September 2024 - Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 21354/23799] drivers/net/ethernet/stmicro/stmmac/dwmac-phytium.c:159:10: error: incompatible pointer to integer conversion returning 'void *' from a function with result type 'int'
by kernel test robot 28 Sep '24

28 Sep '24

Hi wangzhimin, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3841d75a6dcd12d108aaf56560b99431d18169e4 commit: af48889301db8235deab66a8822e3e00195ca14b [21354/23799] dwmac:add phytium dwmac driver config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240928/202409280354.ixZVRGmb-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240928/202409280354.ixZVRGmb-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409280354.ixZVRGmb-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/net/ethernet/stmicro/stmmac/dwmac-phytium.c:159:10: error: incompatible pointer to integer conversion returning 'void *' from a function with result type 'int' [-Wint-conversion] 159 | return stmmac_res.addr; | ^~~~~~~~~~~~~~~ drivers/net/ethernet/stmicro/stmmac/dwmac-phytium.c:172:5: warning: no previous prototype for function 'phytium_dwmac_remove' [-Wmissing-prototypes] 172 | int phytium_dwmac_remove(struct platform_device *pdev) | ^ drivers/net/ethernet/stmicro/stmmac/dwmac-phytium.c:172:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 172 | int phytium_dwmac_remove(struct platform_device *pdev) | ^ | static 1 warning and 1 error generated. vim +159 drivers/net/ethernet/stmicro/stmmac/dwmac-phytium.c 32 33 static int phytium_dwmac_probe(struct platform_device *pdev) 34 { 35 struct fwnode_handle *fwnode = dev_fwnode(&pdev->dev); 36 struct plat_stmmacenet_data *plat; 37 struct stmmac_resources stmmac_res; 38 struct device_node *np = pdev->dev.of_node; 39 struct resource *res; 40 u64 clk_freq; 41 char clk_name[20]; 42 int ret; 43 44 plat = devm_kzalloc(&pdev->dev, sizeof(*plat), GFP_KERNEL); 45 if (!plat) 46 return -ENOMEM; 47 48 plat->dma_cfg = devm_kzalloc(&pdev->dev, sizeof(*plat->dma_cfg), 49 GFP_KERNEL); 50 if (!plat->dma_cfg) 51 return -ENOMEM; 52 53 plat->axi = devm_kzalloc(&pdev->dev, sizeof(*plat->axi), GFP_KERNEL); 54 if (!plat->axi) 55 return -ENOMEM; 56 57 plat->interface = device_get_phy_mode(&pdev->dev); 58 if (plat->interface < 0) 59 return plat->interface; 60 61 /* Configure PHY if using device-tree */ 62 if (pdev->dev.of_node) 63 plat->phy_node = of_parse_phandle(np, "phy-handle", 0); 64 65 if (pdev->dev.of_node) { 66 plat->bus_id = of_alias_get_id(np, "ethernet"); 67 if (plat->bus_id < 0) 68 plat->bus_id = 0; 69 } else if (fwnode_property_read_u32(fwnode, "bus_id", &plat->bus_id)) { 70 plat->bus_id = 2; 71 } 72 73 plat->phy_addr = -1; 74 plat->clk_csr = -1; 75 plat->has_gmac = 1; 76 plat->enh_desc = 1; 77 plat->bugged_jumbo = 1; 78 plat->pmt = 1; 79 plat->force_sf_dma_mode = 1; 80 81 if (fwnode_property_read_u32(fwnode, "max-speed", &plat->max_speed)) 82 plat->max_speed = -1; 83 84 if (fwnode_property_read_u32(fwnode, "max-frame-size", &plat->maxmtu)) 85 plat->maxmtu = JUMBO_LEN; 86 87 if (fwnode_property_read_u32(fwnode, "snps,multicast-filter-bins", 88 &plat->multicast_filter_bins)) 89 plat->multicast_filter_bins = HASH_TABLE_SIZE; 90 91 if (fwnode_property_read_u32(fwnode, "snps,perfect-filter-entries", 92 &plat->unicast_filter_entries)) 93 plat->unicast_filter_entries = 1; 94 95 if (fwnode_property_read_u32(fwnode, "tx-fifo-depth", 96 &plat->tx_fifo_size)) 97 plat->tx_fifo_size = 0x1000; 98 99 if (fwnode_property_read_u32(fwnode, "rx-fifo-depth", 100 &plat->rx_fifo_size)) 101 plat->rx_fifo_size = 0x1000; 102 103 if (phytium_dwmac_acpi_phy(plat, fwnode, &pdev->dev)) 104 return -ENODEV; 105 106 plat->rx_queues_to_use = 1; 107 plat->tx_queues_to_use = 1; 108 plat->rx_queues_cfg[0].mode_to_use = MTL_QUEUE_DCB; 109 plat->tx_queues_cfg[0].mode_to_use = MTL_QUEUE_DCB; 110 111 if (fwnode_property_read_u64(fwnode, "clock-frequency", &clk_freq)) 112 clk_freq = 125000000; 113 114 /* Set system clock */ 115 snprintf(clk_name, sizeof(clk_name), "%s-%d", "stmmaceth", 116 plat->bus_id); 117 118 plat->stmmac_clk = clk_register_fixed_rate(&pdev->dev, clk_name, 119 NULL, 0, clk_freq); 120 if (IS_ERR(plat->stmmac_clk)) { 121 dev_warn(&pdev->dev, "Fail to register stmmac-clk\n"); 122 plat->stmmac_clk = NULL; 123 } 124 125 ret = clk_prepare_enable(plat->stmmac_clk); 126 if (ret) { 127 clk_unregister_fixed_rate(plat->stmmac_clk); 128 return ret; 129 } 130 131 plat->clk_ptp_rate = clk_get_rate(plat->stmmac_clk); 132 plat->clk_ptp_ref = NULL; 133 134 if (fwnode_property_read_u32(fwnode, "snps,pbl", &plat->dma_cfg->pbl)) 135 plat->dma_cfg->pbl = 16; 136 137 fwnode_property_read_u32(fwnode, "snps,txpbl", &plat->dma_cfg->txpbl); 138 fwnode_property_read_u32(fwnode, "snps,rxpbl", &plat->dma_cfg->rxpbl); 139 140 plat->dma_cfg->pblx8 = !fwnode_property_read_bool(fwnode, 141 "snps,no-pbl-x8"); 142 plat->dma_cfg->aal = fwnode_property_read_bool(fwnode, "snps,aal"); 143 plat->dma_cfg->fixed_burst = fwnode_property_read_bool(fwnode, 144 "snps,fixed-burst"); 145 plat->dma_cfg->mixed_burst = fwnode_property_read_bool(fwnode, 146 "snps,mixed-burst"); 147 148 plat->axi->axi_lpi_en = false; 149 plat->axi->axi_xit_frm = false; 150 plat->axi->axi_wr_osr_lmt = 7; 151 plat->axi->axi_rd_osr_lmt = 7; 152 plat->axi->axi_blen[0] = 16; 153 154 memset(&stmmac_res, 0, sizeof(stmmac_res)); 155 res = platform_get_resource(pdev, IORESOURCE_MEM, 0); 156 stmmac_res.addr = devm_ioremap_resource(&pdev->dev, res); 157 if (stmmac_res.addr < 0) { 158 dev_err(&pdev->dev, "resource map failed.\n"); > 159 return stmmac_res.addr; 160 } 161 stmmac_res.irq = platform_get_irq(pdev, 0); 162 if (stmmac_res.irq < 0) { 163 dev_err(&pdev->dev, "IRQ not found.\n"); 164 return -ENXIO; 165 } 166 stmmac_res.wol_irq = stmmac_res.irq; 167 stmmac_res.lpi_irq = -1; 168 169 return stmmac_dvr_probe(&pdev->dev, plat, &stmmac_res); 170 } 171 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 17967/23799] drivers/hwtracing/intel_th/msu-sink.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 28 Sep '24

28 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3841d75a6dcd12d108aaf56560b99431d18169e4 commit: 4d516770f81434cde260d33430626e3880b9902e [17967/23799] intel_th: msu-sink: An example msu buffer "sink" config: x86_64-buildonly-randconfig-001-20240926 (https://download.01.org/0day-ci/archive/20240928/202409280233.aF2FycBU-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240928/202409280233.aF2FycBU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409280233.aF2FycBU-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/hwtracing/intel_th/msu-sink.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 13031/30000] drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:5671:37: sparse: sparse: restricted __le32 degrades to integer
by kernel test robot 28 Sep '24

28 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: bef6f06e039b8929481350d15d6d8c3ba81c6fd2 commit: 7b05030bb7ada6099be6aee436250b07e96a3901 [13031/30000] net: hns3: support set/get VxLAN rule of rx flow director by ethtool config: arm64-randconfig-r131-20240925 (https://download.01.org/0day-ci/archive/20240928/202409280106.13pCWH1k-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240928/202409280106.13pCWH1k-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409280106.13pCWH1k-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:5671:37: sparse: sparse: restricted __le32 degrades to integer drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:5672:37: sparse: sparse: restricted __le32 degrades to integer >> drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:5906:17: sparse: sparse: restricted __be32 degrades to integer drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:6000:17: sparse: sparse: restricted __be32 degrades to integer drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:5252:31: sparse: sparse: context imbalance in 'hclge_sync_fd_user_def_cfg' - unexpected unlock drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:12259:23: sparse: sparse: memset with byte count of 131072 vim +5671 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c 5613 5614 int offset, moffset, ip_offset; 5615 enum HCLGE_FD_KEY_OPT key_opt; 5616 u16 tmp_x_s, tmp_y_s; 5617 u32 tmp_x_l, tmp_y_l; 5618 u8 *p = (u8 *)rule; 5619 int i; 5620 5621 if (rule->unused_tuple & BIT(tuple_bit)) 5622 return true; 5623 5624 key_opt = tuple_key_info[tuple_bit].key_opt; 5625 offset = tuple_key_info[tuple_bit].offset; 5626 moffset = tuple_key_info[tuple_bit].moffset; 5627 5628 switch (key_opt) { 5629 case KEY_OPT_U8: 5630 calc_x(*key_x, p[offset], p[moffset]); 5631 calc_y(*key_y, p[offset], p[moffset]); 5632 5633 return true; 5634 case KEY_OPT_LE16: 5635 calc_x(tmp_x_s, *(u16 *)(&p[offset]), *(u16 *)(&p[moffset])); 5636 calc_y(tmp_y_s, *(u16 *)(&p[offset]), *(u16 *)(&p[moffset])); 5637 *(__le16 *)key_x = cpu_to_le16(tmp_x_s); 5638 *(__le16 *)key_y = cpu_to_le16(tmp_y_s); 5639 5640 return true; 5641 case KEY_OPT_LE32: 5642 calc_x(tmp_x_l, *(u32 *)(&p[offset]), *(u32 *)(&p[moffset])); 5643 calc_y(tmp_y_l, *(u32 *)(&p[offset]), *(u32 *)(&p[moffset])); 5644 *(__le32 *)key_x = cpu_to_le32(tmp_x_l); 5645 *(__le32 *)key_y = cpu_to_le32(tmp_y_l); 5646 5647 return true; 5648 case KEY_OPT_MAC: 5649 for (i = 0; i < ETH_ALEN; i++) { 5650 calc_x(key_x[ETH_ALEN - 1 - i], p[offset + i], 5651 p[moffset + i]); 5652 calc_y(key_y[ETH_ALEN - 1 - i], p[offset + i], 5653 p[moffset + i]); 5654 } 5655 5656 return true; 5657 case KEY_OPT_IP: 5658 ip_offset = IPV4_INDEX * sizeof(u32); 5659 calc_x(tmp_x_l, *(u32 *)(&p[offset + ip_offset]), 5660 *(u32 *)(&p[moffset + ip_offset])); 5661 calc_y(tmp_y_l, *(u32 *)(&p[offset + ip_offset]), 5662 *(u32 *)(&p[moffset + ip_offset])); 5663 *(__le32 *)key_x = cpu_to_le32(tmp_x_l); 5664 *(__le32 *)key_y = cpu_to_le32(tmp_y_l); 5665 5666 return true; 5667 case KEY_OPT_VNI: 5668 calc_x(tmp_x_l, *(u32 *)(&p[offset]), *(u32 *)(&p[moffset])); 5669 calc_y(tmp_y_l, *(u32 *)(&p[offset]), *(u32 *)(&p[moffset])); 5670 for (i = 0; i < HCLGE_VNI_LENGTH; i++) { > 5671 key_x[i] = (cpu_to_le32(tmp_x_l) >> (i * BITS_PER_BYTE)) & 0xFF; 5672 key_y[i] = (cpu_to_le32(tmp_y_l) >> (i * BITS_PER_BYTE)) & 0xFF; 5673 } 5674 return true; 5675 default: 5676 return false; 5677 } 5678 } 5679 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 17809/23796] drivers/powercap/intel_rapl_common.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 27 Sep '24

27 Sep '24

Hi Zhang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3841d75a6dcd12d108aaf56560b99431d18169e4 commit: 74c448a8b8ad8801c117e98ccd0e399413c063bb [17809/23796] Intel: intel_rapl: Fix module autoloading issue config: x86_64-buildonly-randconfig-001-20240926 (https://download.01.org/0day-ci/archive/20240927/202409271931.90b1jljj-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240927/202409271931.90b1jljj-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409271931.90b1jljj-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/powercap/intel_rapl_common.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 12771/30000] drivers/hwtracing/coresight/coresight-core.c:26:1: sparse: sparse: symbol '__pcpu_scope_csdev_sink' was not declared. Should it be static?
by kernel test robot 27 Sep '24

27 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: bef6f06e039b8929481350d15d6d8c3ba81c6fd2 commit: 078577fd8d76863149a3e8c7588ed0b457a095e9 [12771/30000] coresight: core: Add support for dedicated percpu sinks config: arm64-randconfig-r131-20240925 (https://download.01.org/0day-ci/archive/20240927/202409271902.PwZin66T-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240927/202409271902.PwZin66T-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409271902.PwZin66T-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/hwtracing/coresight/coresight-core.c:26:1: sparse: sparse: symbol '__pcpu_scope_csdev_sink' was not declared. Should it be static? vim +/__pcpu_scope_csdev_sink +26 drivers/hwtracing/coresight/coresight-core.c 24 25 static DEFINE_MUTEX(coresight_mutex); > 26 DEFINE_PER_CPU(struct coresight_device *, csdev_sink); 27 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/4] Merge some hns RoCE patches from the mainline to OLK-6.6
by Chengchang Tang 27 Sep '24

27 Sep '24

From: Xinghai Cen <cenxinghai(a)h-partners.com> Merge some hns RoCE patches from the mainline to OLK-6.6 Xinghai Cen (2): Revert "RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range()" Revert "RDMA/hns: Fix Use-After-Free of rsv_qp" wenglianfa (2): RDMA/hns: Fix Use-After-Free of rsv_qp on HIP08 RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range() -- 2.33.0

2 5

[PATCH OLK-5.10 0/5] Some bug fix patches for OLK-5.10 hns RoCE
by Chengchang Tang 27 Sep '24

27 Sep '24

From: Xinghai Cen <cenxinghai(a)h-partners.com> Some bug fix patches for OLK-5.10 hns RoCE Junxian Huang (1): RDMA/hns: Fix ah error counter in sw stat not increasing Xinghai Cen (1): Revert "RDMA/hns: Fix ah error counter in sw stat not increasing when sl is invalid" wenglianfa (3): RDMA/hns: Fix the inconsistency between input max_send_sge and output max_send_sge RDMA/hns: Use one CQ bank per context for HIP09 RDMA/hns: Fix RoCEE hang when multiple QP banks use EXT_SGE drivers/infiniband/hw/hns/hns_roce_ah.c | 6 ++- drivers/infiniband/hw/hns/hns_roce_cq.c | 21 ++++++--- drivers/infiniband/hw/hns/hns_roce_device.h | 7 +++ drivers/infiniband/hw/hns/hns_roce_main.c | 5 +++ drivers/infiniband/hw/hns/hns_roce_qp.c | 50 ++++++++++++++++----- 5 files changed, 69 insertions(+), 20 deletions(-) -- 2.33.0

2 6

[PATCH OLK-6.6] hwmon: (hp-wmi-sensors) Check if WMI event data exists
by Zhao Wenhui 27 Sep '24

27 Sep '24

From: Armin Wolf <W_Armin(a)gmx.de> stable inclusion from stable-v6.6.51 commit 217539e994e53206bbf3fb330261cc78c480d311 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWCY CVE: CVE-2024-46768 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a54da9df75cd1b4b5028f6c60f9a211532680585 ] The BIOS can choose to return no event data in response to a WMI event, so the ACPI object passed to the WMI notify handler can be NULL. Check for such a situation and ignore the event in such a case. Fixes: 23902f98f8d4 ("hwmon: add HP WMI Sensors driver") Signed-off-by: Armin Wolf <W_Armin(a)gmx.de> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Message-ID: <20240901031055.3030-2-W_Armin(a)gmx.de> Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- drivers/hwmon/hp-wmi-sensors.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/hwmon/hp-wmi-sensors.c b/drivers/hwmon/hp-wmi-sensors.c index b5325d0e72b9..dfa1d6926dea 100644 --- a/drivers/hwmon/hp-wmi-sensors.c +++ b/drivers/hwmon/hp-wmi-sensors.c @@ -1637,6 +1637,8 @@ static void hp_wmi_notify(u32 value, void *context) goto out_unlock; wobj = out.pointer; + if (!wobj) + goto out_unlock; err = populate_event_from_wobj(dev, &event, wobj); if (err) { -- 2.34.1

2 1

[PATCH OLK-6.6] nilfs2: protect references to superblock parameters exposed in sysfs
by Zhao Wenhui 27 Sep '24

27 Sep '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v6.6.51 commit 8c6e43b3d5f109cf9c61bc188fcc8175404e924f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYCR CVE: CVE-2024-46780 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 683408258917541bdb294cd717c210a04381931e upstream. The superblock buffers of nilfs2 can not only be overwritten at runtime for modifications/repairs, but they are also regularly swapped, replaced during resizing, and even abandoned when degrading to one side due to backing device issues. So, accessing them requires mutual exclusion using the reader/writer semaphore "nilfs->ns_sem". Some sysfs attribute show methods read this superblock buffer without the necessary mutual exclusion, which can cause problems with pointer dereferencing and memory access, so fix it. Link: https://lkml.kernel.org/r/20240811100320.9913-1-konishi.ryusuke@gmail.com Fixes: da7141fb78db ("nilfs2: add /sys/fs/nilfs2/<device> group") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- fs/nilfs2/sysfs.c | 43 +++++++++++++++++++++++++++++++++---------- 1 file changed, 33 insertions(+), 10 deletions(-) diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c index 379d22e28ed6..905c7eadf967 100644 --- a/fs/nilfs2/sysfs.c +++ b/fs/nilfs2/sysfs.c @@ -836,9 +836,15 @@ ssize_t nilfs_dev_revision_show(struct nilfs_dev_attr *attr, struct the_nilfs *nilfs, char *buf) { - struct nilfs_super_block **sbp = nilfs->ns_sbp; - u32 major = le32_to_cpu(sbp[0]->s_rev_level); - u16 minor = le16_to_cpu(sbp[0]->s_minor_rev_level); + struct nilfs_super_block *raw_sb; + u32 major; + u16 minor; + + down_read(&nilfs->ns_sem); + raw_sb = nilfs->ns_sbp[0]; + major = le32_to_cpu(raw_sb->s_rev_level); + minor = le16_to_cpu(raw_sb->s_minor_rev_level); + up_read(&nilfs->ns_sem); return sysfs_emit(buf, "%d.%d\n", major, minor); } @@ -856,8 +862,13 @@ ssize_t nilfs_dev_device_size_show(struct nilfs_dev_attr *attr, struct the_nilfs *nilfs, char *buf) { - struct nilfs_super_block **sbp = nilfs->ns_sbp; - u64 dev_size = le64_to_cpu(sbp[0]->s_dev_size); + struct nilfs_super_block *raw_sb; + u64 dev_size; + + down_read(&nilfs->ns_sem); + raw_sb = nilfs->ns_sbp[0]; + dev_size = le64_to_cpu(raw_sb->s_dev_size); + up_read(&nilfs->ns_sem); return sysfs_emit(buf, "%llu\n", dev_size); } @@ -879,9 +890,15 @@ ssize_t nilfs_dev_uuid_show(struct nilfs_dev_attr *attr, struct the_nilfs *nilfs, char *buf) { - struct nilfs_super_block **sbp = nilfs->ns_sbp; + struct nilfs_super_block *raw_sb; + ssize_t len; - return sysfs_emit(buf, "%pUb\n", sbp[0]->s_uuid); + down_read(&nilfs->ns_sem); + raw_sb = nilfs->ns_sbp[0]; + len = sysfs_emit(buf, "%pUb\n", raw_sb->s_uuid); + up_read(&nilfs->ns_sem); + + return len; } static @@ -889,10 +906,16 @@ ssize_t nilfs_dev_volume_name_show(struct nilfs_dev_attr *attr, struct the_nilfs *nilfs, char *buf) { - struct nilfs_super_block **sbp = nilfs->ns_sbp; + struct nilfs_super_block *raw_sb; + ssize_t len; + + down_read(&nilfs->ns_sem); + raw_sb = nilfs->ns_sbp[0]; + len = scnprintf(buf, sizeof(raw_sb->s_volume_name), "%s\n", + raw_sb->s_volume_name); + up_read(&nilfs->ns_sem); - return scnprintf(buf, sizeof(sbp[0]->s_volume_name), "%s\n", - sbp[0]->s_volume_name); + return len; } static const char dev_readme_str[] = -- 2.34.1

2 1

[PATCH OLK-5.10] nilfs2: protect references to superblock parameters exposed in sysfs
by Zhao Wenhui 27 Sep '24

27 Sep '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v5.10.226 commit 157c0d94b4c40887329418c70ef4edd1a8d6b4ed category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYCR CVE: CVE-2024-46780 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 683408258917541bdb294cd717c210a04381931e ] The superblock buffers of nilfs2 can not only be overwritten at runtime for modifications/repairs, but they are also regularly swapped, replaced during resizing, and even abandoned when degrading to one side due to backing device issues. So, accessing them requires mutual exclusion using the reader/writer semaphore "nilfs->ns_sem". Some sysfs attribute show methods read this superblock buffer without the necessary mutual exclusion, which can cause problems with pointer dereferencing and memory access, so fix it. Link: https://lkml.kernel.org/r/20240811100320.9913-1-konishi.ryusuke@gmail.com Fixes: da7141fb78db ("nilfs2: add /sys/fs/nilfs2/<device> group") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/nilfs2/sysfs.c [3bcd6c5bd483287f4a09d3d59a012d47677b6edc not merged.] Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- fs/nilfs2/sysfs.c | 43 +++++++++++++++++++++++++++++++++---------- 1 file changed, 33 insertions(+), 10 deletions(-) diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c index 57afd06db62d..fc1c10a4ee45 100644 --- a/fs/nilfs2/sysfs.c +++ b/fs/nilfs2/sysfs.c @@ -843,9 +843,15 @@ ssize_t nilfs_dev_revision_show(struct nilfs_dev_attr *attr, struct the_nilfs *nilfs, char *buf) { - struct nilfs_super_block **sbp = nilfs->ns_sbp; - u32 major = le32_to_cpu(sbp[0]->s_rev_level); - u16 minor = le16_to_cpu(sbp[0]->s_minor_rev_level); + struct nilfs_super_block *raw_sb; + u32 major; + u16 minor; + + down_read(&nilfs->ns_sem); + raw_sb = nilfs->ns_sbp[0]; + major = le32_to_cpu(raw_sb->s_rev_level); + minor = le16_to_cpu(raw_sb->s_minor_rev_level); + up_read(&nilfs->ns_sem); return snprintf(buf, PAGE_SIZE, "%d.%d\n", major, minor); } @@ -863,8 +869,13 @@ ssize_t nilfs_dev_device_size_show(struct nilfs_dev_attr *attr, struct the_nilfs *nilfs, char *buf) { - struct nilfs_super_block **sbp = nilfs->ns_sbp; - u64 dev_size = le64_to_cpu(sbp[0]->s_dev_size); + struct nilfs_super_block *raw_sb; + u64 dev_size; + + down_read(&nilfs->ns_sem); + raw_sb = nilfs->ns_sbp[0]; + dev_size = le64_to_cpu(raw_sb->s_dev_size); + up_read(&nilfs->ns_sem); return snprintf(buf, PAGE_SIZE, "%llu\n", dev_size); } @@ -886,9 +897,15 @@ ssize_t nilfs_dev_uuid_show(struct nilfs_dev_attr *attr, struct the_nilfs *nilfs, char *buf) { - struct nilfs_super_block **sbp = nilfs->ns_sbp; + struct nilfs_super_block *raw_sb; + ssize_t len; - return snprintf(buf, PAGE_SIZE, "%pUb\n", sbp[0]->s_uuid); + down_read(&nilfs->ns_sem); + raw_sb = nilfs->ns_sbp[0]; + len = snprintf(buf, PAGE_SIZE, "%pUb\n", raw_sb->s_uuid); + up_read(&nilfs->ns_sem); + + return len; } static @@ -896,10 +913,16 @@ ssize_t nilfs_dev_volume_name_show(struct nilfs_dev_attr *attr, struct the_nilfs *nilfs, char *buf) { - struct nilfs_super_block **sbp = nilfs->ns_sbp; + struct nilfs_super_block *raw_sb; + ssize_t len; + + down_read(&nilfs->ns_sem); + raw_sb = nilfs->ns_sbp[0]; + len = scnprintf(buf, sizeof(raw_sb->s_volume_name), "%s\n", + raw_sb->s_volume_name); + up_read(&nilfs->ns_sem); - return scnprintf(buf, sizeof(sbp[0]->s_volume_name), "%s\n", - sbp[0]->s_volume_name); + return len; } static const char dev_readme_str[] = -- 2.34.1

2 1