May 2024 - Kernel - mailweb.openeuler.org

[openeuler:OLK-5.10] BUILD SUCCESS f300accff5478c6324a1c31d0337bc28dda75ba9
by kernel test robot 26 May '24

26 May '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: f300accff5478c6324a1c31d0337bc28dda75ba9 !7961 net: atlantic: eliminate double free in error handling logic Warning ids grouped by kconfigs: clang_recent_errors |-- arm64-allyesconfig | |-- Documentation-devicetree-bindings-iio-addac-adi-ad74413r.yaml:channel:Missing-additionalProperties-unevaluatedProperties-constraint | `-- Documentation-devicetree-bindings-sound-amlogic-gx-sound-card.yaml:codec(-):Missing-additionalProperties-unevaluatedProperties-constraint `-- x86_64-allnoconfig |-- Warning:openEuler-MAINTAINERS-references-a-file-that-doesn-t-exist:Documentation-networking-hinic3.rst |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:common-qp.h-is-included-more-than-once. |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_device.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_genl.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_genl_admin.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_uvs_cmd.c:ubcore_device.h-is-included-more-than-once. `-- drivers-ub-urma-uburma-uburma_mmap.c:linux-version.h-not-needed. elapsed time: 727m configs tested: 35 configs skipped: 140 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240525 gcc arm64 randconfig-002-20240525 clang arm64 randconfig-003-20240525 gcc arm64 randconfig-004-20240525 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240525 clang x86_64 buildonly-randconfig-002-20240525 gcc x86_64 buildonly-randconfig-003-20240525 gcc x86_64 buildonly-randconfig-004-20240525 gcc x86_64 buildonly-randconfig-005-20240525 gcc x86_64 buildonly-randconfig-006-20240525 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240525 clang x86_64 randconfig-002-20240525 clang x86_64 randconfig-003-20240525 clang x86_64 randconfig-004-20240525 clang x86_64 randconfig-005-20240525 clang x86_64 randconfig-006-20240525 clang x86_64 randconfig-011-20240525 clang x86_64 randconfig-012-20240525 clang x86_64 randconfig-013-20240525 gcc x86_64 randconfig-014-20240525 clang x86_64 randconfig-015-20240525 gcc x86_64 randconfig-016-20240525 clang x86_64 randconfig-071-20240525 gcc x86_64 randconfig-072-20240525 clang x86_64 randconfig-073-20240525 clang x86_64 randconfig-074-20240525 gcc x86_64 randconfig-075-20240525 gcc x86_64 randconfig-076-20240525 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 4ba26291c36f420273a2546b25d2c0db3115d226
by kernel test robot 26 May '24

26 May '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 4ba26291c36f420273a2546b25d2c0db3115d226 !7971 fbmon: prevent division by zero in fb_videomode_from_videomode() Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202405260123.NWtyQKRm-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) drivers/md/dm-integrity.o: warning: objtool: do_journal_write()+0x134d: stack state mismatch: cfa1=-4-40 cfa2=-1+0 Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allmodconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- arm64-defconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- x86_64-buildonly-randconfig-003-20240525 | `-- drivers-net-ethernet-netswift-ngbe-ngbe_main.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-005-20240525 | `-- drivers-md-dm-integrity.o:warning:objtool:do_journal_write:stack-state-mismatch:cfa1-cfa2 `-- x86_64-randconfig-015-20240525 `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code clang_recent_errors |-- x86_64-allyesconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension |-- x86_64-randconfig-002-20240525 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension |-- x86_64-randconfig-004-20240525 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension `-- x86_64-randconfig-076-20240525 `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension elapsed time: 724m configs tested: 35 configs skipped: 133 tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240525 gcc arm64 randconfig-002-20240525 gcc arm64 randconfig-003-20240525 gcc arm64 randconfig-004-20240525 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240525 clang x86_64 buildonly-randconfig-002-20240525 gcc x86_64 buildonly-randconfig-003-20240525 gcc x86_64 buildonly-randconfig-004-20240525 gcc x86_64 buildonly-randconfig-005-20240525 gcc x86_64 buildonly-randconfig-006-20240525 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240525 clang x86_64 randconfig-002-20240525 clang x86_64 randconfig-003-20240525 clang x86_64 randconfig-004-20240525 clang x86_64 randconfig-005-20240525 clang x86_64 randconfig-006-20240525 clang x86_64 randconfig-011-20240525 clang x86_64 randconfig-012-20240525 clang x86_64 randconfig-013-20240525 gcc x86_64 randconfig-014-20240525 clang x86_64 randconfig-015-20240525 gcc x86_64 randconfig-016-20240525 clang x86_64 randconfig-071-20240525 gcc x86_64 randconfig-072-20240525 clang x86_64 randconfig-073-20240525 clang x86_64 randconfig-074-20240525 gcc x86_64 randconfig-075-20240525 gcc x86_64 randconfig-076-20240525 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 8162/22498] drivers/md/dm-integrity.o: warning: objtool: do_journal_write()+0x134d: stack state mismatch: cfa1=-4-40 cfa2=-1+0
by kernel test robot 26 May '24

26 May '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4ba26291c36f420273a2546b25d2c0db3115d226 commit: 56bc1719652e7a937bc9856f76f0c0fbf8ce1b23 [8162/22498] objtool: Support GCC 9 cold subfunction naming scheme config: x86_64-buildonly-randconfig-005-20240525 (https://download.01.org/0day-ci/archive/20240526/202405260123.NWtyQKRm-lkp@…) compiler: gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240526/202405260123.NWtyQKRm-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405260123.NWtyQKRm-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/md/dm-integrity.c:3606:12: warning: no previous prototype for 'dm_integrity_init' [-Wmissing-prototypes] 3606 | int __init dm_integrity_init(void) | ^~~~~~~~~~~~~~~~~ drivers/md/dm-integrity.c:3625:6: warning: no previous prototype for 'dm_integrity_exit' [-Wmissing-prototypes] 3625 | void dm_integrity_exit(void) | ^~~~~~~~~~~~~~~~~ drivers/md/dm-integrity.c: In function '__journal_read_write': drivers/md/dm-integrity.c:1541:105: warning: array subscript s is outside array bounds of 'commit_id_t[0]' {aka 'long long unsigned int[]'} [-Warray-bounds=] 1541 | *(commit_id_t *)(mem_ptr + JOURNAL_SECTOR_DATA) = je->last_bytes[s]; | ~~~~~~~~~~~~~~^~~ drivers/md/dm-integrity.c:83:21: note: while referencing 'last_bytes' 83 | commit_id_t last_bytes[0]; | ^~~~~~~~~~ drivers/md/dm-integrity.c:87:58: warning: array subscript <unknown> is outside array bounds of 'commit_id_t[0]' {aka 'long long unsigned int[]'} [-Warray-bounds=] 87 | #define journal_entry_tag(ic, je) ((__u8 *)&(je)->last_bytes[(ic)->sectors_per_block]) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/md/dm-integrity.c:1561:49: note: in expansion of macro 'journal_entry_tag' 1561 | char *tag_ptr = journal_entry_tag(ic, je); | ^~~~~~~~~~~~~~~~~ drivers/md/dm-integrity.c:83:21: note: while referencing 'last_bytes' 83 | commit_id_t last_bytes[0]; | ^~~~~~~~~~ drivers/md/dm-integrity.c:87:58: warning: array subscript <unknown> is outside array bounds of 'commit_id_t[0]' {aka 'long long unsigned int[]'} [-Warray-bounds=] 87 | #define journal_entry_tag(ic, je) ((__u8 *)&(je)->last_bytes[(ic)->sectors_per_block]) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/md/dm-integrity.c:1561:49: note: in expansion of macro 'journal_entry_tag' 1561 | char *tag_ptr = journal_entry_tag(ic, je); | ^~~~~~~~~~~~~~~~~ drivers/md/dm-integrity.c:83:21: note: while referencing 'last_bytes' 83 | commit_id_t last_bytes[0]; | ^~~~~~~~~~ drivers/md/dm-integrity.c:1591:55: warning: array subscript s is outside array bounds of 'commit_id_t[0]' {aka 'long long unsigned int[]'} [-Warray-bounds=] 1591 | je->last_bytes[s] = js[s].commit_id; | ~~~~~~~~~~~~~~^~~ drivers/md/dm-integrity.c:83:21: note: while referencing 'last_bytes' 83 | commit_id_t last_bytes[0]; | ^~~~~~~~~~ drivers/md/dm-integrity.c:87:58: warning: array subscript <unknown> is outside array bounds of 'commit_id_t[0]' {aka 'long long unsigned int[]'} [-Warray-bounds=] 87 | #define journal_entry_tag(ic, je) ((__u8 *)&(je)->last_bytes[(ic)->sectors_per_block]) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/md/dm-integrity.c:1601:107: note: in expansion of macro 'journal_entry_tag' 1601 | integrity_sector_checksum(ic, logical_sector, (char *)js, journal_entry_tag(ic, je)); | ^~~~~~~~~~~~~~~~~ drivers/md/dm-integrity.c:83:21: note: while referencing 'last_bytes' 83 | commit_id_t last_bytes[0]; | ^~~~~~~~~~ drivers/md/dm-integrity.c:87:58: warning: array subscript <unknown> is outside array bounds of 'commit_id_t[0]' {aka 'long long unsigned int[]'} [-Warray-bounds=] 87 | #define journal_entry_tag(ic, je) ((__u8 *)&(je)->last_bytes[(ic)->sectors_per_block]) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/md/dm-integrity.c:1599:56: note: in expansion of macro 'journal_entry_tag' 1599 | memcpy(journal_entry_tag(ic, je), checksums_onstack, ic->tag_size); | ^~~~~~~~~~~~~~~~~ drivers/md/dm-integrity.c:83:21: note: while referencing 'last_bytes' 83 | commit_id_t last_bytes[0]; | ^~~~~~~~~~ In function 'restore_last_bytes', inlined from 'do_journal_write' at drivers/md/dm-integrity.c:1958:4: drivers/md/dm-integrity.c:1915:47: warning: array subscript s is outside array bounds of 'commit_id_t[0]' {aka 'long long unsigned int[]'} [-Warray-bounds=] 1915 | js->commit_id = je->last_bytes[s]; | ~~~~~~~~~~~~~~^~~ drivers/md/dm-integrity.c: In function 'do_journal_write': drivers/md/dm-integrity.c:83:21: note: while referencing 'last_bytes' 83 | commit_id_t last_bytes[0]; | ^~~~~~~~~~ In function 'restore_last_bytes', inlined from 'do_journal_write' at drivers/md/dm-integrity.c:1969:5: drivers/md/dm-integrity.c:1915:47: warning: array subscript s is outside array bounds of 'commit_id_t[0]' {aka 'long long unsigned int[]'} [-Warray-bounds=] 1915 | js->commit_id = je->last_bytes[s]; | ~~~~~~~~~~~~~~^~~ drivers/md/dm-integrity.c: In function 'do_journal_write': drivers/md/dm-integrity.c:83:21: note: while referencing 'last_bytes' 83 | commit_id_t last_bytes[0]; | ^~~~~~~~~~ In file included from drivers/md/dm-integrity.c:9: drivers/md/dm-integrity.c:87:58: warning: array subscript <unknown> is outside array bounds of 'commit_id_t[0]' {aka 'long long unsigned int[]'} [-Warray-bounds=] 87 | #define journal_entry_tag(ic, je) ((__u8 *)&(je)->last_bytes[(ic)->sectors_per_block]) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/compiler.h:77:45: note: in definition of macro 'unlikely' 77 | # define unlikely(x) __builtin_expect(!!(x), 0) | ^ drivers/md/dm-integrity.c:2028:71: note: in expansion of macro 'journal_entry_tag' 2028 | if (unlikely(memcmp(test_tag, journal_entry_tag(ic, je2), ic->tag_size))) | ^~~~~~~~~~~~~~~~~ drivers/md/dm-integrity.c:83:21: note: while referencing 'last_bytes' 83 | commit_id_t last_bytes[0]; | ^~~~~~~~~~ drivers/md/dm-integrity.c:87:58: warning: array subscript <unknown> is outside array bounds of 'commit_id_t[0]' {aka 'long long unsigned int[]'} [-Warray-bounds=] 87 | #define journal_entry_tag(ic, je) ((__u8 *)&(je)->last_bytes[(ic)->sectors_per_block]) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/md/dm-integrity.c:2033:61: note: in expansion of macro 'journal_entry_tag' 2033 | r = dm_integrity_rw_tag(ic, journal_entry_tag(ic, je2), &metadata_block, &metadata_offset, | ^~~~~~~~~~~~~~~~~ drivers/md/dm-integrity.c:83:21: note: while referencing 'last_bytes' 83 | commit_id_t last_bytes[0]; | ^~~~~~~~~~ >> drivers/md/dm-integrity.o: warning: objtool: do_journal_write()+0x134d: stack state mismatch: cfa1=-4-40 cfa2=-1+0 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] mm/mempolicy.c: fix the out-of-bounds access issue in mpol_parse_str
by Ze Zuo 25 May '24

25 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9S5SX CVE: NA ------------------------------------------------------------------ commit 50afa8757dea("mm: prepare to support weighted interleaving mempolicy") kabi reservation for structures task_struct, vm_operations_struct, for support of weighted L/R-based memory interleaving Allocation, the above patch failed to add MPOL_WEIGHTED_INTERLEAVE to the policy_modes array, resulting in out-of-bounds accesses when accessing the policy_modes array in mpol_parse_str. Fixes: 50afa8757dea ("mm: prepare to support weighted interleaving mempolicy") Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- mm/mempolicy.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/mm/mempolicy.c b/mm/mempolicy.c index 17aadb5ca5f7..f4860a9e8d0b 100644 --- a/mm/mempolicy.c +++ b/mm/mempolicy.c @@ -1477,7 +1477,8 @@ static inline int sanitize_mpol_flags(int *mode, unsigned short *flags) *flags = *mode & MPOL_MODE_FLAGS; *mode &= ~MPOL_MODE_FLAGS; - if ((unsigned int)(*mode) >= MPOL_MAX) + if ((unsigned int)(*mode) >= MPOL_MAX || + (unsigned int)(*mode) == MPOL_WEIGHTED_INTERLEAVE) return -EINVAL; if ((*flags & MPOL_F_STATIC_NODES) && (*flags & MPOL_F_RELATIVE_NODES)) return -EINVAL; @@ -2989,6 +2990,7 @@ static const char * const policy_modes[] = [MPOL_PREFERRED] = "prefer", [MPOL_BIND] = "bind", [MPOL_INTERLEAVE] = "interleave", + [MPOL_WEIGHTED_INTERLEAVE] = "weighted interleave", [MPOL_LOCAL] = "local", [MPOL_PREFERRED_MANY] = "prefer (many)", }; -- 2.33.0

2 1

[PATCH OLK-5.10] [Huawei] iommu: Reserve kabi for iommu and memory related functions
by Zhang Zekun 25 May '24

25 May '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9S5ZK ------------------------------------- Reserve for the iova and memory alloc related functions. It is used for future patches to merge. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/iommu/iommu.c | 4 ++++ include/linux/iova.h | 8 ++++++++ 2 files changed, 12 insertions(+) diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c index ba33d11f2fdb..bd14b73dccb7 100644 --- a/drivers/iommu/iommu.c +++ b/drivers/iommu/iommu.c @@ -58,6 +58,10 @@ struct iommu_group { struct iommu_domain *default_domain; struct iommu_domain *domain; struct list_head entry; + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) }; struct group_device { diff --git a/include/linux/iova.h b/include/linux/iova.h index dda350fc6aca..b8d89ffacc58 100644 --- a/include/linux/iova.h +++ b/include/linux/iova.h @@ -35,6 +35,8 @@ struct iova_rcache { struct iova_cpu_rcache __percpu *cpu_rcaches; struct iova_domain *iovad; struct delayed_work work; + KABI_RESERVE(1) + KABI_RESERVE(2) }; struct iova_domain; @@ -64,6 +66,8 @@ struct iova_fq { struct iova_fq_entry entries[IOVA_FQ_SIZE]; unsigned head, tail; spinlock_t lock; + KABI_RESERVE(1) + KABI_RESERVE(2) }; /* holds all the iova translations for a domain */ @@ -98,6 +102,10 @@ struct iova_domain { atomic_t fq_timer_on; /* 1 when timer is active, 0 when not */ struct work_struct free_iova_work; + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) }; static inline unsigned long iova_size(struct iova *iova) -- 2.17.1

2 1

[PATCH OLK-5.10 v6 0/4] arm64: Allow CPU0 to be nohz_full
by Xiongfeng Wang 25 May '24

25 May '24

Changelog: v1->v2: change __setup() to early_param() v2->v3: fix kabi because #include <linux/sched/isolation.h> modify defconfig v3->v4: fix riscv compile error: move support_cpu0_nohz_full to tick.h v4->v5: fix kabi change v5->v6: Only check whether there exists only one online housekeeping CPU Xiongfeng Wang (4): isolation: Do not check whether housekeeping CPUs are present isolation: Check whether there exists a housekeeping CPU online arm64: Kconfig: select ARCH_SUSPEND_NONZERO_CPU by default arm64: defconfig: Enable CONFIG_ARCH_SUSPEND_NONZERO_CPU arch/arm64/Kconfig | 3 +++ arch/arm64/configs/openeuler_defconfig | 2 ++ include/linux/cpu.h | 5 ++++- include/linux/sched/isolation.h | 2 ++ include/linux/tick.h | 2 ++ kernel/sched/isolation.c | 31 ++++++++++++++++++++++---- kernel/smp.c | 4 ++++ kernel/time/tick-sched.c | 11 ++++++++- 8 files changed, 54 insertions(+), 6 deletions(-) -- 2.30.0

2 5

[PATCH openEuler-1.0-LTS v2] net/tls: Fix flipped sign in tls_err_abort() calls
by Ziyang Xuan 25 May '24

25 May '24

From: Daniel Jordan <daniel.m.jordan(a)oracle.com> mainline inclusion from mainline-v5.15 commit da353fac65fede6b8b4cfe207f0d9408e3121105 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RCYN CVE: CVE-2021-47496 -------------------------------- sk->sk_err appears to expect a positive value, a convention that ktls doesn't always follow and that leads to memory corruption in other code. For instance, [kworker] tls_encrypt_done(..., err=<negative error from crypto request>) tls_err_abort(.., err) sk->sk_err = err; [task] splice_from_pipe_feed ... tls_sw_do_sendpage if (sk->sk_err) { ret = -sk->sk_err; // ret is positive splice_from_pipe_feed (continued) ret = actor(...) // ret is still positive and interpreted as bytes // written, resulting in underflow of buf->len and // sd->len, leading to huge buf->offset and bogus // addresses computed in later calls to actor() Fix all tls_err_abort() callers to pass a negative error code consistently and centralize the error-prone sign flip there, throwing in a warning to catch future misuse and uninlining the function so it really does only warn once. Cc: stable(a)vger.kernel.org Fixes: c46234ebb4d1e ("tls: RX path for ktls") Reported-by: syzbot+b187b77c8474f9648fae(a)syzkaller.appspotmail.com Signed-off-by: Daniel Jordan <daniel.m.jordan(a)oracle.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: include/net/tls.h net/tls/tls_sw.c [The version does not include commit e3ae2365efc1 and a42055e8d2c3.] Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- include/net/tls.h | 9 ++------- net/tls/tls_sw.c | 15 ++++++++++++--- 2 files changed, 14 insertions(+), 10 deletions(-) diff --git a/include/net/tls.h b/include/net/tls.h index 4457bc67f2e6..de16c863fd66 100644 --- a/include/net/tls.h +++ b/include/net/tls.h @@ -272,6 +272,7 @@ int tls_sk_query(struct sock *sk, int optname, char __user *optval, int __user *optlen); int tls_sk_attach(struct sock *sk, int optname, char __user *optval, unsigned int optlen); +void tls_err_abort(struct sock *sk, int err); int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx, int tx); int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size); @@ -365,12 +366,6 @@ static inline bool tls_is_sk_tx_device_offloaded(struct sock *sk) #endif } -static inline void tls_err_abort(struct sock *sk, int err) -{ - sk->sk_err = err; - sk->sk_error_report(sk); -} - static inline bool tls_bigint_increment(unsigned char *seq, int len) { int i; @@ -388,7 +383,7 @@ static inline void tls_advance_record_sn(struct sock *sk, struct cipher_context *ctx) { if (tls_bigint_increment(ctx->rec_seq, ctx->rec_seq_size)) - tls_err_abort(sk, EBADMSG); + tls_err_abort(sk, -EBADMSG); tls_bigint_increment(ctx->iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE, ctx->iv_size); } diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c index 7d761244a360..1363f5630cae 100644 --- a/net/tls/tls_sw.c +++ b/net/tls/tls_sw.c @@ -34,6 +34,7 @@ * SOFTWARE. */ +#include <linux/bug.h> #include <linux/sched/signal.h> #include <linux/module.h> #include <crypto/aead.h> @@ -43,6 +44,14 @@ #define MAX_IV_SIZE TLS_CIPHER_AES_GCM_128_IV_SIZE +noinline void tls_err_abort(struct sock *sk, int err) +{ + WARN_ON_ONCE(err >= 0); + /* sk->sk_err should contain a positive error code. */ + sk->sk_err = -err; + sk->sk_error_report(sk); +} + static int tls_do_decryption(struct sock *sk, struct scatterlist *sgin, struct scatterlist *sgout, @@ -244,7 +253,7 @@ static int tls_push_record(struct sock *sk, int flags, /* Only pass through MSG_DONTWAIT and MSG_NOSIGNAL flags */ rc = tls_push_sg(sk, tls_ctx, ctx->sg_encrypted_data, 0, flags); if (rc < 0 && rc != -EAGAIN) - tls_err_abort(sk, EBADMSG); + tls_err_abort(sk, -EBADMSG); tls_advance_record_sn(sk, &tls_ctx->tx); out_req: @@ -911,7 +920,7 @@ int tls_sw_recvmsg(struct sock *sk, err = decrypt_skb_update(sk, skb, &msg->msg_iter, &chunk, &zc); if (err < 0) { - tls_err_abort(sk, EBADMSG); + tls_err_abort(sk, -EBADMSG); goto recv_end; } ctx->decrypted = true; @@ -991,7 +1000,7 @@ ssize_t tls_sw_splice_read(struct socket *sock, loff_t *ppos, err = decrypt_skb_update(sk, skb, NULL, &chunk, &zc); if (err < 0) { - tls_err_abort(sk, EBADMSG); + tls_err_abort(sk, -EBADMSG); goto splice_read_end; } ctx->decrypted = true; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
by Yang Yingliang 25 May '24

25 May '24

From: Nam Cao <namcao(a)linutronix.de> mainline inclusion from mainline-v6.9-rc6 commit 9c0f59e47a90c54d0153f8ddc0f80d7a36207d0e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRN6 CVE: CVE-2024-35997 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The flag I2C_HID_READ_PENDING is used to serialize I2C operations. However, this is not necessary, because I2C core already has its own locking for that. More importantly, this flag can cause a lock-up: if the flag is set in i2c_hid_xfer() and an interrupt happens, the interrupt handler (i2c_hid_irq) will check this flag and return immediately without doing anything, then the interrupt handler will be invoked again in an infinite loop. Since interrupt handler is an RT task, it takes over the CPU and the flag-clearing task never gets scheduled, thus we have a lock-up. Delete this unnecessary flag. Reported-and-tested-by: Eva Kurchatova <nyandarknessgirl(a)gmail.com> Closes: https://lore.kernel.org/r/CA+eeCSPUDpUg76ZO8dszSbAGn+UHjcyv8F1J-CUPVARAzEtW… Fixes: 4a200c3b9a40 ("HID: i2c-hid: introduce HID over i2c specification implementation") Cc: <stable(a)vger.kernel.org> Signed-off-by: Nam Cao <namcao(a)linutronix.de> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Conflicts: drivers/hid/i2c-hid/i2c-hid-core.c [yyl: adjust context] Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/hid/i2c-hid/i2c-hid-core.c | 8 -------- 1 file changed, 8 deletions(-) diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c index 0a39e444e308..41771da10682 100644 --- a/drivers/hid/i2c-hid/i2c-hid-core.c +++ b/drivers/hid/i2c-hid/i2c-hid-core.c @@ -56,7 +56,6 @@ /* flags */ #define I2C_HID_STARTED 0 #define I2C_HID_RESET_PENDING 1 -#define I2C_HID_READ_PENDING 2 #define I2C_HID_PWR_ON 0x00 #define I2C_HID_PWR_SLEEP 0x01 @@ -253,7 +252,6 @@ static int __i2c_hid_command(struct i2c_client *client, msg[1].len = data_len; msg[1].buf = buf_recv; msg_num = 2; - set_bit(I2C_HID_READ_PENDING, &ihid->flags); } if (wait) @@ -261,9 +259,6 @@ static int __i2c_hid_command(struct i2c_client *client, ret = i2c_transfer(client->adapter, msg, msg_num); - if (data_len > 0) - clear_bit(I2C_HID_READ_PENDING, &ihid->flags); - if (ret != msg_num) return ret < 0 ? ret : -EIO; @@ -534,9 +529,6 @@ static irqreturn_t i2c_hid_irq(int irq, void *dev_id) { struct i2c_hid *ihid = dev_id; - if (test_bit(I2C_HID_READ_PENDING, &ihid->flags)) - return IRQ_HANDLED; - i2c_hid_get_input(ihid); return IRQ_HANDLED; -- 2.25.1

2 1

[PATCH OLK-6.6 0/8] mm: some misc bugfix
by Kefeng Wang 25 May '24

25 May '24

Most of bugfix about large folio, one about fault around and one about vmalloc, two small code optimization. Baolin Wang (1): mm: huge_memory: add the missing folio_test_pmd_mappable() for THP split statistics Barry Song (1): mm: prohibit the last subpage from reusing the entire large folio John Hubbard (1): mm/memory.c: do_numa_page(): remove a redundant page table read Kefeng Wang (2): mm: memory: fix shift-out-of-bounds in fault_around_bytes_set Revert "mm: support multi-size THP numa balancing" Matthew Wilcox (1): mm: simplify thp_vma_allowable_order Uladzislau Rezki (Sony) (1): mm: vmalloc: bail out early in find_vmap_area() if vmap is not init Zi Yan (1): mm/huge_memory: skip invalid debugfs new_order input for folio split fs/proc/task_mmu.c | 4 +- include/linux/huge_mm.h | 29 ++++++------ mm/huge_memory.c | 20 +++++++-- mm/khugepaged.c | 16 +++---- mm/memory.c | 97 +++++++++++++++-------------------------- mm/mprotect.c | 3 +- mm/vmalloc.c | 3 ++ 7 files changed, 80 insertions(+), 92 deletions(-) -- 2.27.0

2 9

[PATCH openEuler-22.03-LTS-SP2] HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
by Yang Yingliang 25 May '24

25 May '24

From: Nam Cao <namcao(a)linutronix.de> mainline inclusion from mainline-v6.9-rc6 commit 9c0f59e47a90c54d0153f8ddc0f80d7a36207d0e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRN6 CVE: CVE-2024-35997 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The flag I2C_HID_READ_PENDING is used to serialize I2C operations. However, this is not necessary, because I2C core already has its own locking for that. More importantly, this flag can cause a lock-up: if the flag is set in i2c_hid_xfer() and an interrupt happens, the interrupt handler (i2c_hid_irq) will check this flag and return immediately without doing anything, then the interrupt handler will be invoked again in an infinite loop. Since interrupt handler is an RT task, it takes over the CPU and the flag-clearing task never gets scheduled, thus we have a lock-up. Delete this unnecessary flag. Reported-and-tested-by: Eva Kurchatova <nyandarknessgirl(a)gmail.com> Closes: https://lore.kernel.org/r/CA+eeCSPUDpUg76ZO8dszSbAGn+UHjcyv8F1J-CUPVARAzEtW… Fixes: 4a200c3b9a40 ("HID: i2c-hid: introduce HID over i2c specification implementation") Cc: <stable(a)vger.kernel.org> Signed-off-by: Nam Cao <namcao(a)linutronix.de> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Conflicts: drivers/hid/i2c-hid/i2c-hid-core.c [yyl: adjust context] Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/hid/i2c-hid/i2c-hid-core.c | 8 -------- 1 file changed, 8 deletions(-) diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c index 14811d42a5a9..4f8e8f392dab 100644 --- a/drivers/hid/i2c-hid/i2c-hid-core.c +++ b/drivers/hid/i2c-hid/i2c-hid-core.c @@ -56,7 +56,6 @@ /* flags */ #define I2C_HID_STARTED 0 #define I2C_HID_RESET_PENDING 1 -#define I2C_HID_READ_PENDING 2 #define I2C_HID_PWR_ON 0x00 #define I2C_HID_PWR_SLEEP 0x01 @@ -256,7 +255,6 @@ static int __i2c_hid_command(struct i2c_client *client, msg[1].len = data_len; msg[1].buf = buf_recv; msg_num = 2; - set_bit(I2C_HID_READ_PENDING, &ihid->flags); } if (wait) @@ -264,9 +262,6 @@ static int __i2c_hid_command(struct i2c_client *client, ret = i2c_transfer(client->adapter, msg, msg_num); - if (data_len > 0) - clear_bit(I2C_HID_READ_PENDING, &ihid->flags); - if (ret != msg_num) return ret < 0 ? ret : -EIO; @@ -538,9 +533,6 @@ static irqreturn_t i2c_hid_irq(int irq, void *dev_id) { struct i2c_hid *ihid = dev_id; - if (test_bit(I2C_HID_READ_PENDING, &ihid->flags)) - return IRQ_HANDLED; - i2c_hid_get_input(ihid); return IRQ_HANDLED; -- 2.25.1

2 1