- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] sched/rt: Fix rt_runtime leaks with cpu hotplug and RT_RUNTIME_SHARE
by Zhao Wenhui 24 May '24

24 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9RZC8 -------------------------------- When using cgroup rt_bandwidth with RT_RUNTIME_SHARE, if there are cpu hotplug and cpu.rt_runtime_us changing concurrently, the warning in __disable_runtime may occur: [ 991.697692] WARNING: CPU: 0 PID: 49573 at kernel/sched/rt.c:802 rq_offline_rt+0x24d/0x260 [ 991.697795] CPU: 0 PID: 49573 Comm: kworker/1:0 Kdump: loaded Not tainted 6.9.0-rc1+ #4 [ 991.697800] Workqueue: events cpuset_hotplug_workfn [ 991.697803] RIP: 0010:rq_offline_rt+0x24d/0x260 [ 991.697825] Call Trace: [ 991.697827] <TASK> [ 991.697858] set_rq_offline.part.125+0x2d/0x70 [ 991.697864] rq_attach_root+0xda/0x110 [ 991.697867] cpu_attach_domain+0x433/0x860 [ 991.697880] partition_sched_domains_locked+0x2a8/0x3a0 [ 991.697885] rebuild_sched_domains_locked+0x608/0x800 [ 991.697895] rebuild_sched_domains+0x1b/0x30 [ 991.697897] cpuset_hotplug_workfn+0x4b6/0x1160 [ 991.697909] process_scheduled_works+0xad/0x430 [ 991.697917] worker_thread+0x105/0x270 [ 991.697922] kthread+0xde/0x110 [ 991.697928] ret_from_fork+0x2d/0x50 [ 991.697935] ret_from_fork_asm+0x11/0x20 [ 991.697940] </TASK> [ 991.697941] ---[ end trace 0000000000000000 ]--- That's how it happens: CPU0 CPU1 ----- ----- set_rq_offline(rq) __disable_runtime(rq) (1) tg_set_rt_bandwidth (2) do_balance_runtime (3) set_rq_online(rq) __enable_runtime(rq) (4) In step(1) rt_rq->rt_runtime is set to RUNTIME_INF, and this rtrq's runtime is not supposed to change until its rq gets online. However, in step(2) tg_set_rt_bandwidth can set rt_rq->rt_runtime to rt_bandwidth.rt_runtime. Then, in step(3) rtrq's runtime is not RUNTIME_INF, so others can borrow rt_runtime from it. Finally, in step(4) the rq gets online, so its rtrq's runtime is set to rt_bandwidth.rt_runtime again, and Since then the total rt_runtime in the domain is increased by this way. After these steps, when offline cpu, rebuilding the sched_domain will offline all rq, and the last rq will find the rt_runtime is increased but nowhere to return. To fix this, we can add a state RUNTIME_DISABLED, which means the runtime is disabled and should not be used. When the rq is offline, we can set its rtrq's rt_runtime to RUNTIME_DISABLED, and when rq online, reset it. And in tg_set_rt_bandwidth and do_balance_runtime, never change a disabled rt_runtime. Fixes: 7def2be1dc67 ("sched: fix hotplug cpus on ia64") Closes: https://lore.kernel.org/all/47b4a790-9a27-2fc5-f2aa-f9981c6da015@huawei.com/ Co-developed-by: Hui Tang <tanghui20(a)huawei.com> Signed-off-by: Hui Tang <tanghui20(a)huawei.com> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- kernel/sched/fair.c.rej | 52 +++++++++++++++++++++++++++++++++++++++++ kernel/sched/rt.c | 3 ++- kernel/sched/rt.c.rej | 11 +++++++++ 3 files changed, 65 insertions(+), 1 deletion(-) create mode 100644 kernel/sched/fair.c.rej create mode 100644 kernel/sched/rt.c.rej diff --git a/kernel/sched/fair.c.rej b/kernel/sched/fair.c.rej new file mode 100644 index 000000000000..7275501f1bf3 --- /dev/null +++ b/kernel/sched/fair.c.rej @@ -0,0 +1,52 @@ +diff a/kernel/sched/fair.c b/kernel/sched/fair.c (rejected hunks) +@@ -161,9 +161,12 @@ int __weak arch_asym_cpu_priority(int cpu) + #endif + + #ifdef CONFIG_QOS_SCHED +- ++struct qos_overload_checker { ++ struct hrtimer qos_overload_timer; ++ unsigned int cpu; ++}; + static DEFINE_PER_CPU_SHARED_ALIGNED(struct list_head, qos_throttled_cfs_rq); +-static DEFINE_PER_CPU_SHARED_ALIGNED(struct hrtimer, qos_overload_timer); ++static DEFINE_PER_CPU_SHARED_ALIGNED(struct qos_overload_checker, qos_overload_checker); + static DEFINE_PER_CPU(int, qos_cpu_overload); + unsigned int sysctl_overload_detect_period = 5000; /* in ms */ + unsigned int sysctl_offline_wait_interval = 100; /* in ms */ +@@ -7951,14 +7954,17 @@ static void check_preempt_wakeup(struct rq *rq, struct task_struct *p, int wake_ + } + + #ifdef CONFIG_QOS_SCHED ++static struct hrtimer *qos_timer(int cpu) { ++ return &(per_cpu_ptr(&qos_overload_checker, cpu)->qos_overload_timer); ++} + static inline bool qos_timer_is_activated(int cpu) + { +- return hrtimer_active(per_cpu_ptr(&qos_overload_timer, cpu)); ++ return hrtimer_active(qos_timer(cpu)); + } + + static inline void cancel_qos_timer(int cpu) + { +- hrtimer_cancel(per_cpu_ptr(&qos_overload_timer, cpu)); ++ hrtimer_cancel(qos_timer(cpu)); + } + + static inline bool is_offline_task(struct task_struct *p) +@@ -8183,10 +8189,13 @@ void sched_qos_offline_wait(void) + static enum hrtimer_restart qos_overload_timer_handler(struct hrtimer *timer) + { + struct rq_flags rf; +- struct rq *rq = this_rq(); ++ struct qos_overload_checker *checker = container_of(timer, ++ struct qos_overload_checker, qos_overload_timer); ++ int cpu = checker->cpu; ++ struct rq *rq = cpu_rq(cpu); + + rq_lock_irqsave(rq, &rf); +- __unthrottle_qos_cfs_rqs(smp_processor_id()); ++ __unthrottle_qos_cfs_rqs(cpu); + __this_cpu_write(qos_cpu_overload, 1); + + /* Determine whether we need to wake up potentially idle CPU. */ diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c index 58364f489529..bb1f76264686 100644 --- a/kernel/sched/rt.c +++ b/kernel/sched/rt.c @@ -664,7 +664,8 @@ static void do_balance_runtime(struct rt_rq *rt_rq) * or __disable_runtime() below sets a specific rq to inf to * indicate its been disabled and disalow stealing. */ - if (iter->rt_runtime == RUNTIME_INF) + if (iter->rt_runtime == RUNTIME_INF || + iter->rt_runtime == RUNTIME_DISABLED) goto next; /* diff --git a/kernel/sched/rt.c.rej b/kernel/sched/rt.c.rej new file mode 100644 index 000000000000..710818859059 --- /dev/null +++ b/kernel/sched/rt.c.rej @@ -0,0 +1,11 @@ +diff a/kernel/sched/rt.c b/kernel/sched/rt.c (rejected hunks) +@@ -704,7 +704,8 @@ static void do_balance_runtime(struct rt_rq *rt_rq) + * or __disable_runtime() below sets a specific rq to inf to + * indicate its been disabled and disallow stealing. + */ +- if (iter->rt_runtime == RUNTIME_INF) ++ if (iter->rt_runtime == RUNTIME_INF || ++ iter->rt_runtime == RUNTIME_DISABLED) + goto next; + + /* -- 2.34.1

2 1

[PATCH OLK-5.10 v2 0/2] sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_GROUP_SCHED
by Yipeng Zou 24 May '24

24 May '24

It's typo error, should be FAIR_GROUP_SCHED but not FAIR_CGROUP_SCHED. Yipeng Zou (2): Revert "sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED" sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_GROUP_SCHED init/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-5.10] drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume
by Xiongfeng Wang 24 May '24

24 May '24

From: Guchun Chen <guchun.chen(a)amd.com> mainline inclusion from mainline-v5.15-rc5 commit 248b061689a40f4fed05252ee2c89f87cf26d7d8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4NB CVE: CVE-2021-47421 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In current code, when a PCI error state pci_channel_io_normal is detectd, it will report PCI_ERS_RESULT_CAN_RECOVER status to PCI driver, and PCI driver will continue the execution of PCI resume callback report_resume by pci_walk_bridge, and the callback will go into amdgpu_pci_resume finally, where write lock is releasd unconditionally without acquiring such lock first. In this case, a deadlock will happen when other threads start to acquire the read lock. To fix this, add a member in amdgpu_device strucutre to cache pci_channel_state, and only continue the execution in amdgpu_pci_resume when it's pci_channel_io_frozen. Fixes: c9a6b82f45e2 ("drm/amdgpu: Implement DPC recovery") Suggested-by: Andrey Grodzovsky <andrey.grodzovsky(a)amd.com> Signed-off-by: Guchun Chen <guchun.chen(a)amd.com> Reviewed-by: Andrey Grodzovsky <andrey.grodzovsky(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/amdgpu/amdgpu.h [wangxiongfeng: fix context conflicts in struct amdgpu_device] Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 6 ++++++ 2 files changed, 7 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h index ff5555353eb4..683bbefc39c1 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h @@ -997,6 +997,7 @@ struct amdgpu_device { bool in_pci_err_recovery; struct pci_saved_state *pci_state; + pci_channel_state_t pci_channel_state; }; static inline struct amdgpu_device *drm_to_adev(struct drm_device *ddev) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c index a093f1b27724..eab8909f0988 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c @@ -4932,6 +4932,8 @@ pci_ers_result_t amdgpu_pci_error_detected(struct pci_dev *pdev, pci_channel_sta return PCI_ERS_RESULT_DISCONNECT; } + adev->pci_channel_state = state; + switch (state) { case pci_channel_io_normal: return PCI_ERS_RESULT_CAN_RECOVER; @@ -5067,6 +5069,10 @@ void amdgpu_pci_resume(struct pci_dev *pdev) DRM_INFO("PCI error: resume callback!!\n"); + /* Only continue execution for the case of pci_channel_io_frozen */ + if (adev->pci_channel_state != pci_channel_io_frozen) + return; + for (i = 0; i < AMDGPU_MAX_RINGS; ++i) { struct amdgpu_ring *ring = adev->rings[i]; -- 2.20.1

2 1

[PATCH openEuler-22.03-LTS-SP1] hwmon: (axi-fan-control) Fix possible NULL pointer dereference
by Wenyu Huang 24 May '24

24 May '24

From: Dragos Bogdan <dragos.bogdan(a)analog.com> stable inclusion from stable-v5.10.201 commit 7d870088db4863c514a7f8751cd593751983029a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RL31 CVE: CVE-2023-52863 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2a5b3370a1d9750eca325292e291c8c7cb8cf2e0 ] axi_fan_control_irq_handler(), dependent on the private axi_fan_control_data structure, might be called before the hwmon device is registered. That will cause an "Unable to handle kernel NULL pointer dereference" error. Fixes: 8412b410fa5e ("hwmon: Support ADI Fan Control IP") Signed-off-by: Dragos Bogdan <dragos.bogdan(a)analog.com> Signed-off-by: Nuno Sa <nuno.sa(a)analog.com> Link: https://lore.kernel.org/r/20231025132100.649499-1-nuno.sa@analog.com Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/hwmon/axi-fan-control.c | 29 ++++++++++++++++------------- 1 file changed, 16 insertions(+), 13 deletions(-) diff --git a/drivers/hwmon/axi-fan-control.c b/drivers/hwmon/axi-fan-control.c index e3f6b03e6764..0dba67c0054c 100644 --- a/drivers/hwmon/axi-fan-control.c +++ b/drivers/hwmon/axi-fan-control.c @@ -423,6 +423,21 @@ static int axi_fan_control_probe(struct platform_device *pdev) return -ENODEV; } + ret = axi_fan_control_init(ctl, pdev->dev.of_node); + if (ret) { + dev_err(&pdev->dev, "Failed to initialize device\n"); + return ret; + } + + ctl->hdev = devm_hwmon_device_register_with_info(&pdev->dev, + name, + ctl, + &axi_chip_info, + axi_fan_control_groups); + + if (IS_ERR(ctl->hdev)) + return PTR_ERR(ctl->hdev); + ctl->irq = platform_get_irq(pdev, 0); if (ctl->irq < 0) return ctl->irq; @@ -436,19 +451,7 @@ static int axi_fan_control_probe(struct platform_device *pdev) return ret; } - ret = axi_fan_control_init(ctl, pdev->dev.of_node); - if (ret) { - dev_err(&pdev->dev, "Failed to initialize device\n"); - return ret; - } - - ctl->hdev = devm_hwmon_device_register_with_info(&pdev->dev, - name, - ctl, - &axi_chip_info, - NULL); - - return PTR_ERR_OR_ZERO(ctl->hdev); + return 0; } static struct platform_driver axi_fan_control_driver = { -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/1] crypto: engine - fix crypto_queue backlog handling
by Chen Ridong 24 May '24

24 May '24

*** BLURB HERE *** Olivier Bacon (1): crypto: engine - fix crypto_queue backlog handling crypto/algapi.c | 3 +++ crypto/crypto_engine.c | 6 +++--- 2 files changed, 6 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS v2] netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
by Xiongfeng Wang 24 May '24

24 May '24

From: Jason Xing <kernelxing(a)tencent.com> stable inclusion from stable-v5.10.213 commit 34a164d2448264b62af82bc0af3d2c83d12d38ac category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q94J CVE: CVE-2024-27426 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e799299aafed417cc1f32adccb2a0e5268b3f6d5 ] We need to protect the reader reading the sysctl value because the value can be changed concurrently. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jason Xing <kernelxing(a)tencent.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- net/netrom/af_netrom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c index 82daed1296f5..5189ed68c709 100644 --- a/net/netrom/af_netrom.c +++ b/net/netrom/af_netrom.c @@ -460,7 +460,7 @@ static int nr_create(struct net *net, struct socket *sock, int protocol, nr->t2 = msecs_to_jiffies(sysctl_netrom_transport_acknowledge_delay); nr->n2 = - msecs_to_jiffies(sysctl_netrom_transport_maximum_tries); + msecs_to_jiffies(READ_ONCE(sysctl_netrom_transport_maximum_tries)); nr->t4 = msecs_to_jiffies(sysctl_netrom_transport_busy_delay); nr->idle = -- 2.20.1

2 2

[PATCH OLK-5.10 v2] netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
by Xiongfeng Wang 24 May '24

24 May '24

From: Jason Xing <kernelxing(a)tencent.com> stable inclusion from stable-v5.10.213 commit 34a164d2448264b62af82bc0af3d2c83d12d38ac category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q94J CVE: CVE-2024-27426 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e799299aafed417cc1f32adccb2a0e5268b3f6d5 ] We need to protect the reader reading the sysctl value because the value can be changed concurrently. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jason Xing <kernelxing(a)tencent.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- net/netrom/af_netrom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c index 336abc5771fd..33fb5c1a5f49 100644 --- a/net/netrom/af_netrom.c +++ b/net/netrom/af_netrom.c @@ -457,7 +457,7 @@ static int nr_create(struct net *net, struct socket *sock, int protocol, nr->t2 = msecs_to_jiffies(sysctl_netrom_transport_acknowledge_delay); nr->n2 = - msecs_to_jiffies(sysctl_netrom_transport_maximum_tries); + msecs_to_jiffies(READ_ONCE(sysctl_netrom_transport_maximum_tries)); nr->t4 = msecs_to_jiffies(sysctl_netrom_transport_busy_delay); nr->idle = -- 2.20.1

2 1

[PATCH openEuler-1.0-LTS] netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
by Xiongfeng Wang 24 May '24

24 May '24

From: Jason Xing <kernelxing(a)tencent.com> stable inclusion from stable-v5.10.213 commit 34a164d2448264b62af82bc0af3d2c83d12d38ac category: bugfix bugzilla: 189268 CVE: CVE-2024-27426 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e799299aafed417cc1f32adccb2a0e5268b3f6d5 ] We need to protect the reader reading the sysctl value because the value can be changed concurrently. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jason Xing <kernelxing(a)tencent.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- net/netrom/af_netrom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c index 82daed1296f5..5189ed68c709 100644 --- a/net/netrom/af_netrom.c +++ b/net/netrom/af_netrom.c @@ -460,7 +460,7 @@ static int nr_create(struct net *net, struct socket *sock, int protocol, nr->t2 = msecs_to_jiffies(sysctl_netrom_transport_acknowledge_delay); nr->n2 = - msecs_to_jiffies(sysctl_netrom_transport_maximum_tries); + msecs_to_jiffies(READ_ONCE(sysctl_netrom_transport_maximum_tries)); nr->t4 = msecs_to_jiffies(sysctl_netrom_transport_busy_delay); nr->idle = -- 2.20.1

2 1

[PATCH OLK-5.10] netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
by Xiongfeng Wang 24 May '24

24 May '24

From: Jason Xing <kernelxing(a)tencent.com> stable inclusion from stable-v5.10.213 commit 34a164d2448264b62af82bc0af3d2c83d12d38ac category: bugfix bugzilla: 189268 CVE: CVE-2024-27426 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e799299aafed417cc1f32adccb2a0e5268b3f6d5 ] We need to protect the reader reading the sysctl value because the value can be changed concurrently. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jason Xing <kernelxing(a)tencent.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- net/netrom/af_netrom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c index 336abc5771fd..33fb5c1a5f49 100644 --- a/net/netrom/af_netrom.c +++ b/net/netrom/af_netrom.c @@ -457,7 +457,7 @@ static int nr_create(struct net *net, struct socket *sock, int protocol, nr->t2 = msecs_to_jiffies(sysctl_netrom_transport_acknowledge_delay); nr->n2 = - msecs_to_jiffies(sysctl_netrom_transport_maximum_tries); + msecs_to_jiffies(READ_ONCE(sysctl_netrom_transport_maximum_tries)); nr->t4 = msecs_to_jiffies(sysctl_netrom_transport_busy_delay); nr->idle = -- 2.20.1

2 1

[PATCH OLK-5.10 0/1] fix crypto_queue backlog handling
by Chen Ridong 24 May '24

24 May '24

*** BLURB HERE *** Olivier Bacon (1): crypto: engine - fix crypto_queue backlog handling crypto/algapi.c | 3 +++ crypto/crypto_engine.c | 6 +++--- 2 files changed, 6 insertions(+), 3 deletions(-) -- 2.34.1

2 2