September 2024 - Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/1] fix CVE-2023-45896
by Lin Yujun 04 Sep '24

04 Sep '24

Konstantin Komarov (1): fs/ntfs3: Add more attributes checks in mi_enum_attr() fs/ntfs3/record.c | 63 +++++++++++++++++++++++++++++++++++++---------- 1 file changed, 50 insertions(+), 13 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10] hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
by Liu Mingrui 04 Sep '24

04 Sep '24

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v5.10.224 commit 10f7163bfb5f8b4e0c9c05a939f20b8540e33c65 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPRV CVE: CVE-2024-42311 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 26a2ed107929a855155429b11e1293b83e6b2a8b upstream. Syzbot reports uninitialized value access issue as below: loop0: detected capacity change from 0 to 64 ===================================================== BUG: KMSAN: uninit-value in hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30 hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30 d_revalidate fs/namei.c:862 [inline] lookup_fast+0x89e/0x8e0 fs/namei.c:1649 walk_component fs/namei.c:2001 [inline] link_path_walk+0x817/0x1480 fs/namei.c:2332 path_lookupat+0xd9/0x6f0 fs/namei.c:2485 filename_lookup+0x22e/0x740 fs/namei.c:2515 user_path_at_empty+0x8b/0x390 fs/namei.c:2924 user_path_at include/linux/namei.h:57 [inline] do_mount fs/namespace.c:3689 [inline] __do_sys_mount fs/namespace.c:3898 [inline] __se_sys_mount+0x66b/0x810 fs/namespace.c:3875 __x64_sys_mount+0xe4/0x140 fs/namespace.c:3875 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b BUG: KMSAN: uninit-value in hfs_ext_read_extent fs/hfs/extent.c:196 [inline] BUG: KMSAN: uninit-value in hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366 hfs_ext_read_extent fs/hfs/extent.c:196 [inline] hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366 block_read_full_folio+0x4ff/0x11b0 fs/buffer.c:2271 hfs_read_folio+0x55/0x60 fs/hfs/inode.c:39 filemap_read_folio+0x148/0x4f0 mm/filemap.c:2426 do_read_cache_folio+0x7c8/0xd90 mm/filemap.c:3553 do_read_cache_page mm/filemap.c:3595 [inline] read_cache_page+0xfb/0x2f0 mm/filemap.c:3604 read_mapping_page include/linux/pagemap.h:755 [inline] hfs_btree_open+0x928/0x1ae0 fs/hfs/btree.c:78 hfs_mdb_get+0x260c/0x3000 fs/hfs/mdb.c:204 hfs_fill_super+0x1fb1/0x2790 fs/hfs/super.c:406 mount_bdev+0x628/0x920 fs/super.c:1359 hfs_mount+0xcd/0xe0 fs/hfs/super.c:456 legacy_get_tree+0x167/0x2e0 fs/fs_context.c:610 vfs_get_tree+0xdc/0x5d0 fs/super.c:1489 do_new_mount+0x7a9/0x16f0 fs/namespace.c:3145 path_mount+0xf98/0x26a0 fs/namespace.c:3475 do_mount fs/namespace.c:3488 [inline] __do_sys_mount fs/namespace.c:3697 [inline] __se_sys_mount+0x919/0x9e0 fs/namespace.c:3674 __ia32_sys_mount+0x15b/0x1b0 fs/namespace.c:3674 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246 entry_SYSENTER_compat_after_hwframe+0x70/0x82 Uninit was created at: __alloc_pages+0x9a6/0xe00 mm/page_alloc.c:4590 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page mm/slub.c:2190 [inline] allocate_slab mm/slub.c:2354 [inline] new_slab+0x2d7/0x1400 mm/slub.c:2407 ___slab_alloc+0x16b5/0x3970 mm/slub.c:3540 __slab_alloc mm/slub.c:3625 [inline] __slab_alloc_node mm/slub.c:3678 [inline] slab_alloc_node mm/slub.c:3850 [inline] kmem_cache_alloc_lru+0x64d/0xb30 mm/slub.c:3879 alloc_inode_sb include/linux/fs.h:3018 [inline] hfs_alloc_inode+0x5a/0xc0 fs/hfs/super.c:165 alloc_inode+0x83/0x440 fs/inode.c:260 new_inode_pseudo fs/inode.c:1005 [inline] new_inode+0x38/0x4f0 fs/inode.c:1031 hfs_new_inode+0x61/0x1010 fs/hfs/inode.c:186 hfs_mkdir+0x54/0x250 fs/hfs/dir.c:228 vfs_mkdir+0x49a/0x700 fs/namei.c:4126 do_mkdirat+0x529/0x810 fs/namei.c:4149 __do_sys_mkdirat fs/namei.c:4164 [inline] __se_sys_mkdirat fs/namei.c:4162 [inline] __x64_sys_mkdirat+0xc8/0x120 fs/namei.c:4162 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b It missed to initialize .tz_secondswest, .cached_start and .cached_blocks fields in struct hfs_inode_info after hfs_alloc_inode(), fix it. Cc: stable(a)vger.kernel.org Reported-by: syzbot+3ae6be33a50b5aae4dab(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-fsdevel/0000000000005ad04005ee48897f@google.c… Signed-off-by: Chao Yu <chao(a)kernel.org> Link: https://lore.kernel.org/r/20240616013841.2217-1-chao@kernel.org Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- fs/hfs/inode.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/hfs/inode.c b/fs/hfs/inode.c index 6fbde990e056..3d59cdb31278 100644 --- a/fs/hfs/inode.c +++ b/fs/hfs/inode.c @@ -200,6 +200,7 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t HFS_I(inode)->flags = 0; HFS_I(inode)->rsrc_inode = NULL; HFS_I(inode)->fs_blocks = 0; + HFS_I(inode)->tz_secondswest = sys_tz.tz_minuteswest * 60; if (S_ISDIR(mode)) { inode->i_size = 2; HFS_SB(sb)->folder_count++; @@ -275,6 +276,8 @@ void hfs_inode_read_fork(struct inode *inode, struct hfs_extent *ext, for (count = 0, i = 0; i < 3; i++) count += be16_to_cpu(ext[i].count); HFS_I(inode)->first_blocks = count; + HFS_I(inode)->cached_start = 0; + HFS_I(inode)->cached_blocks = 0; inode->i_size = HFS_I(inode)->phys_size = log_size; HFS_I(inode)->fs_blocks = (log_size + sb->s_blocksize - 1) >> sb->s_blocksize_bits; -- 2.25.1

2 1

[openeuler:OLK-5.10 29999/30000] drivers/acpi/acpi_memhotplug.c:236: undefined reference to `hmat_restore_target'
by kernel test robot 04 Sep '24

04 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: b7bed6628b750ffd687d1da0a170dece4b0c08bd commit: 2e1b00fcf1e3152a1e73846f5f9ec37cef088a65 [29999/30000] ACPI/HMAT: Add missing locality information for hot-added device config: x86_64-randconfig-013-20240903 (https://download.01.org/0day-ci/archive/20240904/202409040825.59qJfROR-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240904/202409040825.59qJfROR-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409040825.59qJfROR-lkp@intel.com/ All errors (new ones prefixed by >>): ld: drivers/acpi/acpi_memhotplug.o: in function `acpi_memory_enable_device': >> drivers/acpi/acpi_memhotplug.c:236: undefined reference to `hmat_restore_target' vim +236 drivers/acpi/acpi_memhotplug.c 171 172 static int acpi_memory_enable_device(struct acpi_memory_device *mem_device) 173 { 174 acpi_handle handle = mem_device->device->handle; 175 int result, num_enabled = 0; 176 struct acpi_memory_info *info; 177 int node; 178 179 node = acpi_get_node(handle); 180 /* 181 * Tell the VM there is more memory here... 182 * Note: Assume that this function returns zero on success 183 * We don't have memory-hot-add rollback function,now. 184 * (i.e. memory-hot-remove function) 185 */ 186 list_for_each_entry(info, &mem_device->res_list, list) { 187 if (info->enabled) { /* just sanity check...*/ 188 num_enabled++; 189 continue; 190 } 191 /* 192 * If the memory block size is zero, please ignore it. 193 * Don't try to do the following memory hotplug flowchart. 194 */ 195 if (!info->length) 196 continue; 197 if (node < 0) 198 node = memory_add_physaddr_to_nid(info->start_addr); 199 200 result = __add_memory(node, info->start_addr, info->length, 201 MHP_NONE); 202 203 /* 204 * If the memory block has been used by the kernel, add_memory() 205 * returns -EEXIST. If add_memory() returns the other error, it 206 * means that this memory block is not used by the kernel. 207 */ 208 if (result && result != -EEXIST) 209 continue; 210 211 result = acpi_bind_memory_blocks(info, mem_device->device); 212 if (result) { 213 acpi_unbind_memory_blocks(info); 214 return -ENODEV; 215 } 216 217 info->enabled = 1; 218 219 /* 220 * Add num_enable even if add_memory() returns -EEXIST, so the 221 * device is bound to this driver. 222 */ 223 224 hotplug_mdev[node] = mem_device->device; 225 num_enabled++; 226 } 227 if (acpi_has_method(handle, "_HMA")) { 228 acpi_status status; 229 struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL }; 230 231 status = acpi_evaluate_object(handle, "_HMA", NULL, &buffer); 232 if (ACPI_SUCCESS(status) && buffer.length) { 233 union acpi_object *obj = buffer.pointer; 234 235 if (!obj->buffer.length) > 236 hmat_restore_target(node); 237 } 238 } 239 240 if (!num_enabled) { 241 dev_err(&mem_device->device->dev, "add_memory failed\n"); 242 return -EINVAL; 243 } 244 /* 245 * Sometimes the memory device will contain several memory blocks. 246 * When one memory block is hot-added to the system memory, it will 247 * be regarded as a success. 248 * Otherwise if the last memory block can't be hot-added to the system 249 * memory, it will be failure and the memory device can't be bound with 250 * driver. 251 */ 252 return 0; 253 } 254 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 29716/30000] drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c:1195:5: warning: no previous prototype for function 'hclge_tm_vf_tc_dwrr_cfg'
by kernel test robot 04 Sep '24

04 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: b7bed6628b750ffd687d1da0a170dece4b0c08bd commit: 518ea89ec98b78c749c27d6ba7792e1bdb5779ed [29716/30000] net: hns3: add support for vf multiple tcs config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240904/202409040605.jzWfVsDp-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240904/202409040605.jzWfVsDp-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409040605.jzWfVsDp-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c:1195:5: warning: no previous prototype for function 'hclge_tm_vf_tc_dwrr_cfg' [-Wmissing-prototypes] 1195 | int hclge_tm_vf_tc_dwrr_cfg(struct hclge_vport *vport) | ^ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c:1195:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1195 | int hclge_tm_vf_tc_dwrr_cfg(struct hclge_vport *vport) | ^ | static >> drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c:2323:5: warning: no previous prototype for function 'hclge_mbx_set_vf_multi_tc' [-Wmissing-prototypes] 2323 | int hclge_mbx_set_vf_multi_tc(struct hclge_vport *vport, | ^ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c:2323:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2323 | int hclge_mbx_set_vf_multi_tc(struct hclge_vport *vport, | ^ | static 2 warnings generated. vim +/hclge_tm_vf_tc_dwrr_cfg +1195 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c 1194 > 1195 int hclge_tm_vf_tc_dwrr_cfg(struct hclge_vport *vport) 1196 { 1197 struct hnae3_knic_private_info *kinfo = &vport->nic.kinfo; 1198 struct hclge_dev *hdev = vport->back; 1199 struct hclge_pg_info *pg_info; 1200 u8 dwrr; 1201 int ret; 1202 u32 i; 1203 1204 for (i = 0; i < kinfo->tc_info.max_tc; i++) { 1205 pg_info = &hdev->tm_info.pg_info[hdev->tm_info.tc_info[i].pgid]; 1206 dwrr = i < kinfo->tc_info.num_tc ? pg_info->tc_dwrr[i] : 0; 1207 ret = hclge_tm_qs_weight_cfg(hdev, vport->qs_offset + i, dwrr); 1208 if (ret) 1209 return ret; 1210 } 1211 1212 return 0; 1213 } 1214 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 16259/30000] mm/memcontrol.c:5402:40: error: implicit declaration of function 'ksm_process_profit'
by kernel test robot 04 Sep '24

04 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: b7bed6628b750ffd687d1da0a170dece4b0c08bd commit: 0f6fb3570be40b783d8c756d64297be1a8e3d2b3 [16259/30000] memcg: support ksm merge any mode per cgroup config: x86_64-buildonly-randconfig-004-20240903 (https://download.01.org/0day-ci/archive/20240904/202409040111.5iXDLbsV-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240904/202409040111.5iXDLbsV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409040111.5iXDLbsV-lkp@intel.com/ All errors (new ones prefixed by >>): mm/memcontrol.c: In function 'memory_ksm_show': >> mm/memcontrol.c:5402:40: error: implicit declaration of function 'ksm_process_profit' [-Werror=implicit-function-declaration] 5402 | ksm_process_profits += ksm_process_profit(mm); | ^~~~~~~~~~~~~~~~~~ cc1: some warnings being treated as errors vim +/ksm_process_profit +5402 mm/memcontrol.c 5379 5380 static int memory_ksm_show(struct seq_file *m, void *v) 5381 { 5382 unsigned long ksm_merging_pages = 0; 5383 unsigned long ksm_rmap_items = 0; 5384 long ksm_process_profits = 0; 5385 unsigned int tasks = 0; 5386 struct task_struct *task; 5387 struct mm_struct *mm; 5388 struct css_task_iter it; 5389 struct mem_cgroup *memcg = mem_cgroup_from_seq(m); 5390 5391 css_task_iter_start(&memcg->css, CSS_TASK_ITER_PROCS, &it); 5392 while ((task = css_task_iter_next(&it))) { 5393 mm = get_task_mm(task); 5394 if (!mm) 5395 continue; 5396 5397 if (test_bit(MMF_VM_MERGE_ANY, &mm->flags)) 5398 tasks++; 5399 5400 ksm_rmap_items += mm->ksm_rmap_items; 5401 ksm_merging_pages += mm->ksm_merging_pages; > 5402 ksm_process_profits += ksm_process_profit(mm); 5403 mmput(mm); 5404 } 5405 css_task_iter_end(&it); 5406 5407 seq_printf(m, "merge any state: %d\n", READ_ONCE(memcg->ksm_merge_any)); 5408 seq_printf(m, "merge any tasks: %u\n", tasks); 5409 seq_printf(m, "ksm_rmap_items %lu\n", ksm_rmap_items); 5410 seq_printf(m, "ksm_merging_pages %lu\n", ksm_merging_pages); 5411 seq_printf(m, "ksm_process_profits %ld\n", ksm_process_profits); 5412 return 0; 5413 } 5414 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 29379/30000] drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c:2327:6: warning: no previous prototype for function 'mcp251xfd_tx_obj_write_sync'
by kernel test robot 04 Sep '24

04 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: b7bed6628b750ffd687d1da0a170dece4b0c08bd commit: b4eaf3e808dc2abcab55bc72df3b0d15961f33f0 [29379/30000] can: mcp251xfd: fix infinite loop when xmit fails config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240904/202409040151.sxh3qZ5K-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240904/202409040151.sxh3qZ5K-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409040151.sxh3qZ5K-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c:2327:6: warning: no previous prototype for function 'mcp251xfd_tx_obj_write_sync' [-Wmissing-prototypes] 2327 | void mcp251xfd_tx_obj_write_sync(struct work_struct *work) | ^ drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c:2327:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2327 | void mcp251xfd_tx_obj_write_sync(struct work_struct *work) | ^ | static drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c:511:1: warning: unused function 'mcp251xfd_chip_set_mode_nowait' [-Wunused-function] 511 | mcp251xfd_chip_set_mode_nowait(const struct mcp251xfd_priv *priv, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2 warnings generated. vim +/mcp251xfd_tx_obj_write_sync +2327 drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c 2326 > 2327 void mcp251xfd_tx_obj_write_sync(struct work_struct *work) 2328 { 2329 struct mcp251xfd_priv *priv = container_of(work, struct mcp251xfd_priv, 2330 tx_work); 2331 struct mcp251xfd_tx_obj *tx_obj = priv->tx_work_obj; 2332 struct mcp251xfd_tx_ring *tx_ring = priv->tx; 2333 int err; 2334 2335 err = spi_sync(priv->spi, &tx_obj->msg); 2336 if (err) 2337 mcp251xfd_tx_failure_drop(priv, tx_ring, err); 2338 } 2339 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] dev/parport: fix the array out-of-bounds risk
by dinglongwei 03 Sep '24

03 Sep '24

From: tuhaowen <tuhaowen(a)uniontech.com> stable inclusion from stable-v4.19.320 commit 166a0bddcc27de41fe13f861c8348e8e53e988c8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQAA CVE: CVE-2024-42301 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ab11dac93d2d568d151b1918d7b84c2d02bacbd5 ] Fixed array out-of-bounds issues caused by sprintf by replacing it with snprintf for safer data copying, ensuring the destination buffer is not overflowed. Below is the stack trace I encountered during the actual issue: [ 66.575408s] [pid:5118,cpu4,QThread,4]Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: do_hardware_base_addr+0xcc/0xd0 [parport] [ 66.575408s] [pid:5118,cpu4,QThread,5]CPU: 4 PID: 5118 Comm: QThread Tainted: G S W O 5.10.97-arm64-desktop #7100.57021.2 [ 66.575439s] [pid:5118,cpu4,QThread,6]TGID: 5087 Comm: EFileApp [ 66.575439s] [pid:5118,cpu4,QThread,7]Hardware name: HUAWEI HUAWEI QingYun PGUX-W515x-B081/SP1PANGUXM, BIOS 1.00.07 04/29/2024 [ 66.575439s] [pid:5118,cpu4,QThread,8]Call trace: [ 66.575469s] [pid:5118,cpu4,QThread,9] dump_backtrace+0x0/0x1c0 [ 66.575469s] [pid:5118,cpu4,QThread,0] show_stack+0x14/0x20 [ 66.575469s] [pid:5118,cpu4,QThread,1] dump_stack+0xd4/0x10c [ 66.575500s] [pid:5118,cpu4,QThread,2] panic+0x1d8/0x3bc [ 66.575500s] [pid:5118,cpu4,QThread,3] __stack_chk_fail+0x2c/0x38 [ 66.575500s] [pid:5118,cpu4,QThread,4] do_hardware_base_addr+0xcc/0xd0 [parport] Signed-off-by: tuhaowen <tuhaowen(a)uniontech.com> Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/20240708080430.8221-1-tuhaowen@uniontech.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/parport/procfs.c [Fix context] Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- drivers/parport/procfs.c | 30 ++++++++++++++++++------------ 1 file changed, 18 insertions(+), 12 deletions(-) diff --git a/drivers/parport/procfs.c b/drivers/parport/procfs.c index 48804049d697..c5f7e1ff06f1 100644 --- a/drivers/parport/procfs.c +++ b/drivers/parport/procfs.c @@ -51,12 +51,12 @@ static int do_active_device(struct ctl_table *table, int write, for (dev = port->devices; dev ; dev = dev->next) { if(dev == port->cad) { - len += sprintf(buffer, "%s\n", dev->name); + len += snprintf(buffer, sizeof(buffer), "%s\n", dev->name); } } if(!len) { - len += sprintf(buffer, "%s\n", "none"); + len += snprintf(buffer, sizeof(buffer), "%s\n", "none"); } if (len > *lenp) @@ -87,19 +87,19 @@ static int do_autoprobe(struct ctl_table *table, int write, } if ((str = info->class_name) != NULL) - len += sprintf (buffer + len, "CLASS:%s;\n", str); + len += snprintf (buffer + len, sizeof(buffer) - len, "CLASS:%s;\n", str); if ((str = info->model) != NULL) - len += sprintf (buffer + len, "MODEL:%s;\n", str); + len += snprintf (buffer + len, sizeof(buffer) - len, "MODEL:%s;\n", str); if ((str = info->mfr) != NULL) - len += sprintf (buffer + len, "MANUFACTURER:%s;\n", str); + len += snprintf (buffer + len, sizeof(buffer) - len, "MANUFACTURER:%s;\n", str); if ((str = info->description) != NULL) - len += sprintf (buffer + len, "DESCRIPTION:%s;\n", str); + len += snprintf (buffer + len, sizeof(buffer) - len, "DESCRIPTION:%s;\n", str); if ((str = info->cmdset) != NULL) - len += sprintf (buffer + len, "COMMAND SET:%s;\n", str); + len += snprintf (buffer + len, sizeof(buffer) - len, "COMMAND SET:%s;\n", str); if (len > *lenp) len = *lenp; @@ -117,7 +117,7 @@ static int do_hardware_base_addr(struct ctl_table *table, int write, size_t *lenp, loff_t *ppos) { struct parport *port = (struct parport *)table->extra1; - char buffer[20]; + char buffer[64]; int len = 0; if (*ppos) { @@ -128,7 +128,7 @@ static int do_hardware_base_addr(struct ctl_table *table, int write, if (write) /* permissions prevent this anyway */ return -EACCES; - len += sprintf (buffer, "%lu\t%lu\n", port->base, port->base_hi); + len += snprintf (buffer, sizeof(buffer), "%lu\t%lu\n", port->base, port->base_hi); if (len > *lenp) len = *lenp; @@ -156,7 +156,7 @@ static int do_hardware_irq(struct ctl_table *table, int write, if (write) /* permissions prevent this anyway */ return -EACCES; - len += sprintf (buffer, "%d\n", port->irq); + len += snprintf (buffer, sizeof(buffer), "%d\n", port->irq); if (len > *lenp) len = *lenp; @@ -184,7 +184,7 @@ static int do_hardware_dma(struct ctl_table *table, int write, if (write) /* permissions prevent this anyway */ return -EACCES; - len += sprintf (buffer, "%d\n", port->dma); + len += snprintf (buffer, sizeof(buffer), "%d\n", port->dma); if (len > *lenp) len = *lenp; @@ -213,7 +213,13 @@ static int do_hardware_modes(struct ctl_table *table, int write, return -EACCES; { -#define printmode(x) {if(port->modes&PARPORT_MODE_##x){len+=sprintf(buffer+len,"%s%s",f?",":"",#x);f++;}} +#define printmode(x) { \ + if (port->modes & PARPORT_MODE_##x) { \ + len += snprintf(buffer + len, sizeof(buffer) - len, \ + "%s%s", f ? "," : "", #x); \ + f++; \ + } \ +} int f = 0; printmode(PCSPP); printmode(TRISTATE); -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS] usb: gadget: rndis: add spinlock for rndis response list
by Yuan Can 03 Sep '24

03 Sep '24

From: Daehwan Jung <dh10.jung(a)samsung.com> stable inclusion from stable-v4.19.232 commit 37da52f96aaa5013f0330801efe9211e8e5ccb68 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALPWM CVE: CVE-2022-48926 Reference: https://gitee.com/openeuler/kernel/commit/37da52f96aaa5013f0330801efe9211e8… -------------------------------- commit aaaba1c86d04dac8e49bf508b492f81506257da3 upstream. There's no lock for rndis response list. It could cause list corruption if there're two different list_add at the same time like below. It's better to add in rndis_add_response / rndis_free_response / rndis_get_next_response to prevent any race condition on response list. [ 361.894299] [1: irq/191-dwc3:16979] list_add corruption. next->prev should be prev (ffffff80651764d0), but was ffffff883dc36f80. (next=ffffff80651764d0). [ 361.904380] [1: irq/191-dwc3:16979] Call trace: [ 361.904391] [1: irq/191-dwc3:16979] __list_add_valid+0x74/0x90 [ 361.904401] [1: irq/191-dwc3:16979] rndis_msg_parser+0x168/0x8c0 [ 361.904409] [1: irq/191-dwc3:16979] rndis_command_complete+0x24/0x84 [ 361.904417] [1: irq/191-dwc3:16979] usb_gadget_giveback_request+0x20/0xe4 [ 361.904426] [1: irq/191-dwc3:16979] dwc3_gadget_giveback+0x44/0x60 [ 361.904434] [1: irq/191-dwc3:16979] dwc3_ep0_complete_data+0x1e8/0x3a0 [ 361.904442] [1: irq/191-dwc3:16979] dwc3_ep0_interrupt+0x29c/0x3dc [ 361.904450] [1: irq/191-dwc3:16979] dwc3_process_event_entry+0x78/0x6cc [ 361.904457] [1: irq/191-dwc3:16979] dwc3_process_event_buf+0xa0/0x1ec [ 361.904465] [1: irq/191-dwc3:16979] dwc3_thread_interrupt+0x34/0x5c Fixes: f6281af9d62e ("usb: gadget: rndis: use list_for_each_entry_safe") Cc: stable <stable(a)kernel.org> Signed-off-by: Daehwan Jung <dh10.jung(a)samsung.com> Link: https://lore.kernel.org/r/1645507768-77687-1-git-send-email-dh10.jung@samsu… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- drivers/usb/gadget/function/rndis.c | 8 ++++++++ drivers/usb/gadget/function/rndis.h | 1 + 2 files changed, 9 insertions(+) diff --git a/drivers/usb/gadget/function/rndis.c b/drivers/usb/gadget/function/rndis.c index 6e92549f2567..eaa4cf163eaf 100644 --- a/drivers/usb/gadget/function/rndis.c +++ b/drivers/usb/gadget/function/rndis.c @@ -952,6 +952,7 @@ struct rndis_params *rndis_register(void (*resp_avail)(void *v), void *v) params->resp_avail = resp_avail; params->v = v; INIT_LIST_HEAD(&params->resp_queue); + spin_lock_init(&params->resp_lock); pr_debug("%s: configNr = %d\n", __func__, i); return params; @@ -1045,12 +1046,14 @@ void rndis_free_response(struct rndis_params *params, u8 *buf) { rndis_resp_t *r, *n; + spin_lock(&params->resp_lock); list_for_each_entry_safe(r, n, &params->resp_queue, list) { if (r->buf == buf) { list_del(&r->list); kfree(r); } } + spin_unlock(&params->resp_lock); } EXPORT_SYMBOL_GPL(rndis_free_response); @@ -1060,14 +1063,17 @@ u8 *rndis_get_next_response(struct rndis_params *params, u32 *length) if (!length) return NULL; + spin_lock(&params->resp_lock); list_for_each_entry_safe(r, n, &params->resp_queue, list) { if (!r->send) { r->send = 1; *length = r->length; + spin_unlock(&params->resp_lock); return r->buf; } } + spin_unlock(&params->resp_lock); return NULL; } EXPORT_SYMBOL_GPL(rndis_get_next_response); @@ -1084,7 +1090,9 @@ static rndis_resp_t *rndis_add_response(struct rndis_params *params, u32 length) r->length = length; r->send = 0; + spin_lock(&params->resp_lock); list_add_tail(&r->list, &params->resp_queue); + spin_unlock(&params->resp_lock); return r; } diff --git a/drivers/usb/gadget/function/rndis.h b/drivers/usb/gadget/function/rndis.h index c7e3a70ce6c1..c996ba28bcb7 100644 --- a/drivers/usb/gadget/function/rndis.h +++ b/drivers/usb/gadget/function/rndis.h @@ -174,6 +174,7 @@ typedef struct rndis_params { void (*resp_avail)(void *v); void *v; struct list_head resp_queue; + spinlock_t resp_lock; } rndis_params; /* RNDIS Message parser and other useless functions */ -- 2.17.1

2 1

[openeuler:OLK-5.10] BUILD SUCCESS WITH WARNING b7bed6628b750ffd687d1da0a170dece4b0c08bd
by kernel test robot 03 Sep '24

03 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: b7bed6628b750ffd687d1da0a170dece4b0c08bd !11337 v3 Some features and fixs for hbmdev and hbm cache Warning reports: https://lore.kernel.org/oe-kbuild-all/202409030213.Wm0NsmFj-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202409031250.rcUC04W4-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202409031257.Y7C0PYH5-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202409031941.6m1LMpai-lkp@intel.com Warning: (recently discovered and may have been fixed) drivers/acpi/numa/hmat.c:726:6: warning: no previous prototype for function 'hmat_restore_target' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c:4324:6: warning: variable 'err' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:104: warning: Excess function parameter 'direction' description in 'rnpgbevf_set_ring_vector' drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:104: warning: Excess function parameter 'msix_vector' description in 'rnpgbevf_set_ring_vector' drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:104: warning: Excess function parameter 'queue' description in 'rnpgbevf_set_ring_vector' drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:112: warning: Excess function parameter 'direction' description in 'rnpvf_set_ring_vector' drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:112: warning: Excess function parameter 'msix_vector' description in 'rnpvf_set_ring_vector' drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:112: warning: Excess function parameter 'queue' description in 'rnpvf_set_ring_vector' Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | `-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration |-- arm64-randconfig-002-20240903 | `-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration |-- x86_64-allnoconfig | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-allyesconfig | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:variable-err-is-used-uninitialized-whenever-if-condition-is-false | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-direction-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-queue-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-direction-description-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-queue-description-in-rnpvf_set_ring_vector | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_create_dev_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_create_port_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_remove_dev_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_remove_port_attr_files | |-- drivers-ub-urma-ubcore-ubcore_ctp.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_CTP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_dispatch_event | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_net_exit | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-ctx-not-described-in-ubcore_update_uvs_eid_ret | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-dev-not-described-in-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-req-not-described-in-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:no-previous-prototype-for-function-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_fill_port_netdev | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_lookup_sip_info_without_lock | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_new_sip_req_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_update_sip_entry | |-- drivers-ub-urma-ubcore-ubcore_netlink.c:warning:no-previous-prototype-for-function-ubcore_genl_unicast | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_TP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_TPG-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:no-previous-prototype-for-function-ubcore_tpg_kref_get | |-- drivers-ub-urma-ubcore-ubcore_umem.c:warning:no-previous-prototype-for-function-ubcore_umem_find_best_page_size | |-- drivers-ub-urma-ubcore-ubcore_utp.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_UTP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_vtp.c:warning:no-previous-prototype-for-function-ubcore_hash_table_rmv_vtpn | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_get_umap_ops | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_umap_priv_init | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_unmap_vma_pages | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-buildonly-randconfig-001-20240903 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-buildonly-randconfig-002-20240903 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-buildonly-randconfig-003-20240903 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-buildonly-randconfig-004-20240903 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-defconfig | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register `-- x86_64-rhel-8.3-rust |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register elapsed time: 1590m configs tested: 11 configs skipped: 107 tested configs: arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240903 clang-17 arm64 randconfig-002-20240903 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240903 gcc-12 x86_64 buildonly-randconfig-002-20240903 gcc-12 x86_64 buildonly-randconfig-003-20240903 gcc-12 x86_64 buildonly-randconfig-004-20240903 gcc-12 x86_64 defconfig gcc-11 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS v5 00/30] support block hierarchy stats
by Yu Kuai 03 Sep '24

03 Sep '24

Changes in v5: - add missing callers of blk_rq_hierarchy_stats_complete() in patch 16; - remove blk_mq_debugfs_unregister_hierarchy_stats in patch 16; - use NR_NEW_STAT_GROUPS in patch 18; Changes in v4: - remove changes to cfq in patch 2, also fix kabi change for blk-wbt in patch 2; - check q->mq_ops from the only caller from blk-flush.c in patch 12; Changes in v3: - fix patch 7 format; Changes in v2: - find_get_pid(current->pid); -> get_pid(task_pid(current)); - check q->mq_ops in blk_mq_get_alloc_task(); - remove blk_mq_debugfs_unregister_hierarchy_stats(); - include cgroup_path() inside CONFIG_BLK_CGROUP; Bart Van Assche (1): blk-mq: remove blk_mq_put_ctx() Jens Axboe (4): block: add blk_time_get_ns() and blk_time_get() helpers block: cache current nsec time in struct blk_plug block: update cached timestamp post schedule/preemption block: limit block time caching to in_task() context Yu Kuai (25): blk-mq: export blk-mq-debugfs apis block: fix that blk_time_get_ns() doesn't update time after schedule block: fix kabi broken in struct blk_plug block: support to recored bio allocation time block: support to recored bio allocation task block: support to recored bio allocation time in request block: fix kabi broken for struct request block: support to recored bio allocation task in request block: block: fix kabi broken for struct blk_mq_alloc_data blk-mq-debugfs: factor out a new helper to show allocated request block: support to record when request is completed block-io-hierarchy: core hierarchy stats implementation block-io-hierarchy: core hierarchy iodump implementation blk-io-hierarchy: support to recored the number of slow IO blk-io-hierarchy: support new bio based stage blk-throtl blk-io-hierarchy: support new bio based stage blk-wbt blk-io-hierarchy: support new bio based stage gettag blk-io-hierarchy: support new rq based stage plug blk-io-hierarchy: support new rq based stage mq-deadline blk-io-hierarchy: support new rq based stage bfq blk-io-hierarchy: support new rq based stage kyber blk-io-hierarchy: support new rq based stage hctx blk-io-hierarchy: support new rq based stage requeue blk-io-hierarchy: support new rq based stage rq_driver blk-io-hierarchy: support new stage for bio lifetime arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + block/Kconfig | 8 + block/Makefile | 1 + block/bfq-cgroup.c | 15 +- block/bfq-iosched.c | 34 +- block/bio.c | 17 + block/blk-cgroup.c | 2 +- block/blk-core.c | 37 +- block/blk-flush.c | 22 +- block/blk-io-hierarchy/Kconfig | 145 +++++ block/blk-io-hierarchy/Makefile | 8 + block/blk-io-hierarchy/debugfs.c | 230 ++++++++ block/blk-io-hierarchy/iodump.c | 756 +++++++++++++++++++++++++ block/blk-io-hierarchy/iodump.h | 103 ++++ block/blk-io-hierarchy/stats.c | 429 ++++++++++++++ block/blk-io-hierarchy/stats.h | 366 ++++++++++++ block/blk-iolatency.c | 6 +- block/blk-merge.c | 1 + block/blk-mq-debugfs.c | 21 +- block/blk-mq-debugfs.h | 10 + block/blk-mq-sched.c | 7 +- block/blk-mq-tag.c | 13 +- block/blk-mq.c | 77 ++- block/blk-mq.h | 56 +- block/blk-sysfs.c | 16 + block/blk-throttle.c | 29 +- block/blk-wbt.c | 15 +- block/blk.h | 89 ++- block/kyber-iosched.c | 10 +- block/mq-deadline.c | 15 +- include/linux/blk_types.h | 55 +- include/linux/blkdev.h | 16 + include/linux/sched.h | 2 + kernel/sched/core.c | 6 +- 35 files changed, 2530 insertions(+), 89 deletions(-) create mode 100644 block/blk-io-hierarchy/Kconfig create mode 100644 block/blk-io-hierarchy/Makefile create mode 100644 block/blk-io-hierarchy/debugfs.c create mode 100644 block/blk-io-hierarchy/iodump.c create mode 100644 block/blk-io-hierarchy/iodump.h create mode 100644 block/blk-io-hierarchy/stats.c create mode 100644 block/blk-io-hierarchy/stats.h -- 2.39.2

2 31