September 2024 - Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/1] Fix iBMA bug and change version
by Peng Zhang 19 Sep '24

19 Sep '24

From: Wujiahai <wujiahai(a)huawei.com> 1. The initialization sequence of the edma_host.timer and edma_host is optimized when the iBMA initializes the edma driver. 2. Change the iBMA driver version. Wujiahai (1): BMA: Fix edma driver initialization problem and change the version number. .../ethernet/huawei/bma/cdev_drv/bma_cdev.c | 2 +- .../ethernet/huawei/bma/edma_drv/bma_pci.h | 2 +- .../ethernet/huawei/bma/edma_drv/edma_host.c | 80 ++++++++----------- .../huawei/bma/kbox_drv/kbox_include.h | 2 +- .../ethernet/huawei/bma/veth_drv/veth_hb.h | 2 +- 5 files changed, 38 insertions(+), 50 deletions(-) -- 2.27.0

2 2

[PATCH OLK-6.6 v3] KVM:arm64:Add a kvm module param to get current enabled GIC version
by Zhiqiang Ni 19 Sep '24

19 Sep '24

From: Yanan Wang <wangyanan55(a)huawei.com> virt inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAR5EZ CVE: NA Reference: NA -------------------------------- Using GICv4.1 is not a 100% win in all scenarios, sometimes we need to use different GIC version in different usecases. Given that there is not a straight forward way to check the GIC version that system is using (e.g., kernel messages may be overided with time elapses), let's add a module param in KVM such that userspace can check the GIC version simply by reading /sys/module/kvm/parameters/gic_version. Signed-off-by: Yanan Wang <wangyanan55(a)huawei.com> Signed-off-by: Zhiqiang Ni <nizhiqiang1(a)huawei.com> --- arch/arm64/kvm/vgic/vgic-v3.c | 37 +++++++++++++++++++++++++++++++++++ arch/arm64/kvm/vgic/vgic.h | 8 ++++++++ 2 files changed, 45 insertions(+) diff --git a/arch/arm64/kvm/vgic/vgic-v3.c b/arch/arm64/kvm/vgic/vgic-v3.c index dab599e857b5..227fa1874c3b 100644 --- a/arch/arm64/kvm/vgic/vgic-v3.c +++ b/arch/arm64/kvm/vgic/vgic-v3.c @@ -20,6 +20,37 @@ static bool common_trap; static bool dir_trap; static bool gicv4_enable; +enum gic_version global_gic_version = UNKNOWN_GIC_VERSION; +static const char * const gic_version_str[] = { + "GICv2", + "GICv3", + "GICv4", + "GICv4.1", + "unknown" +}; + +static int get_gic_version(char *buffer, const struct kernel_param *kp); +static const struct kernel_param_ops gic_version_ops = { + .get = get_gic_version, +}; + +static const char *gic_version; +module_param_cb(gic_version, &gic_version_ops, &gic_version, 0444); +MODULE_PARM_DESC(gic_version, "Version of current enabled GIC"); + +static int get_gic_version(char *buffer, const struct kernel_param *kp) +{ + int index = global_gic_version; + + if (index < 0 || index >= ARRAY_SIZE(gic_version_str)) { + kvm_err("Invalid GIC version enum %d\n", index); + return -EINVAL; + } + gic_version = gic_version_str[index]; + + return param_get_charp(buffer, kp); +} + void vgic_v3_set_underflow(struct kvm_vcpu *vcpu) { struct vgic_v3_cpu_if *cpuif = &vcpu->arch.vgic_cpu.vgic_v3; @@ -654,6 +685,7 @@ int vgic_v3_probe(const struct gic_kvm_info *info) kvm_vgic_global_state.nr_lr = (ich_vtr_el2 & 0xf) + 1; kvm_vgic_global_state.can_emulate_gicv2 = false; kvm_vgic_global_state.ich_vtr_el2 = ich_vtr_el2; + global_gic_version = GICV3; /* GICv4 support? */ if (info->has_v4) { @@ -663,6 +695,11 @@ int vgic_v3_probe(const struct gic_kvm_info *info) kvm_vgic_global_state.has_gicv4_1 ? ".1" : "", gicv4_enable ? "en" : "dis"); + if (kvm_vgic_global_state.has_gicv4_1) + global_gic_version = GICV4_1; + else if (kvm_vgic_global_state.has_gicv4) + global_gic_version = GICV4; + #ifdef CONFIG_VIRT_VTIMER_IRQ_BYPASS kvm_vgic_global_state.has_direct_vtimer = info->has_vtimer && gicv4_enable; if (kvm_vgic_global_state.has_direct_vtimer) diff --git a/arch/arm64/kvm/vgic/vgic.h b/arch/arm64/kvm/vgic/vgic.h index 5135c690839e..539909a681d7 100644 --- a/arch/arm64/kvm/vgic/vgic.h +++ b/arch/arm64/kvm/vgic/vgic.h @@ -157,6 +157,14 @@ static inline bool vgic_direct_sgi_or_ppi(struct vgic_irq *irq) #endif } +enum gic_version { + GICV2, + GICV3, + GICV4, + GICV4_1, + UNKNOWN_GIC_VERSION +}; + /* * This struct provides an intermediate representation of the fields contained * in the GICH_VMCR and ICH_VMCR registers, such that code exporting the GIC -- 2.43.0

2 1

[PATCH OLK-6.6 0/3] Fix CVE-2024-44991
by Wang Liang 19 Sep '24

19 Sep '24

Eric Dumazet (2): tcp/dccp: bypass empty buckets in inet_twsk_purge() tcp/dccp: do not care about families in inet_twsk_purge() Florian Westphal (1): tcp: prevent concurrent execution of tcp_sk_exit_batch include/net/inet_timewait_sock.h | 2 +- include/net/tcp.h | 2 +- net/dccp/ipv4.c | 2 +- net/dccp/ipv6.c | 6 ------ net/ipv4/inet_timewait_sock.c | 16 +++++++++------- net/ipv4/tcp_ipv4.c | 16 +++++++++++++++- net/ipv4/tcp_minisocks.c | 6 +++--- net/ipv6/tcp_ipv6.c | 6 ------ 8 files changed, 30 insertions(+), 26 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6 v3] KVM:arm64:Add a kvm parameter to control guest wfi trapping
by Zhiqiang Ni 19 Sep '24

19 Sep '24

virt inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAQV1W CVE: NA Reference: NA -------------------------------- Currently, on GICv4+ system if a vCPU is only runnable process on a pCPU and we are using direct injection of interrupts, the guest WFI trapping will be turn off. So in host view, the vcpu process's CPU util is almost 100%, which may confuse someone. Let's add a kvm parameter to control guest wfi trapping. Signed-off-by: Zhiqiang Ni <nizhiqiang1(a)huawei.com> --- arch/arm64/include/asm/kvm_emulate.h | 3 ++ arch/arm64/include/asm/kvm_host.h | 2 ++ arch/arm64/kvm/arm.c | 49 ++++++++++++++++++++++++++++ 3 files changed, 54 insertions(+) diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h index 2293caab9..6992d010b 100644 --- a/arch/arm64/include/asm/kvm_emulate.h +++ b/arch/arm64/include/asm/kvm_emulate.h @@ -119,6 +119,9 @@ static inline void vcpu_clear_wfx_traps(struct kvm_vcpu *vcpu) vcpu->arch.hcr_el2 &= ~HCR_TWI; else vcpu->arch.hcr_el2 |= HCR_TWI; + + if (force_wfi_trap) + vcpu->arch.hcr_el2 |= HCR_TWI; } static inline void vcpu_set_wfx_traps(struct kvm_vcpu *vcpu) diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h index ac8115098..5ba983f71 100644 --- a/arch/arm64/include/asm/kvm_host.h +++ b/arch/arm64/include/asm/kvm_host.h @@ -54,6 +54,7 @@ #define KVM_REQ_SUSPEND KVM_ARCH_REQ(6) #define KVM_REQ_RESYNC_PMU_EL0 KVM_ARCH_REQ(7) #define KVM_REQ_RELOAD_TLBI_DVMBM KVM_ARCH_REQ(8) +#define KVM_REQ_RELOAD_WFI_TRAPS KVM_ARCH_REQ(9) #define KVM_DIRTY_LOG_MANUAL_CAPS (KVM_DIRTY_LOG_MANUAL_PROTECT_ENABLE | \ KVM_DIRTY_LOG_INITIALLY_SET) @@ -1244,6 +1245,7 @@ extern unsigned int twedel; void kvm_arm_vcpu_power_off(struct kvm_vcpu *vcpu); bool kvm_arm_vcpu_stopped(struct kvm_vcpu *vcpu); +extern bool force_wfi_trap; extern bool kvm_ncsnp_support; extern bool kvm_dvmbm_support; diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c index fe3add87e..3e0e84ce9 100644 --- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -82,6 +82,48 @@ unsigned int twedel; module_param(twedel, uint, 0644); #endif +static int vcpu_req_reload_wfi_traps(const char *val, const struct kernel_param *kp); + +static const struct kernel_param_ops force_wfi_trap_ops = { + .set = vcpu_req_reload_wfi_traps, + .get = param_get_bool, +}; + +bool force_wfi_trap; +module_param_cb(force_wfi_trap, &force_wfi_trap_ops, &force_wfi_trap, 0644); + +static int vcpu_req_reload_wfi_traps(const char *val, const struct kernel_param *kp) +{ + struct kvm *kvm; + bool oldvalue; + int err; + + oldvalue = force_wfi_trap; + err = param_set_bool(val, kp); + if (err) + return err; + + if (oldvalue == force_wfi_trap) + return err; + + /* + * If set the force_wfi_trap from 1 to 0, no need to kick vcpus here. + * The HCR_TWI flag will be cleared in kvm_arch_vcpu_load(). + */ + if (force_wfi_trap == 0) + return 0; + + /* + * We need to kick vcpus out of guest mode here to reload + * wfx trapping config when re-enter guest mode. + */ + mutex_lock(&kvm_lock); + list_for_each_entry(kvm, &vm_list, vm_list) + kvm_make_all_cpus_request(kvm, KVM_REQ_RELOAD_WFI_TRAPS); + mutex_unlock(&kvm_lock); + return err; +} + int kvm_arch_vcpu_should_kick(struct kvm_vcpu *vcpu) { return kvm_vcpu_exiting_guest_mode(vcpu) == IN_GUEST_MODE; @@ -958,6 +1000,13 @@ static int check_vcpu_requests(struct kvm_vcpu *vcpu) if (kvm_check_request(KVM_REQ_RELOAD_TLBI_DVMBM, vcpu)) kvm_hisi_reload_lsudvmbm(vcpu->kvm); + + if (kvm_check_request(KVM_REQ_RELOAD_WFI_TRAPS, vcpu)) { + if (single_task_running()) + vcpu_clear_wfx_traps(vcpu); + else + vcpu_set_wfx_traps(vcpu); + } } return 1; -- 2.43.0

2 1

[PATCH v3 OLK-6.6] KVM:arm64:Add a kvm parameter to control guest wfi trapping
by Zhiqiang Ni 19 Sep '24

19 Sep '24

virt inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAQV1W CVE: NA Reference: NA -------------------------------- Currently, on GICv4+ system if a vCPU is only runnable process on a pCPU and we are using direct injection of interrupts, the guest WFI trapping will be turn off. So in host view, the vcpu process's CPU util is almost 100%, which may confuse someone. Let's add a kvm parameter to control guest wfi trapping. Signed-off-by: Zhiqiang Ni <nizhiqiang1(a)huawei.com> --- arch/arm64/include/asm/kvm_emulate.h | 3 ++ arch/arm64/include/asm/kvm_host.h | 2 ++ arch/arm64/kvm/arm.c | 49 ++++++++++++++++++++++++++++ 3 files changed, 54 insertions(+) diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h index 2293caab9..6992d010b 100644 --- a/arch/arm64/include/asm/kvm_emulate.h +++ b/arch/arm64/include/asm/kvm_emulate.h @@ -119,6 +119,9 @@ static inline void vcpu_clear_wfx_traps(struct kvm_vcpu *vcpu) vcpu->arch.hcr_el2 &= ~HCR_TWI; else vcpu->arch.hcr_el2 |= HCR_TWI; + + if (force_wfi_trap) + vcpu->arch.hcr_el2 |= HCR_TWI; } static inline void vcpu_set_wfx_traps(struct kvm_vcpu *vcpu) diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h index ac8115098..5ba983f71 100644 --- a/arch/arm64/include/asm/kvm_host.h +++ b/arch/arm64/include/asm/kvm_host.h @@ -54,6 +54,7 @@ #define KVM_REQ_SUSPEND KVM_ARCH_REQ(6) #define KVM_REQ_RESYNC_PMU_EL0 KVM_ARCH_REQ(7) #define KVM_REQ_RELOAD_TLBI_DVMBM KVM_ARCH_REQ(8) +#define KVM_REQ_RELOAD_WFI_TRAPS KVM_ARCH_REQ(9) #define KVM_DIRTY_LOG_MANUAL_CAPS (KVM_DIRTY_LOG_MANUAL_PROTECT_ENABLE | \ KVM_DIRTY_LOG_INITIALLY_SET) @@ -1244,6 +1245,7 @@ extern unsigned int twedel; void kvm_arm_vcpu_power_off(struct kvm_vcpu *vcpu); bool kvm_arm_vcpu_stopped(struct kvm_vcpu *vcpu); +extern bool force_wfi_trap; extern bool kvm_ncsnp_support; extern bool kvm_dvmbm_support; diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c index fe3add87e..3e0e84ce9 100644 --- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -82,6 +82,48 @@ unsigned int twedel; module_param(twedel, uint, 0644); #endif +static int vcpu_req_reload_wfi_traps(const char *val, const struct kernel_param *kp); + +static const struct kernel_param_ops force_wfi_trap_ops = { + .set = vcpu_req_reload_wfi_traps, + .get = param_get_bool, +}; + +bool force_wfi_trap; +module_param_cb(force_wfi_trap, &force_wfi_trap_ops, &force_wfi_trap, 0644); + +static int vcpu_req_reload_wfi_traps(const char *val, const struct kernel_param *kp) +{ + struct kvm *kvm; + bool oldvalue; + int err; + + oldvalue = force_wfi_trap; + err = param_set_bool(val, kp); + if (err) + return err; + + if (oldvalue == force_wfi_trap) + return err; + + /* + * If set the force_wfi_trap from 1 to 0, no need to kick vcpus here. + * The HCR_TWI flag will be cleared in kvm_arch_vcpu_load(). + */ + if (force_wfi_trap == 0) + return 0; + + /* + * We need to kick vcpus out of guest mode here to reload + * wfx trapping config when re-enter guest mode. + */ + mutex_lock(&kvm_lock); + list_for_each_entry(kvm, &vm_list, vm_list) + kvm_make_all_cpus_request(kvm, KVM_REQ_RELOAD_WFI_TRAPS); + mutex_unlock(&kvm_lock); + return err; +} + int kvm_arch_vcpu_should_kick(struct kvm_vcpu *vcpu) { return kvm_vcpu_exiting_guest_mode(vcpu) == IN_GUEST_MODE; @@ -958,6 +1000,13 @@ static int check_vcpu_requests(struct kvm_vcpu *vcpu) if (kvm_check_request(KVM_REQ_RELOAD_TLBI_DVMBM, vcpu)) kvm_hisi_reload_lsudvmbm(vcpu->kvm); + + if (kvm_check_request(KVM_REQ_RELOAD_WFI_TRAPS, vcpu)) { + if (single_task_running()) + vcpu_clear_wfx_traps(vcpu); + else + vcpu_set_wfx_traps(vcpu); + } } return 1; -- 2.43.0

2 1

[PATCH v3 OLK-6.6] KVM:arm64:Add a kvm parameter to control guest wfi trapping
by Zhiqiang Ni 19 Sep '24

19 Sep '24

virt inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAQV1W CVE: NA Reference: NA -------------------------------- Currently, on GICv4+ system if a vCPU is only runnable process on a pCPU and we are using direct injection of interrupts, the guest WFI trapping will be turn off. So in host view, the vcpu process's CPU util is almost 100%, which may confuse someone. Let's add a kvm parameter to control guest wfi trapping. Signed-off-by: Zhiqiang Ni <nizhiqiang1(a)huawei.com> --- arch/arm64/include/asm/kvm_emulate.h | 3 ++ arch/arm64/include/asm/kvm_host.h | 2 ++ arch/arm64/kvm/arm.c | 49 ++++++++++++++++++++++++++++ 3 files changed, 54 insertions(+) diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h index 2293caab9..6992d010b 100644 --- a/arch/arm64/include/asm/kvm_emulate.h +++ b/arch/arm64/include/asm/kvm_emulate.h @@ -119,6 +119,9 @@ static inline void vcpu_clear_wfx_traps(struct kvm_vcpu *vcpu) vcpu->arch.hcr_el2 &= ~HCR_TWI; else vcpu->arch.hcr_el2 |= HCR_TWI; + + if (force_wfi_trap) + vcpu->arch.hcr_el2 |= HCR_TWI; } static inline void vcpu_set_wfx_traps(struct kvm_vcpu *vcpu) diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h index ac8115098..5ba983f71 100644 --- a/arch/arm64/include/asm/kvm_host.h +++ b/arch/arm64/include/asm/kvm_host.h @@ -54,6 +54,7 @@ #define KVM_REQ_SUSPEND KVM_ARCH_REQ(6) #define KVM_REQ_RESYNC_PMU_EL0 KVM_ARCH_REQ(7) #define KVM_REQ_RELOAD_TLBI_DVMBM KVM_ARCH_REQ(8) +#define KVM_REQ_RELOAD_WFI_TRAPS KVM_ARCH_REQ(9) #define KVM_DIRTY_LOG_MANUAL_CAPS (KVM_DIRTY_LOG_MANUAL_PROTECT_ENABLE | \ KVM_DIRTY_LOG_INITIALLY_SET) @@ -1244,6 +1245,7 @@ extern unsigned int twedel; void kvm_arm_vcpu_power_off(struct kvm_vcpu *vcpu); bool kvm_arm_vcpu_stopped(struct kvm_vcpu *vcpu); +extern bool force_wfi_trap; extern bool kvm_ncsnp_support; extern bool kvm_dvmbm_support; diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c index fe3add87e..3e0e84ce9 100644 --- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -82,6 +82,48 @@ unsigned int twedel; module_param(twedel, uint, 0644); #endif +static int vcpu_req_reload_wfi_traps(const char *val, const struct kernel_param *kp); + +static const struct kernel_param_ops force_wfi_trap_ops = { + .set = vcpu_req_reload_wfi_traps, + .get = param_get_bool, +}; + +bool force_wfi_trap; +module_param_cb(force_wfi_trap, &force_wfi_trap_ops, &force_wfi_trap, 0644); + +static int vcpu_req_reload_wfi_traps(const char *val, const struct kernel_param *kp) +{ + struct kvm *kvm; + bool oldvalue; + int err; + + oldvalue = force_wfi_trap; + err = param_set_bool(val, kp); + if (err) + return err; + + if (oldvalue == force_wfi_trap) + return err; + + /* + * If set the force_wfi_trap from 1 to 0, no need to kick vcpus here. + * The HCR_TWI flag will be cleared in kvm_arch_vcpu_load(). + */ + if (force_wfi_trap == 0) + return 0; + + /* + * We need to kick vcpus out of guest mode here to reload + * wfx trapping config when re-enter guest mode. + */ + mutex_lock(&kvm_lock); + list_for_each_entry(kvm, &vm_list, vm_list) + kvm_make_all_cpus_request(kvm, KVM_REQ_RELOAD_WFI_TRAPS); + mutex_unlock(&kvm_lock); + return err; +} + int kvm_arch_vcpu_should_kick(struct kvm_vcpu *vcpu) { return kvm_vcpu_exiting_guest_mode(vcpu) == IN_GUEST_MODE; @@ -958,6 +1000,13 @@ static int check_vcpu_requests(struct kvm_vcpu *vcpu) if (kvm_check_request(KVM_REQ_RELOAD_TLBI_DVMBM, vcpu)) kvm_hisi_reload_lsudvmbm(vcpu->kvm); + + if (kvm_check_request(KVM_REQ_RELOAD_WFI_TRAPS, vcpu)) { + if (single_task_running()) + vcpu_clear_wfx_traps(vcpu); + else + vcpu_set_wfx_traps(vcpu); + } } return 1; -- 2.43.0

2 1

[PATCH OLK-6.6] RDMA/hns: Fix ah error counter in sw stat not increasing
by Junxian Huang 19 Sep '24

19 Sep '24

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IARV1S CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git/commit/?id=39… ---------------------------------------------------------------------- There are several error cases where hns_roce_create_ah() returns directly without jumping to sw stat path, thus leading to a problem that the ah error counter does not increase. Fixes: db90f0012b30 ("RDMA/hns: Support SW stats with debugfs") Signed-off-by: Junxian Huang <huangjunxian6(a)hisilicon.com> Link: https://patch.msgid.link/20240912115700.2016443-1-huangjunxian6@hisilicon.c… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Xinghai Cen <cenxinghai(a)h-partners.com> --- drivers/infiniband/hw/hns/hns_roce_ah.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_ah.c b/drivers/infiniband/hw/hns/hns_roce_ah.c index a1adf249b86a..2af9cfd435ec 100644 --- a/drivers/infiniband/hw/hns/hns_roce_ah.c +++ b/drivers/infiniband/hw/hns/hns_roce_ah.c @@ -63,8 +63,10 @@ int hns_roce_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr, u32 max_sl; int ret; - if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08 && udata) - return -EOPNOTSUPP; + if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08 && udata) { + ret = -EOPNOTSUPP; + goto err_out; + } ah->av.port = rdma_ah_get_port_num(ah_attr); ah->av.gid_index = grh->sgid_index; @@ -83,7 +85,7 @@ int hns_roce_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr, ret = 0; if (ret && grh->sgid_attr->gid_type == IB_GID_TYPE_ROCE_UDP_ENCAP) - return ret; + goto err_out; if (tc_mode == HNAE3_TC_MAP_MODE_DSCP && grh->sgid_attr->gid_type == IB_GID_TYPE_ROCE_UDP_ENCAP) @@ -96,7 +98,8 @@ int hns_roce_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr, ibdev_err_ratelimited(&hr_dev->ib_dev, "failed to set sl, sl (%u) shouldn't be larger than %u.\n", ah->av.sl, max_sl); - return -EINVAL; + ret = -EINVAL; + goto err_out; } memcpy(ah->av.dgid, grh->dgid.raw, HNS_ROCE_GID_SIZE); -- 2.33.0

2 1

[PATCH OLK-6.6 v2 0/2] Fix VSYNC referencing an unmapped VPE on GIC v4.0/v4.1
by Zhou Wang 19 Sep '24

19 Sep '24

From: caijian <caijian11(a)h-partners.com> Patch#1 Fix VSYNC referencing an unmapped VPE on GIC v4.1 Patch#2 Fix VSYNC referencing an unmapped VPE on GIC v4.0 Nianyao Tang (1): irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.1 Zhou Wang (1): irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.0 drivers/irqchip/irq-gic-v3-its.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) -- 2.33.0

2 3

[PATCH openEuler-1.0-LTS] mmc: mmc_test: Fix NULL dereference on allocation failure
by Cai Xinchen 19 Sep '24

19 Sep '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v4.19.321 commit e97be13a9f51284da450dd2a592e3fa87b49cdc9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAQOJH CVE: CVE-2024-45028 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a1e627af32ed60713941cbfc8075d44cad07f6dd ] If the "test->highmem = alloc_pages()" allocation fails then calling __free_pages(test->highmem) will result in a NULL dereference. Also change the error code to -ENOMEM instead of returning success. Fixes: 2661081f5ab9 ("mmc_test: highmem tests") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Link: https://lore.kernel.org/r/8c90be28-67b4-4b0d-a105-034dc72a0b31@stanley.moun… Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/mmc/core/mmc_test.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/mmc/core/mmc_test.c b/drivers/mmc/core/mmc_test.c index ef18daeaa4cc..164b4e43050e 100644 --- a/drivers/mmc/core/mmc_test.c +++ b/drivers/mmc/core/mmc_test.c @@ -3101,13 +3101,13 @@ static ssize_t mtf_test_write(struct file *file, const char __user *buf, test->buffer = kzalloc(BUFFER_SIZE, GFP_KERNEL); #ifdef CONFIG_HIGHMEM test->highmem = alloc_pages(GFP_KERNEL | __GFP_HIGHMEM, BUFFER_ORDER); + if (!test->highmem) { + count = -ENOMEM; + goto free_test_buffer; + } #endif -#ifdef CONFIG_HIGHMEM - if (test->buffer && test->highmem) { -#else if (test->buffer) { -#endif mutex_lock(&mmc_test_lock); mmc_test_run(test, testcase); mutex_unlock(&mmc_test_lock); @@ -3115,6 +3115,7 @@ static ssize_t mtf_test_write(struct file *file, const char __user *buf, #ifdef CONFIG_HIGHMEM __free_pages(test->highmem, BUFFER_ORDER); +free_test_buffer: #endif kfree(test->buffer); kfree(test); -- 2.34.1

2 1

[PATCH OLK-5.10] mmc: mmc_test: Fix NULL dereference on allocation failure
by Cai Xinchen 19 Sep '24

19 Sep '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v5.10.225 commit 9b9ba386d7bfdbc38445932c90fa9444c0524bea category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAQOJH CVE: CVE-2024-45028 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a1e627af32ed60713941cbfc8075d44cad07f6dd ] If the "test->highmem = alloc_pages()" allocation fails then calling __free_pages(test->highmem) will result in a NULL dereference. Also change the error code to -ENOMEM instead of returning success. Fixes: 2661081f5ab9 ("mmc_test: highmem tests") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Link: https://lore.kernel.org/r/8c90be28-67b4-4b0d-a105-034dc72a0b31@stanley.moun… Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/mmc/core/mmc_test.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/mmc/core/mmc_test.c b/drivers/mmc/core/mmc_test.c index b9b6f000154b..9ebd5cebd4e1 100644 --- a/drivers/mmc/core/mmc_test.c +++ b/drivers/mmc/core/mmc_test.c @@ -3125,13 +3125,13 @@ static ssize_t mtf_test_write(struct file *file, const char __user *buf, test->buffer = kzalloc(BUFFER_SIZE, GFP_KERNEL); #ifdef CONFIG_HIGHMEM test->highmem = alloc_pages(GFP_KERNEL | __GFP_HIGHMEM, BUFFER_ORDER); + if (!test->highmem) { + count = -ENOMEM; + goto free_test_buffer; + } #endif -#ifdef CONFIG_HIGHMEM - if (test->buffer && test->highmem) { -#else if (test->buffer) { -#endif mutex_lock(&mmc_test_lock); mmc_test_run(test, testcase); mutex_unlock(&mmc_test_lock); @@ -3139,6 +3139,7 @@ static ssize_t mtf_test_write(struct file *file, const char __user *buf, #ifdef CONFIG_HIGHMEM __free_pages(test->highmem, BUFFER_ORDER); +free_test_buffer: #endif kfree(test->buffer); kfree(test); -- 2.34.1

2 1