- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 00/13] KVM: arm64 support vCPU
by Cheng Jian 22 Apr '21

22 Apr '21

This patch set aims to support the vCPU preempted check under KVM/arm64. Christoffer Dall (1): KVM: arm/arm64: Factor out hypercall handling from PSCI code Qian Cai (1): arm64/spinlock: fix a -Wunused-function warning Steven Price (3): KVM: Implement kvm_put_guest() arm/arm64: Provide a wrapper for SMCCC 1.1 calls arm/arm64: Make use of the SMCCC 1.1 wrapper Waiman Long (1): locking/osq: Use optimized spinning loop for arm64 Wanpeng Li (2): KVM: Boost vCPUs that are delivering interrupts KVM: Check preempted_in_kernel for involuntary preemption Zengruan Ye (5): KVM: arm64: Document PV-sched interface KVM: arm64: Implement PV_SCHED_FEATURES call KVM: arm64: Support pvsched preempted via shared structure KVM: arm64: Add interface to support vCPU preempted check KVM: arm64: Support the vCPU preemption check Documentation/virtual/kvm/arm/pvsched.txt | 56 +++++++++++ arch/arm/include/asm/kvm_host.h | 20 ++++ arch/arm/kvm/Makefile | 2 +- arch/arm/kvm/handle_exit.c | 2 +- arch/arm/mm/proc-v7-bugs.c | 13 +-- arch/arm64/include/asm/kvm_host.h | 18 ++++ arch/arm64/include/asm/paravirt.h | 25 ++++- arch/arm64/include/asm/pvsched-abi.h | 16 +++ arch/arm64/include/asm/spinlock.h | 23 +++++ arch/arm64/kernel/Makefile | 2 +- arch/arm64/kernel/cpu_errata.c | 82 ++++++--------- arch/arm64/kernel/paravirt-spinlocks.c | 13 +++ arch/arm64/kernel/paravirt.c | 117 ++++++++++++++++++++++ arch/arm64/kernel/setup.c | 2 + arch/arm64/kvm/Makefile | 2 + arch/arm64/kvm/handle_exit.c | 4 +- arch/s390/kvm/interrupt.c | 2 +- include/kvm/arm_hypercalls.h | 43 ++++++++ include/kvm/arm_psci.h | 2 +- include/linux/arm-smccc.h | 65 ++++++++++++ include/linux/kvm_host.h | 23 +++++ include/linux/kvm_types.h | 2 + kernel/locking/osq_lock.c | 23 ++--- virt/kvm/arm/arm.c | 8 ++ virt/kvm/arm/hypercalls.c | 69 +++++++++++++ virt/kvm/arm/psci.c | 76 +------------- virt/kvm/arm/pvsched.c | 55 ++++++++++ virt/kvm/kvm_main.c | 17 ++-- 28 files changed, 620 insertions(+), 162 deletions(-) create mode 100644 Documentation/virtual/kvm/arm/pvsched.txt create mode 100644 arch/arm64/include/asm/pvsched-abi.h create mode 100644 arch/arm64/kernel/paravirt-spinlocks.c create mode 100644 include/kvm/arm_hypercalls.h create mode 100644 virt/kvm/arm/hypercalls.c create mode 100644 virt/kvm/arm/pvsched.c -- 2.25.1

1 9

[PATCH kernel-4.19 0/5] refetch framework for bcache
by Cheng Jian 22 Apr '21

22 Apr '21

Add a framework to prefetch in bcache. This framework is useful to extend current readahead in bcache, current simply append piece of data of a fixed length, which cannot increase performance well. The framework records every read request from a bcache device and send them to a userspace client, which calculates proper prefetch length ot each request and send them to kernel, and execute prefetch asynchronously. Li Ruilin (5): bcache: add a framework to perform prefetch bcache: provide a switch to bypass all IO requests bcache: inflight prefetch requests block overlapped normal requests bcache: Delay to invalidate cache data in writearound write bcache: Add a sample of userspace prefetch client Documentation/admin-guide/bcache.rst | 4 + drivers/md/bcache/Makefile | 2 +- drivers/md/bcache/acache.c | 591 +++++++++++++++++++++++++++ drivers/md/bcache/acache.h | 79 ++++ drivers/md/bcache/bcache.h | 8 +- drivers/md/bcache/btree.c | 4 +- drivers/md/bcache/request.c | 131 ++++-- drivers/md/bcache/request.h | 31 ++ drivers/md/bcache/stats.c | 13 + drivers/md/bcache/stats.h | 3 + drivers/md/bcache/super.c | 6 + drivers/md/bcache/sysfs.c | 12 + include/trace/events/bcache.h | 22 + samples/acache_client/Makefile | 13 + samples/acache_client/connect.c | 144 +++++++ samples/acache_client/connect.h | 74 ++++ samples/acache_client/main.c | 133 ++++++ 17 files changed, 1222 insertions(+), 48 deletions(-) create mode 100644 drivers/md/bcache/acache.c create mode 100644 drivers/md/bcache/acache.h create mode 100644 samples/acache_client/Makefile create mode 100644 samples/acache_client/connect.c create mode 100644 samples/acache_client/connect.h create mode 100644 samples/acache_client/main.c -- 2.25.1

1 5

[PATCH openEuler-1.0-LTS 26/28] ext4: fix time overflow
by Cheng Jian 22 Apr '21

22 Apr '21

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: 50526 CVE: NA --------------------------- Inode atime/mtime is 64-bit, however ext4 ondisk atime/mtime is 32-bit( 34-bit if extra time is enabled). Thus if in-memory atime/mtime overflow, after umount and mount, atime/mtime will be wrong. In order to fix it, truncate atime/ctime/mtime in ext4_setattr(). This problem was fixed in commit 4881c4971df0 ("ext4: Initialize timestamps limits") from mainline, which relied on commit 50e17c000c46 ("vfs: Add timestamp_truncate() api") and commit 188d20bcd1eb ("vfs: Add file timestamp range support"). However, kabi will be broken if we backport these patches, thus we do local adaptation for ext4 instead. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: zhangyi (F) <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Cheng Jian <cj.chengjian(a)huawei.com> --- fs/ext4/ext4.h | 10 +++++++++- fs/ext4/inode.c | 25 +++++++++++++++++++++++++ 2 files changed, 34 insertions(+), 1 deletion(-) diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h index 975b86151b37..46d7f5162de5 100644 --- a/fs/ext4/ext4.h +++ b/fs/ext4/ext4.h @@ -258,6 +258,10 @@ struct ext4_io_submit { /* First non-reserved inode for old ext4 filesystems */ #define EXT4_GOOD_OLD_FIRST_INO 11 +#define EXT4_EXTRA_TIMESTAMP_MAX (((s64)1 << 34) - 1 + S32_MIN) +#define EXT4_NON_EXTRA_TIMESTAMP_MAX S32_MAX +#define EXT4_TIMESTAMP_MIN S32_MIN + /* * Maximal count of links to a file */ @@ -842,11 +846,15 @@ static inline void ext4_decode_extra_time(struct timespec64 *time, #define EXT4_INODE_SET_XTIME(xtime, inode, raw_inode) \ do { \ - (raw_inode)->xtime = cpu_to_le32((inode)->xtime.tv_sec); \ if (EXT4_FITS_IN_INODE(raw_inode, EXT4_I(inode), xtime ## _extra)) {\ + (raw_inode)->xtime = cpu_to_le32((inode)->xtime.tv_sec); \ (raw_inode)->xtime ## _extra = \ ext4_encode_extra_time(&(inode)->xtime); \ } \ + else {\ + (raw_inode)->xtime = cpu_to_le32(clamp_t(int32_t, (inode)->xtime.tv_sec, S32_MIN, S32_MAX)); \ + ext4_warning_inode(inode, "inode does not support timestamps beyond 2038"); \ + } \ } while (0) #define EXT4_EINODE_SET_XTIME(xtime, einode, raw_inode) \ diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index c68823c50688..ec6b18ba946c 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -5548,6 +5548,29 @@ static void ext4_wait_for_tail_page_commit(struct inode *inode) } } +static void ext4_timestamp_truncate(struct inode *inode, struct iattr *attr) +{ + time64_t max; + + if (!(attr->ia_valid & (ATTR_ATIME | ATTR_CTIME | ATTR_MTIME))) + return; + + if (inode->i_sb->s_time_gran == 1) + max = EXT4_EXTRA_TIMESTAMP_MAX; + else + max = EXT4_NON_EXTRA_TIMESTAMP_MAX; + + if (attr->ia_valid & ATTR_ATIME) + attr->ia_atime.tv_sec = clamp(attr->ia_atime.tv_sec, + (time64_t)EXT4_TIMESTAMP_MIN, max); + if (attr->ia_valid & ATTR_CTIME) + attr->ia_ctime.tv_sec = clamp(attr->ia_ctime.tv_sec, + (time64_t)EXT4_TIMESTAMP_MIN, max); + if (attr->ia_valid & ATTR_MTIME) + attr->ia_mtime.tv_sec = clamp(attr->ia_mtime.tv_sec, + (time64_t)EXT4_TIMESTAMP_MIN, max); +} + /* * ext4_setattr() * @@ -5603,6 +5626,7 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr) if (error) return error; } + if ((ia_valid & ATTR_UID && !uid_eq(attr->ia_uid, inode->i_uid)) || (ia_valid & ATTR_GID && !gid_eq(attr->ia_gid, inode->i_gid))) { handle_t *handle; @@ -5736,6 +5760,7 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr) } if (!error) { + ext4_timestamp_truncate(inode, attr); setattr_copy(inode, attr); mark_inode_dirty(inode); } -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 25/28] ext4: drop legacy pre-1970 encoding workaround
by Cheng Jian 22 Apr '21

22 Apr '21

From: Theodore Ts'o <tytso(a)mit.edu> mainline inclusion from mainline-5.4-rc1 commit cd2d99229dc96219547e6349841e1aad851c6acc category: bugfix bugzilla: 50526 CVE: NA --------------------------- Originally, support for expanded timestamps had a bug in that pre-1970 times were erroneously encoded as being in the the 24th century. This was fixed in commit a4dad1ae24f8 ("ext4: Fix handling of extended tv_sec") which landed in 4.4. Starting with 4.4, pre-1970 timestamps were correctly encoded, but for backwards compatibility those incorrectly encoded timestamps were mapped back to the pre-1970 dates. Given that backwards compatibility workaround has been around for 4 years, and given that running e2fsck from e2fsprogs 1.43.2 and later will offer to fix these timestamps (which has been released for 3 years), it's past time to drop the legacy workaround from the kernel. Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: zhangyi (F) <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Cheng Jian <cj.chengjian(a)huawei.com> --- fs/ext4/ext4.h | 15 +-------------- 1 file changed, 1 insertion(+), 14 deletions(-) diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h index 1f1099a390ef..975b86151b37 100644 --- a/fs/ext4/ext4.h +++ b/fs/ext4/ext4.h @@ -835,21 +835,8 @@ static inline __le32 ext4_encode_extra_time(struct timespec64 *time) static inline void ext4_decode_extra_time(struct timespec64 *time, __le32 extra) { - if (unlikely(extra & cpu_to_le32(EXT4_EPOCH_MASK))) { - -#if 1 - /* Handle legacy encoding of pre-1970 dates with epoch - * bits 1,1. (This backwards compatibility may be removed - * at the discretion of the ext4 developers.) - */ - u64 extra_bits = le32_to_cpu(extra) & EXT4_EPOCH_MASK; - if (extra_bits == 3 && ((time->tv_sec) & 0x80000000) != 0) - extra_bits = 0; - time->tv_sec += extra_bits << 32; -#else + if (unlikely(extra & cpu_to_le32(EXT4_EPOCH_MASK))) time->tv_sec += (u64)(le32_to_cpu(extra) & EXT4_EPOCH_MASK) << 32; -#endif - } time->tv_nsec = (le32_to_cpu(extra) & EXT4_NSEC_MASK) >> EXT4_EPOCH_BITS; } -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 24/28] fuse: fix live lock in fuse_iget()
by Cheng Jian 22 Apr '21

22 Apr '21

From: Amir Goldstein <amir73il(a)gmail.com> mainline inclusion from mainline-v5.12-rc4 commit 775c5033a0d164622d9d10dd0f0a5531639ed3ed category: bugfix bugzilla: NA CVE: CVE-2021-28950 -------------------------------- Commit 5d069dbe8aaf ("fuse: fix bad inode") replaced make_bad_inode() in fuse_iget() with a private implementation fuse_make_bad(). The private implementation fails to remove the bad inode from inode cache, so the retry loop with iget5_locked() finds the same bad inode and marks it bad forever. kmsg snip: [ ] rcu: INFO: rcu_sched self-detected stall on CPU ... [ ] ? bit_wait_io+0x50/0x50 [ ] ? fuse_init_file_inode+0x70/0x70 [ ] ? find_inode.isra.32+0x60/0xb0 [ ] ? fuse_init_file_inode+0x70/0x70 [ ] ilookup5_nowait+0x65/0x90 [ ] ? fuse_init_file_inode+0x70/0x70 [ ] ilookup5.part.36+0x2e/0x80 [ ] ? fuse_init_file_inode+0x70/0x70 [ ] ? fuse_inode_eq+0x20/0x20 [ ] iget5_locked+0x21/0x80 [ ] ? fuse_inode_eq+0x20/0x20 [ ] fuse_iget+0x96/0x1b0 Fixes: 5d069dbe8aaf ("fuse: fix bad inode") Cc: stable(a)vger.kernel.org # 5.10+ Signed-off-by: Amir Goldstein <amir73il(a)gmail.com> Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: zhangyi (F) <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Cheng Jian <cj.chengjian(a)huawei.com> --- fs/fuse/fuse_i.h | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h index 3d88386047df..853d37ec81e0 100644 --- a/fs/fuse/fuse_i.h +++ b/fs/fuse/fuse_i.h @@ -704,6 +704,7 @@ static inline u64 get_node_id(struct inode *inode) static inline void fuse_make_bad(struct inode *inode) { + remove_inode_hash(inode); set_bit(FUSE_I_BAD, &get_fuse_inode(inode)->state); } -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 23/28] fuse: fix bad inode
by Cheng Jian 22 Apr '21

22 Apr '21

From: Miklos Szeredi <mszeredi(a)redhat.com> mainline inclusion from mainline-v5.11-rc1 commit 5d069dbe8aaf2a197142558b6fb2978189ba3454 category: bugfix bugzilla: NA CVE: CVE-2020-36322 -------------------------------- Jan Kara's analysis of the syzbot report (edited): The reproducer opens a directory on FUSE filesystem, it then attaches dnotify mark to the open directory. After that a fuse_do_getattr() call finds that attributes returned by the server are inconsistent, and calls make_bad_inode() which, among other things does: inode->i_mode = S_IFREG; This then confuses dnotify which doesn't tear down its structures properly and eventually crashes. Avoid calling make_bad_inode() on a live inode: switch to a private flag on the fuse inode. Also add the test to ops which the bad_inode_ops would have caught. This bug goes back to the initial merge of fuse in 2.6.14... Reported-by: syzbot+f427adf9324b92652ccc(a)syzkaller.appspotmail.com Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Tested-by: Jan Kara <jack(a)suse.cz> Cc: <stable(a)vger.kernel.org> Conflicts: fs/fuse/inode.c fs/fuse/file.c fs/fuse/xattr.c fs/fuse/dir.c fs/fuse/fuse_i.h [yyl: replace is_bad_inode() with fuse_is_bad(), readdir.c is not added in kernel-4.19] Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: zhangyi (F) <yi.zhang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Cheng Jian <cj.chengjian(a)huawei.com> --- fs/fuse/acl.c | 6 ++++++ fs/fuse/dir.c | 37 ++++++++++++++++++++++++++++++++----- fs/fuse/file.c | 21 ++++++++++++--------- fs/fuse/fuse_i.h | 12 ++++++++++++ fs/fuse/inode.c | 2 +- fs/fuse/xattr.c | 9 +++++++++ 6 files changed, 72 insertions(+), 15 deletions(-) diff --git a/fs/fuse/acl.c b/fs/fuse/acl.c index 5a48cee6d7d3..f529075a2ce8 100644 --- a/fs/fuse/acl.c +++ b/fs/fuse/acl.c @@ -19,6 +19,9 @@ struct posix_acl *fuse_get_acl(struct inode *inode, int type) void *value = NULL; struct posix_acl *acl; + if (fuse_is_bad(inode)) + return ERR_PTR(-EIO); + if (!fc->posix_acl || fc->no_getxattr) return NULL; @@ -53,6 +56,9 @@ int fuse_set_acl(struct inode *inode, struct posix_acl *acl, int type) const char *name; int ret; + if (fuse_is_bad(inode)) + return -EIO; + if (!fc->posix_acl || fc->no_setxattr) return -EOPNOTSUPP; diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c index 6244345a5745..29d8aa4844ff 100644 --- a/fs/fuse/dir.c +++ b/fs/fuse/dir.c @@ -187,7 +187,7 @@ static int fuse_dentry_revalidate(struct dentry *entry, unsigned int flags) int ret; inode = d_inode_rcu(entry); - if (inode && is_bad_inode(inode)) + if (inode && fuse_is_bad(inode)) goto invalid; else if (time_before64(fuse_dentry_time(entry), get_jiffies_64()) || (flags & LOOKUP_REVAL)) { @@ -364,6 +364,9 @@ static struct dentry *fuse_lookup(struct inode *dir, struct dentry *entry, bool outarg_valid = true; bool locked; + if (fuse_is_bad(dir)) + return ERR_PTR(-EIO); + locked = fuse_lock_inode(dir); err = fuse_lookup_name(dir->i_sb, get_node_id(dir), &entry->d_name, &outarg, &inode); @@ -504,6 +507,9 @@ static int fuse_atomic_open(struct inode *dir, struct dentry *entry, struct fuse_conn *fc = get_fuse_conn(dir); struct dentry *res = NULL; + if (fuse_is_bad(dir)) + return -EIO; + if (d_in_lookup(entry)) { res = fuse_lookup(dir, entry, 0); if (IS_ERR(res)) @@ -552,6 +558,9 @@ static int create_new_entry(struct fuse_conn *fc, struct fuse_args *args, int err; struct fuse_forget_link *forget; + if (fuse_is_bad(dir)) + return -EIO; + forget = fuse_alloc_forget(); if (!forget) return -ENOMEM; @@ -679,6 +688,9 @@ static int fuse_unlink(struct inode *dir, struct dentry *entry) struct fuse_conn *fc = get_fuse_conn(dir); FUSE_ARGS(args); + if (fuse_is_bad(dir)) + return -EIO; + args.in.h.opcode = FUSE_UNLINK; args.in.h.nodeid = get_node_id(dir); args.in.numargs = 1; @@ -715,6 +727,9 @@ static int fuse_rmdir(struct inode *dir, struct dentry *entry) struct fuse_conn *fc = get_fuse_conn(dir); FUSE_ARGS(args); + if (fuse_is_bad(dir)) + return -EIO; + args.in.h.opcode = FUSE_RMDIR; args.in.h.nodeid = get_node_id(dir); args.in.numargs = 1; @@ -793,6 +808,9 @@ static int fuse_rename2(struct inode *olddir, struct dentry *oldent, struct fuse_conn *fc = get_fuse_conn(olddir); int err; + if (fuse_is_bad(olddir)) + return -EIO; + if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE)) return -EINVAL; @@ -928,7 +946,7 @@ static int fuse_do_getattr(struct inode *inode, struct kstat *stat, if (!err) { if (fuse_invalid_attr(&outarg.attr) || (inode->i_mode ^ outarg.attr.mode) & S_IFMT) { - make_bad_inode(inode); + fuse_make_bad(inode); err = -EIO; } else { fuse_change_attributes(inode, &outarg.attr, @@ -1125,6 +1143,9 @@ static int fuse_permission(struct inode *inode, int mask) bool refreshed = false; int err = 0; + if (fuse_is_bad(inode)) + return -EIO; + if (!fuse_allow_current_process(fc)) return -EACCES; @@ -1262,7 +1283,7 @@ static int fuse_direntplus_link(struct file *file, dput(dentry); goto retry; } - if (is_bad_inode(inode)) { + if (fuse_is_bad(inode)) { dput(dentry); return -EIO; } @@ -1360,7 +1381,7 @@ static int fuse_readdir(struct file *file, struct dir_context *ctx) u64 attr_version = 0; bool locked; - if (is_bad_inode(inode)) + if (fuse_is_bad(inode)) return -EIO; req = fuse_get_req(fc, 1); @@ -1718,7 +1739,7 @@ int fuse_do_setattr(struct dentry *dentry, struct iattr *attr, if (fuse_invalid_attr(&outarg.attr) || (inode->i_mode ^ outarg.attr.mode) & S_IFMT) { - make_bad_inode(inode); + fuse_make_bad(inode); err = -EIO; goto error; } @@ -1774,6 +1795,9 @@ static int fuse_setattr(struct dentry *entry, struct iattr *attr) struct file *file = (attr->ia_valid & ATTR_FILE) ? attr->ia_file : NULL; int ret; + if (fuse_is_bad(inode)) + return -EIO; + if (!fuse_allow_current_process(get_fuse_conn(inode))) return -EACCES; @@ -1832,6 +1856,9 @@ static int fuse_getattr(const struct path *path, struct kstat *stat, struct inode *inode = d_inode(path->dentry); struct fuse_conn *fc = get_fuse_conn(inode); + if (fuse_is_bad(inode)) + return -EIO; + if (!fuse_allow_current_process(fc)) return -EACCES; diff --git a/fs/fuse/file.c b/fs/fuse/file.c index 6a3d89672ff7..c1af038920dc 100644 --- a/fs/fuse/file.c +++ b/fs/fuse/file.c @@ -207,6 +207,9 @@ int fuse_open_common(struct inode *inode, struct file *file, bool isdir) fc->atomic_o_trunc && fc->writeback_cache; + if (fuse_is_bad(inode)) + return -EIO; + err = generic_file_open(inode, file); if (err) return err; @@ -408,7 +411,7 @@ static int fuse_flush(struct file *file, fl_owner_t id) struct fuse_flush_in inarg; int err; - if (is_bad_inode(inode)) + if (fuse_is_bad(inode)) return -EIO; if (fc->no_flush) @@ -456,7 +459,7 @@ int fuse_fsync_common(struct file *file, loff_t start, loff_t end, struct fuse_fsync_in inarg; int err; - if (is_bad_inode(inode)) + if (fuse_is_bad(inode)) return -EIO; inode_lock(inode); @@ -771,7 +774,7 @@ static int fuse_readpage(struct file *file, struct page *page) int err; err = -EIO; - if (is_bad_inode(inode)) + if (fuse_is_bad(inode)) goto out; err = fuse_do_readpage(file, page); @@ -898,7 +901,7 @@ static int fuse_readpages(struct file *file, struct address_space *mapping, int nr_alloc = min_t(unsigned, nr_pages, FUSE_MAX_PAGES_PER_REQ); err = -EIO; - if (is_bad_inode(inode)) + if (fuse_is_bad(inode)) goto out; data.file = file; @@ -1128,7 +1131,7 @@ static ssize_t fuse_perform_write(struct kiocb *iocb, int err = 0; ssize_t res = 0; - if (is_bad_inode(inode)) + if (fuse_is_bad(inode)) return -EIO; if (inode->i_size < pos + iov_iter_count(ii)) @@ -1421,7 +1424,7 @@ static ssize_t __fuse_direct_read(struct fuse_io_priv *io, ssize_t res; struct inode *inode = file_inode(io->iocb->ki_filp); - if (is_bad_inode(inode)) + if (fuse_is_bad(inode)) return -EIO; res = fuse_direct_io(io, iter, ppos, 0); @@ -1443,7 +1446,7 @@ static ssize_t fuse_direct_write_iter(struct kiocb *iocb, struct iov_iter *from) struct fuse_io_priv io = FUSE_IO_PRIV_SYNC(iocb); ssize_t res; - if (is_bad_inode(inode)) + if (fuse_is_bad(inode)) return -EIO; /* Don't allow parallel writes to the same file */ @@ -1917,7 +1920,7 @@ static int fuse_writepages(struct address_space *mapping, int err; err = -EIO; - if (is_bad_inode(inode)) + if (fuse_is_bad(inode)) goto out; data.inode = inode; @@ -2702,7 +2705,7 @@ long fuse_ioctl_common(struct file *file, unsigned int cmd, if (!fuse_allow_current_process(fc)) return -EACCES; - if (is_bad_inode(inode)) + if (fuse_is_bad(inode)) return -EIO; return fuse_do_ioctl(file, cmd, arg, flags); diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h index dbfc35efbefb..3d88386047df 100644 --- a/fs/fuse/fuse_i.h +++ b/fs/fuse/fuse_i.h @@ -118,6 +118,8 @@ enum { FUSE_I_INIT_RDPLUS, /** An operation changing file size is in progress */ FUSE_I_SIZE_UNSTABLE, + /* Bad inode */ + FUSE_I_BAD, }; struct fuse_conn; @@ -700,6 +702,16 @@ static inline u64 get_node_id(struct inode *inode) return get_fuse_inode(inode)->nodeid; } +static inline void fuse_make_bad(struct inode *inode) +{ + set_bit(FUSE_I_BAD, &get_fuse_inode(inode)->state); +} + +static inline bool fuse_is_bad(struct inode *inode) +{ + return unlikely(test_bit(FUSE_I_BAD, &get_fuse_inode(inode)->state)); +} + /** Device operations */ extern const struct file_operations fuse_dev_operations; diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c index cb018315ecaf..821597c61884 100644 --- a/fs/fuse/inode.c +++ b/fs/fuse/inode.c @@ -317,7 +317,7 @@ struct inode *fuse_iget(struct super_block *sb, u64 nodeid, unlock_new_inode(inode); } else if ((inode->i_mode ^ attr->mode) & S_IFMT) { /* Inode has changed type, any I/O on the old should fail */ - make_bad_inode(inode); + fuse_make_bad(inode); iput(inode); goto retry; } diff --git a/fs/fuse/xattr.c b/fs/fuse/xattr.c index 433717640f78..a4b65374bced 100644 --- a/fs/fuse/xattr.c +++ b/fs/fuse/xattr.c @@ -113,6 +113,9 @@ ssize_t fuse_listxattr(struct dentry *entry, char *list, size_t size) struct fuse_getxattr_out outarg; ssize_t ret; + if (fuse_is_bad(inode)) + return -EIO; + if (!fuse_allow_current_process(fc)) return -EACCES; @@ -178,6 +181,9 @@ static int fuse_xattr_get(const struct xattr_handler *handler, struct dentry *dentry, struct inode *inode, const char *name, void *value, size_t size) { + if (fuse_is_bad(inode)) + return -EIO; + return fuse_getxattr(inode, name, value, size); } @@ -186,6 +192,9 @@ static int fuse_xattr_set(const struct xattr_handler *handler, const char *name, const void *value, size_t size, int flags) { + if (fuse_is_bad(inode)) + return -EIO; + if (!value) return fuse_removexattr(inode, name); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 22/28] net/sctp: fix race condition in sctp_destroy_sock
by Cheng Jian 22 Apr '21

22 Apr '21

From: Or Cohen <orcohen(a)paloaltonetworks.com> mainline inclusion from mainline-v5.12-rc8 commit b166a20b07382b8bc1dcee2a448715c9c2c81b5b category: bugfix bugzilla: NA CVE: CVE-2021-23133 -------------------------------- If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock held and sp->do_auto_asconf is true, then an element is removed from the auto_asconf_splist without any proper locking. This can happen in the following functions: 1. In sctp_accept, if sctp_sock_migrate fails. 2. In inet_create or inet6_create, if there is a bpf program attached to BPF_CGROUP_INET_SOCK_CREATE which denies creation of the sctp socket. The bug is fixed by acquiring addr_wq_lock in sctp_destroy_sock instead of sctp_close. This addresses CVE-2021-23133. Reported-by: Or Cohen <orcohen(a)paloaltonetworks.com> Reviewed-by: Xin Long <lucien.xin(a)gmail.com> Fixes: 610236587600 ("bpf: Add new cgroup attach type to enable sock modifications") Signed-off-by: Or Cohen <orcohen(a)paloaltonetworks.com> Acked-by: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Cheng Jian <cj.chengjian(a)huawei.com> --- net/sctp/socket.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 733c3f448008..addfc8feaef5 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -1571,11 +1571,9 @@ static void sctp_close(struct sock *sk, long timeout) /* Supposedly, no process has access to the socket, but * the net layers still may. - * Also, sctp_destroy_sock() needs to be called with addr_wq_lock - * held and that should be grabbed before socket lock. */ - spin_lock_bh(&net->sctp.addr_wq_lock); - bh_lock_sock_nested(sk); + local_bh_disable(); + bh_lock_sock(sk); /* Hold the sock, since sk_common_release() will put sock_put() * and we have just a little more cleanup. @@ -1584,7 +1582,7 @@ static void sctp_close(struct sock *sk, long timeout) sk_common_release(sk); bh_unlock_sock(sk); - spin_unlock_bh(&net->sctp.addr_wq_lock); + local_bh_enable(); sock_put(sk); @@ -4779,9 +4777,6 @@ static int sctp_init_sock(struct sock *sk) sk_sockets_allocated_inc(sk); sock_prot_inuse_add(net, sk->sk_prot, 1); - /* Nothing can fail after this block, otherwise - * sctp_destroy_sock() will be called without addr_wq_lock held - */ if (net->sctp.default_auto_asconf) { spin_lock(&sock_net(sk)->sctp.addr_wq_lock); list_add_tail(&sp->auto_asconf_list, @@ -4816,7 +4811,9 @@ static void sctp_destroy_sock(struct sock *sk) if (sp->do_auto_asconf) { sp->do_auto_asconf = 0; + spin_lock_bh(&sock_net(sk)->sctp.addr_wq_lock); list_del(&sp->auto_asconf_list); + spin_unlock_bh(&sock_net(sk)->sctp.addr_wq_lock); } sctp_endpoint_free(sp->ep); local_bh_disable(); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 21/28] config: set config hip08 prefetch default value
by Cheng Jian 22 Apr '21

22 Apr '21

From: Yang Yingliang <yangyingliang(a)huawei.com> hulk inclusion category: bugfix bugzilla: NA CVE: NA enable CONFIG_HISILICON_ERRATUM_HIP08_RU_PREFETCH, to add a cmdline option to disable prefetch. Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Cheng Jian <cj.chengjian(a)huawei.com> --- arch/arm64/configs/hulk_defconfig | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/arm64/configs/hulk_defconfig b/arch/arm64/configs/hulk_defconfig index 51d885d95453..5ae11e963337 100644 --- a/arch/arm64/configs/hulk_defconfig +++ b/arch/arm64/configs/hulk_defconfig @@ -398,6 +398,8 @@ CONFIG_ARM64_ERRATUM_845719=y # CONFIG_SOCIONEXT_SYNQUACER_PREITS is not set CONFIG_HISILICON_ERRATUM_161600802=y # CONFIG_QCOM_FALKOR_ERRATUM_E1041 is not set +CONFIG_HISILICON_ERRATUM_HIP08_RU_PREFETCH=y +# CONFIG_HISILICON_HIP08_RU_PREFETCH_DEFAULT_OFF is not set CONFIG_ARM64_4K_PAGES=y # CONFIG_ARM64_16K_PAGES is not set # CONFIG_ARM64_64K_PAGES is not set -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 20/28] ext4: do not set SB_ACTIVE in ext4_orphan_cleanup()
by Cheng Jian 22 Apr '21

22 Apr '21

From: Zhang Yi <yi.zhang(a)huawei.com> hulk inclusion category: bugfix bugzilla: 50774 CVE: NA --------------------------- When CONFIG_QUOTA is enabled, if we failed to mount the filesystem due to some error happens behind ext4_orphan_cleanup(), it will end up triggering a after free issue of super_block. The problem is that ext4_orphan_cleanup() will set SB_ACTIVE flag if CONFIG_QUOTA is enabled, after we cleanup the truncated inodes, the last iput() will put them into the lru list, and these inodes' pages may probably dirty and will be write back by the writeback thread, so it could be raced by freeing super_block in the error path of mount_bdev(). After check the setting of SB_ACTIVE flag in ext4_orphan_cleanup(), it was used to ensure updating the quota file properly, but evict inode and trash data immediately in the last iput does not affect the quotafile, so setting the SB_ACTIVE flag seems not required[1]. Fix this issue by just remove the SB_ACTIVE setting. [1] https://lore.kernel.org/linux-ext4/99cce8ca-e4a0-7301-840f-2ace67c551f3@hua… Cc: stable(a)kernel.org Signed-off-by: Zhang Yi <yi.zhang(a)huawei.com> Tested-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20210331033138.918975-1-yi.zhang@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Reviewed-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Cheng Jian <cj.chengjian(a)huawei.com> --- fs/ext4/super.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 655ba77db225..5f95ed3fbf7d 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -2724,9 +2724,6 @@ static void ext4_orphan_cleanup(struct super_block *sb, sb->s_flags &= ~SB_RDONLY; } #ifdef CONFIG_QUOTA - /* Needed for iput() to work correctly and not trash data */ - sb->s_flags |= SB_ACTIVE; - /* * Turn on quotas which were not enabled for read-only mounts if * filesystem has quota feature, so that they are updated correctly. -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 19/28] RDMA/hns: add eq and cq time cfg compatibility support.
by Cheng Jian 22 Apr '21

22 Apr '21

From: wanglin <wanglin137(a)huawei.com> driver inclusion category: bugfix bugzilla: NA CVE: NA This patch add eq and cq time cfg compatibility support for new Hardware. Reviewed-by: Hu Chunzhi <huchunzhi(a)huawei.com> Reviewed-by: Zhao Weibo <zhaoweibo3(a)huawei.com> Signed-off-by: wanglin <wanglin137(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Cheng Jian <cj.chengjian(a)huawei.com> --- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 69 +++++++++++++++++----- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 5 ++ 2 files changed, 58 insertions(+), 16 deletions(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c index e1ba9877985b..4e81d1bf2441 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c @@ -1483,15 +1483,23 @@ static int hns_roce_config_global_param(struct hns_roce_dev *hr_dev) { struct hns_roce_cfg_global_param *req; struct hns_roce_cmq_desc desc; + u32 clock_cycles_of_1us; hns_roce_cmq_setup_basic_desc(&desc, HNS_ROCE_OPC_CFG_GLOBAL_PARAM, false); req = (struct hns_roce_cfg_global_param *)desc.data; memset(req, 0, sizeof(*req)); + + if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08_B) + clock_cycles_of_1us = HNS_ROCE_1NS_CFG; + else + clock_cycles_of_1us = HNS_ROCE_1US_CFG; + roce_set_field(req->time_cfg_udp_port, CFG_GLOBAL_PARAM_DATA_0_ROCEE_TIME_1US_CFG_M, - CFG_GLOBAL_PARAM_DATA_0_ROCEE_TIME_1US_CFG_S, 0); + CFG_GLOBAL_PARAM_DATA_0_ROCEE_TIME_1US_CFG_S, + clock_cycles_of_1us); roce_set_field(req->time_cfg_udp_port, CFG_GLOBAL_PARAM_DATA_0_ROCEE_UDP_PORT_M, CFG_GLOBAL_PARAM_DATA_0_ROCEE_UDP_PORT_S, 0x12b7); @@ -4943,6 +4951,29 @@ static int hns_roce_v2_set_abs_fields(struct ib_qp *ibqp, return ret; } +static bool check_qp_timeout_cfg_range(struct hns_roce_dev *hr_dev, u8 *timeout) +{ +#define QP_TIMEOUT_MAX_HIP08 20 +#define QP_TIMEOUT_MAX 31 + + if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08_B) { + if (*timeout > QP_TIMEOUT_MAX_HIP08) { + dev_warn(hr_dev->dev, + "Local ACK timeout shall be 0 to 20.\n"); + return false; + } + *timeout += HNS_ROCE_QP_TIMEOUT_OFFSET; + } else if (hr_dev->pci_dev->revision > PCI_REVISION_ID_HIP08_B) { + if (*timeout > QP_TIMEOUT_MAX) { + dev_warn(hr_dev->dev, + "Local ACK timeout shall be 0 to 31.\n"); + return false; + } + } + + return true; +} + static int hns_roce_v2_set_opt_fields(struct ib_qp *ibqp, const struct ib_qp_attr *attr, int attr_mask, @@ -4951,8 +4982,8 @@ static int hns_roce_v2_set_opt_fields(struct ib_qp *ibqp, { struct hns_roce_dev *hr_dev = to_hr_dev(ibqp->device); struct hns_roce_qp *hr_qp = to_hr_qp(ibqp); - struct device *dev = hr_dev->dev; int ret = 0; + u8 timeout; /* The AV component shall be modified for RoCEv2 */ if (attr_mask & IB_QP_AV) { @@ -4963,15 +4994,15 @@ static int hns_roce_v2_set_opt_fields(struct ib_qp *ibqp, } if (attr_mask & IB_QP_TIMEOUT) { - if (attr->timeout < 21) { + timeout = attr->timeout; + if (check_qp_timeout_cfg_range(hr_dev, &timeout)) { roce_set_field(context->byte_28_at_fl, V2_QPC_BYTE_28_AT_M, V2_QPC_BYTE_28_AT_S, - attr->timeout + 10); + timeout); roce_set_field(qpc_mask->byte_28_at_fl, V2_QPC_BYTE_28_AT_M, V2_QPC_BYTE_28_AT_S, 0); - } else - dev_warn(dev, "Local ACK timeout shall be 0 to 20.\n"); + } } if (attr_mask & IB_QP_RETRY_CNT) { @@ -5598,14 +5629,17 @@ static int hns_roce_v2_modify_cq(struct ib_cq *cq, u16 cq_count, u16 cq_period) V2_CQC_BYTE_56_CQ_MAX_CNT_M, V2_CQC_BYTE_56_CQ_MAX_CNT_S, 0); - if (cq_period * HNS_ROCE_CLOCK_ADJUST > 0xFFFF) { - dev_info(hr_dev->dev, "Config cq_period param(0x%x) out of range for modify_cq, adjusted to 65.\n", - cq_period); - cq_period = HNS_ROCE_MAX_CQ_PERIOD; + if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08_B) { + if (cq_period * HNS_ROCE_CLOCK_ADJUST > USHRT_MAX) { + dev_info(hr_dev->dev, "cq_period(%d) reached the upper limit, adjusted to 65.\n", + cq_period); + cq_period = HNS_ROCE_MAX_CQ_PERIOD; + } + cq_period *= HNS_ROCE_CLOCK_ADJUST; } roce_set_field(cq_context->byte_56_cqe_period_maxcnt, V2_CQC_BYTE_56_CQ_PERIOD_M, V2_CQC_BYTE_56_CQ_PERIOD_S, - cq_period * HNS_ROCE_CLOCK_ADJUST); + cq_period); roce_set_field(cqc_mask->byte_56_cqe_period_maxcnt, V2_CQC_BYTE_56_CQ_PERIOD_M, V2_CQC_BYTE_56_CQ_PERIOD_S, 0); @@ -6166,10 +6200,14 @@ static void hns_roce_config_eqc(struct hns_roce_dev *hr_dev, eqc = mb_buf; memset(eqc, 0, sizeof(struct hns_roce_eq_context)); - if (eq_period * HNS_ROCE_CLOCK_ADJUST > 0xFFFF) { - dev_info(hr_dev->dev, "Config eq_period param(0x%x) out of range for config_eqc, adjusted to 65.\n", - eq_period); - eq_period = HNS_ROCE_MAX_CQ_PERIOD; + eq->eq_period = eq_period; + if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08_B) { + if (eq->eq_period * HNS_ROCE_CLOCK_ADJUST > USHRT_MAX) { + dev_info(hr_dev->dev, "eq_period(%d) reached the upper limit, adjusted to 65.\n", + eq->eq_period); + eq->eq_period = HNS_ROCE_MAX_EQ_PERIOD; + } + eq->eq_period *= HNS_ROCE_CLOCK_ADJUST; } /* init eqc */ @@ -6182,7 +6220,6 @@ static void hns_roce_config_eqc(struct hns_roce_dev *hr_dev, eq->eqe_buf_pg_sz = hr_dev->caps.eqe_buf_pg_sz; eq->shift = ilog2((unsigned int)eq->entries); eq->eq_max_cnt = eq_max_cnt; - eq->eq_period = eq_period * HNS_ROCE_CLOCK_ADJUST; eq->arm_st = eq_arm_st; if (!eq->hop_num) diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h index ba81aa607e1d..dad3ac0b4731 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h @@ -37,6 +37,11 @@ #define HNS_ROCE_CLOCK_ADJUST 1000 #define HNS_ROCE_MAX_CQ_PERIOD 65 +#define HNS_ROCE_MAX_EQ_PERIOD 65 +#define HNS_ROCE_QP_TIMEOUT_OFFSET 10 + +#define HNS_ROCE_1US_CFG 999 +#define HNS_ROCE_1NS_CFG 0 #define HNS_ROCE_VF_QPC_BT_NUM 256 #define HNS_ROCE_VF_SCCC_BT_NUM 64 -- 2.25.1

1 0