux.intel.com> mainline inclusion from mainline-v5.8-rc1 commit ffe945e633b527d5a4577b42cbadec3c7cbcf096 category: bugfix bugzilla: 36230 CVE: NA ------------------------------------------------- __collapse_huge_page_swapin() checks the number of referenced PTE to decide if the memory range is hot enough to justify swapin. We have few problems with the approach: - It is way too late: we can do the check much earlier and safe time. khugepaged_scan_pmd() already knows if we have any pages to swap in and number of referenced page. - It stops collapse altogether if there's not enough referenced pages, not only swappingin. Fix it by making the right check early. We also can avoid additional page table scanning if khugepaged_scan_pmd() haven't found any swap entries. Fixes: 0db501f7a34c ("mm, thp: convert from optimistic swapin collapsing to conservative") Signed-off-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Tested-by: Zi Yan <ziy(a)nvidia.com> Reviewed-by: William Kucharski <william.kucharski(a)oracle.com> Reviewed-by: Zi Yan <ziy(a)nvidia.com> Acked-by: Yang Shi <yang.shi(a)linux.alibaba.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: John Hubbard <jhubbard(a)nvidia.com> Cc: Mike Kravetz <mike.kravetz(a)oracle.com> Cc: Ralph Campbell <rcampbell(a)nvidia.com> Link: http://lkml.kernel.org/r/20200416160026.16538-3-kirill.shutemov@linux.intel… Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- mm/khugepaged.c | 27 +++++++++++---------------- 1 file changed, 11 insertions(+), 16 deletions(-) diff --git a/mm/khugepaged.c b/mm/khugepaged.c index 5883fd75d6fc..0ad9f2b2b33e 100644 --- a/mm/khugepaged.c +++ b/mm/khugepaged.c @@ -905,11 +905,6 @@ static bool __collapse_huge_page_swapin(struct mm_struct *mm, .pgoff = linear_page_index(vma, address), }; - /* we only decide to swapin, if there is enough young ptes */ - if (referenced < HPAGE_PMD_NR/2) { - trace_mm_collapse_huge_page_swapin(mm, swapped_in, referenced, 0); - return false; - } vmf.pte = pte_offset_map(pmd, address); for (; vmf.address < address + HPAGE_PMD_NR*PAGE_SIZE; vmf.pte++, vmf.address += PAGE_SIZE) { @@ -949,7 +944,7 @@ static bool __collapse_huge_page_swapin(struct mm_struct *mm, static void collapse_huge_page(struct mm_struct *mm, unsigned long address, struct page **hpage, - int node, int referenced) + int node, int referenced, int unmapped) { pmd_t *pmd, _pmd; pte_t *pte; @@ -1007,7 +1002,8 @@ static void collapse_huge_page(struct mm_struct *mm, * If it fails, we release mmap_sem and jump out_nolock. * Continuing to collapse causes inconsistency. */ - if (!__collapse_huge_page_swapin(mm, vma, address, pmd, referenced)) { + if (unmapped && !__collapse_huge_page_swapin(mm, vma, address, + pmd, referenced)) { mem_cgroup_cancel_charge(new_page, memcg, true); up_read(&mm->mmap_sem); goto out_nolock; @@ -1214,22 +1210,21 @@ static int khugepaged_scan_pmd(struct mm_struct *mm, mmu_notifier_test_young(vma->vm_mm, address)) referenced++; } - if (writable) { - if (referenced) { - result = SCAN_SUCCEED; - ret = 1; - } else { - result = SCAN_LACK_REFERENCED_PAGE; - } - } else { + if (!writable) { result = SCAN_PAGE_RO; + } else if (!referenced || (unmapped && referenced < HPAGE_PMD_NR/2)) { + result = SCAN_LACK_REFERENCED_PAGE; + } else { + result = SCAN_SUCCEED; + ret = 1; } out_unmap: pte_unmap_unlock(pte, ptl); if (ret) { node = khugepaged_find_target_node(); /* collapse_huge_page will return with the mmap_sem released */ - collapse_huge_page(mm, address, hpage, node, referenced); + collapse_huge_page(mm, address, hpage, node, + referenced, unmapped); } out: trace_mm_khugepaged_scan_pmd(mm, page, writable, referenced, -- 2.25.1

1 4

[PATCH 0/4] fixes CVE-2020-27673
by Yang Yingliang 27 Oct '20

27 Oct '20

Juergen Gross (4): xen/events: add a new "late EOI" evtchn framework xen/events: switch user event channels to lateeoi model xen/events: use a common cpu hotplug hook for event channels xen/events: defer eoi in case of excessive number of events .../admin-guide/kernel-parameters.txt | 8 + drivers/xen/events/events_2l.c | 7 +- drivers/xen/events/events_base.c | 363 +++++++++++++++++- drivers/xen/events/events_fifo.c | 70 ++-- drivers/xen/events/events_internal.h | 17 +- drivers/xen/evtchn.c | 7 +- include/xen/events.h | 21 + 7 files changed, 420 insertions(+), 73 deletions(-) -- 2.25.1

1 4

openEuler 选择 5.10 作为下一个长期维护的内核版本 (公示)
by Xie XiuQi 27 Oct '20

27 Oct '20

openEuler 选择 5.10 作为下一个长期维护的内核版本 (公示) - /本文//链接 <https://gitee.com/openeuler/community/blob/master/sig/Kernel/kernel-upgrade…>/ Linux 5.10 预计是 Linux 社区今年的 LTS (long-term support) 版本。openEuler 社区经过多轮沟通，选择 5.10 作为 openEuler 内核的下一个长期维护版本（openEuler Long-term support Kernel, OLK）。openEuler 社区提供不少于4年的维护时间和不少于2年的扩展维护时间。按照规划 openEuler 21.03、21.09 以及 openEuler 22.03 LTS 都将选择该内核版本。（具体时间以openEuler社区官网公布为准）升级安排： * v5.10-rc1 版本发布后，openEuler master 分支切换成 5.10。 * 由于主线 rc 版本尚在更新，openeuler_defconfig 暂时在 src-openeuler/kernel 仓库中提供，待 5.10 正式版本发布之后，再提交到源码仓库。 * openeuler_defconfig 基于 openEuler 20.09 的 config 修改适配，后续根据需求进行调整。 * 版本号格式，切换成 5.10.0-<devel_release>.<maintainence_release>。 * 首先支持 arm64 和 x86_64 架构，risc-v 的支持需要 risc-v sig 做适配。 * 上游社区 5.10 正式发布后（预计12月下旬）， openeuler/kernel 正式建立 OLK-5.10 分支（OLK: openEuler Long-term support Kernel），作为 5.10 的长期维护分支，接受补丁。 * 上游 5.10 正式发布前，如果有补丁需要发送 5.10，可以在 kernel(a)openeuler.org <mailto:kernel@openeuler.org> 中发 RFC 补丁，提前 Review 和讨论。 * 我们也可能提前建立 OLK-5.10 分支，以提前合入部分补丁做验证，但是在上游社区 5.10 正式发布之前，该分支可能会经常做 rebase 和 force push。对 OLK-5.10 或 openEuler 21.03 kernel 的需求 * 需求可以在 https://gitee.com/openeuler/kernel/issues 中提出。 * 如对 defconfig 有诉求也请在上述链接中提 issue。 * openEuler 21.03 计划使用该内核版本，预计2021年1月份之后，将从 OLK-5.10 拉出 openEuler-21.03 维护分支，同时补丁将受限合入 openEuler 21.03。注意事项和说明 * OLK 是 openEuler Long-term support Kernel 的缩写。openEuler LTS 版本和部分创新版本的内核基于 OLK 拉出分支进行维护。 * openEuler 5.10 内核不是基于 openEuler 4.19 内核的演进，而是基于上游社区内核的重新选型，因此如果您之前有合入 openEuler 4.19 的补丁，且这些补丁没有进入上游 5.10 内核，则需要您重新适配后推送到 openEuler 5.10 内核。 * openEuler 5.10 和 openEuler 4.19 两个版本 kabi 不兼容，您在 4.19 编译的 ko 不能直接在 5.10 上安装使用，需要重新适配和编译。 * openEuler 4.19 内核仍然处于维护周期内，如果您正在使用 4.19 内核，也不必紧张，您仍然能收到 4.19 的更新和增强。问题反馈 * kernel 升级期间，如果遇到兼容性、功能等问题，可以在 https://gitee.com/openeuler/kernel/issues 提交 issue。有疑问也可以在 PR 评论中，或者提交 issue 讨论。 * 你也可以发邮件到 kernel(a)openeuler.org <mailto:kernel@openeuler.org> 报议题在 kernel sig 例会中讨论。 * 如果 kernel sig 范围内协调或解决不了的问题，你也可以在 tc 报议题讨论。相关讨论纪要 kernel-sig 切换 5.10 的会议纪要： https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/thread/6… openEuler kernel 版本号在 TC 的议题及会议纪要： * 议题及讨论记录： https://mailweb.openeuler.org/hyperkitty/list/tc@openeuler.org/thread/KOHJN… https://mailweb.openeuler.org/hyperkitty/list/tc@openeuler.org/thread/VNJQ6… * 纪要： https://mailweb.openeuler.org/hyperkitty/list/tc@openeuler.org/thread/ZLAWQ…

1 0

[PATCH] xen/events: avoid removing an event channel while handling it
by Yang Yingliang 27 Oct '20

27 Oct '20

From: Juergen Gross <jgross(a)suse.com> mainline inclusion from mainline-v5.10 commit 073d0552ead5bfc7a3a9c01de590e924f11b5dd2 category: bugfix bugzilla: NA CVE: CVE-2020-27675 -------------------------------- Today it can happen that an event channel is being removed from the system while the event handling loop is active. This can lead to a race resulting in crashes or WARN() splats when trying to access the irq_info structure related to the event channel. Fix this problem by using a rwlock taken as reader in the event handling loop and as writer when deallocating the irq_info structure. As the observed problem was a NULL dereference in evtchn_from_irq() make this function more robust against races by testing the irq_info pointer to be not NULL before dereferencing it. And finally make all accesses to evtchn_to_irq[row][col] atomic ones in order to avoid seeing partial updates of an array element in irq handling. Note that irq handling can be entered only for event channels which have been valid before, so any not populated row isn't a problem in this regard, as rows are only ever added and never removed. This is XSA-331. Cc: stable(a)vger.kernel.org Reported-by: Marek Marczykowski-Górecki <marmarek(a)invisiblethingslab.com> Reported-by: Jinoh Kang <luke1337(a)theori.io> Signed-off-by: Juergen Gross <jgross(a)suse.com> Reviewed-by: Stefano Stabellini <sstabellini(a)kernel.org> Reviewed-by: Wei Liu <wl(a)xen.org> Conflicts: drivers/xen/events/events_base.c [yyl: adjust context] Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/xen/events/events_base.c | 40 ++++++++++++++++++++++++++++---- 1 file changed, 35 insertions(+), 5 deletions(-) diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c index 95e5a9300ff0..75eade7d2017 100644 --- a/drivers/xen/events/events_base.c +++ b/drivers/xen/events/events_base.c @@ -32,6 +32,7 @@ #include <linux/slab.h> #include <linux/irqnr.h> #include <linux/pci.h> +#include <linux/spinlock.h> #ifdef CONFIG_X86 #include <asm/desc.h> @@ -69,6 +70,23 @@ const struct evtchn_ops *evtchn_ops; */ static DEFINE_MUTEX(irq_mapping_update_lock); +/* + * Lock protecting event handling loop against removing event channels. + * Adding of event channels is no issue as the associated IRQ becomes active + * only after everything is setup (before request_[threaded_]irq() the handler + * can't be entered for an event, as the event channel will be unmasked only + * then). + */ +static DEFINE_RWLOCK(evtchn_rwlock); + +/* + * Lock hierarchy: + * + * irq_mapping_update_lock + * evtchn_rwlock + * IRQ-desc lock + */ + static LIST_HEAD(xen_irq_list_head); /* IRQ <-> VIRQ mapping. */ @@ -101,7 +119,7 @@ static void clear_evtchn_to_irq_row(unsigned row) unsigned col; for (col = 0; col < EVTCHN_PER_ROW; col++) - evtchn_to_irq[row][col] = -1; + WRITE_ONCE(evtchn_to_irq[row][col], -1); } static void clear_evtchn_to_irq_all(void) @@ -138,7 +156,7 @@ static int set_evtchn_to_irq(unsigned evtchn, unsigned irq) clear_evtchn_to_irq_row(row); } - evtchn_to_irq[row][col] = irq; + WRITE_ONCE(evtchn_to_irq[row][col], irq); return 0; } @@ -148,7 +166,7 @@ int get_evtchn_to_irq(unsigned evtchn) return -1; if (evtchn_to_irq[EVTCHN_ROW(evtchn)] == NULL) return -1; - return evtchn_to_irq[EVTCHN_ROW(evtchn)][EVTCHN_COL(evtchn)]; + return READ_ONCE(evtchn_to_irq[EVTCHN_ROW(evtchn)][EVTCHN_COL(evtchn)]); } /* Get info for IRQ */ @@ -246,10 +264,14 @@ static void xen_irq_info_cleanup(struct irq_info *info) */ unsigned int evtchn_from_irq(unsigned irq) { - if (unlikely(WARN(irq >= nr_irqs, "Invalid irq %d!\n", irq))) + const struct irq_info *info = NULL; + + if (likely(irq < nr_irqs)) + info = info_for_irq(irq); + if (!info) return 0; - return info_for_irq(irq)->evtchn; + return info->evtchn; } unsigned irq_from_evtchn(unsigned int evtchn) @@ -425,16 +447,21 @@ static int __must_check xen_allocate_irq_gsi(unsigned gsi) static void xen_free_irq(unsigned irq) { struct irq_info *info = irq_get_chip_data(irq); + unsigned long flags; if (WARN_ON(!info)) return; + write_lock_irqsave(&evtchn_rwlock, flags); + list_del(&info->list); irq_set_chip_data(irq, NULL); WARN_ON(info->refcnt > 0); + write_unlock_irqrestore(&evtchn_rwlock, flags); + kfree(info); /* Legacy IRQ descriptors are managed by the arch. */ @@ -1220,6 +1247,8 @@ static void __xen_evtchn_do_upcall(void) int cpu = get_cpu(); unsigned count; + read_lock(&evtchn_rwlock); + do { vcpu_info->evtchn_upcall_pending = 0; @@ -1236,6 +1265,7 @@ static void __xen_evtchn_do_upcall(void) out: + read_unlock(&evtchn_rwlock); put_cpu(); } -- 2.25.1

1 0

[PATCH 1/7] iommu/sysfs: Rename iommu_release_device()
by Yang Yingliang 27 Oct '20

27 Oct '20

From: Joerg Roedel <jroedel(a)suse.de> mainline inclusion from mainline-v4.20-rc1 commit 6954cf9bfda153f9544c63761aabf0199710aec3 category:bugfix bugzilla:NA CVE:NA ------------------- Remove the iommu_ prefix from the function and a few other static data structures so that the iommu_release_device name can be re-used in iommu core code. Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/iommu/iommu-sysfs.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/iommu/iommu-sysfs.c b/drivers/iommu/iommu-sysfs.c index 36d1a7ce7fc4..71c2249d3260 100644 --- a/drivers/iommu/iommu-sysfs.c +++ b/drivers/iommu/iommu-sysfs.c @@ -22,25 +22,25 @@ static struct attribute *devices_attr[] = { NULL, }; -static const struct attribute_group iommu_devices_attr_group = { +static const struct attribute_group devices_attr_group = { .name = "devices", .attrs = devices_attr, }; -static const struct attribute_group *iommu_dev_groups[] = { - &iommu_devices_attr_group, +static const struct attribute_group *dev_groups[] = { + &devices_attr_group, NULL, }; -static void iommu_release_device(struct device *dev) +static void release_device(struct device *dev) { kfree(dev); } static struct class iommu_class = { .name = "iommu", - .dev_release = iommu_release_device, - .dev_groups = iommu_dev_groups, + .dev_release = release_device, + .dev_groups = dev_groups, }; static int __init iommu_dev_init(void) -- 2.25.1

1 6

[PATCH 1/8] bcache: use a separate data structure for the on-disk super block
by Yang Yingliang 26 Oct '20

26 Oct '20

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-5.6-rc1 commit a702a692cd7559053ea573f4e2c84828f0e62824 category: feature bugzilla: 43003 CVE: NA --------------------------- Split out an on-disk version struct cache_sb with the proper endianness annotations. This fixes a fair chunk of sparse warnings, but there are some left due to the way the checksum is defined. Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Coly Li <colyli(a)suse.de> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Acked-by: Hanjun Guo <guohanjun(a)huawei.com> Reviewed-by: Yufen Yu <yuyufen(a)huawei.com> Signed-off-by: zhangyi (F) <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/md/bcache/super.c | 6 ++--- include/uapi/linux/bcache.h | 51 +++++++++++++++++++++++++++++++++++++ 2 files changed, 54 insertions(+), 3 deletions(-) diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c index 78854837f398..8f8a0a69cc0e 100644 --- a/drivers/md/bcache/super.c +++ b/drivers/md/bcache/super.c @@ -63,14 +63,14 @@ static const char *read_super(struct cache_sb *sb, struct block_device *bdev, struct page **res) { const char *err; - struct cache_sb *s; + struct cache_sb_disk *s; struct buffer_head *bh = __bread(bdev, 1, SB_SIZE); unsigned int i; if (!bh) return "IO error"; - s = (struct cache_sb *) bh->b_data; + s = (struct cache_sb_disk *)bh->b_data; sb->offset = le64_to_cpu(s->offset); sb->version = le64_to_cpu(s->version); @@ -209,7 +209,7 @@ static void write_bdev_super_endio(struct bio *bio) static void __write_super(struct cache_sb *sb, struct bio *bio) { - struct cache_sb *out = page_address(bio_first_page_all(bio)); + struct cache_sb_disk *out = page_address(bio_first_page_all(bio)); unsigned int i; bio->bi_iter.bi_sector = SB_SECTOR; diff --git a/include/uapi/linux/bcache.h b/include/uapi/linux/bcache.h index 5d4f58e059fd..1d8b3a9fc080 100644 --- a/include/uapi/linux/bcache.h +++ b/include/uapi/linux/bcache.h @@ -156,6 +156,57 @@ static inline struct bkey *bkey_idx(const struct bkey *k, unsigned int nr_keys) #define BDEV_DATA_START_DEFAULT 16 /* sectors */ +struct cache_sb_disk { + __le64 csum; + __le64 offset; /* sector where this sb was written */ + __le64 version; + + __u8 magic[16]; + + __u8 uuid[16]; + union { + __u8 set_uuid[16]; + __le64 set_magic; + }; + __u8 label[SB_LABEL_SIZE]; + + __le64 flags; + __le64 seq; + __le64 pad[8]; + + union { + struct { + /* Cache devices */ + __le64 nbuckets; /* device size */ + + __le16 block_size; /* sectors */ + __le16 bucket_size; /* sectors */ + + __le16 nr_in_set; + __le16 nr_this_dev; + }; + struct { + /* Backing devices */ + __le64 data_offset; + + /* + * block_size from the cache device section is still used by + * backing devices, so don't add anything here until we fix + * things to not need it for backing devices anymore + */ + }; + }; + + __le32 last_mount; /* time overflow in y2106 */ + + __le16 first_bucket; + union { + __le16 njournal_buckets; + __le16 keys; + }; + __le64 d[SB_JOURNAL_BUCKETS]; /* journal buckets */ +}; + struct cache_sb { __u64 csum; __u64 offset; /* sector where this sb was written */ -- 2.25.1

1 7