- Kernel - mailweb.openeuler.org

[PATCH 1/2] list: introduce list_for_each_continue()
by Yang Yingliang 26 Oct '20

26 Oct '20

From: Pavel Begunkov <asml.silence(a)gmail.com> mainline inclusion from mainline-v5.6-rc1 commit 28ca0d6d39ab1d01c86762c82a585b7cedd2920c category: bugfix bugzilla: 35619 CVE: NA -------------------------------- As other *continue() helpers, this continues iteration from a given position. Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Reviewed-by: zhangyi (F) <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/list.h | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/include/linux/list.h b/include/linux/list.h index de04cc5ed536..0e540581d52c 100644 --- a/include/linux/list.h +++ b/include/linux/list.h @@ -455,6 +455,16 @@ static inline void list_splice_tail_init(struct list_head *list, #define list_for_each(pos, head) \ for (pos = (head)->next; pos != (head); pos = pos->next) +/** + * list_for_each_continue - continue iteration over a list + * @pos: the &struct list_head to use as a loop cursor. + * @head: the head for your list. + * + * Continue to iterate over a list, continuing after the current position. + */ +#define list_for_each_continue(pos, head) \ + for (pos = pos->next; pos != (head); pos = pos->next) + /** * list_for_each_prev - iterate over a list backwards * @pos: the &struct list_head to use as a loop cursor. -- 2.25.1

1 1

[PATCH 1/6] driver core: Introduce device_iommu_mapped() function
by Yang Yingliang 22 Oct '20

22 Oct '20

From: Joerg Roedel <jroedel(a)suse.de> mainline inclusion from mainline-v4.20-rc1 commit dbba197edf32209d110727a02d3a91de4c88520f category:feature bugzilla:NA CVE:NA ------------------- Some places in the kernel check the iommu_group pointer in 'struct device' in order to find out whether a device is mapped by an IOMMU. This is not good way to make this check, as the pointer will be moved to 'struct dev_iommu_data'. This way to make the check is also not very readable. Introduce an explicit function to perform this check. Acked-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Acked-by: Robin Murphy <robin.murphy(a)arm.com> Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/device.h | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/include/linux/device.h b/include/linux/device.h index ee4ed3af30d0..cb9df20a9c97 100644 --- a/include/linux/device.h +++ b/include/linux/device.h @@ -1090,6 +1090,16 @@ static inline struct device *kobj_to_dev(struct kobject *kobj) return container_of(kobj, struct device, kobj); } +/** + * device_iommu_mapped - Returns true when the device DMA is translated + * by an IOMMU + * @dev: Device to perform the check on + */ +static inline bool device_iommu_mapped(struct device *dev) +{ + return (dev->iommu_group != NULL); +} + /* Get the wakeup routines, which depend on struct device */ #include <linux/pm_wakeup.h> -- 2.25.1

1 5

[PATCH 1/6] net/hinic: Fix the driver does not report an error when setting MAC fails
by Yang Yingliang 22 Oct '20

22 Oct '20

From: Chiqijun <chiqijun(a)huawei.com> driver inclusion category: bugfix bugzilla: 4472 ----------------------------------------------------------------------- When using the ip link command to configure the MAC for the VF in the PF, the status 4 will be returned when the MAC is set on the VF; when the PF driver receives the status 4 returned by the firmwre, the MAC setting failed and an error should be reported. Signed-off-by: Chiqijun <chiqijun(a)huawei.com> Reviewed-by: Wangxiaoyun <cloud.wangxiaoyun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- .../net/ethernet/huawei/hinic/hinic_main.c | 7 +++- .../net/ethernet/huawei/hinic/hinic_nic_cfg.c | 41 ++++++++++++------- 2 files changed, 31 insertions(+), 17 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic/hinic_main.c b/drivers/net/ethernet/huawei/hinic/hinic_main.c index b5d0bdadf509..cf7b6ceef060 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_main.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_main.c @@ -1305,8 +1305,11 @@ static int hinic_set_mac_addr(struct net_device *netdev, void *addr) err = hinic_update_mac(nic_dev->hwdev, netdev->dev_addr, saddr->sa_data, 0, func_id); - if (err) - return err; + if (err) { + nicif_err(nic_dev, drv, netdev, "Failed to update mac, err: %d\n", + err); + return err == HINIC_PF_SET_VF_ALREADY ? -EPERM : err; + } memcpy(netdev->dev_addr, saddr->sa_data, ETH_ALEN); diff --git a/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c b/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c index a42dea0ad707..2b349e17260b 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c @@ -231,6 +231,23 @@ int hinic_get_fw_support_func(void *hwdev) #define HINIC_ADD_VLAN_IN_MAC 0x8000 #define HINIC_VLAN_ID_MASK 0x7FFF +#define PF_SET_VF_MAC(hwdev, status) \ + (HINIC_FUNC_TYPE(hwdev) == TYPE_VF && \ + (status) == HINIC_PF_SET_VF_ALREADY) + +static int hinic_check_mac_status(struct hinic_hwdev *hwdev, u8 status, + u16 vlan_id) +{ + if ((status && status != HINIC_MGMT_STATUS_EXIST) || + (vlan_id & CHECK_IPSU_15BIT && status == HINIC_MGMT_STATUS_EXIST)) { + if (PF_SET_VF_MAC(hwdev, status)) + return 0; + + return -EINVAL; + } + + return 0; +} int hinic_set_mac(void *hwdev, const u8 *mac_addr, u16 vlan_id, u16 func_id) { @@ -255,17 +272,14 @@ int hinic_set_mac(void *hwdev, const u8 *mac_addr, u16 vlan_id, u16 func_id) err = l2nic_msg_to_mgmt_sync(hwdev, HINIC_PORT_CMD_SET_MAC, &mac_info, sizeof(mac_info), &mac_info, &out_size); if (err || !out_size || - (mac_info.status && mac_info.status != HINIC_MGMT_STATUS_EXIST && - mac_info.status != HINIC_PF_SET_VF_ALREADY) || - (mac_info.vlan_id & CHECK_IPSU_15BIT && - mac_info.status == HINIC_MGMT_STATUS_EXIST)) { + hinic_check_mac_status(hwdev, mac_info.status, mac_info.vlan_id)) { nic_err(nic_hwdev->dev_hdl, "Failed to update MAC, err: %d, status: 0x%x, out size: 0x%x\n", err, mac_info.status, out_size); - return -EINVAL; + return -EIO; } - if (mac_info.status == HINIC_PF_SET_VF_ALREADY) { + if (PF_SET_VF_MAC(nic_hwdev, mac_info.status)) { nic_warn(nic_hwdev->dev_hdl, "PF has already set VF mac, Ignore set operation\n"); return HINIC_PF_SET_VF_ALREADY; } @@ -302,13 +316,13 @@ int hinic_del_mac(void *hwdev, const u8 *mac_addr, u16 vlan_id, u16 func_id) err = l2nic_msg_to_mgmt_sync(hwdev, HINIC_PORT_CMD_DEL_MAC, &mac_info, sizeof(mac_info), &mac_info, &out_size); if (err || !out_size || - (mac_info.status && mac_info.status != HINIC_PF_SET_VF_ALREADY)) { + (mac_info.status && !PF_SET_VF_MAC(nic_hwdev, mac_info.status))) { nic_err(nic_hwdev->dev_hdl, "Failed to delete MAC, err: %d, status: 0x%x, out size: 0x%x\n", err, mac_info.status, out_size); - return -EINVAL; + return -EIO; } - if (mac_info.status == HINIC_PF_SET_VF_ALREADY) { + if (PF_SET_VF_MAC(nic_hwdev, mac_info.status)) { nic_warn(nic_hwdev->dev_hdl, "PF has already set VF mac, Ignore delete operation\n"); return HINIC_PF_SET_VF_ALREADY; } @@ -343,17 +357,14 @@ int hinic_update_mac(void *hwdev, u8 *old_mac, u8 *new_mac, u16 vlan_id, &mac_info, sizeof(mac_info), &mac_info, &out_size); if (err || !out_size || - (mac_info.status && mac_info.status != HINIC_MGMT_STATUS_EXIST && - mac_info.status != HINIC_PF_SET_VF_ALREADY) || - (mac_info.vlan_id & CHECK_IPSU_15BIT && - mac_info.status == HINIC_MGMT_STATUS_EXIST)) { + hinic_check_mac_status(hwdev, mac_info.status, mac_info.vlan_id)) { nic_err(nic_hwdev->dev_hdl, "Failed to update MAC, err: %d, status: 0x%x, out size: 0x%x\n", err, mac_info.status, out_size); - return -EINVAL; + return -EIO; } - if (mac_info.status == HINIC_PF_SET_VF_ALREADY) { + if (PF_SET_VF_MAC(nic_hwdev, mac_info.status)) { nic_warn(nic_hwdev->dev_hdl, "PF has already set VF MAC. Ignore update operation\n"); return HINIC_PF_SET_VF_ALREADY; } -- 2.25.1

1 5

[PATCH 01/20] nvme-rdma: remove redundant reference between ib_device and tagset
by Yang Yingliang 22 Oct '20

22 Oct '20

From: Max Gurtovoy <maxg(a)mellanox.com> mainline inclusion from mainline-v5.2-rc1 commit 87fd125344d68adf7699ec7396aa9f905ce79a80 category: bugfix bugzilla: NA CVE: NA Link: https://gitee.com/openeuler/kernel/issues/I1WGZE ------------------------------------------------- In the past, before adding f41725bb ("nvme-rdma: Use mr pool") commit, we needed a reference on the ib_device as long as the tagset was alive, as the MRs in the request structures needed a valid ib_device. Now, we allocate/deallocate MR pool per QP and consume on demand. Also remove nvme_rdma_free_tagset function and use blk_mq_free_tag_set instead, as it unneeded anymore. This commit also fixes a memory leakage and possible segmentation fault. When configuring the system with NIC teaming (aka bonding), we use 1 network interface to create an HA connection to the target side. In case one connection breaks down, nvme-rdma driver will get notification from rdma-cm layer that underlying address was change and will start error recovery process. During this process, we'll reconnect to the target via the second interface in the bond without destroying the tagset. This will cause a leakage of the initial rdma device (ndev) and miscount in the reference count of the new created rdma device (new ndev). In the final destruction (or in another error flow), we'll get a warning dump from the ib_dealloc_pd that we still have inflight MR's related to that pd. This happens becasue of the miscount of the reference tag of the rdma device and causing access violation to it's elements (some queues are not destroyed yet). Signed-off-by: Max Gurtovoy <maxg(a)mellanox.com> Signed-off-by: Israel Rukshin <israelr(a)mellanox.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Chao Leng <lengchao(a)huawei.com> Reviewed-by: Jike Cheng <chengjike.cheng(a)huawei.com> Conflicts: drivers/nvme/host/rdma.c [lrz: adjust context] Signed-off-by: Ruozhu Li <liruozhu(a)huawei.com> Signed-off-by: Lijie <lijie34(a)huawei.com> Reviewed-by: Tao Hou <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/nvme/host/rdma.c | 34 +++++----------------------------- 1 file changed, 5 insertions(+), 29 deletions(-) diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c index 077c67816665..0bfc1875575d 100644 --- a/drivers/nvme/host/rdma.c +++ b/drivers/nvme/host/rdma.c @@ -666,15 +666,6 @@ static int nvme_rdma_alloc_io_queues(struct nvme_rdma_ctrl *ctrl) return ret; } -static void nvme_rdma_free_tagset(struct nvme_ctrl *nctrl, - struct blk_mq_tag_set *set) -{ - struct nvme_rdma_ctrl *ctrl = to_rdma_ctrl(nctrl); - - blk_mq_free_tag_set(set); - nvme_rdma_dev_put(ctrl->device); -} - static struct blk_mq_tag_set *nvme_rdma_alloc_tagset(struct nvme_ctrl *nctrl, bool admin) { @@ -712,24 +703,9 @@ static struct blk_mq_tag_set *nvme_rdma_alloc_tagset(struct nvme_ctrl *nctrl, ret = blk_mq_alloc_tag_set(set); if (ret) - goto out; - - /* - * We need a reference on the device as long as the tag_set is alive, - * as the MRs in the request structures need a valid ib_device. - */ - ret = nvme_rdma_dev_get(ctrl->device); - if (!ret) { - ret = -EINVAL; - goto out_free_tagset; - } + return ERR_PTR(ret); return set; - -out_free_tagset: - blk_mq_free_tag_set(set); -out: - return ERR_PTR(ret); } static void nvme_rdma_destroy_admin_queue(struct nvme_rdma_ctrl *ctrl, @@ -737,7 +713,7 @@ static void nvme_rdma_destroy_admin_queue(struct nvme_rdma_ctrl *ctrl, { if (remove) { blk_cleanup_queue(ctrl->ctrl.admin_q); - nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.admin_tagset); + blk_mq_free_tag_set(ctrl->ctrl.admin_tagset); } if (ctrl->async_event_sqe.data) { cancel_work_sync(&ctrl->ctrl.async_event_work); @@ -815,7 +791,7 @@ static int nvme_rdma_configure_admin_queue(struct nvme_rdma_ctrl *ctrl, blk_cleanup_queue(ctrl->ctrl.admin_q); out_free_tagset: if (new) - nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.admin_tagset); + blk_mq_free_tag_set(ctrl->ctrl.admin_tagset); out_free_async_qe: if (ctrl->async_event_sqe.data) { nvme_rdma_free_qe(ctrl->device->dev, &ctrl->async_event_sqe, @@ -832,7 +808,7 @@ static void nvme_rdma_destroy_io_queues(struct nvme_rdma_ctrl *ctrl, { if (remove) { blk_cleanup_queue(ctrl->ctrl.connect_q); - nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.tagset); + blk_mq_free_tag_set(ctrl->ctrl.tagset); } nvme_rdma_free_io_queues(ctrl); } @@ -873,7 +849,7 @@ static int nvme_rdma_configure_io_queues(struct nvme_rdma_ctrl *ctrl, bool new) blk_cleanup_queue(ctrl->ctrl.connect_q); out_free_tag_set: if (new) - nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.tagset); + blk_mq_free_tag_set(ctrl->ctrl.tagset); out_free_io_queues: nvme_rdma_free_io_queues(ctrl); return ret; -- 2.25.1

1 19

【议题收集】【Meeting Notice】openEuler kernel sig meeting Time: 2020-10-16 10:00-12:00
by Xie XiuQi 20 Oct '20

20 Oct '20

openEuler kernel sig meeting 定于 2020-10-16 10:00-12:00 召开，欢迎回复邮件申报议题。 --- 会议信息 --- 会议链接：https://zoom.us/j/94156903933 会议 ID : 94156903933 --- 会议纪要归档 --- Meeting Record 20200918： https://gitee.com/openeuler/kernel/issues/I1WGN0

1 3

[PATCH 00/19] backport stable-4.19.152
by Yang Yingliang 19 Oct '20

19 Oct '20

Anant Thazhemadam (1): staging: comedi: check validity of wMaxPacketSize of usb endpoints found Arnaud Patard (1): drivers/net/ethernet/marvell/mvmdio.c: Fix non OF case Dmitry Golovin (1): ARM: 8939/1: kbuild: use correct nm executable Dominik Przychodni (1): crypto: qat - check cipher length for aead AES-CBC-HMAC-SHA Greg Kroah-Hartman (1): Linux 4.19.152 Herbert Xu (1): crypto: bcm - Verify GCM/CCM key length in setkey Jan Kara (2): reiserfs: Initialize inode keys properly reiserfs: Fix oops during mount Jason A. Donenfeld (1): ARM: 8867/1: vdso: pass --be8 to linker if necessary Leo Yan (1): perf cs-etm: Move definition of 'traceid_list' global variable from header file Leonid Bloch (1): USB: serial: option: Add Telit FT980-KS composition Luiz Augusto von Dentz (2): Bluetooth: Consolidate encryption handling in hci_encrypt_cfm Bluetooth: Disconnect if E0 is used for Level 4 Masahiro Yamada (1): ARM: 8858/1: vdso: use $(LD) instead of $(CC) to link VDSO Mychaela N. Falconia (1): USB: serial: ftdi_sio: add support for FreeCalypso JTAG+UART adapters Oliver Neukum (1): media: usbtv: Fix refcounting mixup Patrick Steinhardt (1): Bluetooth: Fix update of connection state in `hci_encrypt_cfm` Scott Chen (1): USB: serial: pl2303: add device-id for HP GC device Wilken Gottwalt (1): USB: serial: option: add Cellient MPL200 card Makefile | 2 +- arch/arm/boot/compressed/Makefile | 4 +- arch/arm/vdso/Makefile | 22 +++++------ drivers/crypto/bcm/cipher.c | 15 +++++++- drivers/crypto/qat/qat_common/qat_algs.c | 10 ++++- drivers/media/usb/usbtv/usbtv-core.c | 3 +- drivers/net/ethernet/marvell/mvmdio.c | 22 ++++++++--- drivers/staging/comedi/drivers/vmk80xx.c | 3 ++ drivers/usb/serial/ftdi_sio.c | 5 +++ drivers/usb/serial/ftdi_sio_ids.h | 7 ++++ drivers/usb/serial/option.c | 5 +++ drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 1 + fs/reiserfs/inode.c | 6 +-- fs/reiserfs/xattr.c | 7 ++++ include/net/bluetooth/hci_core.h | 30 ++++++++++++--- net/bluetooth/hci_conn.c | 17 +++++++++ net/bluetooth/hci_event.c | 48 ++++++------------------ tools/perf/util/cs-etm.c | 3 ++ tools/perf/util/cs-etm.h | 3 -- 20 files changed, 138 insertions(+), 76 deletions(-) -- 2.25.1

1 19

[PATCH 00/26] huge vmalloc mappings
by Yang Yingliang 19 Oct '20

19 Oct '20

Anshuman Khandual (1): mm/ioremap: probe platform for p4d huge map support Christoph Hellwig (8): mm: remove __get_vm_area mm: unexport unmap_kernel_range_noflush mm: only allow page table mappings for built-in zsmalloc mm: pass addr as unsigned long to vb_free mm: remove vmap_page_range_noflush and vunmap_page_range mm: rename vmap_page_range to map_kernel_range mm: don't return the number of pages from map_kernel_range{, _noflush} mm: remove map_vm_range Daniel Axtens (1): mm/memory.c: add apply_to_existing_page_range() helper Ingo Molnar (1): mm/vmalloc: Add empty <asm/vmalloc.h> headers and use them from <linux/vmalloc.h> Mike Rapoport (1): mm: move lib/ioremap.c to mm/ Nicholas Piggin (9): mm/vmalloc: fix vmalloc_to_page for huge vmap mappings mm: apply_to_pte_range warn and fail if a large pte is encountered mm/vmalloc: rename vmap_*_range vmap_pages_*_range mm/ioremap: rename ioremap_*_range to vmap_*_range mm: HUGE_VMAP arch support cleanup arm64: inline huge vmap supported functions mm: Move vmap_range from mm/ioremap.c to mm/vmalloc.c mm/vmalloc: add vmap_range_noflush variant mm/vmalloc: Hugepage vmalloc mappings Steven Price (2): mm: add generic p?d_leaf() macros arm64: mm: add p?d_leaf() definitions Will Deacon (3): ioremap: rework pXd_free_pYd_page() API lib/ioremap: ensure phys_addr actually corresponds to a physical address lib/ioremap: ensure break-before-make is used for huge p4d mappings Documentation/core-api/cachetlb.rst | 2 +- arch/Kconfig | 4 + arch/alpha/include/asm/vmalloc.h | 4 + arch/arc/include/asm/vmalloc.h | 4 + arch/arm/include/asm/vmalloc.h | 4 + arch/arm64/include/asm/pgtable.h | 2 + arch/arm64/include/asm/vmalloc.h | 29 ++ arch/arm64/mm/mmu.c | 16 - arch/c6x/include/asm/vmalloc.h | 4 + arch/csky/include/asm/vmalloc.h | 4 + arch/h8300/include/asm/vmalloc.h | 4 + arch/hexagon/include/asm/vmalloc.h | 4 + arch/ia64/include/asm/vmalloc.h | 4 + arch/m68k/include/asm/vmalloc.h | 4 + arch/microblaze/include/asm/vmalloc.h | 4 + arch/mips/include/asm/vmalloc.h | 4 + arch/nds32/include/asm/vmalloc.h | 4 + arch/nios2/include/asm/vmalloc.h | 4 + arch/openrisc/include/asm/vmalloc.h | 4 + arch/parisc/include/asm/vmalloc.h | 4 + arch/powerpc/include/asm/vmalloc.h | 12 + arch/powerpc/kernel/pci_64.c | 3 +- arch/riscv/include/asm/vmalloc.h | 4 + arch/s390/include/asm/vmalloc.h | 4 + arch/sh/include/asm/vmalloc.h | 4 + arch/sh/kernel/cpu/sh4/sq.c | 3 +- arch/sparc/include/asm/vmalloc.h | 4 + arch/um/include/asm/vmalloc.h | 4 + arch/unicore32/include/asm/vmalloc.h | 4 + arch/x86/include/asm/vmalloc.h | 12 + arch/x86/mm/ioremap.c | 11 +- arch/x86/mm/pgtable.c | 8 + arch/xtensa/include/asm/vmalloc.h | 4 + include/asm-generic/pgtable.h | 25 ++ include/linux/io.h | 8 - include/linux/mm.h | 3 + include/linux/vmalloc.h | 24 +- init/main.c | 1 - kernel/dma/mapping.c | 3 +- lib/Makefile | 1 - lib/ioremap.c | 183 --------- mm/Kconfig | 2 +- mm/Makefile | 2 +- mm/ioremap.c | 34 ++ mm/memory.c | 152 ++++++-- mm/vmalloc.c | 518 +++++++++++++++++++------- mm/zsmalloc.c | 4 +- 47 files changed, 752 insertions(+), 398 deletions(-) create mode 100644 arch/alpha/include/asm/vmalloc.h create mode 100644 arch/arc/include/asm/vmalloc.h create mode 100644 arch/arm/include/asm/vmalloc.h create mode 100644 arch/arm64/include/asm/vmalloc.h create mode 100644 arch/c6x/include/asm/vmalloc.h create mode 100644 arch/csky/include/asm/vmalloc.h create mode 100644 arch/h8300/include/asm/vmalloc.h create mode 100644 arch/hexagon/include/asm/vmalloc.h create mode 100644 arch/ia64/include/asm/vmalloc.h create mode 100644 arch/m68k/include/asm/vmalloc.h create mode 100644 arch/microblaze/include/asm/vmalloc.h create mode 100644 arch/mips/include/asm/vmalloc.h create mode 100644 arch/nds32/include/asm/vmalloc.h create mode 100644 arch/nios2/include/asm/vmalloc.h create mode 100644 arch/openrisc/include/asm/vmalloc.h create mode 100644 arch/parisc/include/asm/vmalloc.h create mode 100644 arch/powerpc/include/asm/vmalloc.h create mode 100644 arch/riscv/include/asm/vmalloc.h create mode 100644 arch/s390/include/asm/vmalloc.h create mode 100644 arch/sh/include/asm/vmalloc.h create mode 100644 arch/sparc/include/asm/vmalloc.h create mode 100644 arch/um/include/asm/vmalloc.h create mode 100644 arch/unicore32/include/asm/vmalloc.h create mode 100644 arch/x86/include/asm/vmalloc.h create mode 100644 arch/xtensa/include/asm/vmalloc.h delete mode 100644 lib/ioremap.c create mode 100644 mm/ioremap.c -- 2.25.1

1 26

[PATCH 0/4] fixes CVE-2020-12351 and CVE-2020-12352
by Yang Yingliang 19 Oct '20

19 Oct '20

Luiz Augusto von Dentz (4): Bluetooth: A2MP: Fix not initializing all members Bluetooth: L2CAP: Fix calling sk_filter on non-socket based channel Bluetooth: Disable High Speed by default Bluetooth: MGMT: Fix not checking if BT_HS is enabled include/net/bluetooth/l2cap.h | 2 ++ net/bluetooth/Kconfig | 1 - net/bluetooth/a2mp.c | 22 +++++++++++++++++++++- net/bluetooth/l2cap_core.c | 7 ++++--- net/bluetooth/l2cap_sock.c | 14 ++++++++++++++ net/bluetooth/mgmt.c | 7 ++++++- 6 files changed, 47 insertions(+), 6 deletions(-) -- 2.25.1

1 4

[PATCH 00/49] backport stable-4.19.151
by Yang Yingliang 19 Oct '20

19 Oct '20

Aaron Ma (1): platform/x86: thinkpad_acpi: re-initialize ACPI buffer size when reuse Anant Thazhemadam (3): net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key() net: team: fix memory leak in __team_options_register net: usb: rtl8150: set random MAC address when set_ethernet_addr() fails Antony Antony (4): xfrm: clone XFRMA_SET_MARK in xfrm_do_migrate xfrm: clone XFRMA_REPLAY_ESN_VAL in xfrm_do_migrate xfrm: clone XFRMA_SEC_CTX in xfrm_do_migrate xfrm: clone whole liftime_cur structure in xfrm_do_migrate Aya Levin (2): net/mlx5e: Fix VLAN cleanup flow net/mlx5e: Fix VLAN create flow Chaitanya Kulkarni (1): nvme-core: put ctrl ref when module ref get fail Coly Li (1): mmc: core: don't set limits.discard_granularity as 0 Cristian Ciocaltea (1): i2c: owl: Clear NACK and BUS error bits David Howells (3): rxrpc: Downgrade the BUG() for unsupported token type in rxrpc_read() rxrpc: Fix some missing _bh annotations on locking conn->state_lock rxrpc: Fix server keyring leak Dinh Nguyen (1): arm64: dts: stratix10: add status to qspi dts node Dumitru Ceara (1): openvswitch: handle DNAT tuple collision Eric Dumazet (4): macsec: avoid use-after-free in macsec_handle_frame() sctp: fix sctp_auth_init_hmacs() error path team: set dev->needed_headroom in team_setup_by_port() bonding: set dev->needed_headroom in bond_setup_by_slave() Geert Uytterhoeven (1): Revert "ravb: Fixed to be able to unload modules" Greg Kroah-Hartman (1): Linux 4.19.151 Hans de Goede (2): platform/x86: intel-vbtn: Fix SW_TABLET_MODE always reporting 1 on the HP Pavilion 11 x360 platform/x86: intel-vbtn: Switch to an allow-list for SW_TABLET_MODE reporting Herbert Xu (1): xfrm: Use correct address family in xfrm_state_find Hugh Dickins (1): mm/khugepaged: fix filemap page_to_pgoff(page) != offset Jean Delvare (1): i2c: i801: Exclude device from suspend direct complete optimization Jerome Brunet (1): i2c: meson: fix clock setting overwrite Kajol Jain (1): perf: Fix task_function_call() error handling Karol Herbst (1): drm/nouveau/mem: guard against NULL pointer access in mem_del Linus Torvalds (1): usermodehelper: reset umask to default before executing user process Marc Dionne (1): rxrpc: Fix rxkad token xdr encoding Miquel Raynal (1): mtd: rawnand: sunxi: Fix the probe error path Necip Fazil Yildiran (1): platform/x86: fix kconfig dependency warning for FUJITSU_LAPTOP Nicolas Belin (1): i2c: meson: fixup rate calculation with filter delay Peilin Ye (3): fbdev, newport_con: Move FONT_EXTRA_WORDS macros into linux/font.h Fonts: Support FONT_EXTRA_WORDS macros for built-in fonts fbcon: Fix global-out-of-bounds read in fbcon_get_font() Philip Yang (1): drm/amdgpu: prevent double kfree ttm->sg Randy Dunlap (1): mdio: fix mdio-thunder.c dependency & build error Sabrina Dubroca (1): xfrmi: drop ignore_df check before updating pmtu Tetsuo Handa (1): driver core: Fix probe_count imbalance in really_probe() Tom Rix (1): platform/x86: thinkpad_acpi: initialize tp_nvram_state variable Vijay Balakrishna (1): mm: khugepaged: recalculate min_free_kbytes after memory hotplug as expected by khugepaged Vladimir Zapolskiy (1): cifs: Fix incomplete memory allocation on setxattr path Voon Weifeng (1): net: stmmac: removed enabling eee in EEE set callback Wilken Gottwalt (1): net: usb: ax88179_178a: fix missing stop entry in driver_info Makefile | 2 +- .../dts/altera/socfpga_stratix10_socdk.dts | 1 + drivers/base/dd.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 + drivers/gpu/drm/nouveau/nouveau_mem.c | 2 + drivers/i2c/busses/i2c-i801.c | 1 + drivers/i2c/busses/i2c-meson.c | 42 +++++-- drivers/i2c/busses/i2c-owl.c | 6 + drivers/mmc/core/queue.c | 2 +- drivers/mtd/nand/raw/sunxi_nand.c | 2 +- drivers/net/bonding/bond_main.c | 1 + .../net/ethernet/mellanox/mlx5/core/en_fs.c | 14 ++- drivers/net/ethernet/renesas/ravb_main.c | 110 +++++++++--------- .../ethernet/stmicro/stmmac/stmmac_ethtool.c | 15 +-- drivers/net/macsec.c | 4 +- drivers/net/phy/Kconfig | 1 + drivers/net/team/team.c | 3 +- drivers/net/usb/ax88179_178a.c | 1 + drivers/net/usb/rtl8150.c | 16 ++- drivers/nvme/host/core.c | 4 +- drivers/platform/x86/Kconfig | 1 + drivers/platform/x86/intel-vbtn.c | 64 +++++++--- drivers/platform/x86/thinkpad_acpi.c | 6 +- drivers/video/console/newport_con.c | 7 +- drivers/video/fbdev/core/fbcon.c | 12 ++ drivers/video/fbdev/core/fbcon.h | 7 -- drivers/video/fbdev/core/fbcon_rotate.c | 1 + drivers/video/fbdev/core/tileblit.c | 1 + fs/cifs/smb2ops.c | 2 +- include/linux/font.h | 13 +++ include/linux/khugepaged.h | 5 + include/net/xfrm.h | 16 +-- kernel/events/core.c | 5 +- kernel/umh.c | 9 ++ lib/fonts/font_10x18.c | 9 +- lib/fonts/font_6x10.c | 9 +- lib/fonts/font_6x11.c | 9 +- lib/fonts/font_7x14.c | 9 +- lib/fonts/font_8x16.c | 9 +- lib/fonts/font_8x8.c | 9 +- lib/fonts/font_acorn_8x8.c | 9 +- lib/fonts/font_mini_4x6.c | 8 +- lib/fonts/font_pearl_8x8.c | 9 +- lib/fonts/font_sun12x22.c | 9 +- lib/fonts/font_sun8x16.c | 7 +- mm/khugepaged.c | 25 +++- mm/page_alloc.c | 3 + net/openvswitch/conntrack.c | 22 ++-- net/rxrpc/conn_event.c | 6 +- net/rxrpc/key.c | 18 ++- net/sctp/auth.c | 1 + net/wireless/nl80211.c | 3 + net/xfrm/xfrm_interface.c | 2 +- net/xfrm/xfrm_state.c | 42 ++++++- 54 files changed, 391 insertions(+), 209 deletions(-) -- 2.25.1

1 49

[PATCH] perf/core: Fix race in the perf_mmap_close() function
by Yang Yingliang 16 Oct '20

16 Oct '20

From: Jiri Olsa <jolsa(a)redhat.com> mainline inclusion from mainline-v5.10 commit f91072ed1b7283b13ca57fcfbece5a3b92726143 category: bugfix bugzilla: NA CVE: CVE-2020-14351 -------------------------------- There's a possible race in perf_mmap_close() when checking ring buffer's mmap_count refcount value. The problem is that the mmap_count check is not atomic because we call atomic_dec() and atomic_read() separately. perf_mmap_close: ... atomic_dec(&rb->mmap_count); ... if (atomic_read(&rb->mmap_count)) goto out_put; <ring buffer detach> free_uid out_put: ring_buffer_put(rb); /* could be last */ The race can happen when we have two (or more) events sharing same ring buffer and they go through atomic_dec() and then they both see 0 as refcount value later in atomic_read(). Then both will go on and execute code which is meant to be run just once. The code that detaches ring buffer is probably fine to be executed more than once, but the problem is in calling free_uid(), which will later on demonstrate in related crashes and refcount warnings, like: refcount_t: addition on 0; use-after-free. ... RIP: 0010:refcount_warn_saturate+0x6d/0xf ... Call Trace: prepare_creds+0x190/0x1e0 copy_creds+0x35/0x172 copy_process+0x471/0x1a80 _do_fork+0x83/0x3a0 __do_sys_wait4+0x83/0x90 __do_sys_clone+0x85/0xa0 do_syscall_64+0x5b/0x1e0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Using atomic decrease and check instead of separated calls. Tested-by: Michael Petlan <mpetlan(a)redhat.com> Signed-off-by: Jiri Olsa <jolsa(a)kernel.org> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Acked-by: Peter Zijlstra <a.p.zijlstra(a)chello.nl> Acked-by: Namhyung Kim <namhyung(a)kernel.org> Acked-by: Wade Mealing <wmealing(a)redhat.com> Fixes: 9bb5d40cd93c ("perf: Fix mmap() accounting hole"); Link: https://lore.kernel.org/r/20200916115311.GE2301783@krava Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Conflicts: kernel/events/core.c [yyl: adjust context] Reviewed-by: Jian Cheng <cj.chengjian(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/events/core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 30a81d1b7b5c..452775f68129 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -5496,11 +5496,11 @@ static void perf_pmu_output_stop(struct perf_event *event); static void perf_mmap_close(struct vm_area_struct *vma) { struct perf_event *event = vma->vm_file->private_data; - struct ring_buffer *rb = ring_buffer_get(event); struct user_struct *mmap_user = rb->mmap_user; int mmap_locked = rb->mmap_locked; unsigned long size = perf_data_size(rb); + bool detach_rest = false; if (event->pmu->event_unmapped) event->pmu->event_unmapped(event, vma->vm_mm); @@ -5531,7 +5531,8 @@ static void perf_mmap_close(struct vm_area_struct *vma) mutex_unlock(&event->mmap_mutex); } - atomic_dec(&rb->mmap_count); + if (atomic_dec_and_test(&rb->mmap_count)) + detach_rest = true; if (!atomic_dec_and_mutex_lock(&event->mmap_count, &event->mmap_mutex)) goto out_put; @@ -5540,7 +5541,7 @@ static void perf_mmap_close(struct vm_area_struct *vma) mutex_unlock(&event->mmap_mutex); /* If there's still other mmap()s of this buffer, we're done. */ - if (atomic_read(&rb->mmap_count)) + if (!detach_rest) goto out_put; /* -- 2.25.1

1 0