August 2024 - Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/2] CVE-2024-42126
by Jinjie Ruan 20 Aug '24

20 Aug '24

CVE-2024-42126 Jinjie Ruan (1): Revert "powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt." Mahesh Salgaonkar (1): powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt. arch/powerpc/kernel/mce.c | 2 +- arch/powerpc/kernel/traps.c | 8 +++++++- 2 files changed, 8 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/1] CVE-2024-42290
by Yuntao Liu 20 Aug '24

20 Aug '24

CVE-2024-42290 Shenwei Wang (1): irqchip/imx-irqsteer: Handle runtime power management correctly drivers/irqchip/irq-imx-irqsteer.c | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] CVE-2024-42290
by Yuntao Liu 20 Aug '24

20 Aug '24

CVE-2024-42290 Shenwei Wang (1): irqchip/imx-irqsteer: Handle runtime power management correctly drivers/irqchip/irq-imx-irqsteer.c | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-42290
by Yuntao Liu 20 Aug '24

20 Aug '24

CVE-2024-42290 Shenwei Wang (1): irqchip/imx-irqsteer: Handle runtime power management correctly drivers/irqchip/irq-imx-irqsteer.c | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1] ext4: fix infinite loop when replaying fast_commit
by Zhihao Cheng 20 Aug '24

20 Aug '24

From: "Luis Henriques (SUSE)" <luis.henriques(a)linux.dev> mainline inclusion from mainline-v6.11-rc1 commit 907c3fe532253a6ef4eb9c4d67efb71fab58c706 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ7X CVE: CVE-2024-43828 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When doing fast_commit replay an infinite loop may occur due to an uninitialized extent_status struct. ext4_ext_determine_insert_hole() does not detect the replay and calls ext4_es_find_extent_range(), which will return immediately without initializing the 'es' variable. Because 'es' contains garbage, an integer overflow may happen causing an infinite loop in this function, easily reproducible using fstest generic/039. This commit fixes this issue by unconditionally initializing the structure in function ext4_es_find_extent_range(). Thanks to Zhang Yi, for figuring out the real problem! Fixes: 8016e29f4362 ("ext4: fast commit recovery path") Signed-off-by: Luis Henriques (SUSE) <luis.henriques(a)linux.dev> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Link: https://patch.msgid.link/20240515082857.32730-1-luis.henriques@linux.dev Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Zhihao Cheng <chengzhihao(a)huaweicloud.com> --- fs/ext4/extents_status.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c index dd679014db98..1b4f07949136 100644 --- a/fs/ext4/extents_status.c +++ b/fs/ext4/extents_status.c @@ -311,6 +311,8 @@ void ext4_es_find_extent_range(struct inode *inode, ext4_lblk_t lblk, ext4_lblk_t end, struct extent_status *es) { + es->es_lblk = es->es_len = es->es_pblk = 0; + if (EXT4_SB(inode->i_sb)->s_mount_state & EXT4_FC_REPLAY) return; -- 2.31.1

2 1

[PATCH OLK-5.10] ext4: fix infinite loop when replaying fast_commit
by Zhihao Cheng 20 Aug '24

20 Aug '24

From: "Luis Henriques (SUSE)" <luis.henriques(a)linux.dev> mainline inclusion from mainline-v6.11-rc1 commit 907c3fe532253a6ef4eb9c4d67efb71fab58c706 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ7X CVE: CVE-2024-43828 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When doing fast_commit replay an infinite loop may occur due to an uninitialized extent_status struct. ext4_ext_determine_insert_hole() does not detect the replay and calls ext4_es_find_extent_range(), which will return immediately without initializing the 'es' variable. Because 'es' contains garbage, an integer overflow may happen causing an infinite loop in this function, easily reproducible using fstest generic/039. This commit fixes this issue by unconditionally initializing the structure in function ext4_es_find_extent_range(). Thanks to Zhang Yi, for figuring out the real problem! Fixes: 8016e29f4362 ("ext4: fast commit recovery path") Signed-off-by: Luis Henriques (SUSE) <luis.henriques(a)linux.dev> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Link: https://patch.msgid.link/20240515082857.32730-1-luis.henriques@linux.dev Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Zhihao Cheng <chengzhihao(a)huaweicloud.com> --- fs/ext4/extents_status.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c index 783f6205cc9f..cf6e1e001ac7 100644 --- a/fs/ext4/extents_status.c +++ b/fs/ext4/extents_status.c @@ -311,6 +311,8 @@ void ext4_es_find_extent_range(struct inode *inode, ext4_lblk_t lblk, ext4_lblk_t end, struct extent_status *es) { + es->es_lblk = es->es_len = es->es_pblk = 0; + if (EXT4_SB(inode->i_sb)->s_mount_state & EXT4_FC_REPLAY) return; -- 2.31.1

2 1

[PATCH OLK-5.10] PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init()
by liwei 20 Aug '24

20 Aug '24

From: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> mainline inclusion from mainline-v6.11-rc1 commit 5a5095a8bd1bd349cce1c879e5e44407a34dda8a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ5P CVE: CVE-2024-43824 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Instead of getting the epc_features from pci_epc_get_features() API, use the cached pci_epf_test::epc_features value to avoid the NULL check. Since the NULL check is already performed in pci_epf_test_bind(), having one more check in pci_epf_test_core_init() is redundant and it is not possible to hit the NULL pointer dereference. Also with commit a01e7214bef9 ("PCI: endpoint: Remove "core_init_notifier" flag"), 'epc_features' got dereferenced without the NULL check, leading to the following false positive Smatch warning: drivers/pci/endpoint/functions/pci-epf-test.c:784 pci_epf_test_core_init() error: we previously assumed 'epc_features' could be null (see line 747) Thus, remove the redundant NULL check and also use the epc_features:: {msix_capable/msi_capable} flags directly to avoid local variables. [kwilczynski: commit log] Fixes: 5e50ee27d4a5 ("PCI: pci-epf-test: Add support to defer core initialization") Closes: https://lore.kernel.org/linux-pci/024b5826-7180-4076-ae08-57d2584cca3f@moro… Link: https://lore.kernel.org/linux-pci/20240418-pci-epf-test-fix-v2-1-eacd548314… Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Signed-off-by: Krzysztof Wilczyński <kwilczynski(a)kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Reviewed-by: Frank Li <Frank.Li(a)nxp.com> Reviewed-by: Niklas Cassel <cassel(a)kernel.org> Conflicts: drivers/pci/endpoint/functions/pci-epf-test.c [context conflicts] Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/endpoint/functions/pci-epf-test.c | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c index ef52f5097eb3..219ac744275d 100644 --- a/drivers/pci/endpoint/functions/pci-epf-test.c +++ b/drivers/pci/endpoint/functions/pci-epf-test.c @@ -674,19 +674,11 @@ static int pci_epf_test_core_init(struct pci_epf *epf) { struct pci_epf_test *epf_test = epf_get_drvdata(epf); struct pci_epf_header *header = epf->header; - const struct pci_epc_features *epc_features; + const struct pci_epc_features *epc_features = epf_test->epc_features; struct pci_epc *epc = epf->epc; struct device *dev = &epf->dev; - bool msix_capable = false; - bool msi_capable = true; int ret; - epc_features = pci_epc_get_features(epc, epf->func_no); - if (epc_features) { - msix_capable = epc_features->msix_capable; - msi_capable = epc_features->msi_capable; - } - ret = pci_epc_write_header(epc, epf->func_no, header); if (ret) { dev_err(dev, "Configuration header write failed\n"); @@ -697,7 +689,7 @@ static int pci_epf_test_core_init(struct pci_epf *epf) if (ret) return ret; - if (msi_capable) { + if (epc_features->msi_capable) { ret = pci_epc_set_msi(epc, epf->func_no, epf->msi_interrupts); if (ret) { dev_err(dev, "MSI configuration failed\n"); @@ -705,7 +697,7 @@ static int pci_epf_test_core_init(struct pci_epf *epf) } } - if (msix_capable) { + if (epc_features->msix_capable) { ret = pci_epc_set_msix(epc, epf->func_no, epf->msix_interrupts, epf_test->test_reg_bar, epf_test->msix_table_offset); -- 2.25.1

2 1

[openeuler:OLK-5.10] BUILD SUCCESS feb0fe58d128f9c077800989f8b392a3daa7f636
by kernel test robot 20 Aug '24

20 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: feb0fe58d128f9c077800989f8b392a3daa7f636 !10931 drm/lima: fix shared irq handling on driver remove elapsed time: 735m configs tested: 35 configs skipped: 138 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240820 clang-20 arm64 randconfig-002-20240820 clang-20 arm64 randconfig-003-20240820 gcc-14.1.0 arm64 randconfig-004-20240820 clang-20 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240820 clang-18 x86_64 buildonly-randconfig-002-20240820 gcc-11 x86_64 buildonly-randconfig-003-20240820 clang-18 x86_64 buildonly-randconfig-004-20240820 clang-18 x86_64 buildonly-randconfig-005-20240820 clang-18 x86_64 buildonly-randconfig-006-20240820 clang-18 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240820 gcc-12 x86_64 randconfig-002-20240820 gcc-12 x86_64 randconfig-003-20240820 clang-18 x86_64 randconfig-004-20240820 gcc-12 x86_64 randconfig-005-20240820 clang-18 x86_64 randconfig-006-20240820 gcc-12 x86_64 randconfig-011-20240820 clang-18 x86_64 randconfig-012-20240820 gcc-12 x86_64 randconfig-013-20240820 clang-18 x86_64 randconfig-014-20240820 clang-18 x86_64 randconfig-015-20240820 gcc-12 x86_64 randconfig-016-20240820 clang-18 x86_64 randconfig-071-20240820 gcc-12 x86_64 randconfig-072-20240820 gcc-12 x86_64 randconfig-073-20240820 gcc-12 x86_64 randconfig-074-20240820 clang-18 x86_64 randconfig-075-20240820 clang-18 x86_64 randconfig-076-20240820 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS 36fe9923e738b237c70af2304f0d1d2a033fc632
by kernel test robot 20 Aug '24

20 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 36fe9923e738b237c70af2304f0d1d2a033fc632 !10930 libceph: fix race between delayed_work() and ceph_monc_stop() elapsed time: 727m configs tested: 35 configs skipped: 139 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240819 gcc-14.1.0 arm64 randconfig-002-20240819 gcc-14.1.0 arm64 randconfig-003-20240819 gcc-14.1.0 arm64 randconfig-004-20240819 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240819 gcc-12 x86_64 buildonly-randconfig-002-20240819 gcc-12 x86_64 buildonly-randconfig-003-20240819 gcc-12 x86_64 buildonly-randconfig-004-20240819 gcc-12 x86_64 buildonly-randconfig-005-20240819 gcc-12 x86_64 buildonly-randconfig-006-20240819 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240819 clang-18 x86_64 randconfig-002-20240819 clang-18 x86_64 randconfig-003-20240819 gcc-12 x86_64 randconfig-004-20240819 gcc-12 x86_64 randconfig-005-20240819 clang-18 x86_64 randconfig-006-20240819 clang-18 x86_64 randconfig-011-20240819 gcc-12 x86_64 randconfig-012-20240819 clang-18 x86_64 randconfig-013-20240819 clang-18 x86_64 randconfig-014-20240819 gcc-12 x86_64 randconfig-015-20240819 gcc-12 x86_64 randconfig-016-20240819 gcc-12 x86_64 randconfig-071-20240819 gcc-12 x86_64 randconfig-072-20240819 gcc-12 x86_64 randconfig-073-20240819 clang-18 x86_64 randconfig-074-20240819 gcc-12 x86_64 randconfig-075-20240819 gcc-12 x86_64 randconfig-076-20240819 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 063fb5b67877d27a0adebef0dd88bab842d8de07
by kernel test robot 20 Aug '24

20 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 063fb5b67877d27a0adebef0dd88bab842d8de07 !10407 Intel: Backport SPR/EMR CXL and HBM perfmon support to kernel 6.6 Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202408200033.m00Dx7hV-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202408200124.eAjYI7Na-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202408200300.4dy9MKnd-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) arch/arm64/kvm/tmi.c:131:5: warning: no previous prototype for 'tmi_tmm_inf_test' [-Wmissing-prototypes] arch/arm64/kvm/virtcca_cvm.c:244:5: warning: no previous prototype for 'kvm_cvm_create_ttt_levels' [-Wmissing-prototypes] arch/arm64/kvm/virtcca_cvm.c:311:5: warning: no previous prototype for 'kvm_cvm_populate_par_region' [-Wmissing-prototypes] arch/arm64/kvm/virtcca_cvm.c:70:6: warning: no previous prototype for 'kvm_cvm_supports_sve' [-Wmissing-prototypes] arch/arm64/kvm/virtcca_cvm.c:75:6: warning: no previous prototype for 'kvm_cvm_supports_pmu' [-Wmissing-prototypes] arch/arm64/kvm/virtcca_cvm.c:80:5: warning: no previous prototype for 'kvm_cvm_ipa_limit' [-Wmissing-prototypes] arch/arm64/kvm/virtcca_cvm.c:85:5: warning: no previous prototype for 'kvm_cvm_get_num_brps' [-Wmissing-prototypes] arch/arm64/kvm/virtcca_cvm.c:90:5: warning: no previous prototype for 'kvm_cvm_get_num_wrps' [-Wmissing-prototypes] drivers/crypto/ccp/hygon/tdm-dev.c:340:61: error: invalid use of undefined type 'struct module' drivers/crypto/ccp/hygon/tdm-kernel-guard.c:308:37: error: 'NR_syscalls' undeclared (first use in this function); did you mean 'si_syscall'? Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-arm.c:warning:variable-r-is-used-uninitialized-whenever-if-condition-is-false | |-- arch-arm64-kvm-tmi.c:warning:no-previous-prototype-for-function-tmi_tmm_inf_test | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_create_ttt_levels | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_brps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_wrps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_ipa_limit | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_populate_par_region | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_pmu | `-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_sve |-- arm64-randconfig-003-20240820 | |-- arch-arm64-kvm-tmi.c:warning:no-previous-prototype-for-tmi_tmm_inf_test | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-kvm_cvm_create_ttt_levels | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-kvm_cvm_get_num_brps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-kvm_cvm_get_num_wrps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-kvm_cvm_ipa_limit | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-kvm_cvm_populate_par_region | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-kvm_cvm_supports_pmu | `-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-kvm_cvm_supports_sve |-- x86_64-buildonly-randconfig-001-20240819 | `-- kernel-sched-isolation.c:error:setup_max_cpus-undeclared-(first-use-in-this-function) |-- x86_64-buildonly-randconfig-002-20240819 | `-- kernel-sched-isolation.c:error:setup_max_cpus-undeclared-(first-use-in-this-function) |-- x86_64-buildonly-randconfig-004-20240819 | `-- kernel-sched-isolation.c:error:setup_max_cpus-undeclared-(first-use-in-this-function) |-- x86_64-buildonly-randconfig-006-20240819 | `-- drivers-crypto-ccp-hygon-tdm-dev.c:error:invalid-use-of-undefined-type-struct-module `-- x86_64-randconfig-004-20240819 `-- drivers-crypto-ccp-hygon-tdm-kernel-guard.c:error:NR_syscalls-undeclared-(first-use-in-this-function) elapsed time: 727m configs tested: 34 configs skipped: 134 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240820 clang-20 arm64 randconfig-002-20240820 clang-20 arm64 randconfig-003-20240820 gcc-14.1.0 arm64 randconfig-004-20240820 clang-20 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch defconfig gcc-14.1.0 loongarch randconfig-001-20240820 gcc-14.1.0 loongarch randconfig-002-20240820 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240819 gcc-12 x86_64 buildonly-randconfig-002-20240819 gcc-12 x86_64 buildonly-randconfig-003-20240819 gcc-12 x86_64 buildonly-randconfig-004-20240819 gcc-12 x86_64 buildonly-randconfig-005-20240819 gcc-12 x86_64 buildonly-randconfig-006-20240819 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240819 clang-18 x86_64 randconfig-002-20240819 clang-18 x86_64 randconfig-003-20240819 gcc-12 x86_64 randconfig-004-20240819 gcc-12 x86_64 randconfig-005-20240819 clang-18 x86_64 randconfig-006-20240819 clang-18 x86_64 randconfig-011-20240819 gcc-12 x86_64 randconfig-012-20240819 clang-18 x86_64 randconfig-013-20240819 clang-18 x86_64 randconfig-014-20240819 gcc-12 x86_64 randconfig-015-20240819 gcc-12 x86_64 randconfig-016-20240819 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0