Merge Pull Request from: @openeuler-sync-bot 
 

Origin pull request: 
https://gitee.com/openeuler/kernel/pulls/1727 
 
PR sync from: Yu Liao <liaoyu15@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/N7DVTGONEIVDI2GITMMBE6T4J2YVA4WH/ 
timer_shutdown_sync() function is useful for final teardown of an
infrastructure where the timer is subject to a circular dependency
problem.

A common pattern for this is a timer and a workqueue where the timer can
schedule work and work can arm the timer. On shutdown the workqueue must
be destroyed and the timer must be prevented from rearming. Unless the
code has conditionals like 'if (mything->in_shutdown)' to prevent that
there is no way to get this correct with timer_delete_sync().

timer_shutdown_sync() is solving the problem. The correct ordering of
calls in this case is:

 timer_shutdown_sync(&mything->timer);
 workqueue_destroy(&mything->workqueue);

After this 'mything' can be safely freed.

Steven Rostedt (Google) (3):
  ARM: spear: Do not use timer namespace for timer_shutdown() function
  clocksource/drivers/arm_arch_timer: Do not use timer namespace for
    timer_shutdown() function
  clocksource/drivers/sp804: Do not use timer namespace for
    timer_shutdown() function

Thomas Gleixner (10):
  timers: Get rid of del_singleshot_timer_sync()
  timers: Replace BUG_ON()s
  timers: Update kernel-doc for various functions
  timers: Use del_timer_sync() even on UP
  timers: Rename del_timer_sync() to timer_delete_sync()
  timers: Rename del_timer() to timer_delete()
  timers: Silently ignore timers with a NULL function
  timers: Add shutdown mechanism to the internal functions
  timers: Provide timer_shutdown[_sync]()

Yu Liao (2):
  sw64: Do not use timer namespace for timer_shutdown() function
  timers: Keep del_timer[_sync]() exported


-- 
2.25.1
 
https://gitee.com/openeuler/kernel/issues/I7R8WG 
 
Link:https://gitee.com/openeuler/kernel/pulls/1744 

Reviewed-by: Xiongfeng Wang <wangxiongfeng2@huawei.com> 
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com> 

!1731 [sync] PR-1713:  netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID

Merge Pull Request from: @openeuler-sync-bot 
 

Origin pull request: 
https://gitee.com/openeuler/kernel/pulls/1713 
 
PR sync from: Lu Wei <luwei32@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/SGMAG5EQTBM4R4SFB5KR5GIRFLPCZIQP/ 
 
https://gitee.com/src-openeuler/kernel/issues/I7QG0U 
 
Link:https://gitee.com/openeuler/kernel/pulls/1731 

Reviewed-by: Yue Haibing <yuehaibing@huawei.com> 
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com> 

hulk inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7R8WG

--------------------------------

A previous commit made del_timer[_sync]() obsolete and unexported, which
caused kabi to break. So making del_timer[_sync]() exported, the same as
before.
Signed-off-by: NYu Liao <liaoyu15@huawei.com>
(cherry picked from commit ec2d781a)

mainline inclusion
from mainline-v6.2-rc1
commit f571faf6
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I7R8WG

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f571faf6e443b6011ccb585d57866177af1f643c

--------------------------------

Tearing down timers which have circular dependencies to other
functionality, e.g. workqueues, where the timer can schedule work and work
can arm timers, is not trivial.

In those cases it is desired to shutdown the timer in a way which prevents
rearming of the timer. The mechanism to do so is to set timer->function to
NULL and use this as an indicator for the timer arming functions to ignore
the (re)arm request.

Expose new interfaces for this: timer_shutdown_sync() and timer_shutdown().

timer_shutdown_sync() has the same functionality as timer_delete_sync()
plus the NULL-ification of the timer function.

timer_shutdown() has the same functionality as timer_delete() plus the
NULL-ification of the timer function.

In both cases the rearming of the timer is prevented by silently discarding
rearm attempts due to timer->function being NULL.
Co-developed-by: NSteven Rostedt <rostedt@goodmis.org>
Signed-off-by: NSteven Rostedt <rostedt@goodmis.org>
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
Tested-by: NGuenter Roeck <linux@roeck-us.net>
Reviewed-by: NJacob Keller <jacob.e.keller@intel.com>
Reviewed-by: NAnna-Maria Behnsen <anna-maria@linutronix.de>
Link: https://lore.kernel.org/all/20220407161745.7d6754b3@gandalf.local.home
Link: https://lore.kernel.org/all/20221110064101.429013735@goodmis.org
Link: https://lore.kernel.org/r/20221123201625.314230270@linutronix.deSigned-off-by: NYu Liao <liaoyu15@huawei.com>
(cherry picked from commit 4bf511b4)

mainline inclusion
from mainline-v6.2-rc1
commit 0cc04e80
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I7R8WG

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0cc04e80458a822300b93f82ed861a513edde194

--------------------------------

Tearing down timers which have circular dependencies to other
functionality, e.g. workqueues, where the timer can schedule work and work
can arm timers, is not trivial.

In those cases it is desired to shutdown the timer in a way which prevents
rearming of the timer. The mechanism to do so is to set timer->function to
NULL and use this as an indicator for the timer arming functions to ignore
the (re)arm request.

Add a shutdown argument to the relevant internal functions which makes the
actual deactivation code set timer->function to NULL which in turn prevents
rearming of the timer.
Co-developed-by: NSteven Rostedt <rostedt@goodmis.org>
Signed-off-by: NSteven Rostedt <rostedt@goodmis.org>
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
Tested-by: NGuenter Roeck <linux@roeck-us.net>
Reviewed-by: NJacob Keller <jacob.e.keller@intel.com>
Reviewed-by: NAnna-Maria Behnsen <anna-maria@linutronix.de>
Link: https://lore.kernel.org/all/20220407161745.7d6754b3@gandalf.local.home
Link: https://lore.kernel.org/all/20221110064101.429013735@goodmis.org
Link: https://lore.kernel.org/r/20221123201625.253883224@linutronix.deSigned-off-by: NYu Liao <liaoyu15@huawei.com>
(cherry picked from commit 8555e7d6)

mainline inclusion
from mainline-v6.2-rc1
commit 8553b5f2
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I7R8WG

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8553b5f2774a66b1f293b7d783934210afb8f23c

--------------------------------

Tearing down timers which have circular dependencies to other
functionality, e.g. workqueues, where the timer can schedule work and work
can arm timers, is not trivial.

In those cases it is desired to shutdown the timer in a way which prevents
rearming of the timer. The mechanism to do so is to set timer->function to
NULL and use this as an indicator for the timer arming functions to ignore
the (re)arm request.

Split the inner workings of try_do_del_timer_sync(), del_timer_sync() and
del_timer() into helper functions to prepare for implementing the shutdown
functionality.

No functional change.
Co-developed-by: NSteven Rostedt <rostedt@goodmis.org>
Signed-off-by: NSteven Rostedt <rostedt@goodmis.org>
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
Tested-by: NGuenter Roeck <linux@roeck-us.net>
Reviewed-by: NJacob Keller <jacob.e.keller@intel.com>
Reviewed-by: NAnna-Maria Behnsen <anna-maria@linutronix.de>
Link: https://lore.kernel.org/all/20220407161745.7d6754b3@gandalf.local.home
Link: https://lore.kernel.org/all/20221110064101.429013735@goodmis.org
Link: https://lore.kernel.org/r/20221123201625.195147423@linutronix.deSigned-off-by: NYu Liao <liaoyu15@huawei.com>
(cherry picked from commit 7913b067)

mainline inclusion
from mainline-v6.2-rc1
commit d02e382c
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I7R8WG

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d02e382cef06cc73561dd32dfdc171c00dcc416d

--------------------------------

Tearing down timers which have circular dependencies to other
functionality, e.g. workqueues, where the timer can schedule work and work
can arm timers, is not trivial.

In those cases it is desired to shutdown the timer in a way which prevents
rearming of the timer. The mechanism to do so is to set timer->function to
NULL and use this as an indicator for the timer arming functions to ignore
the (re)arm request.

In preparation for that replace the warnings in the relevant code paths
with checks for timer->function == NULL. If the pointer is NULL, then
discard the rearm request silently.

Add debug_assert_init() instead of the WARN_ON_ONCE(!timer->function)
checks so that debug objects can warn about non-initialized timers.

The warning of debug objects does not warn if timer->function == NULL.  It
warns when timer was not initialized using timer_setup[_on_stack]() or via
DEFINE_TIMER(). If developers fail to enable debug objects and then waste
lots of time to figure out why their non-initialized timer is not firing,
they deserve it. Same for initializing a timer with a NULL function.
Co-developed-by: NSteven Rostedt <rostedt@goodmis.org>
Signed-off-by: NSteven Rostedt <rostedt@goodmis.org>
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
Tested-by: NGuenter Roeck <linux@roeck-us.net>
Reviewed-by: NJacob Keller <jacob.e.keller@intel.com>
Reviewed-by: NAnna-Maria Behnsen <anna-maria@linutronix.de>
Link: https://lore.kernel.org/all/20220407161745.7d6754b3@gandalf.local.home
Link: https://lore.kernel.org/all/20221110064101.429013735@goodmis.org
Link: https://lore.kernel.org/r/87wn7kdann.ffs@tglxSigned-off-by: NYu Liao <liaoyu15@huawei.com>
(cherry picked from commit c84834f9)

mainline inclusion
from mainline-v6.2-rc1
commit bb663f0f
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I7R8WG

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bb663f0f3c396c6d05f6c5eeeea96ced20ff112e

--------------------------------

The timer related functions do not have a strict timer_ prefixed namespace
which is really annoying.

Rename del_timer() to timer_delete() and provide del_timer()
as a wrapper. Document that del_timer() is not for new code.
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
Tested-by: NGuenter Roeck <linux@roeck-us.net>
Reviewed-by: NSteven Rostedt (Google) <rostedt@goodmis.org>
Reviewed-by: NJacob Keller <jacob.e.keller@intel.com>
Reviewed-by: NAnna-Maria Behnsen <anna-maria@linutronix.de>
Link: https://lore.kernel.org/r/20221123201625.015535022@linutronix.deSigned-off-by: NYu Liao <liaoyu15@huawei.com>
(cherry picked from commit 37ba6517)

mainline inclusion
from mainline-v6.2-rc1
commit 9b13df3f
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I7R8WG

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9b13df3fb64ee95e2397585404e442afee2c7d4f

--------------------------------

The timer related functions do not have a strict timer_ prefixed namespace
which is really annoying.

Rename del_timer_sync() to timer_delete_sync() and provide del_timer_sync()
as a wrapper. Document that del_timer_sync() is not for new code.
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
Tested-by: NGuenter Roeck <linux@roeck-us.net>
Reviewed-by: NSteven Rostedt (Google) <rostedt@goodmis.org>
Reviewed-by: NJacob Keller <jacob.e.keller@intel.com>
Reviewed-by: NAnna-Maria Behnsen <anna-maria@linutronix.de>
Link: https://lore.kernel.org/r/20221123201624.954785441@linutronix.deSigned-off-by: NYu Liao <liaoyu15@huawei.com>
(cherry picked from commit 3875c56a)

mainline inclusion
from mainline-v6.2-rc1
commit 168f6b6f
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I7R8WG

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=168f6b6ffbeec0b9333f3582e4cf637300858db5

--------------------------------

del_timer_sync() is assumed to be pointless on uniprocessor systems and can
be mapped to del_timer() because in theory del_timer() can never be invoked
while the timer callback function is executed.

This is not entirely true because del_timer() can be invoked from interrupt
context and therefore hit in the middle of a running timer callback.

Contrary to that del_timer_sync() is not allowed to be invoked from
interrupt context unless the affected timer is marked with TIMER_IRQSAFE.
del_timer_sync() has proper checks in place to detect such a situation.

Give up on the UP optimization and make del_timer_sync() unconditionally
available.
Co-developed-by: NSteven Rostedt <rostedt@goodmis.org>
Signed-off-by: NSteven Rostedt <rostedt@goodmis.org>
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
Tested-by: NGuenter Roeck <linux@roeck-us.net>
Reviewed-by: NJacob Keller <jacob.e.keller@intel.com>
Reviewed-by: NAnna-Maria Behnsen <anna-maria@linutronix.de>
Link: https://lore.kernel.org/all/20220407161745.7d6754b3@gandalf.local.home
Link: https://lore.kernel.org/all/20221110064101.429013735@goodmis.org
Link: https://lore.kernel.org/r/20221123201624.888306160@linutronix.deSigned-off-by: NYu Liao <liaoyu15@huawei.com>
(cherry picked from commit 39923cb6)

mainline inclusion
from mainline-v6.2-rc1
commit 14f043f1
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I7R8WG

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=14f043f1340bf30bc60af127bff39f55889fef26

--------------------------------

The kernel-doc of timer related functions is partially uncomprehensible
word salad. Rewrite it to make it useful.
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
Tested-by: NGuenter Roeck <linux@roeck-us.net>
Reviewed-by: NJacob Keller <jacob.e.keller@intel.com>
Reviewed-by: NAnna-Maria Behnsen <anna-maria@linutronix.de>
Link: https://lore.kernel.org/r/20221123201624.828703870@linutronix.deSigned-off-by: NYu Liao <liaoyu15@huawei.com>
(cherry picked from commit baff0f87)

mainline inclusion
from mainline-v6.2-rc1
commit 82ed6f7e
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I7R8WG

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=82ed6f7ef58f9634fe4462dd721902c580f01569

--------------------------------

The timer code still has a few BUG_ON()s left which are crashing the kernel
in situations where it still can recover or simply refuse to take an
action.

Remove the one in the hotplug callback which checks for the CPU being
offline. If that happens then the whole hotplug machinery will explode in
colourful ways.

Replace the rest with WARN_ON_ONCE() and conditional returns where
appropriate.
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
Tested-by: NGuenter Roeck <linux@roeck-us.net>
Reviewed-by: NJacob Keller <jacob.e.keller@intel.com>
Reviewed-by: NAnna-Maria Behnsen <anna-maria@linutronix.de>
Link: https://lore.kernel.org/r/20221123201624.769128888@linutronix.deSigned-off-by: NYu Liao <liaoyu15@huawei.com>
(cherry picked from commit ebf38635)

mainline inclusion
from mainline-v6.2-rc1
commit 9a5a3056
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I7R8WG

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9a5a305686971f4be10c6d7251c8348d74b3e014

--------------------------------

del_singleshot_timer_sync() used to be an optimization for deleting timers
which are not rearmed from the timer callback function.

This optimization turned out to be broken and got mapped to
del_timer_sync() about 17 years ago.

Get rid of the undocumented indirection and use del_timer_sync() directly.

No functional change.
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
Tested-by: NGuenter Roeck <linux@roeck-us.net>
Reviewed-by: NJacob Keller <jacob.e.keller@intel.com>
Reviewed-by: NAnna-Maria Behnsen <anna-maria@linutronix.de>
Link: https://lore.kernel.org/r/20221123201624.706987932@linutronix.de

 Conflicts:
	net/sunrpc/xprt.c
Signed-off-by: NYu Liao <liaoyu15@huawei.com>
(cherry picked from commit fe99d43f)

hulk inclusion
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I7R8WG

--------------------------------

A new "shutdown" timer state is being added to the generic timer code. One
of the functions to change the timer into the state is called
"timer_shutdown()". This means that there can not be other functions
called "timer_shutdown()" as the timer code owns the "timer_*" name space.

Rename timer_shutdown() to sw64_timer_shutdown() to avoid this conflict.
Signed-off-by: NYu Liao <liaoyu15@huawei.com>
(cherry picked from commit d0f4c739)

mainline inclusion
from mainline-v6.2-rc1
commit 6e1fc259
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I7R8WG

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6e1fc2591f116dfb20b65cf27356475461d61bd8

--------------------------------

A new "shutdown" timer state is being added to the generic timer code. One
of the functions to change the timer into the state is called
"timer_shutdown()". This means that there can not be other functions
called "timer_shutdown()" as the timer code owns the "timer_*" name space.

Rename timer_shutdown() to evt_timer_shutdown() to avoid this conflict.
Signed-off-by: NSteven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
Tested-by: NGuenter Roeck <linux@roeck-us.net>
Reviewed-by: NGuenter Roeck <linux@roeck-us.net>
Reviewed-by: NJacob Keller <jacob.e.keller@intel.com>
Reviewed-by: NAnna-Maria Behnsen <anna-maria@linutronix.de>
Link: https://lkml.kernel.org/r/20221106212702.182883323@goodmis.org
Link: https://lore.kernel.org/all/20221105060155.592778858@goodmis.org/
Link: https://lore.kernel.org/r/20221110064147.158230501@goodmis.org
Link: https://lore.kernel.org/r/20221123201624.634354813@linutronix.deSigned-off-by: NYu Liao <liaoyu15@huawei.com>
(cherry picked from commit 3e0e7195)

mainline inclusion
from mainline-v6.2-rc1
commit 73737a58
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I7R8WG

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=73737a5833ace25a8408b0d3b783637cb6bf29d1

--------------------------------

A new "shutdown" timer state is being added to the generic timer code. One
of the functions to change the timer into the state is called
"timer_shutdown()". This means that there can not be other functions
called "timer_shutdown()" as the timer code owns the "timer_*" name space.

Rename timer_shutdown() to arch_timer_shutdown() to avoid this conflict.
Signed-off-by: NSteven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
Tested-by: NGuenter Roeck <linux@roeck-us.net>
Reviewed-by: NGuenter Roeck <linux@roeck-us.net>
Reviewed-by: NJacob Keller <jacob.e.keller@intel.com>
Reviewed-by: NAnna-Maria Behnsen <anna-maria@linutronix.de>
Acked-by: NMarc Zyngier <maz@kernel.org>
Link: https://lkml.kernel.org/r/20221106212702.002251651@goodmis.org
Link: https://lore.kernel.org/all/20221105060155.409832154@goodmis.org/
Link: https://lore.kernel.org/r/20221110064146.981725531@goodmis.org
Link: https://lore.kernel.org/r/20221123201624.574672568@linutronix.deSigned-off-by: NYu Liao <liaoyu15@huawei.com>
(cherry picked from commit 2ebfa836)

mainline inclusion
from mainline-v6.2-rc1
commit 80b55772
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I7R8WG

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=80b55772d41d8afec68dbc4ff0368a9fe5d1f390

--------------------------------

A new "shutdown" timer state is being added to the generic timer code. One
of the functions to change the timer into the state is called
"timer_shutdown()". This means that there can not be other functions called
"timer_shutdown()" as the timer code owns the "timer_*" name space.

Rename timer_shutdown() to spear_timer_shutdown() to avoid this conflict.
Signed-off-by: NSteven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
Tested-by: NGuenter Roeck <linux@roeck-us.net>
Reviewed-by: NGuenter Roeck <linux@roeck-us.net>
Reviewed-by: NJacob Keller <jacob.e.keller@intel.com>
Reviewed-by: NAnna-Maria Behnsen <anna-maria@linutronix.de>
Acked-by: NArnd Bergmann <arnd@arndb.de>
Acked-by: NViresh Kumar <viresh.kumar@linaro.org>
Link: https://lkml.kernel.org/r/20221106212701.822440504@goodmis.org
Link: https://lore.kernel.org/all/20221105060155.228348078@goodmis.org/
Link: https://lore.kernel.org/r/20221110064146.810953418@goodmis.org
Link: https://lore.kernel.org/r/20221123201624.513863211@linutronix.deSigned-off-by: NYu Liao <liaoyu15@huawei.com>
(cherry picked from commit 0695f959)

Merge Pull Request from: @ddjsaiwqq 
 
Fix vcpu timer initialize, saved, restore and triggered functions.
As the previous code does not init vcpu timer, and the timer value
should add time value instead of ticks value to calculate the expire 
time when vcpu timer triggered.
 
 
Link:https://gitee.com/openeuler/kernel/pulls/1617 

Reviewed-by: Kevin Zhu <zhukeqian1@huawei.com> 
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com> 

Merge Pull Request from: @ci-robot 
 
PR sync from: Yong Hu <yong.hu@windriver.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/BYQKULLDBICIPTVMVEPZUOLO6E6W33GS/ 
 
https://gitee.com/openeuler/kernel/issues/I6D0XA 
 
Link:https://gitee.com/openeuler/kernel/pulls/1639 

Reviewed-by: Zheng Zengkai <zhengzengkai@huawei.com> 
Signed-off-by: Zheng Zengkai <zhengzengkai@huawei.com> 

Merge Pull Request from: @openeuler-sync-bot 
 

Origin pull request: 
https://gitee.com/openeuler/kernel/pulls/1711 
 
PR sync from: Zhengchao Shao <shaozhengchao@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/B3ZSS336JXNQSPFJCYBONSQZLLYXKGQ2/ 
 
https://gitee.com/src-openeuler/kernel/issues/I7NYWN 
 
Link:https://gitee.com/openeuler/kernel/pulls/1714 

Reviewed-by: Yue Haibing <yuehaibing@huawei.com> 
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com> 

Merge Pull Request from: @openeuler-sync-bot 
 

Origin pull request: 
https://gitee.com/openeuler/kernel/pulls/1604 
 
PR sync from: Ziyang Xuan <william.xuanziyang@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/5LGGZAJFGQ7GMAJWNGCSQVWZZ2K26FKH/ 
Backport CVE-2023-3863 fix commits.

v2:
  - Resend the patchset.

Krzysztof Kozlowski (1):
  nfc: llcp: simplify llcp_sock_connect() error paths

Lin Ma (1):
  net: nfc: Fix use-after-free caused by nfc_llcp_find_local


-- 
2.25.1
 
https://gitee.com/src-openeuler/kernel/issues/I7NLJR 
 
Link:https://gitee.com/openeuler/kernel/pulls/1632 

Reviewed-by: Yue Haibing <yuehaibing@huawei.com> 
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com> 

mainline inclusion
from mainline-v6.5-rc4
commit 0ebc1064e4874d5987722a2ddbc18f94aa53b211
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7QG0U
CVE: CVE-2023-4147

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0ebc1064e4874d5987722a2ddbc18f94aa53b211

--------------------------------

Bail out with EOPNOTSUPP when adding rule to bound chain via
NFTA_RULE_CHAIN_ID. The following warning splat is shown when
adding a rule to a deleted bound chain:

 WARNING: CPU: 2 PID: 13692 at net/netfilter/nf_tables_api.c:2013 nf_tables_chain_destroy+0x1f7/0x210 [nf_tables]
 CPU: 2 PID: 13692 Comm: chain-bound-rul Not tainted 6.1.39 #1
 RIP: 0010:nf_tables_chain_destroy+0x1f7/0x210 [nf_tables]

Fixes: d0e2c7de ("netfilter: nf_tables: add NFT_CHAIN_BINDING")
Reported-by: NKevin Rich <kevinrich1337@gmail.com>
Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: NFlorian Westphal <fw@strlen.de>
Signed-off-by: NLu Wei <luwei32@huawei.com>
(cherry picked from commit a39007a6)

Merge Pull Request from: @openeuler-sync-bot 
 

Origin pull request: 
https://gitee.com/openeuler/kernel/pulls/1618 
 
LoongArch: fix the following configs not defined:
CONFIG_ZONE_DMA32
CONFIG_TRACE_IRQFLAGS_SUPPORT
CONFIG_HAVE_SETUP_PER_CPU_AREA
CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK
CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK 
 
Link:https://gitee.com/openeuler/kernel/pulls/1710 

Reviewed-by: Guo Dongtai <guodongtai@kylinos.cn> 
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com> 

mainline inclusion
from mainline-v6.5-rc3
commit 00374d9b6d9f932802b55181be9831aa948e5b7c
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7NYWN
CVE: CVE-2023-3772

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=00374d9b6d9f932802b55181be9831aa948e5b7c

--------------------------------

Normally, x->replay_esn and x->preplay_esn should be allocated at
xfrm_alloc_replay_state_esn(...) in xfrm_state_construct(...), hence the
xfrm_update_ae_params(...) is okay to update them. However, the current
implementation of xfrm_new_ae(...) allows a malicious user to directly
dereference a NULL pointer and crash the kernel like below.

BUG: kernel NULL pointer dereference, address: 0000000000000000
PGD 8253067 P4D 8253067 PUD 8e0e067 PMD 0
Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 PID: 98 Comm: poc.npd Not tainted 6.4.0-rc7-00072-gdad9774d #8
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.o4
RIP: 0010:memcpy_orig+0xad/0x140
Code: e8 4c 89 5f e0 48 8d 7f e0 73 d2 83 c2 20 48 29 d6 48 29 d7 83 fa 10 72 34 4c 8b 06 4c 8b 4e 08 c
RSP: 0018:ffff888008f57658 EFLAGS: 00000202
RAX: 0000000000000000 RBX: ffff888008bd0000 RCX: ffffffff8238e571
RDX: 0000000000000018 RSI: ffff888007f64844 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888008f57818
R13: ffff888007f64aa4 R14: 0000000000000000 R15: 0000000000000000
FS:  00000000014013c0(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000000054d8000 CR4: 00000000000006f0
Call Trace:
 <TASK>
 ? __die+0x1f/0x70
 ? page_fault_oops+0x1e8/0x500
 ? __pfx_is_prefetch.constprop.0+0x10/0x10
 ? __pfx_page_fault_oops+0x10/0x10
 ? _raw_spin_unlock_irqrestore+0x11/0x40
 ? fixup_exception+0x36/0x460
 ? _raw_spin_unlock_irqrestore+0x11/0x40
 ? exc_page_fault+0x5e/0xc0
 ? asm_exc_page_fault+0x26/0x30
 ? xfrm_update_ae_params+0xd1/0x260
 ? memcpy_orig+0xad/0x140
 ? __pfx__raw_spin_lock_bh+0x10/0x10
 xfrm_update_ae_params+0xe7/0x260
 xfrm_new_ae+0x298/0x4e0
 ? __pfx_xfrm_new_ae+0x10/0x10
 ? __pfx_xfrm_new_ae+0x10/0x10
 xfrm_user_rcv_msg+0x25a/0x410
 ? __pfx_xfrm_user_rcv_msg+0x10/0x10
 ? __alloc_skb+0xcf/0x210
 ? stack_trace_save+0x90/0xd0
 ? filter_irq_stacks+0x1c/0x70
 ? __stack_depot_save+0x39/0x4e0
 ? __kasan_slab_free+0x10a/0x190
 ? kmem_cache_free+0x9c/0x340
 ? netlink_recvmsg+0x23c/0x660
 ? sock_recvmsg+0xeb/0xf0
 ? __sys_recvfrom+0x13c/0x1f0
 ? __x64_sys_recvfrom+0x71/0x90
 ? do_syscall_64+0x3f/0x90
 ? entry_SYSCALL_64_after_hwframe+0x72/0xdc
 ? copyout+0x3e/0x50
 netlink_rcv_skb+0xd6/0x210
 ? __pfx_xfrm_user_rcv_msg+0x10/0x10
 ? __pfx_netlink_rcv_skb+0x10/0x10
 ? __pfx_sock_has_perm+0x10/0x10
 ? mutex_lock+0x8d/0xe0
 ? __pfx_mutex_lock+0x10/0x10
 xfrm_netlink_rcv+0x44/0x50
 netlink_unicast+0x36f/0x4c0
 ? __pfx_netlink_unicast+0x10/0x10
 ? netlink_recvmsg+0x500/0x660
 netlink_sendmsg+0x3b7/0x700

This Null-ptr-deref bug is assigned CVE-2023-3772. And this commit
adds additional NULL check in xfrm_update_ae_params to fix the NPD.

Fixes: d8647b79 ("xfrm: Add user interface for esn and big anti-replay windows")
Signed-off-by: NLin Ma <linma@zju.edu.cn>
Reviewed-by: NLeon Romanovsky <leonro@nvidia.com>
Signed-off-by: NSteffen Klassert <steffen.klassert@secunet.com>

Conflicts:
	net/xfrm/xfrm_user.c
Signed-off-by: NZhengchao Shao <shaozhengchao@huawei.com>
(cherry picked from commit 5bfbef90)

LoongArch inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7PT2H

--------------------------------
Signed-off-by: NYingkun Meng <mengyingkun@loongson.cn>
Signed-off-by: NHongchen Zhang <zhanghongchen@loongson.cn>
(cherry picked from commit c5226585)

LoongArch inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7PT2H

--------------------------------
Signed-off-by: NHongchen Zhang <zhanghongchen@loongson.cn>
(cherry picked from commit d50c28b6)

LoongArch inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7PT2H

--------------------------------

Percpu area not allocated as expected because some CONFIG not defined,
Defined the required CONFIG to fix it.
Signed-off-by: NHongchen Zhang <zhanghongchen@loongson.cn>
(cherry picked from commit 056e342d)

Merge Pull Request from: @openeuler-sync-bot 
 

Origin pull request: 
https://gitee.com/openeuler/kernel/pulls/1682 
 
PR sync from: Lu Wei <luwei32@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/XHWCN4LVCI4W4ZNP4NXSYHBEYGDNGBUG/ 
 
https://gitee.com/src-openeuler/kernel/issues/I7P3TK 
 
Link:https://gitee.com/openeuler/kernel/pulls/1702 

Reviewed-by: Yue Haibing <yuehaibing@huawei.com> 
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com> 

Merge Pull Request from: @openeuler-sync-bot 
 

Origin pull request: 
https://gitee.com/openeuler/kernel/pulls/1596 
 
PR sync from: Li Lingfeng <lilingfeng3@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/MKD6POKWLXC45KXPZXCZ7N52MPOZMNAR/ 
 
https://gitee.com/src-openeuler/kernel/issues/I7LU2Q 
 
Link:https://gitee.com/openeuler/kernel/pulls/1674 

Reviewed-by: Jialin Zhang <zhangjialin11@huawei.com> 
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com> 

stable inclusion
from stable-v5.10.188
commit 3a91099ecd59a42d1632fcb152bf7222f268ea2b
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7P3TK
CVE: CVE-2023-4004

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3a91099ecd59a42d1632fcb152bf7222f268ea2b

---------------------------

[ Upstream commit 87b5a5c209405cb6b57424cdfa226a6dbd349232 ]

end key should be equal to start unless NFT_SET_EXT_KEY_END is present.

Its possible to add elements that only have a start key
("{ 1.0.0.0 . 2.0.0.0 }") without an internval end.

Insertion treats this via:

if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END))
   end = (const u8 *)nft_set_ext_key_end(ext)->data;
else
   end = start;

but removal side always uses nft_set_ext_key_end().
This is wrong and leads to garbage remaining in the set after removal
next lookup/insert attempt will give:

BUG: KASAN: slab-use-after-free in pipapo_get+0x8eb/0xb90
Read of size 1 at addr ffff888100d50586 by task nft-pipapo_uaf_/1399
Call Trace:
 kasan_report+0x105/0x140
 pipapo_get+0x8eb/0xb90
 nft_pipapo_insert+0x1dc/0x1710
 nf_tables_newsetelem+0x31f5/0x4e00
 ..

Fixes: 3c4287f6 ("nf_tables: Add set type for arbitrary concatenation of ranges")
Reported-by: Nlonial con <kongln9170@gmail.com>
Reviewed-by: NStefano Brivio <sbrivio@redhat.com>
Signed-off-by: NFlorian Westphal <fw@strlen.de>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: NLu Wei <luwei32@huawei.com>
(cherry picked from commit 979e0dee)

Merge Pull Request from: @ci-robot 
 
PR sync from: Wang ShaoBo <bobo.shaobowang@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/LUCQ2ZA4VCZMGUGIE3SQDRCTOPLR3TEX/ 
 
https://gitee.com/openeuler/kernel/issues/I7PN0A 
 
Link:https://gitee.com/openeuler/kernel/pulls/1656 

Reviewed-by: Xie XiuQi <xiexiuqi@huawei.com> 
Signed-off-by: Liu YongQiang <liuyongqiang13@huawei.com> 

Merge Pull Request from: @openeuler-sync-bot 
 

Origin pull request: 
https://gitee.com/openeuler/kernel/pulls/1551 
 
PR sync from: Li Nan <linan122@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/ZPU6DOWXQ62ZYWCTSJSULWSJFG2MUIKX/ 
 
https://gitee.com/openeuler/kernel/issues/I7LU2I 
 
Link:https://gitee.com/openeuler/kernel/pulls/1640 

Reviewed-by: Jialin Zhang <zhangjialin11@huawei.com> 
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com> 

Merge Pull Request from: @openeuler-sync-bot 
 

Origin pull request: 
https://gitee.com/openeuler/kernel/pulls/1605 
 
PR sync from: Li Nan <linan122@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/PLIYRODHJZO5O3JJ5LZMDZ5VC2QZZXUQ/ 
Li Nan (1):
  ksmbd: define SMB2_COMPRESSION_TRANSFORM_ID in fs/ksmbd/smb2pdu.h

Namjae Jeon (1):
  ksmbd: validate smb request protocol id


-- 
2.39.2
 
https://gitee.com/openeuler/kernel/issues/I7LU2S 
 
Link:https://gitee.com/openeuler/kernel/pulls/1664 

Reviewed-by: Jialin Zhang <zhangjialin11@huawei.com> 
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com> 

mainline inclusion
from mainline-v6.4-rc6
commit f1a41187
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7LU2Q
CVE: CVE-2023-38427

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/smb/server?id=f1a411873c85b642f13b01f21b534c2bab81fc1b

--------------------------------

The check in the beginning is
`clen + sizeof(struct smb2_neg_context) <= len_of_ctxts`,
but in the end of loop, `len_of_ctxts` will subtract
`((clen + 7) & ~0x7) + sizeof(struct smb2_neg_context)`, which causes
integer underflow when clen does the 8 alignment. We should use
`(clen + 7) & ~0x7` in the check to avoid underflow from happening.

Then there are some variables that need to be declared unsigned
instead of signed.

[   11.671070] BUG: KASAN: slab-out-of-bounds in smb2_handle_negotiate+0x799/0x1610
[   11.671533] Read of size 2 at addr ffff888005e86cf2 by task kworker/0:0/7
...
[   11.673383] Call Trace:
[   11.673541]  <TASK>
[   11.673679]  dump_stack_lvl+0x33/0x50
[   11.673913]  print_report+0xcc/0x620
[   11.674671]  kasan_report+0xae/0xe0
[   11.675171]  kasan_check_range+0x35/0x1b0
[   11.675412]  smb2_handle_negotiate+0x799/0x1610
[   11.676217]  ksmbd_smb_negotiate_common+0x526/0x770
[   11.676795]  handle_ksmbd_work+0x274/0x810
...

Cc: stable@vger.kernel.org
Signed-off-by: NChih-Yen Chang <cc85nod@gmail.com>
Tested-by: NChih-Yen Chang <cc85nod@gmail.com>
Signed-off-by: NNamjae Jeon <linkinjeon@kernel.org>
Signed-off-by: NSteve French <stfrench@microsoft.com>

Conflict:
  fs/smb/server/smb2pdu.c
Signed-off-by: NLi Lingfeng <lilingfeng3@huawei.com>
(cherry picked from commit 5df19222)

mainline inclusion
from mainline-v6.4-rc6
commit 1c1bcf2d
category: bugfix
bugzilla: 189016, https://gitee.com/openeuler/kernel/issues/I7LU2S
CVE: CVE-2023-38430

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=1c1bcf2d3ea061613119b534f57507c377df20f9

----------------------------------------

This patch add the validation for smb request protocol id.
If it is not one of the four ids(SMB1_PROTO_NUMBER, SMB2_PROTO_NUMBER,
SMB2_TRANSFORM_PROTO_NUM, SMB2_COMPRESSION_TRANSFORM_ID), don't allow
processing the request. And this will fix the following KASAN warning
also.

[   13.905265] BUG: KASAN: slab-out-of-bounds in init_smb2_rsp_hdr+0x1b9/0x1f0
[   13.905900] Read of size 16 at addr ffff888005fd2f34 by task kworker/0:2/44
...
[   13.908553] Call Trace:
[   13.908793]  <TASK>
[   13.908995]  dump_stack_lvl+0x33/0x50
[   13.909369]  print_report+0xcc/0x620
[   13.910870]  kasan_report+0xae/0xe0
[   13.911519]  kasan_check_range+0x35/0x1b0
[   13.911796]  init_smb2_rsp_hdr+0x1b9/0x1f0
[   13.912492]  handle_ksmbd_work+0xe5/0x820

Cc: stable@vger.kernel.org
Reported-by: NChih-Yen Chang <cc85nod@gmail.com>
Signed-off-by: NNamjae Jeon <linkinjeon@kernel.org>
Signed-off-by: NSteve French <stfrench@microsoft.com>

Conflict:
	fs/ksmbd/connection.c
Signed-off-by: NLi Nan <linan122@huawei.com>
(cherry picked from commit c8b52f21)

hulk inclusion
category: bugfix
bugzilla: 189016, https://gitee.com/openeuler/kernel/issues/I7LU2S
CVE: NA

--------------------------------

In mainline, commit 0d35e382 ("cifs: Create a new shared file holding
smb2 pdu definitions") moved 'SMB2_COMPRESSION_TRANSFORM_ID' to
fs/smbfs_common/smb2pdu.h, commit 38c8a9a5 ("smb: move client and
server files to common directory fs/smb") moved fs/ksmbd to fs/smb/server
and included above smb2pdu.h.

Now we need to use 'SMB2_COMPRESSION_TRANSFORM_ID' in fs/ksmbd. But
backport all those patch is not a good iead. Just add the define in
fs/ksmbd/smb2pdu.h.
Signed-off-by: NLi Nan <linan122@huawei.com>
(cherry picked from commit 0fbfade1)

hulk inclusion
category: bugfix
bugzilla: 189067, https://gitee.com/openeuler/kernel/issues/I7PN0A
CVE: NA

-------------------------------------------------

BUG 'sleeping function called from invalid context' reported when
setup MPAM driver, it was blamed to bc9e3f98 ("arm64/mpam:
Fix mpam corrupt when cpu online"), which reported a 'Bad PC' BUG,
but missing the right conclusion, finally disabling irqs before calling
cpuhp_setup_state() may only affect the probability of reproduction.

The reason why triggerring 'Bad PC' BUG report is because mpam_enable()
is __init type function, and may schedule out after calling
__cpuhp_setup_state()->__might_sleep(), so the space of mpam_enable()
might be freed after scheduling back.

As we have changed mpam_enable() to non-init type function, we can
revert commit bc9e3f98 directly, to solve these both two problems.

Fixes: bc9e3f98 ("arm64/mpam: Fix mpam corrupt when cpu online")
Signed-off-by: NWang ShaoBo <bobo.shaobowang@huawei.com>

mainline inclusion
from mainline-v6.4-rc3
commit 443d61d1
category: bugfix
bugzilla: 189030, https://gitee.com/openeuler/kernel/issues/I7LU2I
CVE: CVE-2023-38429

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=443d61d1fa9faa60ef925513d83742902390100f

----------------------------------------

ksmbd_smb2_check_message allows client to return one byte more, so we
need to allocate additional memory in ksmbd_conn_handler_loop to avoid
out-of-bound access.

Cc: stable@vger.kernel.org
Signed-off-by: NChih-Yen Chang <cc85nod@gmail.com>
Acked-by: NNamjae Jeon <linkinjeon@kernel.org>
Signed-off-by: NSteve French <stfrench@microsoft.com>

Conflict:
	fs/ksmbd/connection.c
Signed-off-by: NLi Nan <linan122@huawei.com>
(cherry picked from commit ff45e8b3)

stable inclusion
from stable-v5.10.150
commit 303436e301ba72021c3894c7a44bcfc1dcf17122
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I6D0XA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=303436e301ba72021c3894c7a44bcfc1dcf17122

--------------------------------

commit 61ce339f upstream.

If swiotlb is force enabled dma_max_mapping_size ends up calling
swiotlb_max_mapping_size which takes into account the min align mask for
the device.  Set the min align mask for nvme driver before calling
dma_max_mapping_size while calculating max hw sectors.
Signed-off-by: NRishabh Bhatnagar <risbhat@amazon.com>
Signed-off-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NJialin Zhang <zhangjialin11@huawei.com>
Signed-off-by: NYong Hu <yong.hu@windriver.com>

LoongArch inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7QJIN

--------------------------------

Fix vcpu timer initialize, saved, restore and triggered functions.
As the previous code does not init vcpu timer, and the timer value
should add time value instead of ticks value to calculate the expire
time when vcpu timer triggered.
Signed-off-by: NTianrui Zhao <zhaotianrui@loongson.cn>