Unverified Commit 556c890d authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!385 Backport CVEs and bugfixes 

Merge Pull Request from: @zhangjialin11 
 
Pull new CVEs:
CVE-2022-3707
CVE-2023-0394

cgroup bugfixes from Cai Xinchen
net bugfixes from Zhengchao Shao and Wang Yufen
fs bugfixes from Baokun Li, Li Lingfeng and Li Nan
scsi bugfix from Zhong Jinghua
mm bugfixes form Liu Shixin
irqchip/gic-v4 bugfix from Zenghui Yu
 
 
Link:https://gitee.com/openeuler/kernel/pulls/385

 

Reviewed-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parents a8eb2fe3 b71792e4

drivers/gpu/drm/i915/gvt/gtt.c

+13 −4
Original line number Diff line number Diff line
@@ -1192,10 +1192,8 @@ static int split_2MB_gtt_entry(struct intel_vgpu *vgpu, 
	for_each_shadow_entry(sub_spt, &sub_se, sub_index) {

		ret = intel_gvt_hypervisor_dma_map_guest_page(vgpu,

				start_gfn + sub_index, PAGE_SIZE, &dma_addr);

		if (ret) {

			ppgtt_invalidate_spt(spt);

			return ret;

		}

		if (ret)

			goto err;

		sub_se.val64 = se->val64;



		/* Copy the PAT field from PDE. */
@@ -1214,6 +1212,17 @@ static int split_2MB_gtt_entry(struct intel_vgpu *vgpu, 
	ops->set_pfn(se, sub_spt->shadow_page.mfn);

	ppgtt_set_shadow_entry(spt, se, index);

	return 0;

err:

	/* Cancel the existing addess mappings of DMA addr. */

	for_each_present_shadow_entry(sub_spt, &sub_se, sub_index) {

		gvt_vdbg_mm("invalidate 4K entry\n");

		ppgtt_invalidate_pte(sub_spt, &sub_se);

	}

	/* Release the new allocated spt. */

	trace_spt_change(sub_spt->vgpu->id, "release", sub_spt,

		sub_spt->guest_page.gfn, sub_spt->shadow_page.type);

	ppgtt_free_spt(sub_spt);

	return ret;

}



static int split_64KB_gtt_entry(struct intel_vgpu *vgpu,

drivers/irqchip/irq-gic-v3-its.c

+19 −9
Original line number Diff line number Diff line
@@ -3061,18 +3061,12 @@ static int __init allocate_lpi_tables(void) 
	return 0;

}



static u64 its_clear_vpend_valid(void __iomem *vlpi_base, u64 clr, u64 set)

static u64 read_vpend_dirty_clear(void __iomem *vlpi_base)

{

	u32 count = 1000000;	/* 1s! */

	bool clean;

	u64 val;



	val = gicr_read_vpendbaser(vlpi_base + GICR_VPENDBASER);

	val &= ~GICR_VPENDBASER_Valid;

	val &= ~clr;

	val |= set;

	gicr_write_vpendbaser(val, vlpi_base + GICR_VPENDBASER);



	do {

		val = gicr_read_vpendbaser(vlpi_base + GICR_VPENDBASER);

		clean = !(val & GICR_VPENDBASER_Dirty);
@@ -3083,11 +3077,27 @@ static u64 its_clear_vpend_valid(void __iomem *vlpi_base, u64 clr, u64 set) 
		}

	} while (!clean && count);



	if (unlikely(val & GICR_VPENDBASER_Dirty)) {

	if (unlikely(!clean))

		pr_err_ratelimited("ITS virtual pending table not cleaning\n");

		val |= GICR_VPENDBASER_PendingLast;



	return val;

}



static u64 its_clear_vpend_valid(void __iomem *vlpi_base, u64 clr, u64 set)

{

	u64 val;



	/* Make sure we wait until the RD is done with the initial scan */

	val = read_vpend_dirty_clear(vlpi_base);

	val &= ~GICR_VPENDBASER_Valid;

	val &= ~clr;

	val |= set;

	gicr_write_vpendbaser(val, vlpi_base + GICR_VPENDBASER);



	val = read_vpend_dirty_clear(vlpi_base);

	if (unlikely(val & GICR_VPENDBASER_Dirty))

		val |= GICR_VPENDBASER_PendingLast;



	return val;

}

drivers/net/ethernet/cortina/gemini.c

+12 −12
Original line number Diff line number Diff line
@@ -1920,7 +1920,7 @@ static void gmac_get_stats64(struct net_device *netdev, 


	/* Racing with RX NAPI */

	do {

		start = u64_stats_fetch_begin(&port->rx_stats_syncp);

		start = u64_stats_fetch_begin_irq(&port->rx_stats_syncp);



		stats->rx_packets = port->stats.rx_packets;

		stats->rx_bytes = port->stats.rx_bytes;
@@ -1932,11 +1932,11 @@ static void gmac_get_stats64(struct net_device *netdev, 
		stats->rx_crc_errors = port->stats.rx_crc_errors;

		stats->rx_frame_errors = port->stats.rx_frame_errors;



	} while (u64_stats_fetch_retry(&port->rx_stats_syncp, start));

	} while (u64_stats_fetch_retry_irq(&port->rx_stats_syncp, start));



	/* Racing with MIB and TX completion interrupts */

	do {

		start = u64_stats_fetch_begin(&port->ir_stats_syncp);

		start = u64_stats_fetch_begin_irq(&port->ir_stats_syncp);



		stats->tx_errors = port->stats.tx_errors;

		stats->tx_packets = port->stats.tx_packets;
@@ -1946,15 +1946,15 @@ static void gmac_get_stats64(struct net_device *netdev, 
		stats->rx_missed_errors = port->stats.rx_missed_errors;

		stats->rx_fifo_errors = port->stats.rx_fifo_errors;



	} while (u64_stats_fetch_retry(&port->ir_stats_syncp, start));

	} while (u64_stats_fetch_retry_irq(&port->ir_stats_syncp, start));



	/* Racing with hard_start_xmit */

	do {

		start = u64_stats_fetch_begin(&port->tx_stats_syncp);

		start = u64_stats_fetch_begin_irq(&port->tx_stats_syncp);



		stats->tx_dropped = port->stats.tx_dropped;



	} while (u64_stats_fetch_retry(&port->tx_stats_syncp, start));

	} while (u64_stats_fetch_retry_irq(&port->tx_stats_syncp, start));



	stats->rx_dropped += stats->rx_missed_errors;

}
@@ -2032,18 +2032,18 @@ static void gmac_get_ethtool_stats(struct net_device *netdev, 
	/* Racing with MIB interrupt */

	do {

		p = values;

		start = u64_stats_fetch_begin(&port->ir_stats_syncp);

		start = u64_stats_fetch_begin_irq(&port->ir_stats_syncp);



		for (i = 0; i < RX_STATS_NUM; i++)

			*p++ = port->hw_stats[i];



	} while (u64_stats_fetch_retry(&port->ir_stats_syncp, start));

	} while (u64_stats_fetch_retry_irq(&port->ir_stats_syncp, start));

	values = p;



	/* Racing with RX NAPI */

	do {

		p = values;

		start = u64_stats_fetch_begin(&port->rx_stats_syncp);

		start = u64_stats_fetch_begin_irq(&port->rx_stats_syncp);



		for (i = 0; i < RX_STATUS_NUM; i++)

			*p++ = port->rx_stats[i];
@@ -2051,13 +2051,13 @@ static void gmac_get_ethtool_stats(struct net_device *netdev, 
			*p++ = port->rx_csum_stats[i];

		*p++ = port->rx_napi_exits;



	} while (u64_stats_fetch_retry(&port->rx_stats_syncp, start));

	} while (u64_stats_fetch_retry_irq(&port->rx_stats_syncp, start));

	values = p;



	/* Racing with TX start_xmit */

	do {

		p = values;

		start = u64_stats_fetch_begin(&port->tx_stats_syncp);

		start = u64_stats_fetch_begin_irq(&port->tx_stats_syncp);



		for (i = 0; i < TX_MAX_FRAGS; i++) {

			*values++ = port->tx_frag_stats[i];
@@ -2066,7 +2066,7 @@ static void gmac_get_ethtool_stats(struct net_device *netdev, 
		*values++ = port->tx_frags_linearized;

		*values++ = port->tx_hw_csummed;



	} while (u64_stats_fetch_retry(&port->tx_stats_syncp, start));

	} while (u64_stats_fetch_retry_irq(&port->tx_stats_syncp, start));

}



static int gmac_get_ksettings(struct net_device *netdev,

drivers/net/ethernet/google/gve/gve_ethtool.c

+8 −8
Original line number Diff line number Diff line
@@ -172,14 +172,14 @@ gve_get_ethtool_stats(struct net_device *netdev, 
				struct gve_rx_ring *rx = &priv->rx[ring];



				start =

				  u64_stats_fetch_begin(&priv->rx[ring].statss);

				  u64_stats_fetch_begin_irq(&priv->rx[ring].statss);

				tmp_rx_pkts = rx->rpackets;

				tmp_rx_bytes = rx->rbytes;

				tmp_rx_skb_alloc_fail = rx->rx_skb_alloc_fail;

				tmp_rx_buf_alloc_fail = rx->rx_buf_alloc_fail;

				tmp_rx_desc_err_dropped_pkt =

					rx->rx_desc_err_dropped_pkt;

			} while (u64_stats_fetch_retry(&priv->rx[ring].statss,

			} while (u64_stats_fetch_retry_irq(&priv->rx[ring].statss,

						       start));

			rx_pkts += tmp_rx_pkts;

			rx_bytes += tmp_rx_bytes;
@@ -193,10 +193,10 @@ gve_get_ethtool_stats(struct net_device *netdev, 
		if (priv->tx) {

			do {

				start =

				  u64_stats_fetch_begin(&priv->tx[ring].statss);

				  u64_stats_fetch_begin_irq(&priv->tx[ring].statss);

				tmp_tx_pkts = priv->tx[ring].pkt_done;

				tmp_tx_bytes = priv->tx[ring].bytes_done;

			} while (u64_stats_fetch_retry(&priv->tx[ring].statss,

			} while (u64_stats_fetch_retry_irq(&priv->tx[ring].statss,

						       start));

			tx_pkts += tmp_tx_pkts;

			tx_bytes += tmp_tx_bytes;
@@ -254,13 +254,13 @@ gve_get_ethtool_stats(struct net_device *netdev, 
			data[i++] = rx->cnt;

			do {

				start =

				  u64_stats_fetch_begin(&priv->rx[ring].statss);

				  u64_stats_fetch_begin_irq(&priv->rx[ring].statss);

				tmp_rx_bytes = rx->rbytes;

				tmp_rx_skb_alloc_fail = rx->rx_skb_alloc_fail;

				tmp_rx_buf_alloc_fail = rx->rx_buf_alloc_fail;

				tmp_rx_desc_err_dropped_pkt =

					rx->rx_desc_err_dropped_pkt;

			} while (u64_stats_fetch_retry(&priv->rx[ring].statss,

			} while (u64_stats_fetch_retry_irq(&priv->rx[ring].statss,

						       start));

			data[i++] = tmp_rx_bytes;

			/* rx dropped packets */
@@ -313,9 +313,9 @@ gve_get_ethtool_stats(struct net_device *netdev, 
			data[i++] = tx->done;

			do {

				start =

				  u64_stats_fetch_begin(&priv->tx[ring].statss);

				  u64_stats_fetch_begin_irq(&priv->tx[ring].statss);

				tmp_tx_bytes = tx->bytes_done;

			} while (u64_stats_fetch_retry(&priv->tx[ring].statss,

			} while (u64_stats_fetch_retry_irq(&priv->tx[ring].statss,

						       start));

			data[i++] = tmp_tx_bytes;

			data[i++] = tx->wake_queue;

drivers/net/ethernet/google/gve/gve_main.c

+6 −6
Original line number Diff line number Diff line
@@ -40,10 +40,10 @@ static void gve_get_stats(struct net_device *dev, struct rtnl_link_stats64 *s) 
		for (ring = 0; ring < priv->rx_cfg.num_queues; ring++) {

			do {

				start =

				  u64_stats_fetch_begin(&priv->rx[ring].statss);

				  u64_stats_fetch_begin_irq(&priv->rx[ring].statss);

				packets = priv->rx[ring].rpackets;

				bytes = priv->rx[ring].rbytes;

			} while (u64_stats_fetch_retry(&priv->rx[ring].statss,

			} while (u64_stats_fetch_retry_irq(&priv->rx[ring].statss,

						       start));

			s->rx_packets += packets;

			s->rx_bytes += bytes;
@@ -53,10 +53,10 @@ static void gve_get_stats(struct net_device *dev, struct rtnl_link_stats64 *s) 
		for (ring = 0; ring < priv->tx_cfg.num_queues; ring++) {

			do {

				start =

				  u64_stats_fetch_begin(&priv->tx[ring].statss);

				  u64_stats_fetch_begin_irq(&priv->tx[ring].statss);

				packets = priv->tx[ring].pkt_done;

				bytes = priv->tx[ring].bytes_done;

			} while (u64_stats_fetch_retry(&priv->tx[ring].statss,

			} while (u64_stats_fetch_retry_irq(&priv->tx[ring].statss,

						       start));

			s->tx_packets += packets;

			s->tx_bytes += bytes;
@@ -1041,9 +1041,9 @@ void gve_handle_report_stats(struct gve_priv *priv) 
	if (priv->tx) {

		for (idx = 0; idx < priv->tx_cfg.num_queues; idx++) {

			do {

				start = u64_stats_fetch_begin(&priv->tx[idx].statss);

				start = u64_stats_fetch_begin_irq(&priv->tx[idx].statss);

				tx_bytes = priv->tx[idx].bytes_done;

			} while (u64_stats_fetch_retry(&priv->tx[idx].statss, start));

			} while (u64_stats_fetch_retry_irq(&priv->tx[idx].statss, start));

			stats[stats_idx++] = (struct stats) {

				.stat_name = cpu_to_be32(TX_WAKE_CNT),

				.value = cpu_to_be64(priv->tx[idx].wake_queue),