February 2024 - Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 3638/3684] drivers/i2c/busses/i2c-hisi.c:476: warning: expecting prototype for i2c_dw_acpi_pin_mux_change(). Prototype was for i2c_hisi_pin_mux_change() instead
by kernel test robot 01 Mar '24

01 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 3016126ef302b602feaa8a7b99e4f85987536d65 commit: bdc031294c4d4fd6326f9460ceedd37fa1d79195 [3638/3684] i2c: hisi: Add gpio bus recovery support config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20240301/202403010757.Yy3swMx9-lkp@…) compiler: clang version 19.0.0git (https://github.com/llvm/llvm-project edd4aee4dd9b5b98b2576a6f783e4086173d902a) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240301/202403010757.Yy3swMx9-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403010757.Yy3swMx9-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/i2c/busses/i2c-hisi.c:476: warning: expecting prototype for i2c_dw_acpi_pin_mux_change(). Prototype was for i2c_hisi_pin_mux_change() instead vim +476 drivers/i2c/busses/i2c-hisi.c 465 466 /** 467 * i2c_dw_acpi_pin_mux_change - Change the I2C controller's pin mux through ACPI 468 * @dev: device owns the SCL/SDA pin 469 * @to_gpio: true to switch to GPIO, false to switch to SCL/SDA 470 * 471 * The function invokes the specific ACPI method "PMUX" for changing the 472 * pin mux of I2C controller between SCL/SDA and GPIO in order to help on 473 * the generic GPIO recovery process. 474 */ 475 static void i2c_hisi_pin_mux_change(struct device *dev, bool to_gpio) > 476 { 477 acpi_handle handle = ACPI_HANDLE(dev); 478 struct acpi_object_list arg_list; 479 unsigned long long data; 480 union acpi_object arg; 481 482 arg.type = ACPI_TYPE_INTEGER; 483 arg.integer.value = to_gpio; 484 arg_list.count = 1; 485 arg_list.pointer = &arg; 486 487 acpi_evaluate_integer(handle, HISI_I2C_PIN_MUX_METHOD, &arg_list, &data); 488 } 489 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 14909/21656] drivers/net/ethernet/hisilicon/hns3/hnae3.h:721:26: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]'
by kernel test robot 29 Feb '24

29 Feb '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: a828e118f71b941479af277bc6aade0094fc62fe commit: 729f96a4e0c32f1c1bfa60e4ff485aa91890963d [14909/21656] net: hns3: optimize the process of queue reset config: arm64-randconfig-001-20240228 (https://download.01.org/0day-ci/archive/20240229/202402292301.Zc2bmew3-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240229/202402292301.Zc2bmew3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402292301.Zc2bmew3-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3345:5: warning: no previous prototype for 'hclge_set_all_vf_rst' [-Wmissing-prototypes] 3345 | int hclge_set_all_vf_rst(struct hclge_dev *hdev, bool reset) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9556:5: warning: no previous prototype for 'hclge_reset_tqp_cmd' [-Wmissing-prototypes] 9556 | int hclge_reset_tqp_cmd(struct hnae3_handle *handle) | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9603:5: warning: no previous prototype for 'hclge_reset_rcb' [-Wmissing-prototypes] 9603 | int hclge_reset_rcb(struct hnae3_handle *handle) | ^~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:11699:5: warning: no previous prototype for 'hclge_init' [-Wmissing-prototypes] 11699 | int hclge_init(void) | ^~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c: In function 'hclge_get_strings': drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:668:50: warning: '%s' directive output may be truncated writing up to 3359 bytes into a region of size 32 [-Wformat-truncation=] 668 | snprintf(buff, ETH_GSTRING_LEN, "%s", strs[i].desc); | ^~ In function 'hclge_comm_get_strings', inlined from 'hclge_get_strings' at drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:774:7: drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:668:17: note: 'snprintf' output between 1 and 3360 bytes into a destination of size 32 668 | snprintf(buff, ETH_GSTRING_LEN, "%s", strs[i].desc); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h:9, from drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:18: In function 'hclge_func_reset_cmd', inlined from 'hclge_reset_prepare_wait' at drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3608:9: drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3467:26: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 3467 | hnae3_set_bit(req->mac_func_reset, HCLGE_CFG_RESET_FUNC_B, 1); drivers/net/ethernet/hisilicon/hns3/hnae3.h:720:18: note: in definition of macro 'hnae3_set_field' 720 | (origin) &= (~(mask)); \ | ^~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3467:9: note: in expansion of macro 'hnae3_set_bit' 3467 | hnae3_set_bit(req->mac_func_reset, HCLGE_CFG_RESET_FUNC_B, 1); | ^~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c: In function 'hclge_reset_prepare_wait': drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3462:27: note: at offset 8 into object 'desc' of size 32 3462 | struct hclge_desc desc; | ^~~~ In function 'hclge_func_reset_cmd', inlined from 'hclge_reset_prepare_wait' at drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3608:9: >> drivers/net/ethernet/hisilicon/hns3/hnae3.h:721:26: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 721 | (origin) |= ((val) << (shift)) & (mask); \ | ~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hnae3.h:726:9: note: in expansion of macro 'hnae3_set_field' 726 | hnae3_set_field((origin), (0x1 << (shift)), (shift), (val)) | ^~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3467:9: note: in expansion of macro 'hnae3_set_bit' 3467 | hnae3_set_bit(req->mac_func_reset, HCLGE_CFG_RESET_FUNC_B, 1); | ^~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c: In function 'hclge_reset_prepare_wait': drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3462:27: note: at offset 8 into object 'desc' of size 32 3462 | struct hclge_desc desc; | ^~~~ In function 'hclge_func_reset_cmd', inlined from 'hclge_reset_prepare_wait' at drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3608:9: drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3468:29: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 3468 | req->fun_reset_vfid = func_id; | ~~~~~~~~~~~~~~~~~~~~^~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c: In function 'hclge_reset_prepare_wait': drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3462:27: note: at offset 8 into object 'desc' of size 32 3462 | struct hclge_desc desc; | ^~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c: In function 'hclge_func_reset_cmd': drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3467:26: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 3467 | hnae3_set_bit(req->mac_func_reset, HCLGE_CFG_RESET_FUNC_B, 1); | ^~ drivers/net/ethernet/hisilicon/hns3/hnae3.h:720:18: note: in definition of macro 'hnae3_set_field' 720 | (origin) &= (~(mask)); \ | ^~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3467:9: note: in expansion of macro 'hnae3_set_bit' 3467 | hnae3_set_bit(req->mac_func_reset, HCLGE_CFG_RESET_FUNC_B, 1); | ^~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3462:27: note: at offset 8 into object 'desc' of size 32 3462 | struct hclge_desc desc; | ^~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3467:26: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 3467 | hnae3_set_bit(req->mac_func_reset, HCLGE_CFG_RESET_FUNC_B, 1); | ^~ drivers/net/ethernet/hisilicon/hns3/hnae3.h:721:18: note: in definition of macro 'hnae3_set_field' 721 | (origin) |= ((val) << (shift)) & (mask); \ | ^~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3467:9: note: in expansion of macro 'hnae3_set_bit' 3467 | hnae3_set_bit(req->mac_func_reset, HCLGE_CFG_RESET_FUNC_B, 1); | ^~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3462:27: note: at offset 8 into object 'desc' of size 32 3462 | struct hclge_desc desc; | ^~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3468:12: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 3468 | req->fun_reset_vfid = func_id; | ^~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3462:27: note: at offset 8 into object 'desc' of size 32 3462 | struct hclge_desc desc; | ^~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c: In function 'hclge_reset_rcb': drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9619:26: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 9619 | hnae3_set_bit(req->fun_reset_rcb, HCLGE_CFG_RESET_RCB_B, 1); | ^~ drivers/net/ethernet/hisilicon/hns3/hnae3.h:720:18: note: in definition of macro 'hnae3_set_field' 720 | (origin) &= (~(mask)); \ | ^~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9619:9: note: in expansion of macro 'hnae3_set_bit' 9619 | hnae3_set_bit(req->fun_reset_rcb, HCLGE_CFG_RESET_RCB_B, 1); | ^~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9610:27: note: at offset 8 into object 'desc' of size 32 9610 | struct hclge_desc desc; | ^~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9619:26: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 9619 | hnae3_set_bit(req->fun_reset_rcb, HCLGE_CFG_RESET_RCB_B, 1); | ^~ drivers/net/ethernet/hisilicon/hns3/hnae3.h:721:18: note: in definition of macro 'hnae3_set_field' 721 | (origin) |= ((val) << (shift)) & (mask); \ | ^~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9619:9: note: in expansion of macro 'hnae3_set_bit' 9619 | hnae3_set_bit(req->fun_reset_rcb, HCLGE_CFG_RESET_RCB_B, 1); | ^~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9610:27: note: at offset 8 into object 'desc' of size 32 9610 | struct hclge_desc desc; | ^~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9620:12: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 9620 | req->fun_reset_rcb_vqid_start = cpu_to_le16(queue_gid); | ^~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9610:27: note: at offset 8 into object 'desc' of size 32 9610 | struct hclge_desc desc; | ^~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9621:12: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 9621 | req->fun_reset_rcb_vqid_num = cpu_to_le16(handle->kinfo.num_tqps); | ^~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9610:27: note: at offset 8 into object 'desc' of size 32 9610 | struct hclge_desc desc; | ^~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9630:28: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 9630 | return_status = req->fun_reset_rcb_return_status; | ^~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9610:27: note: at offset 8 into object 'desc' of size 32 9610 | struct hclge_desc desc; | ^~~~ vim +721 drivers/net/ethernet/hisilicon/hns3/hnae3.h 38caee9d3ee8b32 Salil 2017-08-02 717 e4e87715aa850ab Peng Li 2018-07-02 718 #define hnae3_set_field(origin, mask, shift, val) \ 38caee9d3ee8b32 Salil 2017-08-02 719 do { \ 38caee9d3ee8b32 Salil 2017-08-02 720 (origin) &= (~(mask)); \ 38caee9d3ee8b32 Salil 2017-08-02 @721 (origin) |= ((val) << (shift)) & (mask); \ 38caee9d3ee8b32 Salil 2017-08-02 722 } while (0) e4e87715aa850ab Peng Li 2018-07-02 723 #define hnae3_get_field(origin, mask, shift) (((origin) & (mask)) >> (shift)) 38caee9d3ee8b32 Salil 2017-08-02 724 :::::: The code at line 721 was first introduced by commit :::::: 38caee9d3ee8b32b36912f54e19438eddd126772 net: hns3: Add support of the HNAE3 framework :::::: TO: Salil <salil.mehta(a)huawei.com> :::::: CC: David S. Miller <davem(a)davemloft.net> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] sched/membarrier: reduce the ability to hammer on sys_membarrier
by Zhao Wenhui 29 Feb '24

29 Feb '24

From: Linus Torvalds <torvalds(a)linuxfoundation.org> stable inclusion from stable-v4.19.307 commit 3cd139875e9a7688b3fc715264032620812a5fa3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93SNV CVE: CVE-2024-26602 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 944d5fe50f3f03daacfea16300e656a1691c4a23 upstream. On some systems, sys_membarrier can be very expensive, causing overall slowdowns for everything. So put a lock on the path in order to serialize the accesses to prevent the ability for this to be called at too high of a frequency and saturate the machine. Reviewed-and-tested-by: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Acked-by: Borislav Petkov <bp(a)alien8.de> Fixes: 22e4ebb97582 ("membarrier: Provide expedited private command") Fixes: c5f58bd58f43 ("membarrier: Provide GLOBAL_EXPEDITED command") Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> [ converted to explicit mutex_*() calls - cleanup.h is not in this stable branch - gregkh ] Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- kernel/sched/membarrier.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kernel/sched/membarrier.c b/kernel/sched/membarrier.c index 1757074be994..4978b8fe59e5 100644 --- a/kernel/sched/membarrier.c +++ b/kernel/sched/membarrier.c @@ -34,6 +34,8 @@ | MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED \ | MEMBARRIER_PRIVATE_EXPEDITED_SYNC_CORE_BITMASK) +static DEFINE_MUTEX(membarrier_ipi_mutex); + static void ipi_mb(void *info) { smp_mb(); /* IPIs should be serializing but paranoid. */ @@ -89,6 +91,7 @@ static int membarrier_global_expedited(void) if (!zalloc_cpumask_var(&tmpmask, GFP_KERNEL)) return -ENOMEM; + mutex_lock(&membarrier_ipi_mutex); cpus_read_lock(); rcu_read_lock(); for_each_online_cpu(cpu) { @@ -135,6 +138,7 @@ static int membarrier_global_expedited(void) * rq->curr modification in scheduler. */ smp_mb(); /* exit from system call is not a mb */ + mutex_unlock(&membarrier_ipi_mutex); return 0; } @@ -168,6 +172,7 @@ static int membarrier_private_expedited(int flags) if (!zalloc_cpumask_var(&tmpmask, GFP_KERNEL)) return -ENOMEM; + mutex_lock(&membarrier_ipi_mutex); cpus_read_lock(); rcu_read_lock(); for_each_online_cpu(cpu) { @@ -202,6 +207,7 @@ static int membarrier_private_expedited(int flags) * rq->curr modification in scheduler. */ smp_mb(); /* exit from system call is not a mb */ + mutex_unlock(&membarrier_ipi_mutex); return 0; } -- 2.34.1

2 1

[PATCH OLK-5.10 0/7] ext4: dio: Put endio under irq context for overwrite
by Zhihao Cheng 29 Feb '24

29 Feb '24

Christoph Hellwig (2): iomap: rename the flags variable in __iomap_dio_rw iomap: pass a flags argument to iomap_dio_rw Jens Axboe (3): iomap: cleanup up iomap_dio_bio_end_io() iomap: use an unsigned type for IOMAP_DIO_* defines iomap: add IOMAP_DIO_INLINE_COMP Zhihao Cheng (2): iomap: Add a IOMAP_DIO_MAY_INLINE_COMP flag ext4: Optimize endio process for DIO overwrites fs/btrfs/inode.c | 4 +-- fs/ext4/file.c | 15 +++++--- fs/gfs2/file.c | 7 ++-- fs/iomap/direct-io.c | 84 ++++++++++++++++++++++++++++--------------- fs/xfs/xfs_file.c | 5 ++- fs/zonefs/super.c | 4 +-- include/linux/iomap.h | 16 +++++++-- 7 files changed, 88 insertions(+), 47 deletions(-) -- 2.31.1

2 8

[PATCH openEuler-1.0-LTS v2 0/2] fix CVE-2020-36782
by Zhang Xiaoxu 29 Feb '24

29 Feb '24

v1->v2: update bugzilla Qinglang Miao (1): i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails Zhang Qilong (1): PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter drivers/i2c/busses/i2c-imx-lpi2c.c | 2 +- include/linux/pm_runtime.h | 21 +++++++++++++++++++++ 2 files changed, 22 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH v1 OLK-6.6 0/3] kworker: Fix the problem of ipsan performance degradation on ARM architecture
by jiangdongxu 29 Feb '24

29 Feb '24

From: shaodenghui <shaodenghui(a)huawei.com> When the current downstream FS tests IPSAN, it is found that the performance on ARM is much worse than that on X86, and the test data of IPSAN fluctuates greatly. After analysis, the reason is that when iscsi issues IO, the task is sent to kworker for processing by iscsi_xmitworker. The workqueue created by iscsi can automatically identify the CPU of the soft interrupt currently processed by iscsi, and automatically schedule the workqueue to the corresponding NUMA node. shaodenghui (3): iscsi: add member for NUMA aware order workqueue workqueue: implement NUMA affinity for single thread workqueue iscsi: use dynamic single thread workqueue to improve performance drivers/scsi/iscsi_tcp.c | 9 +++++++++ drivers/scsi/libiscsi.c | 17 ++++++++++++----- include/linux/workqueue.h | 1 + include/scsi/libiscsi.h | 1 + kernel/workqueue.c | 15 ++++++++++----- 5 files changed, 33 insertions(+), 10 deletions(-) -- 2.33.0

2 4

[PATCH openEuler-1.0-LTS v2] io_uring: fix overflows checks in provide buffers
by Long Li 29 Feb '24

29 Feb '24

From: Pavel Begunkov <asml.silence(a)gmail.com> stable inclusion from stable-v5.10.36 commit cbbc13b115b8f18e0a714d89f87fbdc499acfe2d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94JIH CVE: CVE-2021-47040 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 38134ada0ceea3e848fe993263c0ff6207fd46e7 ] Colin reported before possible overflow and sign extension problems in io_provide_buffers_prep(). As Linus pointed out previous attempt did nothing useful, see d81269fecb8ce ("io_uring: fix provide_buffers sign extension"). Do that with help of check_<op>_overflow helpers. And fix struct io_provide_buf::len type, as it doesn't make much sense to keep it signed. Reported-by: Colin Ian King <colin.king(a)canonical.com> Fixes: efe68c1ca8f49 ("io_uring: validate the full range of provided buffers for access") Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Link: https://lore.kernel.org/r/46538827e70fce5f6cdb50897cff4cacc490f380.16184882… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/io_uring.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index 018d38bec473..afac3197fd6c 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -486,7 +486,7 @@ struct io_splice { struct io_provide_buf { struct file *file; __u64 addr; - __s32 len; + __u32 len; __u32 bgid; __u16 nbufs; __u16 bid; @@ -3606,7 +3606,7 @@ static int io_remove_buffers(struct io_kiocb *req, bool force_nonblock, static int io_provide_buffers_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) { - unsigned long size; + unsigned long size, tmp_check; struct io_provide_buf *p = &req->pbuf; u64 tmp; @@ -3620,6 +3620,12 @@ static int io_provide_buffers_prep(struct io_kiocb *req, p->addr = READ_ONCE(sqe->addr); p->len = READ_ONCE(sqe->len); + if (check_mul_overflow((unsigned long)p->len, (unsigned long)p->nbufs, + &size)) + return -EOVERFLOW; + if (check_add_overflow((unsigned long)p->addr, size, &tmp_check)) + return -EOVERFLOW; + size = (unsigned long)p->len * p->nbufs; if (!access_ok(u64_to_user_ptr(p->addr), size)) return -EFAULT; -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2020-36782
by Zhang Xiaoxu 29 Feb '24

29 Feb '24

*** BLURB HERE *** Qinglang Miao (1): i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails Zhang Qilong (1): PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter drivers/i2c/busses/i2c-imx-lpi2c.c | 2 +- include/linux/pm_runtime.h | 21 +++++++++++++++++++++ 2 files changed, 22 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS V1] parisc: Clear stale IIR value on instruction access rights trap
by Cheng Yu 29 Feb '24

29 Feb '24

From: Helge Deller <deller(a)gmx.de> mainline inclusion from mainline-v5.16-rc7 commit 484730e5862f6b872dca13840bed40fd7c60fa26 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I947PH CVE: CVE-2021-46928 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When a trap 7 (Instruction access rights) occurs, this means the CPU couldn't execute an instruction due to missing execute permissions on the memory region. In this case it seems the CPU didn't even fetched the instruction from memory and thus did not store it in the cr19 (IIR) register before calling the trap handler. So, the trap handler will find some random old stale value in cr19. This patch simply overwrites the stale IIR value with a constant magic "bad food" value (0xbaadf00d), in the hope people don't start to try to understand the various random IIR values in trap 7 dumps. Noticed-by: John David Anglin <dave.anglin(a)bell.net> Signed-off-by: Helge Deller <deller(a)gmx.de> --- arch/parisc/kernel/traps.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c index abeb5321a83f..f509ce685f0e 100644 --- a/arch/parisc/kernel/traps.c +++ b/arch/parisc/kernel/traps.c @@ -697,6 +697,8 @@ void notrace handle_interruption(int code, struct pt_regs *regs) } up_read(&current->mm->mmap_sem); } + /* CPU could not fetch instruction, so clear stale IIR value. */ + regs->iir = 0xbaadf00d; /* Fall Through */ case 27: /* Data memory protection ID trap */ -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS V1] parisc: Clear stale IIR value on instruction access rights trap
by Guan Jing 29 Feb '24

29 Feb '24

From: Helge Deller <deller(a)gmx.de> mainline inclusion from mainline-v5.16-rc7 commit 484730e5862f6b872dca13840bed40fd7c60fa26 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I947PH CVE: CVE-2021-46928 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When a trap 7 (Instruction access rights) occurs, this means the CPU couldn't execute an instruction due to missing execute permissions on the memory region. In this case it seems the CPU didn't even fetched the instruction from memory and thus did not store it in the cr19 (IIR) register before calling the trap handler. So, the trap handler will find some random old stale value in cr19. This patch simply overwrites the stale IIR value with a constant magic "bad food" value (0xbaadf00d), in the hope people don't start to try to understand the various random IIR values in trap 7 dumps. Noticed-by: John David Anglin <dave.anglin(a)bell.net> Signed-off-by: Helge Deller <deller(a)gmx.de> --- arch/parisc/kernel/traps.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c index abeb5321a83f..f509ce685f0e 100644 --- a/arch/parisc/kernel/traps.c +++ b/arch/parisc/kernel/traps.c @@ -697,6 +697,8 @@ void notrace handle_interruption(int code, struct pt_regs *regs) } up_read(&current->mm->mmap_sem); } + /* CPU could not fetch instruction, so clear stale IIR value. */ + regs->iir = 0xbaadf00d; /* Fall Through */ case 27: /* Data memory protection ID trap */ -- 2.25.1

2 1