November 2024 - Kernel - mailweb.openeuler.org

[openeuler:OLK-5.10 2417/2417] kernel/sched/psi.c:199:23: warning: no previous prototype for 'to_psi_group_ext'
by kernel test robot 13 Nov '24

13 Nov '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 400fd9ccb52e01bf78acae2bbc1710923a15f033 commit: 65479800e82741cf74021459e951eccc3c07c6d4 [2417/2417] psi: add struct psi_group_ext config: x86_64-randconfig-001-20241112 (https://download.01.org/0day-ci/archive/20241113/202411130536.ah7Yo4Qa-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241113/202411130536.ah7Yo4Qa-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411130536.ah7Yo4Qa-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/sched/psi.c:199:23: warning: no previous prototype for 'to_psi_group_ext' [-Wmissing-prototypes] 199 | struct psi_group_ext *to_psi_group_ext(struct psi_group *psi) | ^~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] vim +/to_psi_group_ext +199 kernel/sched/psi.c 198 > 199 struct psi_group_ext *to_psi_group_ext(struct psi_group *psi) 200 { 201 if (psi == &psi_system) 202 return &psi_stat_system; 203 else 204 return container_of(psi, struct psi_group_ext, psi); 205 } 206 #else 207 static inline struct psi_group_ext *to_psi_group_ext(struct psi_group *psi) 208 { 209 return NULL; 210 } 211 #endif 212 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2417/2417] kernel/sched/fair.c:4499:43: error: no member named 'steal_h_nr_running' in 'struct cfs_rq'; did you mean 'idle_h_nr_running'?
by kernel test robot 13 Nov '24

13 Nov '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 400fd9ccb52e01bf78acae2bbc1710923a15f033 commit: 433c0b72564239cf3086f563d5ca32a10e4ffd3f [2417/2417] sched/fair: Count the number of tasks marked as steal_task on cfs_rq config: x86_64-randconfig-015-20241112 (https://download.01.org/0day-ci/archive/20241113/202411130044.gkUMo98D-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241113/202411130044.gkUMo98D-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411130044.gkUMo98D-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from kernel/sched/fair.c:23: In file included from kernel/sched/sched.h:39: In file included from include/linux/blkdev.h:9: In file included from include/linux/genhd.h:20: In file included from include/linux/blk_types.h:11: In file included from include/linux/bvec.h:14: In file included from include/linux/mm.h:1587: include/linux/vmstat.h:417:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 417 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 418 | item]; | ~~~~ include/linux/vmstat.h:424:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 424 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 425 | NR_VM_NUMA_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:436:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 436 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 437 | NR_VM_NUMA_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:445:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 445 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 446 | NR_VM_NUMA_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ In file included from kernel/sched/fair.c:23: kernel/sched/sched.h:1864:15: warning: cast from 'void (*)(struct rq *)' to 'void (*)(struct callback_head *)' converts to incompatible function type [-Wcast-function-type-strict] 1864 | head->func = (void (*)(struct callback_head *))func; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> kernel/sched/fair.c:4499:43: error: no member named 'steal_h_nr_running' in 'struct cfs_rq'; did you mean 'idle_h_nr_running'? 4499 | (rq->cfs.h_nr_running < 2 || rq->cfs.steal_h_nr_running == 0)) | ^~~~~~~~~~~~~~~~~~ | idle_h_nr_running kernel/sched/sched.h:632:16: note: 'idle_h_nr_running' declared here 632 | unsigned int idle_h_nr_running; /* SCHED_IDLE */ | ^ kernel/sched/fair.c:4525:36: error: no member named 'steal_h_nr_running' in 'struct cfs_rq'; did you mean 'idle_h_nr_running'? 4525 | if (group_steal_used() && rq->cfs.steal_h_nr_running < 1) | ^~~~~~~~~~~~~~~~~~ | idle_h_nr_running kernel/sched/sched.h:632:16: note: 'idle_h_nr_running' declared here 632 | unsigned int idle_h_nr_running; /* SCHED_IDLE */ | ^ kernel/sched/fair.c:6670:12: error: no member named 'steal_h_nr_running' in 'struct cfs_rq'; did you mean 'idle_h_nr_running'? 6670 | cfs_rq->steal_h_nr_running++; | ^~~~~~~~~~~~~~~~~~ | idle_h_nr_running kernel/sched/sched.h:632:16: note: 'idle_h_nr_running' declared here 632 | unsigned int idle_h_nr_running; /* SCHED_IDLE */ | ^ kernel/sched/fair.c:6694:12: error: no member named 'steal_h_nr_running' in 'struct cfs_rq'; did you mean 'idle_h_nr_running'? 6694 | cfs_rq->steal_h_nr_running++; | ^~~~~~~~~~~~~~~~~~ | idle_h_nr_running kernel/sched/sched.h:632:16: note: 'idle_h_nr_running' declared here 632 | unsigned int idle_h_nr_running; /* SCHED_IDLE */ | ^ kernel/sched/fair.c:6795:12: error: no member named 'steal_h_nr_running' in 'struct cfs_rq'; did you mean 'idle_h_nr_running'? 6795 | cfs_rq->steal_h_nr_running--; | ^~~~~~~~~~~~~~~~~~ | idle_h_nr_running kernel/sched/sched.h:632:16: note: 'idle_h_nr_running' declared here 632 | unsigned int idle_h_nr_running; /* SCHED_IDLE */ | ^ kernel/sched/fair.c:6831:12: error: no member named 'steal_h_nr_running' in 'struct cfs_rq'; did you mean 'idle_h_nr_running'? 6831 | cfs_rq->steal_h_nr_running--; | ^~~~~~~~~~~~~~~~~~ | idle_h_nr_running kernel/sched/sched.h:632:16: note: 'idle_h_nr_running' declared here 632 | unsigned int idle_h_nr_running; /* SCHED_IDLE */ | ^ kernel/sched/fair.c:13229:29: error: no member named 'steal_h_nr_running' in 'struct cfs_rq'; did you mean 'idle_h_nr_running'? 13229 | if (tg_used && src_rq->cfs.steal_h_nr_running < 1) | ^~~~~~~~~~~~~~~~~~ | idle_h_nr_running kernel/sched/sched.h:632:16: note: 'idle_h_nr_running' declared here 632 | unsigned int idle_h_nr_running; /* SCHED_IDLE */ | ^ kernel/sched/fair.c:13241:30: error: no member named 'steal_h_nr_running' in 'struct cfs_rq'; did you mean 'idle_h_nr_running'? 13241 | (tg_used && src_rq->cfs.steal_h_nr_running < 1)) | ^~~~~~~~~~~~~~~~~~ | idle_h_nr_running kernel/sched/sched.h:632:16: note: 'idle_h_nr_running' declared here 632 | unsigned int idle_h_nr_running; /* SCHED_IDLE */ | ^ kernel/sched/fair.c:13411:6: warning: no previous prototype for function 'task_vruntime_update' [-Wmissing-prototypes] 13411 | void task_vruntime_update(struct rq *rq, struct task_struct *p, bool in_fi) | ^ kernel/sched/fair.c:13411:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 13411 | void task_vruntime_update(struct rq *rq, struct task_struct *p, bool in_fi) | ^ | static 7 warnings and 8 errors generated. vim +4499 kernel/sched/fair.c 4485 4486 static void overload_clear(struct rq *rq) 4487 { 4488 struct sparsemask *overload_cpus; 4489 unsigned long time; 4490 bool need_clear = false; 4491 4492 if (!steal_enabled()) 4493 return; 4494 4495 if (!group_steal_used() && rq->cfs.h_nr_running >= 2) 4496 return; 4497 4498 if (group_steal_used() && > 4499 (rq->cfs.h_nr_running < 2 || rq->cfs.steal_h_nr_running == 0)) 4500 need_clear = true; 4501 4502 if (!need_clear) 4503 return; 4504 4505 time = schedstat_start_time(); 4506 rcu_read_lock(); 4507 overload_cpus = rcu_dereference(rq->cfs_overload_cpus); 4508 if (overload_cpus) 4509 sparsemask_clear_elem(overload_cpus, rq->cpu); 4510 rcu_read_unlock(); 4511 schedstat_end_time(rq, time); 4512 } 4513 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1290/1290] arch/arm64/mm/init.c:784:17: error: 'mem_sleep_current' undeclared
by kernel test robot 13 Nov '24

13 Nov '24

Hi Ding, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 58ec866c31299a4b0d63a01cb026877c5f85e4d9 commit: fdda68feeca82610ccbcdcbda7250623a6d187d2 [1290/1290] arm64/ascend: Set mem_sleep_current to PM_SUSPEND_ON for ascend platform config: arm64-randconfig-003-20241112 (https://download.01.org/0day-ci/archive/20241113/202411130037.24hgbc37-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241113/202411130037.24hgbc37-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411130037.24hgbc37-lkp@intel.com/ All errors (new ones prefixed by >>): arch/arm64/mm/init.c:469:13: warning: no previous prototype for 'arm64_memblock_init' [-Wmissing-prototypes] 469 | void __init arm64_memblock_init(void) | ^~~~~~~~~~~~~~~~~~~ arch/arm64/mm/init.c: In function 'ascend_enable_setup': >> arch/arm64/mm/init.c:784:17: error: 'mem_sleep_current' undeclared (first use in this function) 784 | mem_sleep_current = PM_SUSPEND_ON; | ^~~~~~~~~~~~~~~~~ arch/arm64/mm/init.c:784:17: note: each undeclared identifier is reported only once for each function it appears in vim +/mem_sleep_current +784 arch/arm64/mm/init.c 770 771 #ifdef CONFIG_ASCEND_FEATURES 772 static int __init ascend_enable_setup(char *__unused) 773 { 774 if (IS_ENABLED(CONFIG_ASCEND_DVPP_MMAP)) 775 enable_mmap_dvpp = 1; 776 777 if (IS_ENABLED(CONFIG_ASCEND_IOPF_HIPRI)) 778 enable_iopf_hipri = 1; 779 780 if (IS_ENABLED(CONFIG_ASCEND_CHARGE_MIGRATE_HUGEPAGES)) 781 enable_charge_mighp = 1; 782 783 if (IS_ENABLED(CONFIG_SUSPEND)) > 784 mem_sleep_current = PM_SUSPEND_ON; 785 786 return 1; 787 } 788 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION 400fd9ccb52e01bf78acae2bbc1710923a15f033
by kernel test robot 12 Nov '24

12 Nov '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 400fd9ccb52e01bf78acae2bbc1710923a15f033 !13095 Update ASPM sysfs on MFD function removal to avoid use-after-free Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202411121519.FfuB626X-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202411121753.yQqZUvdw-lkp@intel.com crypto/asymmetric_keys/pgp_public_key.c:201:33: warning: unused variable 'pgp' [-Wunused-variable] crypto/asymmetric_keys/pgp_public_key.c:48:39: warning: 'struct pgp_parse_pubkey' declared inside parameter list will not be visible outside of this definition or declaration drivers/gpu/drm/phytium/phytium_dp.c:300:17: warning: 'strncpy' output may be truncated copying 32 bytes from a string of length 439 [-Wstringop-truncation] Unverified Error/Warning (likely false positive, kindly check if interested): fs/btrfs/extent_io.c:1945 __process_pages_contig() warn: variable dereferenced before check 'index_ret' (see line 1888) Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_enter | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- arm64-randconfig-001-20241112 | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:strncpy-output-may-be-truncated-copying-bytes-from-a-string-of-length | `-- kernel-sched-topology.c:error:implicit-declaration-of-function-register_sysctl_init |-- arm64-randconfig-002-20241112 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | `-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm |-- x86_64-allnoconfig | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | `-- ld.lld:error:duplicate-symbol:debug |-- x86_64-buildonly-randconfig-003-20241112 | `-- vmlinux.o:warning:objtool:do_syscall_64:call-to-memset()-leaves-.noinstr.text-section |-- x86_64-kexec | `-- kernel-trace-trace_uprobe.o:warning:objtool:__uprobe_perf_func:unreachable-instruction |-- x86_64-randconfig-001-20241112 | |-- crypto-asymmetric_keys-pgp_public_key.c:warning:struct-pgp_parse_pubkey-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration | `-- crypto-asymmetric_keys-pgp_public_key.c:warning:unused-variable-pgp `-- x86_64-randconfig-161-20241112 `-- fs-btrfs-extent_io.c-__process_pages_contig()-warn:variable-dereferenced-before-check-index_ret-(see-line-) elapsed time: 779m configs tested: 11 configs skipped: 93 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20241112 gcc-14.2.0 arm64 randconfig-002-20241112 clang-20 arm64 randconfig-003-20241112 clang-20 arm64 randconfig-004-20241112 clang-20 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 rhel-8.3 gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1 0/1] fix CVE-2024-50115
by Liao Chen 12 Nov '24

12 Nov '24

fix CVE-2024-50115 Sean Christopherson (1): [Backport] KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory arch/x86/kvm/svm/nested.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[openeuler:openEuler-1.0-LTS 1290/1290] drivers/clocksource/arm_arch_timer.c:554:44: error: 'hisi_161010101_read_cntvct_el0' undeclared
by kernel test robot 12 Nov '24

12 Nov '24

Hi Yang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 078e0901be705959736f37cb993768ed39658448 commit: e63b4759933f6a5c5ce6cdc1d11c7bf2201d0612 [1290/1290] arm64: arch_timer: only do cntvct workaround on VDSO path on D05 config: arm64-randconfig-002-20241112 (https://download.01.org/0day-ci/archive/20241112/202411122158.hK6m4BFI-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241112/202411122158.hK6m4BFI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411122158.hK6m4BFI-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/clocksource/arm_arch_timer.c: In function 'arch_timer_enable_workaround': >> drivers/clocksource/arm_arch_timer.c:554:44: error: 'hisi_161010101_read_cntvct_el0' undeclared (first use in this function) 554 | if (wa->read_cntvct_el0 == hisi_161010101_read_cntvct_el0) { | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/clocksource/arm_arch_timer.c:554:44: note: each undeclared identifier is reported only once for each function it appears in vim +/hisi_161010101_read_cntvct_el0 +554 drivers/clocksource/arm_arch_timer.c 527 528 static 529 void arch_timer_enable_workaround(const struct arch_timer_erratum_workaround *wa, 530 bool local) 531 { 532 int i; 533 534 if (local) { 535 __this_cpu_write(timer_unstable_counter_workaround, wa); 536 } else { 537 for_each_possible_cpu(i) 538 per_cpu(timer_unstable_counter_workaround, i) = wa; 539 } 540 541 /* 542 * Use the locked version, as we're called from the CPU 543 * hotplug framework. Otherwise, we end-up in deadlock-land. 544 */ 545 static_branch_enable_cpuslocked(&arch_timer_read_ool_enabled); 546 547 /* 548 * Don't use the vdso fastpath if errata require using the 549 * out-of-line counter accessor. We may change our mind pretty 550 * late in the game (with a per-CPU erratum, for example), so 551 * change both the default value and the vdso itself. 552 */ 553 if (wa->read_cntvct_el0) { > 554 if (wa->read_cntvct_el0 == hisi_161010101_read_cntvct_el0) { 555 clocksource_counter.archdata.vdso_direct = true; 556 vdso_default = true; 557 vdso_fix = true; 558 } else { 559 clocksource_counter.archdata.vdso_direct = false; 560 vdso_default = false; 561 } 562 } 563 } 564 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/1] fix CVE-2024-50115
by Liao Chen 12 Nov '24

12 Nov '24

fix CVE-2024-50115 Sean Christopherson (1): [Backport] KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory arch/x86/kvm/svm/nested.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] fix CVE-2024-50115
by Liao Chen 12 Nov '24

12 Nov '24

fix CVE-2024-50115 Sean Christopherson (1): [Backport] KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory arch/x86/kvm/svm/nested.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6] net/ncsi: Disable the ncsi work before freeing the associated structure
by Zhang Changzhong 12 Nov '24

12 Nov '24

From: Eddie James <eajames(a)linux.ibm.com> mainline inclusion from mainline-v6.12-rc2 commit a0ffa68c70b367358b2672cdab6fa5bc4c40de2c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRA5 CVE: CVE-2024-49945 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The work function can run after the ncsi device is freed, resulting in use-after-free bugs or kernel panic. Fixes: 2d283bdd079c ("net/ncsi: Resource management") Signed-off-by: Eddie James <eajames(a)linux.ibm.com> Link: https://patch.msgid.link/20240925155523.1017097-1-eajames@linux.ibm.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: net/ncsi/ncsi-manage.c [commit 86898fa6b8cd ("workqueue: Implement disable/enable for (delayed) work items") not merged] Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/ncsi/ncsi-manage.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/ncsi/ncsi-manage.c b/net/ncsi/ncsi-manage.c index 90c6cf6..60725e0 100644 --- a/net/ncsi/ncsi-manage.c +++ b/net/ncsi/ncsi-manage.c @@ -1949,6 +1949,8 @@ void ncsi_unregister_dev(struct ncsi_dev *nd) list_del_rcu(&ndp->node); spin_unlock_irqrestore(&ncsi_dev_lock, flags); + cancel_work_sync(&ndp->work); + kfree(ndp); } EXPORT_SYMBOL_GPL(ncsi_unregister_dev); -- 2.9.5

2 1

[PATCH openEuler-22.03-LTS-SP1] net/ncsi: Disable the ncsi work before freeing the associated structure
by Zhang Changzhong 12 Nov '24

12 Nov '24

From: Eddie James <eajames(a)linux.ibm.com> mainline inclusion from mainline-v6.12-rc2 commit a0ffa68c70b367358b2672cdab6fa5bc4c40de2c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRA5 CVE: CVE-2024-49945 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The work function can run after the ncsi device is freed, resulting in use-after-free bugs or kernel panic. Fixes: 2d283bdd079c ("net/ncsi: Resource management") Signed-off-by: Eddie James <eajames(a)linux.ibm.com> Link: https://patch.msgid.link/20240925155523.1017097-1-eajames@linux.ibm.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: net/ncsi/ncsi-manage.c [commit 86898fa6b8cd ("workqueue: Implement disable/enable for (delayed) work items") not merged] Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/ncsi/ncsi-manage.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/ncsi/ncsi-manage.c b/net/ncsi/ncsi-manage.c index ffff8da..4f51dc0 100644 --- a/net/ncsi/ncsi-manage.c +++ b/net/ncsi/ncsi-manage.c @@ -1895,6 +1895,8 @@ void ncsi_unregister_dev(struct ncsi_dev *nd) list_del_rcu(&ndp->node); spin_unlock_irqrestore(&ncsi_dev_lock, flags); + cancel_work_sync(&ndp->work); + kfree(ndp); } EXPORT_SYMBOL_GPL(ncsi_unregister_dev); -- 2.9.5

2 1