- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] PM: hibernate: Get block device exclusively in swsusp_check()
by Yang Yingliang 01 Nov '21

01 Nov '21

From: Ye Bin <yebin10(a)huawei.com> mainline inclusion from mainline-v5.16 commit 39fbef4b0f77f9c89c8f014749ca533643a37c9f category: bugfix bugzilla: 182871 CVE: NA ----------------------------------------------- The following kernel crash can be triggered: [ 89.266592] ------------[ cut here ]------------ [ 89.267427] kernel BUG at fs/buffer.c:3020! [ 89.268264] invalid opcode: 0000 [#1] SMP KASAN PTI [ 89.269116] CPU: 7 PID: 1750 Comm: kmmpd-loop0 Not tainted 5.10.0-862.14.0.6.x86_64-08610-gc932cda3cef4-dirty #20 [ 89.273169] RIP: 0010:submit_bh_wbc.isra.0+0x538/0x6d0 [ 89.277157] RSP: 0018:ffff888105ddfd08 EFLAGS: 00010246 [ 89.278093] RAX: 0000000000000005 RBX: ffff888124231498 RCX: ffffffffb2772612 [ 89.279332] RDX: 1ffff11024846293 RSI: 0000000000000008 RDI: ffff888124231498 [ 89.280591] RBP: ffff8881248cc000 R08: 0000000000000001 R09: ffffed1024846294 [ 89.281851] R10: ffff88812423149f R11: ffffed1024846293 R12: 0000000000003800 [ 89.283095] R13: 0000000000000001 R14: 0000000000000000 R15: ffff8881161f7000 [ 89.284342] FS: 0000000000000000(0000) GS:ffff88839b5c0000(0000) knlGS:0000000000000000 [ 89.285711] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 89.286701] CR2: 00007f166ebc01a0 CR3: 0000000435c0e000 CR4: 00000000000006e0 [ 89.287919] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 89.289138] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 89.290368] Call Trace: [ 89.290842] write_mmp_block+0x2ca/0x510 [ 89.292218] kmmpd+0x433/0x9a0 [ 89.294902] kthread+0x2dd/0x3e0 [ 89.296268] ret_from_fork+0x22/0x30 [ 89.296906] Modules linked in: by running the following commands: 1. mkfs.ext4 -O mmp /dev/sda -b 1024 2. mount /dev/sda /home/test 3. echo "/dev/sda" > /sys/power/resume That happens because swsusp_check() calls set_blocksize() on the target partition which confuses the file system: Thread1 Thread2 mount /dev/sda /home/test get s_mmp_bh --> has mapped flag start kmmpd thread echo "/dev/sda" > /sys/power/resume resume_store software_resume swsusp_check set_blocksize truncate_inode_pages_range truncate_cleanup_page block_invalidatepage discard_buffer --> clean mapped flag write_mmp_block submit_bh submit_bh_wbc BUG_ON(!buffer_mapped(bh)) To address this issue, modify swsusp_check() to open the target block device with exclusive access. Signed-off-by: Ye Bin <yebin10(a)huawei.com> [ rjw: Subject and changelog edits ] Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/power/swap.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/kernel/power/swap.c b/kernel/power/swap.c index d7f6c1a288d33..4fde37fce4ea4 100644 --- a/kernel/power/swap.c +++ b/kernel/power/swap.c @@ -1512,9 +1512,10 @@ int swsusp_read(unsigned int *flags_p) int swsusp_check(void) { int error; + void *holder; hib_resume_bdev = blkdev_get_by_dev(swsusp_resume_device, - FMODE_READ, NULL); + FMODE_READ | FMODE_EXCL, &holder); if (!IS_ERR(hib_resume_bdev)) { set_blocksize(hib_resume_bdev, PAGE_SIZE); clear_page(swsusp_header); @@ -1536,7 +1537,7 @@ int swsusp_check(void) put: if (error) - blkdev_put(hib_resume_bdev, FMODE_READ); + blkdev_put(hib_resume_bdev, FMODE_READ | FMODE_EXCL); else pr_debug("Image signature found, resuming\n"); } else { -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS V3] README: README optimize
by Laibin Qiu 01 Nov '21

01 Nov '21

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4FS3G?from=project-issue CVE: NA --------------------------- There are some language problems in the README file, and MarkDown fromat syntax is not effective, and it needs to be adjusted. Signed-off-by: suqin <suqin2(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> --- README | 311 +++++++++++++++++++++++++++++---------------------------- 1 file changed, 161 insertions(+), 150 deletions(-) diff --git a/README b/README index 46c9ea352..3374c4726 100644 --- a/README +++ b/README @@ -1,174 +1,188 @@ -Contributions to openEuler kernel project -========================================= +# How to Contribute +------- -Sign CLA --------- +- [How to Contribute](#How to Contribute) -Before submitting any Contributions to openEuler, you have to sign CLA. + \- [Sign the CLA](#Sign the CLA) -See: - https://openeuler.org/zh/cla.html - https://openeuler.org/en/cla.html + \- [Steps of submitting patches](#Steps of submitting patches) -Steps of submitting patches ---------------------------- + \- [Use the unified patch format](#Use the unified patch format) -1. Compile and test your patches successfully. -2. Generate patches - Your patches should be based on top of latest openEuler branch, and should - use git-format-patch to generate patches, and if it's a patchset, it's - better to use --cover-letter option to describe what the patchset does. + \- [Define the patch format](#Define the patch format) - Using scripts/checkpatch.pl to make sure there's no coding style issue. + \- [Examples](#Examples) - And make sure your patch follow unified openEuler patch format describe - below. + \- [Email client - Thunderbird settings](#Email client - Thunderbird settings) -3. Send patch to openEuler mailing list - Use this command to send patches to openEuler mailing list: +- [Linux kernel](#Linux kernel) - git send-email *.patch -to="kernel(a)openeuler.org" --suppress-cc=all +### Sign the CLA - *NOTE*: that you must add --suppress-cc=all if you use git send-email, - otherwise the email will be cced to the people in upstream community and mailing - lists. +------- - *See*: How to send patches using git-send-email - https://git-scm.com/docs/git-send-email +Before making any contributions to openEuler, sign the CLA first. -4. Mark "v1, v2, v3 ..." in your patch subject if you have multiple versions - to send out. +Address: [https://openeuler.org/en/cla.html](https://openeuler.org/en/cla.html) - Use --subject-prefix="PATCH v2" option to add v2 tag for patchset. - git format-patch --subject-prefix="PATCH v2" -1 +### Steps of submitting patches +------- - Subject examples: - Subject: [PATCH v2 01/27] fork: fix some -Wmissing-prototypes warnings - Subject: [PATCH v3] ext2: improve scalability of bitmap searching +**Step 1** Compile and test your patches. -5. Upstream your kernel patch to kernel community is strongly recommended. - openEuler will sync up with kernel master timely. +**Step 2** Generate patches. -6. Sign your work - the Developer’s Certificate of Origin - As the same of upstream kernel community, you also need to sign your patch. +Your patches should be generated based on the latest openEuler branch using git-format-patch. If your patches are in a patchset, it is better to use the **--cover-letter** option to describe what the patchset does. - See: https://www.kernel.org/doc/html/latest/process/submitting-patches.html +Use **scripts/checkpatch.pl** to ensure that no coding style issue exists. - The sign-off is a simple line at the end of the explanation for the patch, - which certifies that you wrote it or otherwise have the right to pass it - on as an open-source patch. The rules are pretty simple: if you can certify - the below: +In addition, ensure that your patches comply with the unified openEuler patch format described below. - Developer’s Certificate of Origin 1.1 - ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +**Step 3** Send your patches to the openEuler mailing list. - By making a contribution to this project, I certify that: +To do so, run the following command: - (a) The contribution was created in whole or in part by me and I have - the right to submit it under the open source license indicated in - the file; or + `git send-email *.patch -to="kernel(a)openeuler.org" --suppress-cc=all` - (b The contribution is based upon previous work that, to the best of - my knowledge, is covered under an appropriate open source license - and I have the right under that license to submit that work with - modifications, whether created in whole or in part by me, under - the same open source license (unless I am permitted to submit under - a different license), as indicated in the file; or +*NOTE*: Add **--suppress-cc=all** if you use git-send-email; otherwise, the email will be copied to all people in the upstream community and mailing lists. - (c) The contribution was provided directly to me by some other person - who certified (a), (b) or (c) and I have not modified it. +For details about how to send patches using git-send-email, see [https://git-scm.com/docs/git-send-email](https://git-scm.com/docs/git-send-…. - (d) I understand and agree that this project and the contribution are - public and that a record of the contribution (including all personal - information I submit with it, including my sign-off) is maintained - indefinitely and may be redistributed consistent with this project - or the open source license(s) involved. +**Step 4** Mark "v1, v2, v3 ..." in your patch subject if you have multiple versions to send out. - then you just add a line saying: +Use the **--subject-prefix="PATCH v2"** option to add the v2 tag to the patchset. - Signed-off-by: Random J Developer <random(a)developer.example.org> + `git format-patch --subject-prefix="PATCH v2" -1` - using your real name (sorry, no pseudonyms or anonymous contributions.) +Subject examples: -Use unified patch format ------------------------- + Subject: [PATCH v2 01/27] fork: fix some -Wmissing-prototypes warnings + + Subject: [PATCH v3] ext2: improve scalability of bitmap searching + +**Step 5** Upstream your kernel patches to the kernel community (recommended). openEuler will synchronize with the kernel master in a timely manner. + +**Step 6** Sign your work - the Developer’s Certificate of Origin. + + Similar to the upstream kernel community, you also need to sign your patch. + + For details, see [https://www.kernel.org/doc/html/latest/process/submitting-patches.html](htt…. + + The sign-off is a simple line at the end of the explanation of the patch, which certifies that you wrote it or otherwise have the right to pass it on as an open source patch. The rules are pretty simple. You can certify as below: + + Developer’s Certificate of Origin 1.1 + + ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + + By making a contribution to this project, I certify that: + + (a) The contribution was created in whole or in part by me and I have the right to submit it under the open source license indicated in the file; + + (b) The contribution is based upon previous work that, to the best of my knowledge, is covered under an appropriate open source license and I have the right under that license to submit that work with modifications, whether created in whole or in part by me, under the same open source license (unless I am permitted to submit under a different license), as indicated in the file; + + (c) The contribution was provided directly to me by some other person who certified (a), (b) or (c) and I have not modified it. + + (d) I understand and agree that this project and the contribution are public and that a record of the contribution (including all personal information I submit with it, including my sign-off) is maintained indefinitely and may be redistributed consistent with this project or the open source license(s) involved. + +Then you add a line saying: + +Signed-off-by: Random J Developer <random(a)developer.example.org> + +Use your real name (sorry, no pseudonyms or anonymous contributions). + +### Use the unified patch format +------- Reasons: -1. long term maintainability - openEuler will merge massive patches. If all patches are merged by casual - changelog format without a unified format, the git log will be messy, and - then it's hard to figure out the original patch. +1. Long term maintainability + + openEuler will merge massive patches. If all patches are merged by casual + + changelog formats without a unified format, the git logs will be messy, and + + then it is hard to figure out the original patches. + +2. Kernel upgrade -2. kernel upgrade - We definitely will upgrade our openEuler kernel in someday, using strict - patch management will alleviate the pain to migrate patches during big upgrade. + We definitely will upgrade our openEuler kernel in someday, so strict patch management -3. easy for script parsing - Keyword highlighting is necessary for script parsing. + will alleviate the pain to migrate patches during big upgrades. -Patch format definition ------------------------ +3. Easy for script parsing + + Keyword highlighting is necessary for script parsing. + +### Define the patch format +------- + +[M] stands for "mandatory". + +[O] stands for "option". -[M] stands for "mandatory" -[O] stands for "option" $category can be: bug preparation, bugfix, perf, feature, doc, other... -If category is feature, then we also need to add feature name like below: - category: feature - feature: YYY (the feature name) +If category is feature, we need to add a feature name as below: -If the patch is related to CVE or bugzilla, then we need add the corresponding -tag like below (In general, it should include at least one of the following): - CVE: $cve-id - bugzilla: $bug-id +```cpp +category: feature +feature: YYY (the feature name) +``` -Additional changelog should include at least one of the flollwing: - 1) Why we should apply this patch - 2) What real problem in product does this patch resolved - 3) How could we reproduce this bug or how to test - 4) Other useful information for help to understand this patch or problem +If the patch is related to CVE or bugzilla, we need to add the corresponding tag as below (In general, it should include at least one of the following): -The detail information is very useful for porting patch to another kenrel branch. +```cpp +CVE: $cve-id +bugzilla: $bug-id +``` -Example for mainline patch: +Additional changelog should include at least one of the following: - mainline inclusion [M] - from $mainline-version [M] - commit $id [M] - category: $category [M] - bugzilla: $bug-id [O] - CVE: $cve-id [O] +1. Why we should apply this patch - additional changelog [O] +2. What real problems in the product does this patch resolved + +3. How could we reproduce this bug or how to test + +4. Other useful information for help to understand this patch or problem + +The detailed information is very useful for migrating a patch to another kernel branch. + +Example for mainline patch: - -------------------------------- +```cpp +mainline inclusion [M] +from $mainline-version [M] +commit $id [M] +category: $category [M] +bugzilla: $bug-id [O] +CVE: $cve-id [O] - original changelog +additional changelog [O] - Signed-off-by: $yourname <$yourname(a)huawei.com> [M] +-------------------------------- - ($mainline-version could be mainline-3.5, mainline-3.6, etc...) +original changelog +Signed-off-by: $yourname <$yourname(a)huawei.com> [M] +($mainline-version could be mainline-3.5, mainline-3.6, etc...) +``` -Examples --------- +### Examples +------- +```cpp mainline inclusion from mainline-4.10 commit 0becc0ae5b42828785b589f686725ff5bc3b9b25 category: bugfix bugzilla: 3004 -CVE: NA - -The patch fixes a BUG_ON in the product: injecting single bit ECC error -to memory before system boot use hardware inject tools, which cause a -large amount of CMCI during system booting . +CVE: N/A -[ 1.146580] mce: [Hardware Error]: Machine check events logged -[ 1.152908] ------------[ cut here ]------------ -[ 1.157751] kernel BUG at kernel/timer.c:951! -[ 1.162321] invalid opcode: 0000 [#1] SMP -... +The patch fixes a BUG_ON in the product: Injecting a single bit ECC error to the memory before system boot using hardware inject tools will cause a large amount of CMCI during system booting . +[ 1.146580] mce: [Hardware Error]: Machine check events logged +[ 1.152908] ------------[ cut here ]------------ +[ 1.157751] kernel BUG at kernel/timer.c:951! +[ 1.162321] invalid opcode: 0000 [#1] SMP ------------------------------------------------- @@ -177,50 +191,47 @@ original changelog <original S-O-B> Signed-off-by: Zhang San <zhangsan(a)huawei.com> Tested-by: Li Si <lisi(a)huawei.com> +``` + +### Email client - Thunderbird settings +------- + +If you are a new developer in the kernel community, it is highly recommended that you use the Thunderbird mail client. + +1. Thunderbird Installation + + Obtain the English version of Thunderbird from [http://www.mozilla.org/]( http://www.mozilla.org/) and install it on your system. + + Download URL: https://www.thunderbird.net/en-US/thunderbird/all/ + +2. Settings + + 2.1 Use the plain text format instead of the HTML format. + + Choose **Options > Account Settings > Composition & Addressing**, and do **NOT** select Compose message in HTML format. -Email Client - Thunderbird Settings ------------------------------------ + 2.2 Editor settings -If you are newly developer in the kernel community, it is highly recommended -to use thunderbird mail client. + **Tools > Options> Advanced > Config editor** -1. Thunderbird Installation - Get English version Thunderbird from http://www.mozilla.org/ and install - it on your system。 + \- To bring up the Thunderbird's registry editor, set **mailnews.send_plaintext_flowed** to **false**. - Download url: https://www.thunderbird.net/en-US/thunderbird/all/ + \- Disable HTML Format: Set **mail.identity.id1.compose_html** to **false**. -2. Settings - 2.1 Use plain text format instead of HTML format - Options -> Account Settings -> Composition & Addressing, do *NOT* select - "Compose message in HTML format". + \- Enable UTF-8: Set **prefs.converted-to-utf8** to **true**. - 2.2 Editor Settings - Tools->Options->Advanced->Config editor. + \- View messages in UTF-8: Set **mailnews.view_default_charset** to **UTF-8**. - - To bring up the thunderbird's registry editor, and set: - "mailnews.send_plaintext_flowed" to "false". - - Disable HTML Format: Set "mail.identity.id1.compose_html" to "false". - - Enable UTF8: Set "prefs.converted-to-utf8" to "true". - - View message in UTF-8: Set "mailnews.view_default_charset" to "UTF-8". - - Set mailnews.wraplength to 9999 for avoiding auto-wrap + \- Set **mailnews.wraplength** to **9999** to avoid auto-wrap. -Linux kernel -============ +# Linux kernel +------- -There are several guides for kernel developers and users. These guides can -be rendered in a number of formats, like HTML and PDF. Please read -Documentation/admin-guide/README.rst first. +There are several guides for kernel developers and users, which can be rendered in a number of formats, like HTML and PDF. You can read **Documentation/admin-guide/README.rst** first. -In order to build the documentation, use ``make htmldocs`` or -``make pdfdocs``. The formatted documentation can also be read online at: +In order to build the documentation, use **make htmldocs** or **make pdfdocs**. The formatted documentation can also be read online at: https://www.kernel.org/doc/html/latest/ - https://www.kernel.org/doc/html/latest/ +There are various text files in the Documentation/ subdirectory, several of which use the Restructured Text markup notation. See Documentation/00-INDEX for a list of what is contained in each file. -There are various text files in the Documentation/ subdirectory, -several of them using the Restructured Text markup notation. -See Documentation/00-INDEX for a list of what is contained in each file. +Read the **Documentation/process/changes.rst** file, as it contains the requirements for building and running the kernel, and information about the problems that may be caused by upgrading your kernel. -Please read the Documentation/process/changes.rst file, as it contains the -requirements for building and running the kernel, and information about -the problems which may result by upgrading your kernel. -- 2.22.0

1 0

[PATCH openEuler-1.0-LTS] blk-cgroup: synchronize blkg creation against policy deactivation
by Yang Yingliang 01 Nov '21

01 Nov '21

From: Yu Kuai <yukuai3(a)huawei.com> mainline inclusion from mainline-v5.16 commit 0c9d338c8443b06da8e8d3bfce824c5ea6d3488f category: bugfix bugzilla: 182378 CVE: NA --------------------------- Our test reports a null pointer dereference: [ 168.534653] ================================================================== [ 168.535614] Disabling lock debugging due to kernel taint [ 168.536346] BUG: kernel NULL pointer dereference, address: 0000000000000008 [ 168.537274] #PF: supervisor read access in kernel mode [ 168.537964] #PF: error_code(0x0000) - not-present page [ 168.538667] PGD 0 P4D 0 [ 168.539025] Oops: 0000 [#1] PREEMPT SMP KASAN [ 168.539656] CPU: 13 PID: 759 Comm: bash Tainted: G B 5.15.0-rc2-next-202100 [ 168.540954] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_0738364 [ 168.542736] RIP: 0010:bfq_pd_init+0x88/0x1e0 [ 168.543318] Code: 98 00 00 00 e8 c9 e4 5b ff 4c 8b 65 00 49 8d 7c 24 08 e8 bb e4 5b ff 4d0 [ 168.545803] RSP: 0018:ffff88817095f9c0 EFLAGS: 00010002 [ 168.546497] RAX: 0000000000000001 RBX: ffff888101a1c000 RCX: 0000000000000000 [ 168.547438] RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff888106553428 [ 168.548402] RBP: ffff888106553400 R08: ffffffff961bcaf4 R09: 0000000000000001 [ 168.549365] R10: ffffffffa2e16c27 R11: fffffbfff45c2d84 R12: 0000000000000000 [ 168.550291] R13: ffff888101a1c098 R14: ffff88810c7a08c8 R15: ffffffffa55541a0 [ 168.551221] FS: 00007fac75227700(0000) GS:ffff88839ba80000(0000) knlGS:0000000000000000 [ 168.552278] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 168.553040] CR2: 0000000000000008 CR3: 0000000165ce7000 CR4: 00000000000006e0 [ 168.554000] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 168.554929] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 168.555888] Call Trace: [ 168.556221] <TASK> [ 168.556510] blkg_create+0x1c0/0x8c0 [ 168.556989] blkg_conf_prep+0x574/0x650 [ 168.557502] ? stack_trace_save+0x99/0xd0 [ 168.558033] ? blkcg_conf_open_bdev+0x1b0/0x1b0 [ 168.558629] tg_set_conf.constprop.0+0xb9/0x280 [ 168.559231] ? kasan_set_track+0x29/0x40 [ 168.559758] ? kasan_set_free_info+0x30/0x60 [ 168.560344] ? tg_set_limit+0xae0/0xae0 [ 168.560853] ? do_sys_openat2+0x33b/0x640 [ 168.561383] ? do_sys_open+0xa2/0x100 [ 168.561877] ? __x64_sys_open+0x4e/0x60 [ 168.562383] ? __kasan_check_write+0x20/0x30 [ 168.562951] ? copyin+0x48/0x70 [ 168.563390] ? _copy_from_iter+0x234/0x9e0 [ 168.563948] tg_set_conf_u64+0x17/0x20 [ 168.564467] cgroup_file_write+0x1ad/0x380 [ 168.565014] ? cgroup_file_poll+0x80/0x80 [ 168.565568] ? __mutex_lock_slowpath+0x30/0x30 [ 168.566165] ? pgd_free+0x100/0x160 [ 168.566649] kernfs_fop_write_iter+0x21d/0x340 [ 168.567246] ? cgroup_file_poll+0x80/0x80 [ 168.567796] new_sync_write+0x29f/0x3c0 [ 168.568314] ? new_sync_read+0x410/0x410 [ 168.568840] ? __handle_mm_fault+0x1c97/0x2d80 [ 168.569425] ? copy_page_range+0x2b10/0x2b10 [ 168.570007] ? _raw_read_lock_bh+0xa0/0xa0 [ 168.570622] vfs_write+0x46e/0x630 [ 168.571091] ksys_write+0xcd/0x1e0 [ 168.571563] ? __x64_sys_read+0x60/0x60 [ 168.572081] ? __kasan_check_write+0x20/0x30 [ 168.572659] ? do_user_addr_fault+0x446/0xff0 [ 168.573264] __x64_sys_write+0x46/0x60 [ 168.573774] do_syscall_64+0x35/0x80 [ 168.574264] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 168.574960] RIP: 0033:0x7fac74915130 [ 168.575456] Code: 73 01 c3 48 8b 0d 58 ed 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 444 [ 168.577969] RSP: 002b:00007ffc3080e288 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 168.578986] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007fac74915130 [ 168.579937] RDX: 0000000000000009 RSI: 000056007669f080 RDI: 0000000000000001 [ 168.580884] RBP: 000056007669f080 R08: 000000000000000a R09: 00007fac75227700 [ 168.581841] R10: 000056007655c8f0 R11: 0000000000000246 R12: 0000000000000009 [ 168.582796] R13: 0000000000000001 R14: 00007fac74be55e0 R15: 00007fac74be08c0 [ 168.583757] </TASK> [ 168.584063] Modules linked in: [ 168.584494] CR2: 0000000000000008 [ 168.584964] ---[ end trace 2475611ad0f77a1a ]--- This is because blkg_alloc() is called from blkg_conf_prep() without holding 'q->queue_lock', and elevator is exited before blkg_create(): thread 1 thread 2 blkg_conf_prep spin_lock_irq(&q->queue_lock); blkg_lookup_check -> return NULL spin_unlock_irq(&q->queue_lock); blkg_alloc blkcg_policy_enabled -> true pd = ->pd_alloc_fn blkg->pd[i] = pd blk_mq_exit_sched bfq_exit_queue blkcg_deactivate_policy spin_lock_irq(&q->queue_lock); __clear_bit(pol->plid, q->blkcg_pols); spin_unlock_irq(&q->queue_lock); q->elevator = NULL; spin_lock_irq(&q->queue_lock); blkg_create if (blkg->pd[i]) ->pd_init_fn -> q->elevator is NULL spin_unlock_irq(&q->queue_lock); Because blkcg_deactivate_policy() requires queue to be frozen, we can grab q_usage_counter to synchoronize blkg_conf_prep() against blkcg_deactivate_policy(). Fixes: e21b7a0b9887 ("block, bfq: add full hierarchical scheduling and cgroups support") Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Acked-by: Tejun Heo <tj(a)kernel.org> Link: https://lore.kernel.org/r/20211020014036.2141723-1-yukuai3@huawei.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflict: block/blk-cgroup.c - commit ed6cddefdfd3 ("block: convert the rest of block to bdev_get_queue") is not backported. - commit 015d254cb02b ("blkcg: separate blkcg_conf_get_disk() out of blkg_conf_prep()") is not backported. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/blk-cgroup.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index 7dca3a0144243..d4a8d8fbe1a0e 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -857,6 +857,14 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol, q = disk->queue; + /* + * blkcg_deactivate_policy() requires queue to be frozen, we can grab + * q_usage_counter to prevent concurrent with blkcg_deactivate_policy(). + */ + ret = blk_queue_enter(q, 0); + if (ret) + goto fail; + rcu_read_lock(); spin_lock_irq(q->queue_lock); @@ -891,13 +899,13 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol, new_blkg = blkg_alloc(pos, q, GFP_KERNEL); if (unlikely(!new_blkg)) { ret = -ENOMEM; - goto fail; + goto fail_exit_queue; } if (radix_tree_preload(GFP_KERNEL)) { blkg_free(new_blkg); ret = -ENOMEM; - goto fail; + goto fail_exit_queue; } rcu_read_lock(); @@ -926,6 +934,7 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol, goto success; } success: + blk_queue_exit(q); ctx->disk = disk; ctx->blkg = blkg; ctx->body = body; @@ -936,6 +945,8 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol, fail_unlock: spin_unlock_irq(q->queue_lock); rcu_read_unlock(); +fail_exit_queue: + blk_queue_exit(q); fail: put_disk_and_module(disk); /* -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] isdn: cpai: check ctr->cnr to avoid array index out of bound
by Yang Yingliang 01 Nov '21

01 Nov '21

From: Xiaolong Huang <butterflyhuangxx(a)gmail.com> stable inclusion from linux-4.19.214 commit 7d91adc0ccb060ce564103315189466eb822cc6a CVE: CVE-2021-3896 -------------------------------- commit 1f3e2e97c003f80c4b087092b225c8787ff91e4d upstream. The cmtp_add_connection() would add a cmtp session to a controller and run a kernel thread to process cmtp. __module_get(THIS_MODULE); session->task = kthread_run(cmtp_session, session, "kcmtpd_ctr_%d", session->num); During this process, the kernel thread would call detach_capi_ctr() to detach a register controller. if the controller was not attached yet, detach_capi_ctr() would trigger an array-index-out-bounds bug. [ 46.866069][ T6479] UBSAN: array-index-out-of-bounds in drivers/isdn/capi/kcapi.c:483:21 [ 46.867196][ T6479] index -1 is out of range for type 'capi_ctr *[32]' [ 46.867982][ T6479] CPU: 1 PID: 6479 Comm: kcmtpd_ctr_0 Not tainted 5.15.0-rc2+ #8 [ 46.869002][ T6479] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 [ 46.870107][ T6479] Call Trace: [ 46.870473][ T6479] dump_stack_lvl+0x57/0x7d [ 46.870974][ T6479] ubsan_epilogue+0x5/0x40 [ 46.871458][ T6479] __ubsan_handle_out_of_bounds.cold+0x43/0x48 [ 46.872135][ T6479] detach_capi_ctr+0x64/0xc0 [ 46.872639][ T6479] cmtp_session+0x5c8/0x5d0 [ 46.873131][ T6479] ? __init_waitqueue_head+0x60/0x60 [ 46.873712][ T6479] ? cmtp_add_msgpart+0x120/0x120 [ 46.874256][ T6479] kthread+0x147/0x170 [ 46.874709][ T6479] ? set_kthread_struct+0x40/0x40 [ 46.875248][ T6479] ret_from_fork+0x1f/0x30 [ 46.875773][ T6479] Signed-off-by: Xiaolong Huang <butterflyhuangxx(a)gmail.com> Acked-by: Arnd Bergmann <arnd(a)arndb.de> Link: https://lore.kernel.org/r/20211008065830.305057-1-butterflyhuangxx@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Rui Xiang <rui.xiang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/isdn/capi/kcapi.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/isdn/capi/kcapi.c b/drivers/isdn/capi/kcapi.c index a4ceb61c5b603..ed9ee2bbf232e 100644 --- a/drivers/isdn/capi/kcapi.c +++ b/drivers/isdn/capi/kcapi.c @@ -565,6 +565,11 @@ int detach_capi_ctr(struct capi_ctr *ctr) ctr_down(ctr, CAPI_CTR_DETACHED); + if (ctr->cnr < 1 || ctr->cnr - 1 >= CAPI_MAXCONTR) { + err = -EINVAL; + goto unlock_out; + } + if (capi_controller[ctr->cnr - 1] != ctr) { err = -EINVAL; goto unlock_out; -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] nbd: Fix use-after-free in pid_show
by Yang Yingliang 01 Nov '21

01 Nov '21

From: Ye Bin <yebin10(a)huawei.com> mainline inclusion from mainline-v5.16 commit 0c98057be9efa32de78dbc4685fc73da9d71faa1 category: bugfix bugzilla: 182939 CVE: NA ----------------------------------------------- I got issue as follows: [ 263.886511] BUG: KASAN: use-after-free in pid_show+0x11f/0x13f [ 263.888359] Read of size 4 at addr ffff8880bf0648c0 by task cat/746 [ 263.890479] CPU: 0 PID: 746 Comm: cat Not tainted 4.19.90-dirty #140 [ 263.893162] Call Trace: [ 263.893509] dump_stack+0x108/0x15f [ 263.893999] print_address_description+0xa5/0x372 [ 263.894641] kasan_report.cold+0x236/0x2a8 [ 263.895696] __asan_report_load4_noabort+0x25/0x30 [ 263.896365] pid_show+0x11f/0x13f [ 263.897422] dev_attr_show+0x48/0x90 [ 263.898361] sysfs_kf_seq_show+0x24d/0x4b0 [ 263.899479] kernfs_seq_show+0x14e/0x1b0 [ 263.900029] seq_read+0x43f/0x1150 [ 263.900499] kernfs_fop_read+0xc7/0x5a0 [ 263.903764] vfs_read+0x113/0x350 [ 263.904231] ksys_read+0x103/0x270 [ 263.905230] __x64_sys_read+0x77/0xc0 [ 263.906284] do_syscall_64+0x106/0x360 [ 263.906797] entry_SYSCALL_64_after_hwframe+0x44/0xa9 Reproduce this issue as follows: 1. nbd-server 8000 /tmp/disk 2. nbd-client localhost 8000 /dev/nbd1 3. cat /sys/block/nbd1/pid Then trigger use-after-free in pid_show. Reason is after do step '2', nbd-client progress is already exit. So it's task_struct already freed. To solve this issue, revert part of 6521d39a64b3's modify and remove useless 'recv_task' member of nbd_device. Fixes: 6521d39a64b3 ("nbd: Remove variable 'pid'") Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: Josef Bacik <josef(a)toxicpanda.com> Link: https://lore.kernel.org/r/20211020073959.2679255-1-yebin10@huawei.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> conflicts: drivers/block/nbd.c Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/block/nbd.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 45e6ae6add382..2a3794801704a 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -112,11 +112,11 @@ struct nbd_device { struct workqueue_struct *recv_workq; struct list_head list; - struct task_struct *task_recv; struct task_struct *task_setup; struct completion *destroy_complete; unsigned long flags; + pid_t pid; /* pid of nbd-client, if attached */ }; #define NBD_CMD_REQUEUED 1 @@ -211,7 +211,7 @@ static ssize_t pid_show(struct device *dev, struct gendisk *disk = dev_to_disk(dev); struct nbd_device *nbd = (struct nbd_device *)disk->private_data; - return sprintf(buf, "%d\n", task_pid_nr(nbd->task_recv)); + return sprintf(buf, "%d\n", nbd->pid); } static const struct device_attribute pid_attr = { @@ -329,7 +329,7 @@ static void nbd_size_set(struct nbd_device *nbd, loff_t blocksize, struct nbd_config *config = nbd->config; config->blksize = blocksize; config->bytesize = blocksize * nr_blocks; - if (nbd->task_recv != NULL) + if (nbd->pid) nbd_size_update(nbd, false); } @@ -1234,7 +1234,7 @@ static void nbd_config_put(struct nbd_device *nbd) if (test_and_clear_bit(NBD_RT_HAS_PID_FILE, &config->runtime_flags)) device_remove_file(disk_to_dev(nbd->disk), &pid_attr); - nbd->task_recv = NULL; + nbd->pid = 0; nbd_clear_sock(nbd); if (config->num_connections) { int i; @@ -1269,7 +1269,7 @@ static int nbd_start_device(struct nbd_device *nbd) int num_connections = config->num_connections; int error = 0, i; - if (nbd->task_recv) + if (nbd->pid) return -EBUSY; if (!config->socks) return -EINVAL; @@ -1288,7 +1288,7 @@ static int nbd_start_device(struct nbd_device *nbd) } blk_mq_update_nr_hw_queues(&nbd->tag_set, config->num_connections); - nbd->task_recv = current; + nbd->pid = task_pid_nr(current); nbd_parse_flags(nbd); @@ -1546,8 +1546,8 @@ static int nbd_dbg_tasks_show(struct seq_file *s, void *unused) { struct nbd_device *nbd = s->private; - if (nbd->task_recv) - seq_printf(s, "recv: %d\n", task_pid_nr(nbd->task_recv)); + if (nbd->pid) + seq_printf(s, "recv: %d\n", nbd->pid); return 0; } @@ -2106,7 +2106,7 @@ static int nbd_genl_reconfigure(struct sk_buff *skb, struct genl_info *info) mutex_lock(&nbd->config_lock); config = nbd->config; if (!test_bit(NBD_RT_BOUND, &config->runtime_flags) || - !nbd->task_recv) { + !nbd->pid) { dev_err(nbd_to_dev(nbd), "not configured, cannot reconfigure\n"); ret = -EINVAL; -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] iommu/arm-smmu-v3: Add suspend and resume support
by Yang Yingliang 01 Nov '21

01 Nov '21

From: Bixuan Cui <cuibixuan(a)huawei.com> ascend inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4DZ7Q CVE: NA ------------------------------------------------------- Add suspend and resume support for smmuv3. The smmu is stopped when suspending and started when resuming. Signed-off-by: Bixuan Cui <cuibixuan(a)huawei.com> Signed-off-by: Zhou Guanghui <zhouguanghui1(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/iommu/arm-smmu-v3.c | 98 +++++++++++++++++++++++++++++++++---- 1 file changed, 88 insertions(+), 10 deletions(-) diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c index 560980c54014a..12d503bb3b1e0 100644 --- a/drivers/iommu/arm-smmu-v3.c +++ b/drivers/iommu/arm-smmu-v3.c @@ -693,6 +693,7 @@ struct arm_smmu_device { unsigned int mpam_partid_max; unsigned int mpam_pmg_max; + bool bypass; }; struct arm_smmu_stream { @@ -3455,6 +3456,13 @@ static void arm_smmu_write_msi_msg(struct msi_desc *desc, struct msi_msg *msg) doorbell = (((u64)msg->address_hi) << 32) | msg->address_lo; doorbell &= MSI_CFG0_ADDR_MASK; +#ifdef CONFIG_PM_SLEEP + /* Saves the msg (base addr of msi irq) and restores it during resume */ + desc->msg.address_lo = msg->address_lo; + desc->msg.address_hi = msg->address_hi; + desc->msg.data = msg->data; +#endif + writeq_relaxed(doorbell, smmu->base + cfg[0]); writel_relaxed(msg->data, smmu->base + cfg[1]); writel_relaxed(ARM_SMMU_MEMATTR_DEVICE_nGnRE, smmu->base + cfg[2]); @@ -3510,6 +3518,40 @@ static void arm_smmu_setup_msis(struct arm_smmu_device *smmu) devm_add_action(dev, arm_smmu_free_msis, dev); } +#ifdef CONFIG_PM_SLEEP +static void arm_smmu_resume_msis(struct arm_smmu_device *smmu) +{ + struct msi_desc *desc; + struct device *dev = smmu->dev; + + for_each_msi_entry(desc, dev) { + switch (desc->platform.msi_index) { + case EVTQ_MSI_INDEX: + case GERROR_MSI_INDEX: + case PRIQ_MSI_INDEX: { + phys_addr_t *cfg = arm_smmu_msi_cfg[desc->platform.msi_index]; + struct msi_msg *msg = &desc->msg; + phys_addr_t doorbell = (((u64)msg->address_hi) << 32) | msg->address_lo; + + doorbell &= MSI_CFG0_ADDR_MASK; + writeq_relaxed(doorbell, smmu->base + cfg[0]); + writel_relaxed(msg->data, smmu->base + cfg[1]); + writel_relaxed(ARM_SMMU_MEMATTR_DEVICE_nGnRE, + smmu->base + cfg[2]); + break; + } + default: + continue; + + } + } +} +#else +static void arm_smmu_resume_msis(struct arm_smmu_device *smmu) +{ +} +#endif + static void arm_smmu_setup_message_based_spi(struct arm_smmu_device *smmu) { struct irq_desc *desc; @@ -3541,11 +3583,17 @@ static void arm_smmu_setup_message_based_spi(struct arm_smmu_device *smmu) } } -static void arm_smmu_setup_unique_irqs(struct arm_smmu_device *smmu) +static void arm_smmu_setup_unique_irqs(struct arm_smmu_device *smmu, bool resume) { int irq, ret; - arm_smmu_setup_msis(smmu); + if (!resume) + arm_smmu_setup_msis(smmu); + else { + /* The irq doesn't need to be re-requested during resume */ + arm_smmu_resume_msis(smmu); + return; + } /* Request interrupt lines */ irq = smmu->evtq.q.irq; @@ -3587,7 +3635,7 @@ static void arm_smmu_setup_unique_irqs(struct arm_smmu_device *smmu) } } -static int arm_smmu_setup_irqs(struct arm_smmu_device *smmu) +static int arm_smmu_setup_irqs(struct arm_smmu_device *smmu, bool resume) { int ret, irq; u32 irqen_flags = IRQ_CTRL_EVTQ_IRQEN | IRQ_CTRL_GERROR_IRQEN; @@ -3614,7 +3662,7 @@ static int arm_smmu_setup_irqs(struct arm_smmu_device *smmu) if (ret < 0) dev_warn(smmu->dev, "failed to enable combined irq\n"); } else - arm_smmu_setup_unique_irqs(smmu); + arm_smmu_setup_unique_irqs(smmu, resume); if (smmu->features & ARM_SMMU_FEAT_PRI) irqen_flags |= IRQ_CTRL_PRIQ_IRQEN; @@ -3642,7 +3690,7 @@ static int arm_smmu_device_disable(struct arm_smmu_device *smmu) return ret; } -static int arm_smmu_device_reset(struct arm_smmu_device *smmu, bool bypass) +static int arm_smmu_device_reset(struct arm_smmu_device *smmu, bool resume) { int ret; u32 reg, enables; @@ -3747,7 +3795,7 @@ static int arm_smmu_device_reset(struct arm_smmu_device *smmu, bool bypass) } } - ret = arm_smmu_setup_irqs(smmu); + ret = arm_smmu_setup_irqs(smmu, resume); if (ret) { dev_err(smmu->dev, "failed to setup irqs\n"); return ret; @@ -3757,7 +3805,7 @@ static int arm_smmu_device_reset(struct arm_smmu_device *smmu, bool bypass) enables &= ~(CR0_EVTQEN | CR0_PRIQEN); /* Enable the SMMU interface, or ensure bypass */ - if (!bypass || disable_bypass) { + if (!smmu->bypass || disable_bypass) { enables |= CR0_SMMUEN; } else { ret = arm_smmu_update_gbpa(smmu, 0, GBPA_ABORT); @@ -4383,6 +4431,26 @@ int arm_smmu_get_dev_user_mpam_en(struct device *dev, int *user_mpam_en) } EXPORT_SYMBOL(arm_smmu_get_dev_user_mpam_en); +#ifdef CONFIG_PM_SLEEP +static int arm_smmu_suspend(struct device *dev) +{ + /* + * The smmu is powered off and related registers are automatically + * cleared when suspend. No need to do anything. + */ + return 0; +} + +static int arm_smmu_resume(struct device *dev) +{ + struct arm_smmu_device *smmu = dev_get_drvdata(dev); + + arm_smmu_device_reset(smmu, true); + + return 0; +} +#endif + static int arm_smmu_device_probe(struct platform_device *pdev) { int irq, ret; @@ -4390,7 +4458,6 @@ static int arm_smmu_device_probe(struct platform_device *pdev) resource_size_t ioaddr; struct arm_smmu_device *smmu; struct device *dev = &pdev->dev; - bool bypass; smmu = devm_kzalloc(dev, sizeof(*smmu), GFP_KERNEL); if (!smmu) { @@ -4408,7 +4475,7 @@ static int arm_smmu_device_probe(struct platform_device *pdev) } /* Set bypass mode according to firmware probing result */ - bypass = !!ret; + smmu->bypass = !!ret; /* Base address */ res = platform_get_resource(pdev, IORESOURCE_MEM, 0); @@ -4454,7 +4521,7 @@ static int arm_smmu_device_probe(struct platform_device *pdev) platform_set_drvdata(pdev, smmu); /* Reset the device */ - ret = arm_smmu_device_reset(smmu, bypass); + ret = arm_smmu_device_reset(smmu, false); if (ret) return ret; @@ -4527,11 +4594,22 @@ static const struct of_device_id arm_smmu_of_match[] = { }; MODULE_DEVICE_TABLE(of, arm_smmu_of_match); +#ifdef CONFIG_PM_SLEEP +static const struct dev_pm_ops arm_smmu_pm_ops = { + .suspend = arm_smmu_suspend, + .resume = arm_smmu_resume, +}; +#define ARM_SMMU_PM_OPS (&arm_smmu_pm_ops) +#else +#define ARM_SMMU_PM_OPS NULL +#endif + static struct platform_driver arm_smmu_driver = { .driver = { .name = "arm-smmu-v3", .of_match_table = of_match_ptr(arm_smmu_of_match), .suppress_bind_attrs = true, + .pm = ARM_SMMU_PM_OPS, }, .probe = arm_smmu_device_probe, .remove = arm_smmu_device_remove, -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/2] scsi: scsi_debug: Fix out-of-bound read in resp_readcap16()
by Yang Yingliang 01 Nov '21

01 Nov '21

From: Ye Bin <yebin10(a)huawei.com> mainline inclusion from mainline-v5.16 commit 4e3ace0051e7e504b55d239daab8789dd89b863c category: bugfix bugzilla: 176010 CVE: NA ----------------------------------------------- The following warning was observed running syzkaller: [ 3813.830724] sg_write: data in/out 65466/242 bytes for SCSI command 0x9e-- guessing data in; [ 3813.830724] program syz-executor not setting count and/or reply_len properly [ 3813.836956] ================================================================== [ 3813.839465] BUG: KASAN: stack-out-of-bounds in sg_copy_buffer+0x157/0x1e0 [ 3813.841773] Read of size 4096 at addr ffff8883cf80f540 by task syz-executor/1549 [ 3813.846612] Call Trace: [ 3813.846995] dump_stack+0x108/0x15f [ 3813.847524] print_address_description+0xa5/0x372 [ 3813.848243] kasan_report.cold+0x236/0x2a8 [ 3813.849439] check_memory_region+0x240/0x270 [ 3813.850094] memcpy+0x30/0x80 [ 3813.850553] sg_copy_buffer+0x157/0x1e0 [ 3813.853032] sg_copy_from_buffer+0x13/0x20 [ 3813.853660] fill_from_dev_buffer+0x135/0x370 [ 3813.854329] resp_readcap16+0x1ac/0x280 [ 3813.856917] schedule_resp+0x41f/0x1630 [ 3813.858203] scsi_debug_queuecommand+0xb32/0x17e0 [ 3813.862699] scsi_dispatch_cmd+0x330/0x950 [ 3813.863329] scsi_request_fn+0xd8e/0x1710 [ 3813.863946] __blk_run_queue+0x10b/0x230 [ 3813.864544] blk_execute_rq_nowait+0x1d8/0x400 [ 3813.865220] sg_common_write.isra.0+0xe61/0x2420 [ 3813.871637] sg_write+0x6c8/0xef0 [ 3813.878853] __vfs_write+0xe4/0x800 [ 3813.883487] vfs_write+0x17b/0x530 [ 3813.884008] ksys_write+0x103/0x270 [ 3813.886268] __x64_sys_write+0x77/0xc0 [ 3813.886841] do_syscall_64+0x106/0x360 [ 3813.887415] entry_SYSCALL_64_after_hwframe+0x44/0xa9 This issue can be reproduced with the following syzkaller log: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd/3\x00') open_by_handle_at(r1, &(0x7f00000003c0)=ANY=[@ANYRESHEX], 0x602000) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40782) write$binfmt_aout(r2, &(0x7f0000000340)=ANY=[@ANYBLOB="00000000deff000000000000000000000000000000000000000000000000000047f007af9e107a41ec395f1bded7be24277a1501ff6196a83366f4e6362bc0ff2b247f68a972989b094b2da4fb3607fcf611a22dd04310d28c75039d"], 0x126) In resp_readcap16() we get "int alloc_len" value -1104926854, and then pass the huge arr_len to fill_from_dev_buffer(), but arr is only 32 bytes. This leads to OOB in sg_copy_buffer(). To solve this issue, define alloc_len as u32. Link: https://lore.kernel.org/r/20211013033913.2551004-2-yebin10@huawei.com Acked-by: Douglas Gilbert <dgilbert(a)interlog.com> Signed-off-by: Ye Bin <yebin10(a)huawei.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> conflicts: drivers/scsi/scsi_debug.c Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/scsi/scsi_debug.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c index 082b2695e02f3..d8befc6fbec9c 100644 --- a/drivers/scsi/scsi_debug.c +++ b/drivers/scsi/scsi_debug.c @@ -1665,7 +1665,7 @@ static int resp_readcap16(struct scsi_cmnd *scp, { unsigned char *cmd = scp->cmnd; unsigned char arr[SDEBUG_READCAP16_ARR_SZ]; - int alloc_len; + u32 alloc_len; alloc_len = get_unaligned_be32(cmd + 10); /* following just in case virtual_gb changed */ @@ -1694,7 +1694,7 @@ static int resp_readcap16(struct scsi_cmnd *scp, } return fill_from_dev_buffer(scp, arr, - min(alloc_len, SDEBUG_READCAP16_ARR_SZ)); + min_t(u32, alloc_len, SDEBUG_READCAP16_ARR_SZ)); } #define SDEBUG_MAX_TGTPGS_ARR_SZ 1412 -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS V2] README: README optimize
by Laibin Qiu 01 Nov '21

01 Nov '21

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4FS3G?from=project-issue CVE: NA --------------------------- There are some language problems in the README file, and MarkDown fromat syntax is not effective, and it needs to be adjusted. Signed-off-by: suqin <suqin2(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- README | 226 ---------------------------------------- README.md | 237 ++++++++++++++++++++++++++++++++++++++++++ scripts/checkpatch.pl | 2 +- 3 files changed, 238 insertions(+), 227 deletions(-) delete mode 100644 README create mode 100644 README.md diff --git a/README b/README deleted file mode 100644 index 46c9ea352..000000000 --- a/README +++ /dev/null @@ -1,226 +0,0 @@ -Contributions to openEuler kernel project -========================================= - -Sign CLA --------- - -Before submitting any Contributions to openEuler, you have to sign CLA. - -See: - https://openeuler.org/zh/cla.html - https://openeuler.org/en/cla.html - -Steps of submitting patches ---------------------------- - -1. Compile and test your patches successfully. -2. Generate patches - Your patches should be based on top of latest openEuler branch, and should - use git-format-patch to generate patches, and if it's a patchset, it's - better to use --cover-letter option to describe what the patchset does. - - Using scripts/checkpatch.pl to make sure there's no coding style issue. - - And make sure your patch follow unified openEuler patch format describe - below. - -3. Send patch to openEuler mailing list - Use this command to send patches to openEuler mailing list: - - git send-email *.patch -to="kernel(a)openeuler.org" --suppress-cc=all - - *NOTE*: that you must add --suppress-cc=all if you use git send-email, - otherwise the email will be cced to the people in upstream community and mailing - lists. - - *See*: How to send patches using git-send-email - https://git-scm.com/docs/git-send-email - -4. Mark "v1, v2, v3 ..." in your patch subject if you have multiple versions - to send out. - - Use --subject-prefix="PATCH v2" option to add v2 tag for patchset. - git format-patch --subject-prefix="PATCH v2" -1 - - Subject examples: - Subject: [PATCH v2 01/27] fork: fix some -Wmissing-prototypes warnings - Subject: [PATCH v3] ext2: improve scalability of bitmap searching - -5. Upstream your kernel patch to kernel community is strongly recommended. - openEuler will sync up with kernel master timely. - -6. Sign your work - the Developer’s Certificate of Origin - As the same of upstream kernel community, you also need to sign your patch. - - See: https://www.kernel.org/doc/html/latest/process/submitting-patches.html - - The sign-off is a simple line at the end of the explanation for the patch, - which certifies that you wrote it or otherwise have the right to pass it - on as an open-source patch. The rules are pretty simple: if you can certify - the below: - - Developer’s Certificate of Origin 1.1 - ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - - By making a contribution to this project, I certify that: - - (a) The contribution was created in whole or in part by me and I have - the right to submit it under the open source license indicated in - the file; or - - (b The contribution is based upon previous work that, to the best of - my knowledge, is covered under an appropriate open source license - and I have the right under that license to submit that work with - modifications, whether created in whole or in part by me, under - the same open source license (unless I am permitted to submit under - a different license), as indicated in the file; or - - (c) The contribution was provided directly to me by some other person - who certified (a), (b) or (c) and I have not modified it. - - (d) I understand and agree that this project and the contribution are - public and that a record of the contribution (including all personal - information I submit with it, including my sign-off) is maintained - indefinitely and may be redistributed consistent with this project - or the open source license(s) involved. - - then you just add a line saying: - - Signed-off-by: Random J Developer <random(a)developer.example.org> - - using your real name (sorry, no pseudonyms or anonymous contributions.) - -Use unified patch format ------------------------- - -Reasons: - -1. long term maintainability - openEuler will merge massive patches. If all patches are merged by casual - changelog format without a unified format, the git log will be messy, and - then it's hard to figure out the original patch. - -2. kernel upgrade - We definitely will upgrade our openEuler kernel in someday, using strict - patch management will alleviate the pain to migrate patches during big upgrade. - -3. easy for script parsing - Keyword highlighting is necessary for script parsing. - -Patch format definition ------------------------ - -[M] stands for "mandatory" -[O] stands for "option" -$category can be: bug preparation, bugfix, perf, feature, doc, other... - -If category is feature, then we also need to add feature name like below: - category: feature - feature: YYY (the feature name) - -If the patch is related to CVE or bugzilla, then we need add the corresponding -tag like below (In general, it should include at least one of the following): - CVE: $cve-id - bugzilla: $bug-id - -Additional changelog should include at least one of the flollwing: - 1) Why we should apply this patch - 2) What real problem in product does this patch resolved - 3) How could we reproduce this bug or how to test - 4) Other useful information for help to understand this patch or problem - -The detail information is very useful for porting patch to another kenrel branch. - -Example for mainline patch: - - mainline inclusion [M] - from $mainline-version [M] - commit $id [M] - category: $category [M] - bugzilla: $bug-id [O] - CVE: $cve-id [O] - - additional changelog [O] - - -------------------------------- - - original changelog - - Signed-off-by: $yourname <$yourname(a)huawei.com> [M] - - ($mainline-version could be mainline-3.5, mainline-3.6, etc...) - -Examples --------- - -mainline inclusion -from mainline-4.10 -commit 0becc0ae5b42828785b589f686725ff5bc3b9b25 -category: bugfix -bugzilla: 3004 -CVE: NA - -The patch fixes a BUG_ON in the product: injecting single bit ECC error -to memory before system boot use hardware inject tools, which cause a -large amount of CMCI during system booting . - -[ 1.146580] mce: [Hardware Error]: Machine check events logged -[ 1.152908] ------------[ cut here ]------------ -[ 1.157751] kernel BUG at kernel/timer.c:951! -[ 1.162321] invalid opcode: 0000 [#1] SMP -... - -------------------------------------------------- - -original changelog - -<original S-O-B> -Signed-off-by: Zhang San <zhangsan(a)huawei.com> -Tested-by: Li Si <lisi(a)huawei.com> - -Email Client - Thunderbird Settings ------------------------------------ - -If you are newly developer in the kernel community, it is highly recommended -to use thunderbird mail client. - -1. Thunderbird Installation - Get English version Thunderbird from http://www.mozilla.org/ and install - it on your system。 - - Download url: https://www.thunderbird.net/en-US/thunderbird/all/ - -2. Settings - 2.1 Use plain text format instead of HTML format - Options -> Account Settings -> Composition & Addressing, do *NOT* select - "Compose message in HTML format". - - 2.2 Editor Settings - Tools->Options->Advanced->Config editor. - - - To bring up the thunderbird's registry editor, and set: - "mailnews.send_plaintext_flowed" to "false". - - Disable HTML Format: Set "mail.identity.id1.compose_html" to "false". - - Enable UTF8: Set "prefs.converted-to-utf8" to "true". - - View message in UTF-8: Set "mailnews.view_default_charset" to "UTF-8". - - Set mailnews.wraplength to 9999 for avoiding auto-wrap - -Linux kernel -============ - -There are several guides for kernel developers and users. These guides can -be rendered in a number of formats, like HTML and PDF. Please read -Documentation/admin-guide/README.rst first. - -In order to build the documentation, use ``make htmldocs`` or -``make pdfdocs``. The formatted documentation can also be read online at: - - https://www.kernel.org/doc/html/latest/ - -There are various text files in the Documentation/ subdirectory, -several of them using the Restructured Text markup notation. -See Documentation/00-INDEX for a list of what is contained in each file. - -Please read the Documentation/process/changes.rst file, as it contains the -requirements for building and running the kernel, and information about -the problems which may result by upgrading your kernel. diff --git a/README.md b/README.md new file mode 100644 index 000000000..3374c4726 --- /dev/null +++ b/README.md @@ -0,0 +1,237 @@ +# How to Contribute +------- + +- [How to Contribute](#How to Contribute) + + \- [Sign the CLA](#Sign the CLA) + + \- [Steps of submitting patches](#Steps of submitting patches) + + \- [Use the unified patch format](#Use the unified patch format) + + \- [Define the patch format](#Define the patch format) + + \- [Examples](#Examples) + + \- [Email client - Thunderbird settings](#Email client - Thunderbird settings) + +- [Linux kernel](#Linux kernel) + +### Sign the CLA + +------- + +Before making any contributions to openEuler, sign the CLA first. + +Address: [https://openeuler.org/en/cla.html](https://openeuler.org/en/cla.html) + +### Steps of submitting patches +------- + +**Step 1** Compile and test your patches. + +**Step 2** Generate patches. + +Your patches should be generated based on the latest openEuler branch using git-format-patch. If your patches are in a patchset, it is better to use the **--cover-letter** option to describe what the patchset does. + +Use **scripts/checkpatch.pl** to ensure that no coding style issue exists. + +In addition, ensure that your patches comply with the unified openEuler patch format described below. + +**Step 3** Send your patches to the openEuler mailing list. + +To do so, run the following command: + + `git send-email *.patch -to="kernel(a)openeuler.org" --suppress-cc=all` + +*NOTE*: Add **--suppress-cc=all** if you use git-send-email; otherwise, the email will be copied to all people in the upstream community and mailing lists. + +For details about how to send patches using git-send-email, see [https://git-scm.com/docs/git-send-email](https://git-scm.com/docs/git-send-…. + +**Step 4** Mark "v1, v2, v3 ..." in your patch subject if you have multiple versions to send out. + +Use the **--subject-prefix="PATCH v2"** option to add the v2 tag to the patchset. + + `git format-patch --subject-prefix="PATCH v2" -1` + +Subject examples: + + Subject: [PATCH v2 01/27] fork: fix some -Wmissing-prototypes warnings + + Subject: [PATCH v3] ext2: improve scalability of bitmap searching + +**Step 5** Upstream your kernel patches to the kernel community (recommended). openEuler will synchronize with the kernel master in a timely manner. + +**Step 6** Sign your work - the Developer’s Certificate of Origin. + + Similar to the upstream kernel community, you also need to sign your patch. + + For details, see [https://www.kernel.org/doc/html/latest/process/submitting-patches.html](htt…. + + The sign-off is a simple line at the end of the explanation of the patch, which certifies that you wrote it or otherwise have the right to pass it on as an open source patch. The rules are pretty simple. You can certify as below: + + Developer’s Certificate of Origin 1.1 + + ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + + By making a contribution to this project, I certify that: + + (a) The contribution was created in whole or in part by me and I have the right to submit it under the open source license indicated in the file; + + (b) The contribution is based upon previous work that, to the best of my knowledge, is covered under an appropriate open source license and I have the right under that license to submit that work with modifications, whether created in whole or in part by me, under the same open source license (unless I am permitted to submit under a different license), as indicated in the file; + + (c) The contribution was provided directly to me by some other person who certified (a), (b) or (c) and I have not modified it. + + (d) I understand and agree that this project and the contribution are public and that a record of the contribution (including all personal information I submit with it, including my sign-off) is maintained indefinitely and may be redistributed consistent with this project or the open source license(s) involved. + +Then you add a line saying: + +Signed-off-by: Random J Developer <random(a)developer.example.org> + +Use your real name (sorry, no pseudonyms or anonymous contributions). + +### Use the unified patch format +------- + +Reasons: + +1. Long term maintainability + + openEuler will merge massive patches. If all patches are merged by casual + + changelog formats without a unified format, the git logs will be messy, and + + then it is hard to figure out the original patches. + +2. Kernel upgrade + + We definitely will upgrade our openEuler kernel in someday, so strict patch management + + will alleviate the pain to migrate patches during big upgrades. + +3. Easy for script parsing + + Keyword highlighting is necessary for script parsing. + +### Define the patch format +------- + +[M] stands for "mandatory". + +[O] stands for "option". + +$category can be: bug preparation, bugfix, perf, feature, doc, other... + +If category is feature, we need to add a feature name as below: + +```cpp +category: feature +feature: YYY (the feature name) +``` + +If the patch is related to CVE or bugzilla, we need to add the corresponding tag as below (In general, it should include at least one of the following): + +```cpp +CVE: $cve-id +bugzilla: $bug-id +``` + +Additional changelog should include at least one of the following: + +1. Why we should apply this patch + +2. What real problems in the product does this patch resolved + +3. How could we reproduce this bug or how to test + +4. Other useful information for help to understand this patch or problem + +The detailed information is very useful for migrating a patch to another kernel branch. + +Example for mainline patch: + +```cpp +mainline inclusion [M] +from $mainline-version [M] +commit $id [M] +category: $category [M] +bugzilla: $bug-id [O] +CVE: $cve-id [O] + +additional changelog [O] + +-------------------------------- + +original changelog +Signed-off-by: $yourname <$yourname(a)huawei.com> [M] +($mainline-version could be mainline-3.5, mainline-3.6, etc...) +``` + +### Examples +------- + +```cpp +mainline inclusion +from mainline-4.10 +commit 0becc0ae5b42828785b589f686725ff5bc3b9b25 +category: bugfix +bugzilla: 3004 +CVE: N/A + +The patch fixes a BUG_ON in the product: Injecting a single bit ECC error to the memory before system boot using hardware inject tools will cause a large amount of CMCI during system booting . +[ 1.146580] mce: [Hardware Error]: Machine check events logged +[ 1.152908] ------------[ cut here ]------------ +[ 1.157751] kernel BUG at kernel/timer.c:951! +[ 1.162321] invalid opcode: 0000 [#1] SMP + +------------------------------------------------- + +original changelog + +<original S-O-B> +Signed-off-by: Zhang San <zhangsan(a)huawei.com> +Tested-by: Li Si <lisi(a)huawei.com> +``` + +### Email client - Thunderbird settings +------- + +If you are a new developer in the kernel community, it is highly recommended that you use the Thunderbird mail client. + +1. Thunderbird Installation + + Obtain the English version of Thunderbird from [http://www.mozilla.org/]( http://www.mozilla.org/) and install it on your system. + + Download URL: https://www.thunderbird.net/en-US/thunderbird/all/ + +2. Settings + + 2.1 Use the plain text format instead of the HTML format. + + Choose **Options > Account Settings > Composition & Addressing**, and do **NOT** select Compose message in HTML format. + + 2.2 Editor settings + + **Tools > Options> Advanced > Config editor** + + \- To bring up the Thunderbird's registry editor, set **mailnews.send_plaintext_flowed** to **false**. + + \- Disable HTML Format: Set **mail.identity.id1.compose_html** to **false**. + + \- Enable UTF-8: Set **prefs.converted-to-utf8** to **true**. + + \- View messages in UTF-8: Set **mailnews.view_default_charset** to **UTF-8**. + + \- Set **mailnews.wraplength** to **9999** to avoid auto-wrap. + +# Linux kernel +------- + +There are several guides for kernel developers and users, which can be rendered in a number of formats, like HTML and PDF. You can read **Documentation/admin-guide/README.rst** first. + +In order to build the documentation, use **make htmldocs** or **make pdfdocs**. The formatted documentation can also be read online at: https://www.kernel.org/doc/html/latest/ + +There are various text files in the Documentation/ subdirectory, several of which use the Restructured Text markup notation. See Documentation/00-INDEX for a list of what is contained in each file. + +Read the **Documentation/process/changes.rst** file, as it contains the requirements for building and running the kernel, and information about the problems that may be caused by upgrading your kernel. + diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl index 161b0224d..d9a8ae4da 100755 --- a/scripts/checkpatch.pl +++ b/scripts/checkpatch.pl @@ -1063,7 +1063,7 @@ sub top_of_kernel_tree { my @tree_check = ( "COPYING", "CREDITS", "Kbuild", "MAINTAINERS", "Makefile", - "README", "Documentation", "arch", "include", "drivers", + "README.md", "Documentation", "arch", "include", "drivers", "fs", "init", "ipc", "kernel", "lib", "scripts", ); -- 2.22.0

1 0

[PATCH openEuler-1.0-LTS] scsi: hisi_sas: unsupported DIX between OS and HBA only for SATA device
by Yang Yingliang 01 Nov '21

01 Nov '21

From: Yang Xingui <yangxingui(a)huawei.com> driver inclusion category: bugfix bugzilla: NA CVE: NA Signed-off-by: Yang Xingui <yangxingui(a)huawei.com> Reviewed-by: Ouyangdelong <ouyangdelong(a)huawei.com> Reviewed-by: Kangfenglong <kangfenglong(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/scsi/hisi_sas/hisi_sas.h | 10 ++++++++++ drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 7 ++++++- 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/hisi_sas/hisi_sas.h b/drivers/scsi/hisi_sas/hisi_sas.h index 3fd32606ecb00..8e9424e62a150 100644 --- a/drivers/scsi/hisi_sas/hisi_sas.h +++ b/drivers/scsi/hisi_sas/hisi_sas.h @@ -77,6 +77,16 @@ #define HISI_SAS_SATA_PROTOCOL_FPDMA 0x8 #define HISI_SAS_SATA_PROTOCOL_ATAPI 0x10 +#define HISI_SAS_DIF_PROT_MASK (SHOST_DIF_TYPE1_PROTECTION | \ + SHOST_DIF_TYPE2_PROTECTION | \ + SHOST_DIF_TYPE3_PROTECTION) + +#define HISI_SAS_DIX_PROT_MASK (SHOST_DIX_TYPE1_PROTECTION | \ + SHOST_DIX_TYPE2_PROTECTION | \ + SHOST_DIX_TYPE3_PROTECTION) + +#define HISI_SAS_PROT_MASK (HISI_SAS_DIF_PROT_MASK | HISI_SAS_DIX_PROT_MASK) + #define CLEAR_ITCT_TIMEOUT 20 struct hisi_hba; diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c index 0e4cc16e542d6..9d6e21be35841 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c @@ -3357,9 +3357,14 @@ hisi_sas_shost_alloc_pci(struct pci_dev *pdev) hisi_hba->dev = dev; hisi_hba->shost = shost; SHOST_TO_SAS_HA(shost) = &hisi_hba->sha; - hisi_hba->enable_dix_dif = enable_dix_dif; hisi_hba->user_ctl_irq = user_ctl_irq; + if (enable_dix_dif & ~HISI_SAS_PROT_MASK) + dev_err(dev, "unsupported protection mask 0x%x, using default (0x0)\n", + enable_dix_dif); + else + hisi_hba->enable_dix_dif = enable_dix_dif; + timer_setup(&hisi_hba->timer, NULL, 0); if (hisi_sas_get_fw_info(hisi_hba) < 0) -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 01/19] nbd: don't handle response without a corresponding request message
by Yang Yingliang 30 Oct '21

30 Oct '21

From: Yu Kuai <yukuai3(a)huawei.com> mainline inclusion from mainline-next-20211018 commit b5644a3a79bf3be5f1238db1b2f241374b27b0f0 category: bugfix bugzilla: 49890 CVE: NA --------------------------- While handling a response message from server, nbd_read_stat() will try to get request by tag, and then complete the request. However, this is problematic if nbd haven't sent a corresponding request message: t1 t2 submit_bio nbd_queue_rq blk_mq_start_request recv_work nbd_read_stat blk_mq_tag_to_rq blk_mq_complete_request nbd_send_cmd Thus add a new cmd flag 'NBD_CMD_INFLIGHT', it will be set in nbd_send_cmd() and checked in nbd_read_stat(). Noted that this patch can't fix that blk_mq_tag_to_rq() might return a freed request, and this will be fixed in following patches. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Ming Lei <ming.lei(a)redhat.com> Reviewed-by: Josef Bacik <josef(a)toxicpanda.com> Link: https://lore.kernel.org/r/20210916093350.1410403-2-yukuai3@huawei.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/block/nbd.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 6a72c07ce3cba..05153b84d5400 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -120,6 +120,12 @@ struct nbd_device { }; #define NBD_CMD_REQUEUED 1 +/* + * This flag will be set if nbd_queue_rq() succeed, and will be checked and + * cleared in completion. Both setting and clearing of the flag are protected + * by cmd->lock. + */ +#define NBD_CMD_INFLIGHT 2 struct nbd_cmd { struct nbd_device *nbd; @@ -369,6 +375,7 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req, if (!mutex_trylock(&cmd->lock)) return BLK_EH_RESET_TIMER; + __clear_bit(NBD_CMD_INFLIGHT, &cmd->flags); if (!refcount_inc_not_zero(&nbd->config_refs)) { cmd->status = BLK_STS_TIMEOUT; mutex_unlock(&cmd->lock); @@ -674,6 +681,12 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index) cmd = blk_mq_rq_to_pdu(req); mutex_lock(&cmd->lock); + if (!__test_and_clear_bit(NBD_CMD_INFLIGHT, &cmd->flags)) { + dev_err(disk_to_dev(nbd->disk), "Suspicious reply %d (status %u flags %lu)", + tag, cmd->status, cmd->flags); + ret = -ENOENT; + goto out; + } if (cmd->cmd_cookie != nbd_handle_to_cookie(handle)) { dev_err(disk_to_dev(nbd->disk), "Double reply on req %p, cmd_cookie %u, handle cookie %u\n", req, cmd->cmd_cookie, nbd_handle_to_cookie(handle)); @@ -768,6 +781,7 @@ static void nbd_clear_req(struct request *req, void *data, bool reserved) struct nbd_cmd *cmd = blk_mq_rq_to_pdu(req); mutex_lock(&cmd->lock); + __clear_bit(NBD_CMD_INFLIGHT, &cmd->flags); cmd->status = BLK_STS_IOERR; mutex_unlock(&cmd->lock); @@ -903,7 +917,13 @@ static int nbd_handle_cmd(struct nbd_cmd *cmd, int index) * returns EAGAIN can be retried on a different socket. */ ret = nbd_send_cmd(nbd, cmd, index); - if (ret == -EAGAIN) { + /* + * Access to this flag is protected by cmd->lock, thus it's safe to set + * the flag after nbd_send_cmd() succeed to send request to server. + */ + if (!ret) + __set_bit(NBD_CMD_INFLIGHT, &cmd->flags); + else if (ret == -EAGAIN) { dev_err_ratelimited(disk_to_dev(nbd->disk), "Request send failed, requeueing\n"); nbd_mark_nsock_dead(nbd, nsock, 1); -- 2.25.1

1 18