Merge Pull Request from: @openeuler-sync-bot 
 

Origin pull request: 
https://gitee.com/openeuler/kernel/pulls/1144 
 
Loop branch using 'i++' as condition will cause the loop to not execute
when 'i == 0', should use '++i', Fix it.

issue： https://gitee.com/openeuler/kernel/issues/I7DUYJ 
 
Link:https://gitee.com/openeuler/kernel/pulls/1201 

Reviewed-by: Yang Shen <shenyang39@huawei.com> 
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com> 

Merge Pull Request from: @svishen 
 
This patch revert "net: hns3: disbable pfc en before the reset" and backport the mainline

issue:
https://gitee.com/openeuler/kernel/issues/I7S5M4 
 
Link:https://gitee.com/openeuler/kernel/pulls/1719 

Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com> 

Merge Pull Request from: @steven-song3 
 
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7PGHA
CVE:NA

 --------------------------------

1.fix a serial of uninitialized bugs 
2.fix the bug that expression does not compute the number of elements
Reviewed-by: NChen Mou <chenmou@3snic.com>
Reviewed-by: NWan Renyong <wanry@3snic.com>
Reviewed-by: NYang Gan <yanggan@3snic.com>
Reviewed-by: NWen Liang <wenliang@3snic.com>
Signed-off-by: NSteven Song <steven.song@3snic.com>

==================================
Test:
compille: pass
insmod/rmmod: pass
iperf: Pass 
 
Link:https://gitee.com/openeuler/kernel/pulls/1597 

Reviewed-by: Jason Zeng <jason.zeng@intel.com> 
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com> 

mainline inclusion
from mainline-v6.4-rc3
commit f14db070
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7S5M4
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f14db07064727dd3bc0906c77a6d2759c1bbb395

----------------------------------------------------------------------

To prevent the system from abnormally sending PFC frames after an
abnormal reset. The hns3 driver notifies the firmware to disable pfc
before reset.

Fixes: 35d93a30 ("net: hns3: adjust the process of PF reset")
Signed-off-by: NJijie Shao <shaojijie@huawei.com>
Signed-off-by: NHao Lan <lanhao@huawei.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
Signed-off-by: NJiantao Xiao <xiaojiantao1@h-partners.com>

driver inclusion
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I7S5M4
CVE: NA

----------------------------------------------------------------------

The patch provides a customized interface to modify the pause trans time
and retains the configured parameters.
Signed-off-by: Nshaojijie <shaojijie@huawei.com>
Signed-off-by: NJiantao Xiao <xiaojiantao1@h-partners.com>

driver inclusion
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I7S5M4
CVE: NA

----------------------------------------------------------------------

This reverts commit d8f1cb18.
Signed-off-by: NJiantao Xiao <xiaojiantao1@h-partners.com>

driver inclusion
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I7S5M4
CVE: NA

----------------------------------------------------------------------

This reverts commit 29e4bb1a.
Signed-off-by: NJiantao Xiao <xiaojiantao1@h-partners.com>

Merge Pull Request from: @svishen 
 
This patch revert some patch and backport some kernel accepted

issue：
https://gitee.com/openeuler/kernel/issues/I7ON9Y 
 
Link:https://gitee.com/openeuler/kernel/pulls/1683 

Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com> 

Merge Pull Request from: @ci-robot 
 
PR sync from: Hui Tang <tanghui20@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/25WFMRKCSRO72P3FCQ5FNDCGWK6GYMAZ/ 
 
https://gitee.com/openeuler/kernel/issues/I526XC 
 
Link:https://gitee.com/openeuler/kernel/pulls/1630 

Reviewed-by: Zucheng Zheng <zhengzucheng@huawei.com> 
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com> 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zhengchao Shao <shaozhengchao@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/B3ZSS336JXNQSPFJCYBONSQZLLYXKGQ2/ 
 
https://gitee.com/src-openeuler/kernel/issues/I7NYWN 
 
Link:https://gitee.com/openeuler/kernel/pulls/1711 

Reviewed-by: Yue Haibing <yuehaibing@huawei.com> 
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com> 

mainline inclusion
from mainline-v6.5-rc4
commit 6d2336120aa6e1a8a64fa5d6ee5c3f3d0809fe9b
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I7ON9Y
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6d2336120aa6e1a8a64fa5d6ee5c3f3d0809fe9b

----------------------------------------------------------------------

When the tm module is configured with traffic, traffic
may be abnormal. This patch fixes this problem.
Before the tm module is configured, traffic processing
should be stopped. After the tm module is configured,
traffic processing is enabled.
Signed-off-by: NHao Lan <lanhao@huawei.com>
Signed-off-by: NJijie Shao <shaojijie@huawei.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
Signed-off-by: NJiantao Xiao <xiaojiantao1@h-partners.com>

mainline inclusion
from mainline-v6.5-rc4
commit b27d0232e8897f7c896dc8ad80c9907dd57fd3f3
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7ON9Y
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b27d0232e8897f7c896dc8ad80c9907dd57fd3f3

----------------------------------------------------------------------

Current only the first 32 bits of the capability flag bit are considered.
When the matching capability flag bit is greater than 31 bits,
it will get an error bit.This patch use bitmap to solve this issue.
It can handle each capability bit whitout bit width limit.

Fixes: da77aef9 ("net: hns3: create common cmdq resource allocate/free/query APIs")
Signed-off-by: NHao Lan <lanhao@huawei.com>
Signed-off-by: NJijie Shao <shaojijie@huawei.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
Signed-off-by: NJiantao Xiao <xiaojiantao1@h-partners.com>

driver inclusion
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I7ON9Y
CVE: NA

----------------------------------------------------------------------

Implement debugfs for wake on lan to hns3. The debugfs
support verify the firmware wake on lan configuration.
Signed-off-by: NHao Lan <lanhao@huawei.com>
Signed-off-by: NJiantao Xiao <xiaojiantao1@h-partners.com>
Reviewed-by: NYue Haibing <yuehaibing@huawei.com>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>

mainline inclusion
from mainline-v6.4-rc1
commit 3b064f54
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I7ON9Y
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3b064f541be822dc095991c6dda20a75eb51db5e

----------------------------------------------------------------------

The HNS3 driver supports Wake-on-LAN, which can wake up
the server from power off state to power on state by magic
packet or magic security packet.

ChangeLog:
v1->v2:
Deleted the debugfs function that overlaps with the ethtool function
from suggestion of Andrew Lunn.

v2->v3:
Return the wol configuration stored in driver,
suggested by Alexander H Duyck.

v3->v4:
Add a helper to go from netdev to the local struct,
suggested by Simon Horman and Jakub Kicinski.
Reviewed-by: NSimon Horman <simon.horman@corigine.com>
Signed-off-by: NHao Lan <lanhao@huawei.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
Signed-off-by: NJiantao Xiao <xiaojiantao1@h-partners.com>

driver inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7ON9Y
CVE: NA

----------------------------------------------------------------------

This reverts commit c3c5f044.
Signed-off-by: NJiantao Xiao <xiaojiantao1@h-partners.com>

driver inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7ON9Y
CVE: NA

----------------------------------------------------------------------

This reverts commit 7fbc48aa.
Signed-off-by: NJiantao Xiao <xiaojiantao1@h-partners.com>

driver inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7ON9Y
CVE: NA

----------------------------------------------------------------------

This reverts commit c92b8f62.
Signed-off-by: NJiantao Xiao <xiaojiantao1@h-partners.com>

driver inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7ON9Y
CVE: NA

----------------------------------------------------------------------

This reverts commit 987f422a.
Signed-off-by: NJiantao Xiao <xiaojiantao1@h-partners.com>

driver inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7ON9Y
CVE: NA

----------------------------------------------------------------------

This reverts commit 92c6f2cf.
Signed-off-by: NJiantao Xiao <xiaojiantao1@h-partners.com>

driver inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7ON9Y
CVE: NA

----------------------------------------------------------------------

This reverts commit f5432d46.
Signed-off-by: NJiantao Xiao <xiaojiantao1@h-partners.com>

driver inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7ON9Y
CVE: NA

----------------------------------------------------------------------

This reverts commit 702c687c.
Signed-off-by: NJiantao Xiao <xiaojiantao1@h-partners.com>

driver inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7ON9Y
CVE: NA

----------------------------------------------------------------------

This reverts commit b62afba4.
Signed-off-by: NJiantao Xiao <xiaojiantao1@h-partners.com>

Merge Pull Request from: @ci-robot 
 
PR sync from: Guo Mengqi <guomengqi3@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/AYXIAD7WTNXTTOHZT4J7NYVFK2CC3GKH/ 
Andy Shevchenko (1):
  lib/cmdline: fix get_option() for strings starting with hyphen

Huang Shijie (1):
  lib/genalloc.c: change return type to unsigned long for bitmap_set_ll

Saravana Kannan (1):
  driver core: Update device link status properly for
    device_bind_driver()

Sumera Priyadarsini (1):
  bus: arm-integrator-lm: Add of_node_put() before return statement


-- 
2.17.1
 
https://gitee.com/openeuler/kernel/issues/I7R8MK 
 
Link:https://gitee.com/openeuler/kernel/pulls/1707 

Reviewed-by: Weilong Chen <chenweilong@huawei.com> 
Reviewed-by: Jialin Zhang <zhangjialin11@huawei.com> 
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com> 

Merge Pull Request from: @zhangwei123171 
 


/sys/fs/cgroup/cpu/cpu.qos_level is not needed, and easy to cause misunderstanding. 
 
Link:https://gitee.com/openeuler/kernel/pulls/1660 

Reviewed-by: zhao xiaoqiang <zhaoxiaoqiang11@jd.com> 
Reviewed-by: Zucheng Zheng <zhengzucheng@huawei.com> 
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com> 
Acked-by: Xie XiuQi <xiexiuqi@huawei.com> 

mainline inclusion
from mainline-v6.5-rc3
commit 00374d9b6d9f932802b55181be9831aa948e5b7c
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7NYWN
CVE: CVE-2023-3772

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=00374d9b6d9f932802b55181be9831aa948e5b7c

--------------------------------

Normally, x->replay_esn and x->preplay_esn should be allocated at
xfrm_alloc_replay_state_esn(...) in xfrm_state_construct(...), hence the
xfrm_update_ae_params(...) is okay to update them. However, the current
implementation of xfrm_new_ae(...) allows a malicious user to directly
dereference a NULL pointer and crash the kernel like below.

BUG: kernel NULL pointer dereference, address: 0000000000000000
PGD 8253067 P4D 8253067 PUD 8e0e067 PMD 0
Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 PID: 98 Comm: poc.npd Not tainted 6.4.0-rc7-00072-gdad9774d #8
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.o4
RIP: 0010:memcpy_orig+0xad/0x140
Code: e8 4c 89 5f e0 48 8d 7f e0 73 d2 83 c2 20 48 29 d6 48 29 d7 83 fa 10 72 34 4c 8b 06 4c 8b 4e 08 c
RSP: 0018:ffff888008f57658 EFLAGS: 00000202
RAX: 0000000000000000 RBX: ffff888008bd0000 RCX: ffffffff8238e571
RDX: 0000000000000018 RSI: ffff888007f64844 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888008f57818
R13: ffff888007f64aa4 R14: 0000000000000000 R15: 0000000000000000
FS:  00000000014013c0(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000000054d8000 CR4: 00000000000006f0
Call Trace:
 <TASK>
 ? __die+0x1f/0x70
 ? page_fault_oops+0x1e8/0x500
 ? __pfx_is_prefetch.constprop.0+0x10/0x10
 ? __pfx_page_fault_oops+0x10/0x10
 ? _raw_spin_unlock_irqrestore+0x11/0x40
 ? fixup_exception+0x36/0x460
 ? _raw_spin_unlock_irqrestore+0x11/0x40
 ? exc_page_fault+0x5e/0xc0
 ? asm_exc_page_fault+0x26/0x30
 ? xfrm_update_ae_params+0xd1/0x260
 ? memcpy_orig+0xad/0x140
 ? __pfx__raw_spin_lock_bh+0x10/0x10
 xfrm_update_ae_params+0xe7/0x260
 xfrm_new_ae+0x298/0x4e0
 ? __pfx_xfrm_new_ae+0x10/0x10
 ? __pfx_xfrm_new_ae+0x10/0x10
 xfrm_user_rcv_msg+0x25a/0x410
 ? __pfx_xfrm_user_rcv_msg+0x10/0x10
 ? __alloc_skb+0xcf/0x210
 ? stack_trace_save+0x90/0xd0
 ? filter_irq_stacks+0x1c/0x70
 ? __stack_depot_save+0x39/0x4e0
 ? __kasan_slab_free+0x10a/0x190
 ? kmem_cache_free+0x9c/0x340
 ? netlink_recvmsg+0x23c/0x660
 ? sock_recvmsg+0xeb/0xf0
 ? __sys_recvfrom+0x13c/0x1f0
 ? __x64_sys_recvfrom+0x71/0x90
 ? do_syscall_64+0x3f/0x90
 ? entry_SYSCALL_64_after_hwframe+0x72/0xdc
 ? copyout+0x3e/0x50
 netlink_rcv_skb+0xd6/0x210
 ? __pfx_xfrm_user_rcv_msg+0x10/0x10
 ? __pfx_netlink_rcv_skb+0x10/0x10
 ? __pfx_sock_has_perm+0x10/0x10
 ? mutex_lock+0x8d/0xe0
 ? __pfx_mutex_lock+0x10/0x10
 xfrm_netlink_rcv+0x44/0x50
 netlink_unicast+0x36f/0x4c0
 ? __pfx_netlink_unicast+0x10/0x10
 ? netlink_recvmsg+0x500/0x660
 netlink_sendmsg+0x3b7/0x700

This Null-ptr-deref bug is assigned CVE-2023-3772. And this commit
adds additional NULL check in xfrm_update_ae_params to fix the NPD.

Fixes: d8647b79 ("xfrm: Add user interface for esn and big anti-replay windows")
Signed-off-by: NLin Ma <linma@zju.edu.cn>
Reviewed-by: NLeon Romanovsky <leonro@nvidia.com>
Signed-off-by: NSteffen Klassert <steffen.klassert@secunet.com>

Conflicts:
	net/xfrm/xfrm_user.c
Signed-off-by: NZhengchao Shao <shaozhengchao@huawei.com>

Merge Pull Request from: @Hongchen_Zhang 
 
LoongArch: fix the following configs not defined:
CONFIG_ZONE_DMA32
CONFIG_TRACE_IRQFLAGS_SUPPORT
CONFIG_HAVE_SETUP_PER_CPU_AREA
CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK
CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK 
 
Link:https://gitee.com/openeuler/kernel/pulls/1618 

Reviewed-by: Jialin Zhang <zhangjialin11@huawei.com> 
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com> 

mainline inclusion
from mainline-v5.13-rc1
commit b6f617df
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7R8MK
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b6f617df4fa936c1ab1831c2b23563f6c1add6c4

--------------------------------

Device link status was not getting updated correctly when
device_bind_driver() is called on a device. This causes a warning[1].
Fix this by updating device links that can be updated and dropping
device links that can't be updated to a sensible state.

[1] - https://lore.kernel.org/lkml/56f7d032-ba5a-a8c7-23de-2969d98c527e@nvidia.com/Tested-by: NJon Hunter <jonathanh@nvidia.com>
Signed-off-by: NSaravana Kannan <saravanak@google.com>
Link: https://lore.kernel.org/r/20210302211133.2244281-3-saravanak@google.comSigned-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NGuo Mengqi <guomengqi3@huawei.com>

mainline inclusion
from mainline-v5.12-rc1
commit 0e24465d
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7R8MK
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0e24465d3313832e82f8bd9ee2439da1367dd2e5

--------------------------------

Just as bitmap_clear_ll(), change return type to unsigned long
for bitmap_set_ll to avoid the possible overflow in future.

Link: https://lkml.kernel.org/r/20210105031644.2771-1-sjhuang@iluvatar.aiSigned-off-by: NHuang Shijie <sjhuang@iluvatar.ai>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: NGuo Mengqi <guomengqi3@huawei.com>

mainline inclusion
from mainline-v5.11-rc6
commit 1740e673
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7R8MK
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1740e6736922cc1a5d061cc4240d08eacfbbaa71

--------------------------------

Every iteration of for_each_available_child_of_node() decrements
the reference count of the previous node, however when control is
transferred from the middle of the loop, as in the case of a return
or break or goto, there is no decrement thus ultimately resulting in
a memory leak.

Fix a potential memory leak in arm-integrator-lm.c by inserting
of_node_put() before a return statement.

Issue found with Coccinelle.
Signed-off-by: NSumera Priyadarsini <sylphrenadin@gmail.com>
Signed-off-by: NLinus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20200829174154.GA9319@Kaladin
Link: https://lore.kernel.org/r/20210112092549.251548-1-linus.walleij@linaro.org'
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NGuo Mengqi <guomengqi3@huawei.com>

mainline inclusion
from mainline-v5.11-rc1
commit e291851d
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7R8MK
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e291851d65495739e4eede33b6bc387bb546a19b

--------------------------------

When string doesn't have an integer and starts from hyphen get_option()
may return interesting results.  Fix it to return 0.

The simple_strtoull() is used due to absence of simple_strtoul() in a boot
code on some architectures.

Note, the Fixes tag below is rather for anthropological curiosity.

Link: https://lkml.kernel.org/r/20201112180732.75589-4-andriy.shevchenko@linux.intel.com
Fixes: f68565831e72 ("Import 2.4.0-test2pre3")
Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Brendan Higgins <brendanhiggins@google.com>
Cc: David Gow <davidgow@google.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Vitor Massaru Iha <vitor@massaru.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: NGuo Mengqi <guomengqi3@huawei.com>

Merge Pull Request from: @ci-robot 
 
PR sync from: Lu Wei <luwei32@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/XHWCN4LVCI4W4ZNP4NXSYHBEYGDNGBUG/ 
 
https://gitee.com/src-openeuler/kernel/issues/I7P3TK 
 
Link:https://gitee.com/openeuler/kernel/pulls/1682 

Reviewed-by: Yue Haibing <yuehaibing@huawei.com> 
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com> 

Merge Pull Request from: @ci-robot 
 
PR sync from: Weili Qian <qianweili@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/KHHPZOD3JVABJQY57SZLORLNLITIPA3M/ 
 
https://gitee.com/openeuler/kernel/issues/I7R6TQ 
 
Link:https://gitee.com/openeuler/kernel/pulls/1690 

Reviewed-by: Yang Shen <shenyang39@huawei.com> 
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com> 

driver inclusion
category: cleanup
bugzilla: https://gitee.com/openeuler/kernel/issues/I7R6TQ
CVE: NA

----------------------------------------------------------------------

Deleted the kernel pointer address printing by the security check.
Signed-off-by: NKai Ye <yekai13@huawei.com>
Signed-off-by: NJiangShui Yang <yangjiangshui@h-partners.com>

Merge Pull Request from: @ci-robot 
 
PR sync from: Yi Yang <yiyang13@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/F3MDGNSS4NARSSKD53VIBRG3ZXPCVNL4/ 
 
https://gitee.com/openeuler/kernel/issues/I7LEZX 
 
Link:https://gitee.com/openeuler/kernel/pulls/1672 

Reviewed-by: Jialin Zhang <zhangjialin11@huawei.com> 
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com> 

Merge Pull Request from: @openeuler-sync-bot 
 

Origin pull request: 
https://gitee.com/openeuler/kernel/pulls/1070 
 
Fix some reset problem for accelerator drivers.

Weili Qian (5):
crypto: hisilicon/qm - flush all work before driver removed.
crypto: hisilicon/hpre - enable sva error interrupt event
crypto: hisilicon/qm - remove duplicate assignment and release
crypto: hisilicon/qm - disable same error report before resetting
crypto: hisilicon/qm - disable error report before flr 
 
Link:https://gitee.com/openeuler/kernel/pulls/1268 

Reviewed-by: Yang Shen <shenyang39@huawei.com> 
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com> 

stable inclusion
from stable-v5.10.188
commit 3a91099ecd59a42d1632fcb152bf7222f268ea2b
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7P3TK
CVE: CVE-2023-4004

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3a91099ecd59a42d1632fcb152bf7222f268ea2b

---------------------------

[ Upstream commit 87b5a5c209405cb6b57424cdfa226a6dbd349232 ]

end key should be equal to start unless NFT_SET_EXT_KEY_END is present.

Its possible to add elements that only have a start key
("{ 1.0.0.0 . 2.0.0.0 }") without an internval end.

Insertion treats this via:

if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END))
   end = (const u8 *)nft_set_ext_key_end(ext)->data;
else
   end = start;

but removal side always uses nft_set_ext_key_end().
This is wrong and leads to garbage remaining in the set after removal
next lookup/insert attempt will give:

BUG: KASAN: slab-use-after-free in pipapo_get+0x8eb/0xb90
Read of size 1 at addr ffff888100d50586 by task nft-pipapo_uaf_/1399
Call Trace:
 kasan_report+0x105/0x140
 pipapo_get+0x8eb/0xb90
 nft_pipapo_insert+0x1dc/0x1710
 nf_tables_newsetelem+0x31f5/0x4e00
 ..

Fixes: 3c4287f6 ("nf_tables: Add set type for arbitrary concatenation of ranges")
Reported-by: Nlonial con <kongln9170@gmail.com>
Reviewed-by: NStefano Brivio <sbrivio@redhat.com>
Signed-off-by: NFlorian Westphal <fw@strlen.de>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: NLu Wei <luwei32@huawei.com>

hulk inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7LEZX

--------------------------------

There is memleak in alloc_pid:
------------------------------
unreferenced object 0xffff88810c181940 (size 224):
  comm "sshd", pid 8191, jiffies 4294946950 (age 524.570s)
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 00 00 00 ad 4e ad de  .............N..
    ff ff ff ff 6b 6b 6b 6b ff ff ff ff ff ff ff ff  ....kkkk........
  backtrace:
    [<ffffffff814774e6>] kmem_cache_alloc+0x5c6/0x9b0
    [<ffffffff81177342>] alloc_pid+0x72/0x570
    [<ffffffff81140ac4>] copy_process+0x1374/0x2470
    [<ffffffff81141d77>] kernel_clone+0xb7/0x900
    [<ffffffff81142645>] __se_sys_clone+0x85/0xb0
    [<ffffffff8114269b>] __x64_sys_clone+0x2b/0x30
    [<ffffffff83965a72>] do_syscall_64+0x32/0x80
    [<ffffffff83a00085>] entry_SYSCALL_64_after_hwframe+0x61/0xc6

The pid memleak is triggered by the following race:
task[sshd]                      task[bash]
-----------------------		-----------------------
				do_exit();
				disassociate_ctty();
				spin_lock_irq(¤t->sighand->siglock);
				put_pid(current->signal->tty_old_pgrp);
				current->signal->tty_old_pgrp = NULL;
				tty = tty_kref_get(current->signal->tty);
				//tty is not NULL
				spin_unlock_irq(¤t->sighand->siglock);
tty_vhangup();
tty_lock(tty);
...
tty_signal_session_leader();
spin_lock_irq(&p->sighand->siglock);
...
p->signal->tty_old_pgrp = get_pid(tty->pgrp); // tty_old_pgrp reassign
spin_unlock_irq(&p->sighand->siglock);
...
tty_unlock(tty);
				if (tty) {
				    tty_lock(tty);
				    ...
				    put_pid(tty->pgrp);
				    tty->pgrp = NULL;// It's too late
				    ...
				    tty_unlock(tty);
				}

in task[bash], tty_old_pgrp is released by disassociate_ctty(), then it's
reassigned by tty_signal_session_leader() in task[sshd], cause memleak.

fix the memleak by add put_pid() in disassociate_ctty() after tty_old_pgrp
is reassigned.

Fixes: c8bcd9c5 ("tty: Fix ->session locking")
Signed-off-by: NYi Yang <yiyang13@huawei.com>

Merge Pull Request from: @did-you-collect-the-wool-today 
 
virt inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7QPGW
CVE: NA

------------------------------------------------------------------

In probe_vendor_drivers, all registered vendor drivers are traversed.
This is not a good idea. If a vendor driver is not implemented well
enough, it may cause the system to panic. Use the vendor id and
device id to select a proper driver.

In the pervious device registration logic, since the live migration
operation ops of the three accelerator devices is the same.
Therefore, only one driver entity will be registered. As a result,
only the first sec will be loaded successfully, while hpre and zip
cannot be loaded.

The acc live migration driver needs to be adapted.
Signed-off-by: NLongfang Liu <liulongfang@huawei.com>
Signed-off-by: NKunkun Jiang <jiangkunkun@huawei.com>
 
 
Link:https://gitee.com/openeuler/kernel/pulls/1659 

Reviewed-by: Zenghui Yu <yuzenghui@huawei.com> 
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com> 

Merge Pull Request from: @ci-robot 
 
PR sync from: Ruan Jinjie <ruanjinjie@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/DMKZQARD2PWAP2YXIKY6D454ZNKTEVT3/ 
Backport CVE-2023-4132 fix commits.

Duoming Zhou (2):
  media: usb: siano: Fix use after free bugs caused by do_submit_urb
  media: usb: siano: Fix warning due to null work_func_t function
    pointer


-- 
2.34.1
 
https://gitee.com/openeuler/kernel/issues/I7QTMZ 
 
Link:https://gitee.com/openeuler/kernel/pulls/1657 

Reviewed-by: Jialin Zhang <zhangjialin11@huawei.com> 
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com> 

Merge Pull Request from: @kwb0523 
 
We'd like to be able to identify netns from sock_ops and sk_msg hooks to
accelerate local process communication form different netns. 
 
Link:https://gitee.com/openeuler/kernel/pulls/1522 

Reviewed-by: Jackie Liu <liuyun01@kylinos.cn> 
Reviewed-by: Yue Haibing <yuehaibing@huawei.com> 
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com>