Unverified Commit 9f63c157 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!14845 merge HULK-6.6 patches into OLK-6.6

Merge Pull Request from: @ci-robot 
 
PR sync from: Kaixiong Yu <yukaixiong@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/WF7OC6XJJ5GS5PFWDMPQZII65ANN2WGQ/ 
merge HULK-6.6 CVE patches into OLK-6.6

CVE-No as listed:

CVE-2024-56715

CVE-2024-56610

CVE-2024-56617

CVE-2024-53105 

CVE-2024-53109 

CVE-2024-53056 


Brett Creeley (1):
  ionic: Fix netdev notifier unregister on failure

Dan Carpenter (1):
  drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy()

Hajime Tazaki (1):
  nommu: pass NULL argument to vma_iter_prealloc()

Lorenzo Stoakes (1):
  mm: refactor map_deny_write_exec()

Marco Elver (1):
  kcsan: Turn report_filterlist_lock into a raw_spinlock

Ricardo Neri (1):
  cacheinfo: Allocate memory during CPU hotplug if not done from the
    primary CPU

Roman Gushchin (1):
  mm: page_alloc: move mlocked flag clearance into free_pages_prepare()


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/IBEANA
https://gitee.com/src-openeuler/kernel/issues/IBEAOU
https://gitee.com/src-openeuler/kernel/issues/IB8IUV
https://gitee.com/src-openeuler/kernel/issues/IB5KR0
https://gitee.com/src-openeuler/kernel/issues/IB8IUS
https://gitee.com/src-openeuler/kernel/issues/IB7051
https://gitee.com/src-openeuler/kernel/issues/IBEG3Z 
 
Link:https://gitee.com/openeuler/kernel/pulls/14845

 

Reviewed-by: default avatarZhang Peng <zhangpeng362@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents 26ccd8b3 85ccbdf2
Loading
Loading
Loading
Loading
+8 −6
Original line number Diff line number Diff line
@@ -58,7 +58,7 @@ bool last_level_cache_is_valid(unsigned int cpu)
{
	struct cacheinfo *llc;

	if (!cache_leaves(cpu))
	if (!cache_leaves(cpu) || !per_cpu_cacheinfo(cpu))
		return false;

	llc = per_cpu_cacheinfo_idx(cpu, cache_leaves(cpu) - 1);
@@ -511,11 +511,9 @@ int __weak populate_cache_leaves(unsigned int cpu)
	return -ENOENT;
}

static inline
int allocate_cache_info(int cpu)
static inline int allocate_cache_info(int cpu)
{
	per_cpu_cacheinfo(cpu) = kcalloc(cache_leaves(cpu),
					 sizeof(struct cacheinfo), GFP_ATOMIC);
	per_cpu_cacheinfo(cpu) = kcalloc(cache_leaves(cpu), sizeof(struct cacheinfo), GFP_ATOMIC);
	if (!per_cpu_cacheinfo(cpu)) {
		cache_leaves(cpu) = 0;
		return -ENOMEM;
@@ -587,7 +585,11 @@ static inline int init_level_allocate_ci(unsigned int cpu)
	 */
	ci_cacheinfo(cpu)->early_ci_levels = false;

	if (cache_leaves(cpu) <= early_leaves)
	/*
	 * Some architectures (e.g., x86) do not use early initialization.
	 * Allocate memory now in such case.
	 */
	if (cache_leaves(cpu) <= early_leaves && per_cpu_cacheinfo(cpu))
		return 0;

	kfree(per_cpu_cacheinfo(cpu));
+1 −2
Original line number Diff line number Diff line
@@ -163,10 +163,9 @@ static void mtk_drm_crtc_destroy(struct drm_crtc *crtc)

	mtk_mutex_put(mtk_crtc->mutex);
#if IS_REACHABLE(CONFIG_MTK_CMDQ)
	mtk_drm_cmdq_pkt_destroy(&mtk_crtc->cmdq_handle);

	if (mtk_crtc->cmdq_client.chan) {
		mbox_free_channel(mtk_crtc->cmdq_client.chan);
		mtk_drm_cmdq_pkt_destroy(&mtk_crtc->cmdq_handle);
		mtk_crtc->cmdq_client.chan = NULL;
	}
#endif
+2 −2
Original line number Diff line number Diff line
@@ -3736,8 +3736,8 @@ int ionic_lif_register(struct ionic_lif *lif)
	/* only register LIF0 for now */
	err = register_netdev(lif->netdev);
	if (err) {
		dev_err(lif->ionic->dev, "Cannot register net device, aborting\n");
		ionic_lif_unregister_phc(lif);
		dev_err(lif->ionic->dev, "Cannot register net device: %d, aborting\n", err);
		ionic_lif_unregister(lif);
		return err;
	}

+36 −38
Original line number Diff line number Diff line
@@ -46,14 +46,8 @@ static struct {
	int		used;		/* number of elements used */
	bool		sorted;		/* if elements are sorted */
	bool		whitelist;	/* if list is a blacklist or whitelist */
} report_filterlist = {
	.addrs		= NULL,
	.size		= 8,		/* small initial size */
	.used		= 0,
	.sorted		= false,
	.whitelist	= false,	/* default is blacklist */
};
static DEFINE_SPINLOCK(report_filterlist_lock);
} report_filterlist;
static DEFINE_RAW_SPINLOCK(report_filterlist_lock);

/*
 * The microbenchmark allows benchmarking KCSAN core runtime only. To run
@@ -110,7 +104,7 @@ bool kcsan_skip_report_debugfs(unsigned long func_addr)
		return false;
	func_addr -= offset; /* Get function start */

	spin_lock_irqsave(&report_filterlist_lock, flags);
	raw_spin_lock_irqsave(&report_filterlist_lock, flags);
	if (report_filterlist.used == 0)
		goto out;

@@ -127,7 +121,7 @@ bool kcsan_skip_report_debugfs(unsigned long func_addr)
		ret = !ret;

out:
	spin_unlock_irqrestore(&report_filterlist_lock, flags);
	raw_spin_unlock_irqrestore(&report_filterlist_lock, flags);
	return ret;
}

@@ -135,9 +129,9 @@ static void set_report_filterlist_whitelist(bool whitelist)
{
	unsigned long flags;

	spin_lock_irqsave(&report_filterlist_lock, flags);
	raw_spin_lock_irqsave(&report_filterlist_lock, flags);
	report_filterlist.whitelist = whitelist;
	spin_unlock_irqrestore(&report_filterlist_lock, flags);
	raw_spin_unlock_irqrestore(&report_filterlist_lock, flags);
}

/* Returns 0 on success, error-code otherwise. */
@@ -145,6 +139,9 @@ static ssize_t insert_report_filterlist(const char *func)
{
	unsigned long flags;
	unsigned long addr = kallsyms_lookup_name(func);
	unsigned long *delay_free = NULL;
	unsigned long *new_addrs = NULL;
	size_t new_size = 0;
	ssize_t ret = 0;

	if (!addr) {
@@ -152,32 +149,33 @@ static ssize_t insert_report_filterlist(const char *func)
		return -ENOENT;
	}

	spin_lock_irqsave(&report_filterlist_lock, flags);

	if (report_filterlist.addrs == NULL) {
		/* initial allocation */
		report_filterlist.addrs =
			kmalloc_array(report_filterlist.size,
				      sizeof(unsigned long), GFP_ATOMIC);
		if (report_filterlist.addrs == NULL) {
			ret = -ENOMEM;
			goto out;
retry_alloc:
	/*
	 * Check if we need an allocation, and re-validate under the lock. Since
	 * the report_filterlist_lock is a raw, cannot allocate under the lock.
	 */
	if (data_race(report_filterlist.used == report_filterlist.size)) {
		new_size = (report_filterlist.size ?: 4) * 2;
		delay_free = new_addrs = kmalloc_array(new_size, sizeof(unsigned long), GFP_KERNEL);
		if (!new_addrs)
			return -ENOMEM;
	}
	} else if (report_filterlist.used == report_filterlist.size) {
		/* resize filterlist */
		size_t new_size = report_filterlist.size * 2;
		unsigned long *new_addrs =
			krealloc(report_filterlist.addrs,
				 new_size * sizeof(unsigned long), GFP_ATOMIC);

		if (new_addrs == NULL) {
			/* leave filterlist itself untouched */
			ret = -ENOMEM;
			goto out;

	raw_spin_lock_irqsave(&report_filterlist_lock, flags);
	if (report_filterlist.used == report_filterlist.size) {
		/* Check we pre-allocated enough, and retry if not. */
		if (report_filterlist.used >= new_size) {
			raw_spin_unlock_irqrestore(&report_filterlist_lock, flags);
			kfree(new_addrs); /* kfree(NULL) is safe */
			delay_free = new_addrs = NULL;
			goto retry_alloc;
		}

		if (report_filterlist.used)
			memcpy(new_addrs, report_filterlist.addrs, report_filterlist.used * sizeof(unsigned long));
		delay_free = report_filterlist.addrs; /* free the old list */
		report_filterlist.addrs = new_addrs;  /* switch to the new list */
		report_filterlist.size = new_size;
		report_filterlist.addrs = new_addrs;
	}

	/* Note: deduplicating should be done in userspace. */
@@ -185,9 +183,9 @@ static ssize_t insert_report_filterlist(const char *func)
		kallsyms_lookup_name(func);
	report_filterlist.sorted = false;

out:
	spin_unlock_irqrestore(&report_filterlist_lock, flags);
	raw_spin_unlock_irqrestore(&report_filterlist_lock, flags);

	kfree(delay_free);
	return ret;
}

@@ -204,13 +202,13 @@ static int show_info(struct seq_file *file, void *v)
	}

	/* show filter functions, and filter type */
	spin_lock_irqsave(&report_filterlist_lock, flags);
	raw_spin_lock_irqsave(&report_filterlist_lock, flags);
	seq_printf(file, "\n%s functions: %s\n",
		   report_filterlist.whitelist ? "whitelisted" : "blacklisted",
		   report_filterlist.used == 0 ? "none" : "");
	for (i = 0; i < report_filterlist.used; ++i)
		seq_printf(file, " %ps\n", (void *)report_filterlist.addrs[i]);
	spin_unlock_irqrestore(&report_filterlist_lock, flags);
	raw_spin_unlock_irqrestore(&report_filterlist_lock, flags);

	return 0;
}
+15 −0
Original line number Diff line number Diff line
@@ -1076,12 +1076,27 @@ __always_inline bool free_pages_prepare(struct page *page,
	bool skip_kasan_poison = should_skip_kasan_poison(page);
	bool init = want_init_on_free();
	bool compound = PageCompound(page);
	struct folio *folio = page_folio(page);

	VM_BUG_ON_PAGE(PageTail(page), page);

	trace_mm_page_free(page, order);
	kmsan_free_page(page, order);

	/*
	 * In rare cases, when truncation or holepunching raced with
	 * munlock after VM_LOCKED was cleared, Mlocked may still be
	 * found set here.  This does not indicate a problem, unless
	 * "unevictable_pgs_cleared" appears worryingly large.
	 */
	if (unlikely(folio_test_mlocked(folio))) {
		long nr_pages = folio_nr_pages(folio);
		
		__folio_clear_mlocked(folio);
		zone_stat_mod_folio(folio, NR_MLOCK, -nr_pages);
		count_vm_events(UNEVICTABLE_PGCLEARED, nr_pages);
	}

	if (unlikely(PageHWPoison(page)) && !order) {
		/*
		 * Do not let hwpoison pages hit pcplists/buddy
Loading