[OLK-6.6] 从kernel上游linux-6.6.y分支回合nvme和lpfc驱动重要的bugfix

从上游kernel stale tree v6.6.y分支回合nvme和lpfc重要的bugfix:
lpfc驱动:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-6.6.y&id=1960bb56a9c83ff32eeee0398deaeb35b0b664b3
该commit修复了系统中断号泄露的问题，修复的patch需要移植到olk-6.6分支上.

nvme驱动:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-6.6.y&id=3a982ada411b8c52695f1784c3f4784771f30209
该commit修复了一个特定条件下解引用sk->sk_state_change(sk) null指针的问题（NULL pointer dereferences）, 
问题详细的原因分析如下：
queue->state_change is set as part of nvmet_tcp_set_queue_sock(), but if
the TCP connection isn't established when nvmet_tcp_set_queue_sock() is
called then queue->state_change isn't set and sock->sk->sk_state_change
isn't replaced.
相关的函数代码如下：

```
static int nvmet_tcp_set_queue_sock(struct nvmet_tcp_queue *queue)
{
	struct socket *sock = queue->sock;
	struct inet_sock *inet = inet_sk(sock->sk);
	
	......
	//如果tcp链接没有建立
	if (sock->sk->sk_state != TCP_ESTABLISHED) {
		/*
		 * If the socket is already closing, don't even start
		 * consuming it
		 */
		ret = -ENOTCONN;
		//走到该分支，没有设置如下的两个函数指针
		//queue->state_change
		//sock->sk->sk_state_change
	} else {
		......
		//正常路径下面两个函数指针都会赋值
		queue->state_change = sock->sk->sk_state_change;
		sock->sk->sk_state_change = nvmet_tcp_state_change;
		......
	}

return ret;
}

static void nvmet_tcp_restore_socket_callbacks(struct nvmet_tcp_queue *queue)
{
        struct socket *sock = queue->sock;
        ......
        //如果走到tcp链接没有建立的路径，会导致赋值的函数指针为NULL
        sock->sk->sk_state_change = queue->state_change;
        ......
}

导致后续使用出现空指针接引用的路径如下：
调用链tcp_v4_do_rcv()=>tcp_rcv_established()=>tcp_data_queue()=>tcp_fin()
void tcp_fin(struct sock *sk)
{
	struct tcp_sock *tp = tcp_sk(sk);

......

if (!sock_flag(sk, SOCK_DEAD)) {
			sk->sk_state_change(sk);//sk->sk_state_change为NULL，解引用空指针

/* Do not send POLL_HUP for half duplex close. */
			if (sk->sk_shutdown == SHUTDOWN_MASK ||
				sk->sk_state == TCP_CLOSE)
					sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_HUP);
			else
					sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_IN);
	}
	......
}
```
该问题会导致系统panic, 修复的patch需要移植到olk-6.6分支上.

GVP openEuler / kernel
Closed

Content Risk Flag

Comments (1)

GVPopenEuler / kernelClosed

Content Risk Flag