July 2024 - Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] kdb: Fix buffer overflow during tab-complete
by Tengda Wu 08 Jul '24

08 Jul '24

From: Daniel Thompson <daniel.thompson(a)linaro.org> stable inclusion from stable-v5.10.219 commit cfdc2fa4db57503bc6d3817240547c8ddc55fa96 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAB05N CVE: CVE-2024-39480 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e9730744bf3af04cda23799029342aa3cddbc454 upstream. Currently, when the user attempts symbol completion with the Tab key, kdb will use strncpy() to insert the completed symbol into the command buffer. Unfortunately it passes the size of the source buffer rather than the destination to strncpy() with predictably horrible results. Most obviously if the command buffer is already full but cp, the cursor position, is in the middle of the buffer, then we will write past the end of the supplied buffer. Fix this by replacing the dubious strncpy() calls with memmove()/memcpy() calls plus explicit boundary checks to make sure we have enough space before we start moving characters around. Reported-by: Justin Stitt <justinstitt(a)google.com> Closes: https://lore.kernel.org/all/CAFhGd8qESuuifuHsNjFPR-Va3P80bxrw+LqvC8deA8GziU… Cc: stable(a)vger.kernel.org Reviewed-by: Douglas Anderson <dianders(a)chromium.org> Reviewed-by: Justin Stitt <justinstitt(a)google.com> Tested-by: Justin Stitt <justinstitt(a)google.com> Link: https://lore.kernel.org/r/20240424-kgdb_read_refactor-v3-1-f236dbe9828d@lin… Signed-off-by: Daniel Thompson <daniel.thompson(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Fixes: 5d5314d6795f3c1c0f415348ff8c51f7de042b77 ("kdb: core for kgdb back end (1 of 2)") Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/debug/kdb/kdb_io.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/kernel/debug/kdb/kdb_io.c b/kernel/debug/kdb/kdb_io.c index 6735ac36b718..dcc7e13e98b3 100644 --- a/kernel/debug/kdb/kdb_io.c +++ b/kernel/debug/kdb/kdb_io.c @@ -354,14 +354,19 @@ static char *kdb_read(char *buffer, size_t bufsize) kdb_printf(kdb_prompt_str); kdb_printf("%s", buffer); } else if (tab != 2 && count > 0) { - len_tmp = strlen(p_tmp); - strncpy(p_tmp+len_tmp, cp, lastchar-cp+1); - len_tmp = strlen(p_tmp); - strncpy(cp, p_tmp+len, len_tmp-len + 1); - len = len_tmp - len; - kdb_printf("%s", cp); - cp += len; - lastchar += len; + /* How many new characters do we want from tmpbuffer? */ + len_tmp = strlen(p_tmp) - len; + if (lastchar + len_tmp >= bufend) + len_tmp = bufend - lastchar; + + if (len_tmp) { + /* + 1 ensures the '\0' is memmove'd */ + memmove(cp+len_tmp, cp, (lastchar-cp) + 1); + memcpy(cp, p_tmp+len, len_tmp); + kdb_printf("%s", cp); + cp += len_tmp; + lastchar += len_tmp; + } } kdb_nextline = 1; /* reset output line number */ break; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] kdb: Fix buffer overflow during tab-complete
by Tengda Wu 08 Jul '24

08 Jul '24

From: Daniel Thompson <daniel.thompson(a)linaro.org> stable inclusion from stable-v4.19.316 commit fb824a99e148ff272a53d71d84122728b5f00992 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAB05N CVE: CVE-2024-39480 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e9730744bf3af04cda23799029342aa3cddbc454 upstream. Currently, when the user attempts symbol completion with the Tab key, kdb will use strncpy() to insert the completed symbol into the command buffer. Unfortunately it passes the size of the source buffer rather than the destination to strncpy() with predictably horrible results. Most obviously if the command buffer is already full but cp, the cursor position, is in the middle of the buffer, then we will write past the end of the supplied buffer. Fix this by replacing the dubious strncpy() calls with memmove()/memcpy() calls plus explicit boundary checks to make sure we have enough space before we start moving characters around. Reported-by: Justin Stitt <justinstitt(a)google.com> Closes: https://lore.kernel.org/all/CAFhGd8qESuuifuHsNjFPR-Va3P80bxrw+LqvC8deA8GziU… Cc: stable(a)vger.kernel.org Reviewed-by: Douglas Anderson <dianders(a)chromium.org> Reviewed-by: Justin Stitt <justinstitt(a)google.com> Tested-by: Justin Stitt <justinstitt(a)google.com> Link: https://lore.kernel.org/r/20240424-kgdb_read_refactor-v3-1-f236dbe9828d@lin… Signed-off-by: Daniel Thompson <daniel.thompson(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Fixes: 5d5314d6795f3c1c0f415348ff8c51f7de042b77 ("kdb: core for kgdb back end (1 of 2)") Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/debug/kdb/kdb_io.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/kernel/debug/kdb/kdb_io.c b/kernel/debug/kdb/kdb_io.c index 6a4b41484afe..2ce307c86977 100644 --- a/kernel/debug/kdb/kdb_io.c +++ b/kernel/debug/kdb/kdb_io.c @@ -364,14 +364,19 @@ static char *kdb_read(char *buffer, size_t bufsize) kdb_printf(kdb_prompt_str); kdb_printf("%s", buffer); } else if (tab != 2 && count > 0) { - len_tmp = strlen(p_tmp); - strncpy(p_tmp+len_tmp, cp, lastchar-cp+1); - len_tmp = strlen(p_tmp); - strncpy(cp, p_tmp+len, len_tmp-len + 1); - len = len_tmp - len; - kdb_printf("%s", cp); - cp += len; - lastchar += len; + /* How many new characters do we want from tmpbuffer? */ + len_tmp = strlen(p_tmp) - len; + if (lastchar + len_tmp >= bufend) + len_tmp = bufend - lastchar; + + if (len_tmp) { + /* + 1 ensures the '\0' is memmove'd */ + memmove(cp+len_tmp, cp, (lastchar-cp) + 1); + memcpy(cp, p_tmp+len, len_tmp); + kdb_printf("%s", cp); + cp += len_tmp; + lastchar += len_tmp; + } } kdb_nextline = 1; /* reset output line number */ break; -- 2.34.1

2 1

[PATCH OLK-6.6 0/1] fix CVE-2024-39481
by Hongbo Li 08 Jul '24

08 Jul '24

Fix CVE-2024-39481. Tomi Valkeinen (1): media: mc: Fix graph walk in media_pipeline_start drivers/media/mc/mc-entity.c | 6 ++++++ 1 file changed, 6 insertions(+) -- 2.34.1

2 2

[PATCH OLK-6.6] KVM: SVM: WARN on vNMI + NMI window iff NMIs are outright masked
by Zizhi Wo 08 Jul '24

08 Jul '24

From: Sean Christopherson <seanjc(a)google.com> stable inclusion from stable-v6.6.34 commit f79edaf7370986d73d204b36c50cc563a4c0f356 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAB16D CVE: CVE-2024-39483 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit b4bd556467477420ee3a91fbcba73c579669edc6 upstream. When requesting an NMI window, WARN on vNMI support being enabled if and only if NMIs are actually masked, i.e. if the vCPU is already handling an NMI. KVM's ABI for NMIs that arrive simultanesouly (from KVM's point of view) is to inject one NMI and pend the other. When using vNMI, KVM pends the second NMI simply by setting V_NMI_PENDING, and lets the CPU do the rest (hardware automatically sets V_NMI_BLOCKING when an NMI is injected). However, if KVM can't immediately inject an NMI, e.g. because the vCPU is in an STI shadow or is running with GIF=0, then KVM will request an NMI window and trigger the WARN (but still function correctly). Whether or not the GIF=0 case makes sense is debatable, as the intent of KVM's behavior is to provide functionality that is as close to real hardware as possible. E.g. if two NMIs are sent in quick succession, the probability of both NMIs arriving in an STI shadow is infinitesimally low on real hardware, but significantly larger in a virtual environment, e.g. if the vCPU is preempted in the STI shadow. For GIF=0, the argument isn't as clear cut, because the window where two NMIs can collide is much larger in bare metal (though still small). That said, KVM should not have divergent behavior for the GIF=0 case based on whether or not vNMI support is enabled. And KVM has allowed simultaneous NMIs with GIF=0 for over a decade, since commit 7460fb4a3400 ("KVM: Fix simultaneous NMIs"). I.e. KVM's GIF=0 handling shouldn't be modified without a *really* good reason to do so, and if KVM's behavior were to be modified, it should be done irrespective of vNMI support. Fixes: fa4c027a7956 ("KVM: x86: Add support for SVM's Virtual NMI") Cc: stable(a)vger.kernel.org Cc: Santosh Shukla <Santosh.Shukla(a)amd.com> Cc: Maxim Levitsky <mlevitsk(a)redhat.com> Signed-off-by: Sean Christopherson <seanjc(a)google.com> Message-ID: <20240522021435.1684366-1-seanjc(a)google.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- arch/x86/kvm/svm/svm.c | 27 +++++++++++++++++++-------- 1 file changed, 19 insertions(+), 8 deletions(-) diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index 8adb6e31c113..1424eb898028 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -3860,16 +3860,27 @@ static void svm_enable_nmi_window(struct kvm_vcpu *vcpu) struct vcpu_svm *svm = to_svm(vcpu); /* - * KVM should never request an NMI window when vNMI is enabled, as KVM - * allows at most one to-be-injected NMI and one pending NMI, i.e. if - * two NMIs arrive simultaneously, KVM will inject one and set - * V_NMI_PENDING for the other. WARN, but continue with the standard - * single-step approach to try and salvage the pending NMI. + * If NMIs are outright masked, i.e. the vCPU is already handling an + * NMI, and KVM has not yet intercepted an IRET, then there is nothing + * more to do at this time as KVM has already enabled IRET intercepts. + * If KVM has already intercepted IRET, then single-step over the IRET, + * as NMIs aren't architecturally unmasked until the IRET completes. + * + * If vNMI is enabled, KVM should never request an NMI window if NMIs + * are masked, as KVM allows at most one to-be-injected NMI and one + * pending NMI. If two NMIs arrive simultaneously, KVM will inject one + * NMI and set V_NMI_PENDING for the other, but if and only if NMIs are + * unmasked. KVM _will_ request an NMI window in some situations, e.g. + * if the vCPU is in an STI shadow or if GIF=0, KVM can't immediately + * inject the NMI. In those situations, KVM needs to single-step over + * the STI shadow or intercept STGI. */ - WARN_ON_ONCE(is_vnmi_enabled(svm)); + if (svm_get_nmi_mask(vcpu)) { + WARN_ON_ONCE(is_vnmi_enabled(svm)); - if (svm_get_nmi_mask(vcpu) && !svm->awaiting_iret_completion) - return; /* IRET will cause a vm exit */ + if (!svm->awaiting_iret_completion) + return; /* IRET will cause a vm exit */ + } /* * SEV-ES guests are responsible for signaling when a vCPU is ready to -- 2.39.2

2 1

[openeuler:OLK-6.6 3342/10598] include/linux/pgplib.h:36:23: error: field has incomplete type 'enum pgp_key_version'
by kernel test robot 08 Jul '24

08 Jul '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 01c2a11a75f4f8b273ef3e34cca3974b10314a3a commit: 43d4042e06d2bf96adf67d25e8d91653507a4cf9 [3342/10598] KEYS: Provide a function to load keys from a PGP keyring blob config: arm64-randconfig-r131-20240707 (https://download.01.org/0day-ci/archive/20240708/202407081638.r5xQjyqM-lkp@…) compiler: clang version 19.0.0git (https://github.com/llvm/llvm-project a0c6b8aef853eedaa0980f07c0a502a5a8a9740e) reproduce: (https://download.01.org/0day-ci/archive/20240708/202407081638.r5xQjyqM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202407081638.r5xQjyqM-lkp@intel.com/ Note: the openeuler/OLK-6.6 HEAD 01c2a11a75f4f8b273ef3e34cca3974b10314a3a builds fine. It only hurts bisectability. All errors (new ones prefixed by >>): In file included from crypto/asymmetric_keys/pgp_preload.c:19: include/linux/pgplib.h:26:15: warning: declaration of 'enum pgp_packet_tag' will not be visible outside of this function [-Wvisibility] 26 | enum pgp_packet_tag type, | ^ >> include/linux/pgplib.h:36:23: error: field has incomplete type 'enum pgp_key_version' 36 | enum pgp_key_version version : 8; | ^ include/linux/pgplib.h:36:7: note: forward declaration of 'enum pgp_key_version' 36 | enum pgp_key_version version : 8; | ^ >> include/linux/pgplib.h:37:23: error: field has incomplete type 'enum pgp_pubkey_algo' 37 | enum pgp_pubkey_algo pubkey_algo : 8; | ^ include/linux/pgplib.h:37:7: note: forward declaration of 'enum pgp_pubkey_algo' 37 | enum pgp_pubkey_algo pubkey_algo : 8; | ^ crypto/asymmetric_keys/pgp_preload.c:63:10: warning: declaration of 'enum pgp_packet_tag' will not be visible outside of this function [-Wvisibility] 63 | enum pgp_packet_tag type, u8 headerlen, | ^ crypto/asymmetric_keys/pgp_preload.c:63:25: error: variable has incomplete type 'enum pgp_packet_tag' 63 | enum pgp_packet_tag type, u8 headerlen, | ^ crypto/asymmetric_keys/pgp_preload.c:63:10: note: forward declaration of 'enum pgp_packet_tag' 63 | enum pgp_packet_tag type, u8 headerlen, | ^ crypto/asymmetric_keys/pgp_preload.c:107:36: error: use of undeclared identifier 'PGP_PKT_PUBLIC_KEY' 107 | ctx.pgp.types_of_interest = (1 << PGP_PKT_PUBLIC_KEY); | ^ >> crypto/asymmetric_keys/pgp_preload.c:108:25: error: incompatible function pointer types assigning to 'int (*)(struct pgp_parse_context *, enum pgp_packet_tag, u8, const u8 *, size_t)' (aka 'int (*)(struct pgp_parse_context *, enum pgp_packet_tag, unsigned char, const unsigned char *, unsigned long)') from 'int (struct pgp_parse_context *, enum pgp_packet_tag, u8, const u8 *, size_t)' (aka 'int (struct pgp_parse_context *, enum pgp_packet_tag, unsigned char, const unsigned char *, unsigned long)') [-Wincompatible-function-pointer-types] 108 | ctx.pgp.process_packet = found_pgp_key; | ^ ~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_preload.c:101:12: warning: no previous prototype for function 'preload_pgp_keys' [-Wmissing-prototypes] 101 | int __init preload_pgp_keys(const u8 *pgpdata, size_t pgpdatalen, | ^ crypto/asymmetric_keys/pgp_preload.c:101:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 101 | int __init preload_pgp_keys(const u8 *pgpdata, size_t pgpdatalen, | ^ | static 3 warnings and 5 errors generated. -- In file included from crypto/asymmetric_keys/pgp_public_key.c:19: In file included from include/linux/mpi.h:21: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2193: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from crypto/asymmetric_keys/pgp_public_key.c:20: include/linux/pgplib.h:26:15: warning: declaration of 'enum pgp_packet_tag' will not be visible outside of this function [-Wvisibility] 26 | enum pgp_packet_tag type, | ^ >> include/linux/pgplib.h:36:23: error: field has incomplete type 'enum pgp_key_version' 36 | enum pgp_key_version version : 8; | ^ include/linux/pgplib.h:36:7: note: forward declaration of 'enum pgp_key_version' 36 | enum pgp_key_version version : 8; | ^ >> include/linux/pgplib.h:37:23: error: field has incomplete type 'enum pgp_pubkey_algo' 37 | enum pgp_pubkey_algo pubkey_algo : 8; | ^ include/linux/pgplib.h:37:7: note: forward declaration of 'enum pgp_pubkey_algo' 37 | enum pgp_pubkey_algo pubkey_algo : 8; | ^ crypto/asymmetric_keys/pgp_public_key.c:63:2: error: call to undeclared function 'kenter'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 63 | kenter(""); | ^ crypto/asymmetric_keys/pgp_public_key.c:65:22: error: use of undeclared identifier 'PGP_KEY_VERSION_4' 65 | n = (pgp->version < PGP_KEY_VERSION_4) ? 8 : 6; | ^ crypto/asymmetric_keys/pgp_public_key.c:67:9: error: call to undeclared function 'mpi_key_length'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 67 | ret = mpi_key_length(key_ptr, keylen, nb + i, nn + i); | ^ crypto/asymmetric_keys/pgp_public_key.c:95:21: error: use of undeclared identifier 'PGP_KEY_VERSION_4' 95 | if (pgp->version < PGP_KEY_VERSION_4) { | ^ crypto/asymmetric_keys/pgp_public_key.c:115:2: error: call to undeclared function 'kleave'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 115 | kleave(" = %d", ret); | ^ crypto/asymmetric_keys/pgp_public_key.c:134:42: error: use of undeclared identifier 'PGP_KEY_VERSION_4' 134 | tfm = crypto_alloc_shash(pgp->version < PGP_KEY_VERSION_4 ? | ^ crypto/asymmetric_keys/pgp_public_key.c:191:2: error: call to undeclared function 'kleave'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 191 | kleave(" = %d", ret); | ^ crypto/asymmetric_keys/pgp_public_key.c:199:12: warning: declaration of 'enum pgp_packet_tag' will not be visible outside of this function [-Wvisibility] 199 | enum pgp_packet_tag type, | ^ crypto/asymmetric_keys/pgp_public_key.c:199:27: error: variable has incomplete type 'enum pgp_packet_tag' 199 | enum pgp_packet_tag type, | ^ crypto/asymmetric_keys/pgp_public_key.c:199:12: note: forward declaration of 'enum pgp_packet_tag' 199 | enum pgp_packet_tag type, | ^ crypto/asymmetric_keys/pgp_public_key.c:211:2: error: call to undeclared function 'kenter'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 211 | kenter(",%u,%u,,%zu", type, headerlen, datalen); | ^ >> crypto/asymmetric_keys/pgp_public_key.c:213:14: error: use of undeclared identifier 'PGP_PKT_USER_ID' 213 | if (type == PGP_PKT_USER_ID) { | ^ crypto/asymmetric_keys/pgp_public_key.c:216:3: error: call to undeclared function 'kleave'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 216 | kleave(" = 0 [user ID]"); | ^ crypto/asymmetric_keys/pgp_public_key.c:221:3: error: call to undeclared function 'kleave'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 221 | kleave(" = -ENOKEY [already]"); | ^ >> crypto/asymmetric_keys/pgp_public_key.c:234:25: error: use of undeclared identifier 'PGP_PUBKEY__LAST' 234 | if (pgp.pubkey_algo >= PGP_PUBKEY__LAST) | ^ >> crypto/asymmetric_keys/pgp_public_key.c:236:9: error: use of undeclared identifier 'pgp_to_public_key_algo' 236 | algo = pgp_to_public_key_algo[pgp.pubkey_algo]; | ^ crypto/asymmetric_keys/pgp_public_key.c:252:2: error: call to undeclared function 'kleave'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 252 | kleave(" = 0 [use]"); | ^ crypto/asymmetric_keys/pgp_public_key.c:310:2: error: call to undeclared function 'kenter'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 310 | kenter(""); | ^ >> crypto/asymmetric_keys/pgp_public_key.c:313:36: error: use of undeclared identifier 'PGP_PKT_PUBLIC_KEY' 313 | ctx.pgp.types_of_interest = (1 << PGP_PKT_PUBLIC_KEY) | | ^ fatal error: too many errors emitted, stopping now [-ferror-limit=] 3 warnings and 20 errors generated. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] vim +36 include/linux/pgplib.h b78af6579e15dc David Howells 2023-09-12 31 b78af6579e15dc David Howells 2023-09-12 32 extern int pgp_parse_packets(const u8 *data, size_t datalen, b78af6579e15dc David Howells 2023-09-12 33 struct pgp_parse_context *ctx); b78af6579e15dc David Howells 2023-09-12 34 b78af6579e15dc David Howells 2023-09-12 35 struct pgp_parse_pubkey { b78af6579e15dc David Howells 2023-09-12 @36 enum pgp_key_version version : 8; b78af6579e15dc David Howells 2023-09-12 @37 enum pgp_pubkey_algo pubkey_algo : 8; b78af6579e15dc David Howells 2023-09-12 38 __kernel_old_time_t creation_time; b78af6579e15dc David Howells 2023-09-12 39 __kernel_old_time_t expires_at; b78af6579e15dc David Howells 2023-09-12 40 }; b78af6579e15dc David Howells 2023-09-12 41 :::::: The code at line 36 was first introduced by commit :::::: b78af6579e15dcdff86504da90af77f3e890270e PGPLIB: Basic packet parser :::::: TO: David Howells <dhowells(a)redhat.com> :::::: CC: zgzxx <zhangguangzhi3(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] drm: zynqmp_dpsub: Always register bridge
by Zhang Changzhong 08 Jul '24

08 Jul '24

From: Sean Anderson <sean.anderson(a)linux.dev> stable inclusion from stable-v6.6.33 commit 6ead3eccf67bc8318b1ce95ed879b2cc05b4fce9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA7YJM CVE: CVE-2024-38664 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit be3f3042391d061cfca2bd22630e0d101acea5fc ] We must always register the DRM bridge, since zynqmp_dp_hpd_work_func calls drm_bridge_hpd_notify, which in turn expects hpd_mutex to be initialized. We do this before zynqmp_dpsub_drm_init since that calls drm_bridge_attach. This fixes the following lockdep warning: [ 19.217084] ------------[ cut here ]------------ [ 19.227530] DEBUG_LOCKS_WARN_ON(lock->magic != lock) [ 19.227768] WARNING: CPU: 0 PID: 140 at kernel/locking/mutex.c:582 __mutex_lock+0x4bc/0x550 [ 19.241696] Modules linked in: [ 19.244937] CPU: 0 PID: 140 Comm: kworker/0:4 Not tainted 6.6.20+ #96 [ 19.252046] Hardware name: xlnx,zynqmp (DT) [ 19.256421] Workqueue: events zynqmp_dp_hpd_work_func [ 19.261795] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 19.269104] pc : __mutex_lock+0x4bc/0x550 [ 19.273364] lr : __mutex_lock+0x4bc/0x550 [ 19.277592] sp : ffffffc085c5bbe0 [ 19.281066] x29: ffffffc085c5bbe0 x28: 0000000000000000 x27: ffffff88009417f8 [ 19.288624] x26: ffffff8800941788 x25: ffffff8800020008 x24: ffffffc082aa3000 [ 19.296227] x23: ffffffc080d90e3c x22: 0000000000000002 x21: 0000000000000000 [ 19.303744] x20: 0000000000000000 x19: ffffff88002f5210 x18: 0000000000000000 [ 19.311295] x17: 6c707369642e3030 x16: 3030613464662072 x15: 0720072007200720 [ 19.318922] x14: 0000000000000000 x13: 284e4f5f4e524157 x12: 0000000000000001 [ 19.326442] x11: 0001ffc085c5b940 x10: 0001ff88003f388b x9 : 0001ff88003f3888 [ 19.334003] x8 : 0001ff88003f3888 x7 : 0000000000000000 x6 : 0000000000000000 [ 19.341537] x5 : 0000000000000000 x4 : 0000000000001668 x3 : 0000000000000000 [ 19.349054] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffff88003f3880 [ 19.356581] Call trace: [ 19.359160] __mutex_lock+0x4bc/0x550 [ 19.363032] mutex_lock_nested+0x24/0x30 [ 19.367187] drm_bridge_hpd_notify+0x2c/0x6c [ 19.371698] zynqmp_dp_hpd_work_func+0x44/0x54 [ 19.376364] process_one_work+0x3ac/0x988 [ 19.380660] worker_thread+0x398/0x694 [ 19.384736] kthread+0x1bc/0x1c0 [ 19.388241] ret_from_fork+0x10/0x20 [ 19.392031] irq event stamp: 183 [ 19.395450] hardirqs last enabled at (183): [<ffffffc0800b9278>] finish_task_switch.isra.0+0xa8/0x2d4 [ 19.405140] hardirqs last disabled at (182): [<ffffffc081ad3754>] __schedule+0x714/0xd04 [ 19.413612] softirqs last enabled at (114): [<ffffffc080133de8>] srcu_invoke_callbacks+0x158/0x23c [ 19.423128] softirqs last disabled at (110): [<ffffffc080133de8>] srcu_invoke_callbacks+0x158/0x23c [ 19.432614] ---[ end trace 0000000000000000 ]--- Fixes: eb2d64bfcc17 ("drm: xlnx: zynqmp_dpsub: Report HPD through the bridge") Signed-off-by: Sean Anderson <sean.anderson(a)linux.dev> Reviewed-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Reviewed-by: Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240308204741.3631919-1-sean… Signed-off-by: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/gpu/drm/xlnx/zynqmp_dpsub.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/xlnx/zynqmp_dpsub.c b/drivers/gpu/drm/xlnx/zynqmp_dpsub.c index 88eb33acd..face8d6 100644 --- a/drivers/gpu/drm/xlnx/zynqmp_dpsub.c +++ b/drivers/gpu/drm/xlnx/zynqmp_dpsub.c @@ -256,12 +256,12 @@ static int zynqmp_dpsub_probe(struct platform_device *pdev) if (ret) goto err_dp; + drm_bridge_add(dpsub->bridge); + if (dpsub->dma_enabled) { ret = zynqmp_dpsub_drm_init(dpsub); if (ret) goto err_disp; - } else { - drm_bridge_add(dpsub->bridge); } dev_info(&pdev->dev, "ZynqMP DisplayPort Subsystem driver probed"); @@ -288,9 +288,8 @@ static void zynqmp_dpsub_remove(struct platform_device *pdev) if (dpsub->drm) zynqmp_dpsub_drm_cleanup(dpsub); - else - drm_bridge_remove(dpsub->bridge); + drm_bridge_remove(dpsub->bridge); zynqmp_disp_remove(dpsub); zynqmp_dp_remove(dpsub); -- 2.9.5

2 1

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2024-36478
by Li Nan 08 Jul '24

08 Jul '24

Damien Le Moal (1): null_blk: Move driver into its own directory Yu Kuai (1): null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues' drivers/block/{ => null_blk}/null_blk.h | 0 .../{null_blk_trace.h => null_blk/trace.h} | 2 +- .../{null_blk_main.c => null_blk/main.c} | 43 +++++++++++-------- .../{null_blk_trace.c => null_blk/trace.c} | 2 +- .../{null_blk_zoned.c => null_blk/zoned.c} | 2 +- drivers/block/Kconfig | 8 +--- drivers/block/Makefile | 7 +-- drivers/block/null_blk/Kconfig | 12 ++++++ drivers/block/null_blk/Makefile | 11 +++++ 9 files changed, 54 insertions(+), 33 deletions(-) rename drivers/block/{ => null_blk}/null_blk.h (100%) rename drivers/block/{null_blk_trace.h => null_blk/trace.h} (97%) rename drivers/block/{null_blk_main.c => null_blk/main.c} (99%) rename drivers/block/{null_blk_trace.c => null_blk/trace.c} (93%) rename drivers/block/{null_blk_zoned.c => null_blk/zoned.c} (99%) create mode 100644 drivers/block/null_blk/Kconfig create mode 100644 drivers/block/null_blk/Makefile -- 2.39.2

2 3

[openeuler:OLK-6.6 3348/10598] security/integrity/ima/ima_digest_list.c:164:37: sparse: sparse: cast to restricted __le16
by kernel test robot 08 Jul '24

08 Jul '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 01c2a11a75f4f8b273ef3e34cca3974b10314a3a commit: 5fbe16a682d5af0c2f7145096851e31e3c921d64 [3348/10598] ima: Execute parser to upload digest lists not recognizable by the kernel config: arm64-randconfig-r131-20240707 (https://download.01.org/0day-ci/archive/20240708/202407081457.7NZpgJgk-lkp@…) compiler: clang version 19.0.0git (https://github.com/llvm/llvm-project a0c6b8aef853eedaa0980f07c0a502a5a8a9740e) reproduce: (https://download.01.org/0day-ci/archive/20240708/202407081457.7NZpgJgk-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202407081457.7NZpgJgk-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> security/integrity/ima/ima_digest_list.c:164:37: sparse: sparse: cast to restricted __le16 security/integrity/ima/ima_digest_list.c:165:42: sparse: sparse: cast to restricted __le16 security/integrity/ima/ima_digest_list.c:166:37: sparse: sparse: cast to restricted __le16 >> security/integrity/ima/ima_digest_list.c:167:38: sparse: sparse: cast to restricted __le32 security/integrity/ima/ima_digest_list.c:168:40: sparse: sparse: cast to restricted __le32 >> security/integrity/ima/ima_digest_list.c:416:20: sparse: sparse: symbol 'parser_task' was not declared. Should it be static? vim +164 security/integrity/ima/ima_digest_list.c b3fef06570ef2b Roberto Sassu 2023-09-12 138 b3fef06570ef2b Roberto Sassu 2023-09-12 139 int ima_parse_compact_list(loff_t size, void *buf, int op) b3fef06570ef2b Roberto Sassu 2023-09-12 140 { b3fef06570ef2b Roberto Sassu 2023-09-12 141 u8 *digest; b3fef06570ef2b Roberto Sassu 2023-09-12 142 void *bufp = buf, *bufendp = buf + size; b3fef06570ef2b Roberto Sassu 2023-09-12 143 struct compact_list_hdr *hdr; b3fef06570ef2b Roberto Sassu 2023-09-12 144 size_t digest_len; b3fef06570ef2b Roberto Sassu 2023-09-12 145 int ret = 0, i; b3fef06570ef2b Roberto Sassu 2023-09-12 146 80701e75d21f48 Roberto Sassu 2023-09-12 147 if (!(ima_digest_list_actions & ima_policy_flag)) 80701e75d21f48 Roberto Sassu 2023-09-12 148 return -EACCES; 80701e75d21f48 Roberto Sassu 2023-09-12 149 b3fef06570ef2b Roberto Sassu 2023-09-12 150 while (bufp < bufendp) { b3fef06570ef2b Roberto Sassu 2023-09-12 151 if (bufp + sizeof(*hdr) > bufendp) { b3fef06570ef2b Roberto Sassu 2023-09-12 152 pr_err("compact list, invalid data\n"); b3fef06570ef2b Roberto Sassu 2023-09-12 153 return -EINVAL; b3fef06570ef2b Roberto Sassu 2023-09-12 154 } b3fef06570ef2b Roberto Sassu 2023-09-12 155 b3fef06570ef2b Roberto Sassu 2023-09-12 156 hdr = bufp; b3fef06570ef2b Roberto Sassu 2023-09-12 157 b3fef06570ef2b Roberto Sassu 2023-09-12 158 if (hdr->version != 1) { b3fef06570ef2b Roberto Sassu 2023-09-12 159 pr_err("compact list, unsupported version\n"); b3fef06570ef2b Roberto Sassu 2023-09-12 160 return -EINVAL; b3fef06570ef2b Roberto Sassu 2023-09-12 161 } b3fef06570ef2b Roberto Sassu 2023-09-12 162 b3fef06570ef2b Roberto Sassu 2023-09-12 163 if (ima_canonical_fmt) { b3fef06570ef2b Roberto Sassu 2023-09-12 @164 hdr->type = le16_to_cpu(hdr->type); b3fef06570ef2b Roberto Sassu 2023-09-12 165 hdr->modifiers = le16_to_cpu(hdr->modifiers); b3fef06570ef2b Roberto Sassu 2023-09-12 166 hdr->algo = le16_to_cpu(hdr->algo); b3fef06570ef2b Roberto Sassu 2023-09-12 @167 hdr->count = le32_to_cpu(hdr->count); b3fef06570ef2b Roberto Sassu 2023-09-12 168 hdr->datalen = le32_to_cpu(hdr->datalen); b3fef06570ef2b Roberto Sassu 2023-09-12 169 } b3fef06570ef2b Roberto Sassu 2023-09-12 170 b3fef06570ef2b Roberto Sassu 2023-09-12 171 if (hdr->algo >= HASH_ALGO__LAST) b3fef06570ef2b Roberto Sassu 2023-09-12 172 return -EINVAL; b3fef06570ef2b Roberto Sassu 2023-09-12 173 b3fef06570ef2b Roberto Sassu 2023-09-12 174 digest_len = hash_digest_size[hdr->algo]; b3fef06570ef2b Roberto Sassu 2023-09-12 175 b3fef06570ef2b Roberto Sassu 2023-09-12 176 if (hdr->type >= COMPACT__LAST) { b3fef06570ef2b Roberto Sassu 2023-09-12 177 pr_err("compact list, invalid type %d\n", hdr->type); b3fef06570ef2b Roberto Sassu 2023-09-12 178 return -EINVAL; b3fef06570ef2b Roberto Sassu 2023-09-12 179 } b3fef06570ef2b Roberto Sassu 2023-09-12 180 b3fef06570ef2b Roberto Sassu 2023-09-12 181 bufp += sizeof(*hdr); b3fef06570ef2b Roberto Sassu 2023-09-12 182 b3fef06570ef2b Roberto Sassu 2023-09-12 183 for (i = 0; i < hdr->count; i++) { b3fef06570ef2b Roberto Sassu 2023-09-12 184 if (bufp + digest_len > bufendp) { b3fef06570ef2b Roberto Sassu 2023-09-12 185 pr_err("compact list, invalid data\n"); b3fef06570ef2b Roberto Sassu 2023-09-12 186 return -EINVAL; b3fef06570ef2b Roberto Sassu 2023-09-12 187 } b3fef06570ef2b Roberto Sassu 2023-09-12 188 b3fef06570ef2b Roberto Sassu 2023-09-12 189 digest = bufp; b3fef06570ef2b Roberto Sassu 2023-09-12 190 bufp += digest_len; b3fef06570ef2b Roberto Sassu 2023-09-12 191 b3fef06570ef2b Roberto Sassu 2023-09-12 192 if (op == DIGEST_LIST_OP_ADD) b3fef06570ef2b Roberto Sassu 2023-09-12 193 ret = ima_add_digest_data_entry(digest, b3fef06570ef2b Roberto Sassu 2023-09-12 194 hdr->algo, hdr->type, hdr->modifiers); b3fef06570ef2b Roberto Sassu 2023-09-12 195 else if (op == DIGEST_LIST_OP_DEL) b3fef06570ef2b Roberto Sassu 2023-09-12 196 ima_del_digest_data_entry(digest, hdr->algo, b3fef06570ef2b Roberto Sassu 2023-09-12 197 hdr->type); b3fef06570ef2b Roberto Sassu 2023-09-12 198 if (ret < 0 && ret != -EEXIST) b3fef06570ef2b Roberto Sassu 2023-09-12 199 return ret; b3fef06570ef2b Roberto Sassu 2023-09-12 200 } b3fef06570ef2b Roberto Sassu 2023-09-12 201 b3fef06570ef2b Roberto Sassu 2023-09-12 202 if (i != hdr->count || b3fef06570ef2b Roberto Sassu 2023-09-12 203 bufp != (void *)hdr + sizeof(*hdr) + hdr->datalen) { b3fef06570ef2b Roberto Sassu 2023-09-12 204 pr_err("compact list, invalid data\n"); b3fef06570ef2b Roberto Sassu 2023-09-12 205 return -EINVAL; b3fef06570ef2b Roberto Sassu 2023-09-12 206 } b3fef06570ef2b Roberto Sassu 2023-09-12 207 } b3fef06570ef2b Roberto Sassu 2023-09-12 208 b3fef06570ef2b Roberto Sassu 2023-09-12 209 return bufp - buf; b3fef06570ef2b Roberto Sassu 2023-09-12 210 } 80701e75d21f48 Roberto Sassu 2023-09-12 211 :::::: The code at line 164 was first introduced by commit :::::: b3fef06570ef2b61dd7181e5c1d128bfcbf6b2ef ima: Add parser of compact digest list :::::: TO: Roberto Sassu <roberto.sassu(a)huawei.com> :::::: CC: zgzxx <zhangguangzhi3(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 7037/10596] drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1374:9: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 08 Jul '24

08 Jul '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 3b421b6002e287e38790cbdad4a3e08baf7e1bc4 commit: f0db1bf5852542c46c16d0b305193069e265f769 [7037/10596] Huawei BMA: Adding Huawei BMA driver: host_edma_drv config: loongarch-randconfig-r132-20240707 (https://download.01.org/0day-ci/archive/20240708/202407081155.6fc6bMvH-lkp@…) compiler: loongarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240708/202407081155.6fc6bMvH-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202407081155.6fc6bMvH-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:108:16: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:110:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:131:35: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:136:28: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:147:16: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:254:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:413:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:581:6: sparse: sparse: symbol 'host_dma_transfer_without_list' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:629:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:608:6: sparse: sparse: symbol 'host_dma_transfer_withlist' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:653:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:668:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:708:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:716:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:748:25: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:754:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:759:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:765:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:777:27: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:791:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:810:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:852:35: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:859:49: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:869:49: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:876:33: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:960:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:966:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:996:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1046:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1050:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1061:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1087:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1102:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1126:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1138:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1160:25: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1162:44: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1165:22: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1166:33: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got unsigned char * @@ drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1166:33: sparse: expected void const volatile [noderef] __iomem *addr drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1166:33: sparse: got unsigned char * drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1167:22: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1167:22: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got unsigned char * @@ drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1167:22: sparse: expected void const volatile [noderef] __iomem *addr drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1167:22: sparse: got unsigned char * drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1169:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1175:28: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1175:28: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1175:28: sparse: expected void volatile [noderef] __iomem *addr drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1175:28: sparse: got void * drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1181:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1186:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1196:33: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1200:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1201:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1203:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1217:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1218:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1219:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1227:36: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1227:36: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1227:36: sparse: expected void volatile [noderef] __iomem *addr drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1227:36: sparse: got void * drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1272:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1282:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1287:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1299:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1356:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1372:23: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1371:35: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void [noderef] __iomem *edma_send_addr @@ got void * @@ drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1371:35: sparse: expected void [noderef] __iomem *edma_send_addr drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1371:35: sparse: got void * >> drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1374:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const * @@ got void [noderef] __iomem *edma_send_addr @@ drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1374:9: sparse: expected void const * drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1374:9: sparse: got void [noderef] __iomem *edma_send_addr >> drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1374:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const * @@ got void [noderef] __iomem *edma_send_addr @@ drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1374:9: sparse: expected void const * drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1374:9: sparse: got void [noderef] __iomem *edma_send_addr >> drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1374:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void * @@ got void [noderef] __iomem *edma_send_addr @@ drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1374:9: sparse: expected void * drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1374:9: sparse: got void [noderef] __iomem *edma_send_addr drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1377:23: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1376:35: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void [noderef] __iomem *edma_recv_addr @@ got void * @@ drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1376:35: sparse: expected void [noderef] __iomem *edma_recv_addr drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1376:35: sparse: got void * drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1380:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1406:16: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1413:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1442:16: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c: note: in included file (through include/linux/rculist.h, include/linux/pid.h, include/linux/sched.h, ...): include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true vim +1374 drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c 1268 1269 struct edma_user_inft_s *edma_host_get_user_inft(u32 type) 1270 { 1271 if (type >= TYPE_MAX) { > 1272 BMA_LOG(DLOG_ERROR, "type error %d\n", type); 1273 return NULL; 1274 } 1275 1276 return g_user_func[type]; 1277 } 1278 1279 int edma_host_user_register(u32 type, struct edma_user_inft_s *func) 1280 { 1281 if (type >= TYPE_MAX) { 1282 BMA_LOG(DLOG_ERROR, "type error %d\n", type); 1283 return -EFAULT; 1284 } 1285 1286 if (!func) { 1287 BMA_LOG(DLOG_ERROR, "func is NULL\n"); 1288 return -EFAULT; 1289 } 1290 1291 g_user_func[type] = func; 1292 1293 return 0; 1294 } 1295 1296 int edma_host_user_unregister(u32 type) 1297 { 1298 if (type >= TYPE_MAX) { 1299 BMA_LOG(DLOG_ERROR, "type error %d\n", type); 1300 return -EFAULT; 1301 } 1302 1303 g_user_func[type] = NULL; 1304 1305 return 0; 1306 } 1307 1308 int edma_host_init(struct edma_host_s *edma_host) 1309 { 1310 int ret = 0; 1311 struct bma_dev_s *bma_dev = NULL; 1312 struct notify_msg *pnm = NULL; 1313 1314 if (!edma_host) 1315 return -1; 1316 1317 bma_dev = list_entry(edma_host, struct bma_dev_s, edma_host); 1318 g_bma_dev = bma_dev; 1319 1320 edma_host->pdev = bma_dev->bma_pci_dev->pdev; 1321 1322 #ifdef EDMA_TIMER 1323 #ifdef HAVE_TIMER_SETUP 1324 timer_setup(&edma_host->timer, edma_host_timeout, 0); 1325 #else 1326 setup_timer(&edma_host->timer, edma_host_timeout, 1327 (unsigned long)edma_host); 1328 #endif 1329 (void)mod_timer(&edma_host->timer, jiffies_64 + TIMER_INTERVAL_CHECK); 1330 #ifdef USE_DMA 1331 #ifdef HAVE_TIMER_SETUP 1332 timer_setup(&edma_host->dma_timer, edma_host_dma_timeout, 0); 1333 1334 #else 1335 setup_timer(&edma_host->dma_timer, edma_host_dma_timeout, 1336 (unsigned long)edma_host); 1337 #endif 1338 (void)mod_timer(&edma_host->dma_timer, 1339 jiffies_64 + DMA_TIMER_INTERVAL_CHECK); 1340 #endif 1341 1342 #else 1343 init_completion(&edma_host->msg_ready); 1344 1345 edma_host->edma_thread = 1346 kthread_run(edma_host_thread, (void *)edma_host, "edma_host_msg"); 1347 1348 if (IS_ERR(edma_host->edma_thread)) { 1349 BMA_LOG(DLOG_ERROR, "kernel_run edma_host_msg failed\n"); 1350 return PTR_ERR(edma_host->edma_thread); 1351 } 1352 #endif 1353 1354 edma_host->msg_send_buf = kmalloc(HOST_MAX_SEND_MBX_LEN, GFP_KERNEL); 1355 if (!edma_host->msg_send_buf) { 1356 BMA_LOG(DLOG_ERROR, "malloc msg_send_buf failed!"); 1357 ret = -ENOMEM; 1358 goto failed1; 1359 } 1360 1361 edma_host->msg_send_write = 0; 1362 1363 spin_lock_init(&edma_host->send_msg_lock); 1364 1365 tasklet_init(&edma_host->tasklet, 1366 (void (*)(unsigned long))edma_host_isr_tasklet, 1367 (unsigned long)edma_host); 1368 1369 edma_host->edma_flag = bma_dev->bma_pci_dev->edma_swap_addr; 1370 > 1371 edma_host->edma_send_addr = 1372 (void *)((unsigned char *)bma_dev->bma_pci_dev->edma_swap_addr + 1373 HOST_DMA_FLAG_LEN); > 1374 memset(edma_host->edma_send_addr, 0, SIZE_OF_MBX_HDR); 1375 1376 edma_host->edma_recv_addr = 1377 (void *)((unsigned char *)edma_host->edma_send_addr + 1378 HOST_MAX_SEND_MBX_LEN); 1379 1380 BMA_LOG(DLOG_DEBUG, 1381 "edma_flag = %p, edma_send_addr = %p, edma_recv_addr = %p\n", 1382 edma_host->edma_flag, edma_host->edma_send_addr, 1383 edma_host->edma_recv_addr); 1384 1385 edma_host->hostrtc_viraddr = bma_dev->bma_pci_dev->hostrtc_viraddr; 1386 1387 init_waitqueue_head(&edma_host->wq_dmah2b); 1388 init_waitqueue_head(&edma_host->wq_dmab2h); 1389 1390 spin_lock_init(&edma_host->reg_lock); 1391 1392 edma_host->h2b_state = H2BSTATE_IDLE; 1393 edma_host->b2h_state = B2HSTATE_IDLE; 1394 1395 #ifdef HAVE_TIMER_SETUP 1396 timer_setup(&edma_host->heartbeat_timer, 1397 edma_host_heartbeat_timer, 0); 1398 #else 1399 setup_timer(&edma_host->heartbeat_timer, 1400 edma_host_heartbeat_timer, 1401 (unsigned long)edma_host); 1402 #endif 1403 (void)mod_timer(&edma_host->heartbeat_timer, 1404 jiffies_64 + HEARTBEAT_TIMER_INTERVAL_CHECK); 1405 1406 pnm = (struct notify_msg *)edma_host->edma_flag; 1407 if (pnm) 1408 pnm->host_registered = REGISTERED; 1409 1410 GET_SYS_SECONDS(edma_host->statistics.init_time); 1411 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues'
by Li Nan 08 Jul '24

08 Jul '24

From: Yu Kuai <yukuai3(a)huawei.com> mainline inclusion from mainline-v6.10-rc1 commit a2db328b0839312c169eb42746ec46fc1ab53ed2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA7D6H CVE: CVE-2024-36478 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Writing 'power' and 'submit_queues' concurrently will trigger kernel panic: Test script: modprobe null_blk nr_devices=0 mkdir -p /sys/kernel/config/nullb/nullb0 while true; do echo 1 > submit_queues; echo 4 > submit_queues; done & while true; do echo 1 > power; echo 0 > power; done Test result: BUG: kernel NULL pointer dereference, address: 0000000000000148 Oops: 0000 [#1] PREEMPT SMP RIP: 0010:__lock_acquire+0x41d/0x28f0 Call Trace: <TASK> lock_acquire+0x121/0x450 down_write+0x5f/0x1d0 simple_recursive_removal+0x12f/0x5c0 blk_mq_debugfs_unregister_hctxs+0x7c/0x100 blk_mq_update_nr_hw_queues+0x4a3/0x720 nullb_update_nr_hw_queues+0x71/0xf0 [null_blk] nullb_device_submit_queues_store+0x79/0xf0 [null_blk] configfs_write_iter+0x119/0x1e0 vfs_write+0x326/0x730 ksys_write+0x74/0x150 This is because del_gendisk() can concurrent with blk_mq_update_nr_hw_queues(): nullb_device_power_store nullb_apply_submit_queues null_del_dev del_gendisk nullb_update_nr_hw_queues if (!dev->nullb) // still set while gendisk is deleted return 0 blk_mq_update_nr_hw_queues dev->nullb = NULL Fix this problem by resuing the global mutex to protect nullb_device_power_store() and nullb_update_nr_hw_queues() from configfs. Fixes: 45919fbfe1c4 ("null_blk: Enable modifying 'submit_queues' after an instance has been configured") Reported-and-tested-by: Yi Zhang <yi.zhang(a)redhat.com> Closes: https://lore.kernel.org/all/CAHj4cs9LgsHLnjg8z06LQ3Pr5cax-+Ps+xT7AP7TPnEjSt… Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Zhu Yanjun <yanjun.zhu(a)linux.dev> Link: https://lore.kernel.org/r/20240523153934.1937851-1-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: drivers/block/null_blk/main.c [ A lot of conflict, this patch just expand the protection range of mutex, ignore conflict. ] Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/block/null_blk/main.c | 43 +++++++++++++++++++++-------------- 1 file changed, 26 insertions(+), 17 deletions(-) diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c index 35b390a785dd..91c8412442d0 100644 --- a/drivers/block/null_blk/main.c +++ b/drivers/block/null_blk/main.c @@ -323,11 +323,9 @@ CONFIGFS_ATTR(nullb_device_, NAME); static int nullb_apply_submit_queues(struct nullb_device *dev, unsigned int submit_queues) { - struct nullb *nullb = dev->nullb; + struct nullb *nullb; struct blk_mq_tag_set *set; - - if (!nullb) - return 0; + int ret = 0; /* * Make sure that null_init_hctx() does not access nullb->queues[] past @@ -335,9 +333,20 @@ static int nullb_apply_submit_queues(struct nullb_device *dev, */ if (submit_queues > nr_cpu_ids) return -EINVAL; + + mutex_lock(&lock); + + nullb = dev->nullb; + if (!nullb) + goto out; + set = nullb->tag_set; blk_mq_update_nr_hw_queues(set, submit_queues); - return set->nr_hw_queues == submit_queues ? 0 : -ENOMEM; + ret = set->nr_hw_queues == submit_queues ? 0 : -ENOMEM; + +out: + mutex_unlock(&lock); + return ret; } NULLB_DEVICE_ATTR(size, ulong, NULL); @@ -378,27 +387,31 @@ static ssize_t nullb_device_power_store(struct config_item *item, if (ret < 0) return ret; + ret = count; + mutex_lock(&lock); if (!dev->power && newp) { if (test_and_set_bit(NULLB_DEV_FL_UP, &dev->flags)) - return count; + goto out; + if (null_add_dev(dev)) { clear_bit(NULLB_DEV_FL_UP, &dev->flags); - return -ENOMEM; + ret = -ENOMEM; + goto out; } set_bit(NULLB_DEV_FL_CONFIGURED, &dev->flags); dev->power = newp; } else if (dev->power && !newp) { if (test_and_clear_bit(NULLB_DEV_FL_UP, &dev->flags)) { - mutex_lock(&lock); dev->power = newp; null_del_dev(dev->nullb); - mutex_unlock(&lock); } clear_bit(NULLB_DEV_FL_CONFIGURED, &dev->flags); } - return count; +out: + mutex_unlock(&lock); + return ret; } CONFIGFS_ATTR(nullb_device_, power); @@ -1880,15 +1893,11 @@ static int null_add_dev(struct nullb_device *dev) blk_queue_flag_set(QUEUE_FLAG_NONROT, nullb->q); blk_queue_flag_clear(QUEUE_FLAG_ADD_RANDOM, nullb->q); - mutex_lock(&lock); rv = ida_simple_get(&nullb_indexes, 0, 0, GFP_KERNEL); - if (rv < 0) { - mutex_unlock(&lock); + if (rv < 0) goto out_cleanup_zone; - } nullb->index = rv; dev->index = rv; - mutex_unlock(&lock); blk_queue_logical_block_size(nullb->q, dev->blocksize); blk_queue_physical_block_size(nullb->q, dev->blocksize); @@ -1901,9 +1910,7 @@ static int null_add_dev(struct nullb_device *dev) if (rv) goto out_ida_free; - mutex_lock(&lock); list_add_tail(&nullb->list, &nullb_list); - mutex_unlock(&lock); return 0; @@ -1985,7 +1992,9 @@ static int __init null_init(void) ret = -ENOMEM; goto err_dev; } + mutex_lock(&lock); ret = null_add_dev(dev); + mutex_unlock(&lock); if (ret) { null_free_dev(dev); goto err_dev; -- 2.39.2

2 1