April 2025 - Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 1365/1365] drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed.
by kernel test robot 29 Apr '25

29 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 230c2b30f879859ac3e9d3cc46407a9dbb103160 commit: b8815fbbe89b0d15fa3296c3e57d2197a92f5bc0 [1365/1365] ACPI: CPPC: Fix cppc_cpufreq_init failed in CPU Hotplug situation config: x86_64-randconfig-102-20250103 (https://download.01.org/0day-ci/archive/20250429/202504290328.U1Cc5OUy-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504290328.U1Cc5OUy-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed. vim +614 drivers/acpi/cppc_acpi.c 576 577 int acpi_get_psd_map(struct cppc_cpudata **all_cpu_data) 578 { 579 struct cpc_desc **cpc_pptr, *cpc_ptr; 580 int parsed_core_num = 0; 581 int i, ret; 582 583 cpc_pptr = kcalloc(num_possible_cpus(), sizeof(void *), GFP_KERNEL); 584 if (!cpc_pptr) 585 return -ENOMEM; 586 for_each_possible_cpu(i) { 587 cpc_pptr[i] = kzalloc(sizeof(struct cpc_desc), GFP_KERNEL); 588 if (!cpc_pptr[i]) { 589 ret = -ENOMEM; 590 goto out; 591 } 592 } 593 594 /* 595 * We can not use acpi_get_devices() to walk the processor devices 596 * because some processor device is not present. 597 */ 598 ret = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, 599 ACPI_UINT32_MAX, acpi_parse_cpc, NULL, 600 cpc_pptr, (void **)&parsed_core_num); 601 if (ret) 602 goto out; 603 if (parsed_core_num != num_possible_cpus()) { 604 ret = -EINVAL; 605 goto out; 606 } 607 608 ret = __acpi_get_psd_map(all_cpu_data, cpc_pptr); 609 610 out: 611 for_each_possible_cpu(i) { 612 cpc_ptr = cpc_pptr[i]; 613 if (cpc_ptr) > 614 kfree(cpc_ptr); 615 } 616 kfree(cpc_pptr); 617 618 return ret; 619 } 620 EXPORT_SYMBOL_GPL(acpi_get_psd_map); 621 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] net: fix geneve_opt length integer overflow
by Wang Liang 28 Apr '25

28 Apr '25

From: Lin Ma <linma(a)zju.edu.cn> mainline inclusion from mainline-v6.15-rc1 commit b27055a08ad4b415dcf15b63034f9cb236f7fb40 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QP0 CVE: CVE-2025-22055 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- struct geneve_opt uses 5 bit length for each single option, which means every vary size option should be smaller than 128 bytes. However, all current related Netlink policies cannot promise this length condition and the attacker can exploit a exact 128-byte size option to *fake* a zero length option and confuse the parsing logic, further achieve heap out-of-bounds read. One example crash log is like below: [ 3.905425] ================================================================== [ 3.905925] BUG: KASAN: slab-out-of-bounds in nla_put+0xa9/0xe0 [ 3.906255] Read of size 124 at addr ffff888005f291cc by task poc/177 [ 3.906646] [ 3.906775] CPU: 0 PID: 177 Comm: poc-oob-read Not tainted 6.1.132 #1 [ 3.907131] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 [ 3.907784] Call Trace: [ 3.907925] <TASK> [ 3.908048] dump_stack_lvl+0x44/0x5c [ 3.908258] print_report+0x184/0x4be [ 3.909151] kasan_report+0xc5/0x100 [ 3.909539] kasan_check_range+0xf3/0x1a0 [ 3.909794] memcpy+0x1f/0x60 [ 3.909968] nla_put+0xa9/0xe0 [ 3.910147] tunnel_key_dump+0x945/0xba0 [ 3.911536] tcf_action_dump_1+0x1c1/0x340 [ 3.912436] tcf_action_dump+0x101/0x180 [ 3.912689] tcf_exts_dump+0x164/0x1e0 [ 3.912905] fw_dump+0x18b/0x2d0 [ 3.913483] tcf_fill_node+0x2ee/0x460 [ 3.914778] tfilter_notify+0xf4/0x180 [ 3.915208] tc_new_tfilter+0xd51/0x10d0 [ 3.918615] rtnetlink_rcv_msg+0x4a2/0x560 [ 3.919118] netlink_rcv_skb+0xcd/0x200 [ 3.919787] netlink_unicast+0x395/0x530 [ 3.921032] netlink_sendmsg+0x3d0/0x6d0 [ 3.921987] __sock_sendmsg+0x99/0xa0 [ 3.922220] __sys_sendto+0x1b7/0x240 [ 3.922682] __x64_sys_sendto+0x72/0x90 [ 3.922906] do_syscall_64+0x5e/0x90 [ 3.923814] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 [ 3.924122] RIP: 0033:0x7e83eab84407 [ 3.924331] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 faf [ 3.925330] RSP: 002b:00007ffff505e370 EFLAGS: 00000202 ORIG_RAX: 000000000000002c [ 3.925752] RAX: ffffffffffffffda RBX: 00007e83eaafa740 RCX: 00007e83eab84407 [ 3.926173] RDX: 00000000000001a8 RSI: 00007ffff505e3c0 RDI: 0000000000000003 [ 3.926587] RBP: 00007ffff505f460 R08: 00007e83eace1000 R09: 000000000000000c [ 3.926977] R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffff505f3c0 [ 3.927367] R13: 00007ffff505f5c8 R14: 00007e83ead1b000 R15: 00005d4fbbe6dcb8 Fix these issues by enforing correct length condition in related policies. Fixes: 925d844696d9 ("netfilter: nft_tunnel: add support for geneve opts") Fixes: 4ece47787077 ("lwtunnel: add options setting and dumping for geneve") Fixes: 0ed5269f9e41 ("net/sched: add tunnel option support to act_tunnel_key") Fixes: 0a6e77784f49 ("net/sched: allow flower to match tunnel options") Signed-off-by: Lin Ma <linma(a)zju.edu.cn> Reviewed-by: Xin Long <lucien.xin(a)gmail.com> Acked-by: Cong Wang <xiyou.wangcong(a)gmail.com> Link: https://patch.msgid.link/20250402165632.6958-1-linma@zju.edu.cn Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/ip_tunnel_core.c net/netfilter/nft_tunnel.c net/sched/act_tunnel_key.c net/sched/cls_flower.c [conflicts due to not merge 4ece47787077 ("lwtunnel: add options setting and dumping for geneve"), conflicts due to not merge 925d844696d9 ("netfilter: nft_tunnel: add support for geneve opts"), conflicts due to not merge fca3f91cc38a ("net: sched: add vxlan option support to act_tunnel_key"), conflicts due to not merge d8f9dfae49ce ("net: sched: allow flower to match vxlan options")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/sched/act_tunnel_key.c | 2 +- net/sched/cls_flower.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c index f43234be5695..5ae31bdaffb7 100644 --- a/net/sched/act_tunnel_key.c +++ b/net/sched/act_tunnel_key.c @@ -64,7 +64,7 @@ geneve_opt_policy[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_MAX + 1] = { [TCA_TUNNEL_KEY_ENC_OPT_GENEVE_CLASS] = { .type = NLA_U16 }, [TCA_TUNNEL_KEY_ENC_OPT_GENEVE_TYPE] = { .type = NLA_U8 }, [TCA_TUNNEL_KEY_ENC_OPT_GENEVE_DATA] = { .type = NLA_BINARY, - .len = 128 }, + .len = 127 }, }; static int diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c index fff54fa798d5..227c78db7548 100644 --- a/net/sched/cls_flower.c +++ b/net/sched/cls_flower.c @@ -500,7 +500,7 @@ geneve_opt_policy[TCA_FLOWER_KEY_ENC_OPT_GENEVE_MAX + 1] = { [TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS] = { .type = NLA_U16 }, [TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE] = { .type = NLA_U8 }, [TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA] = { .type = NLA_BINARY, - .len = 128 }, + .len = 127 }, }; static void fl_set_key_val(struct nlattr **tb, -- 2.34.1

2 1

[PATCH OLK-6.6] rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy
by Zhang Changzhong 28 Apr '25

28 Apr '25

From: "Matthieu Baerts (NGI0)" <matttbe(a)kernel.org> mainline inclusion from mainline-v6.13-rc7 commit 7f5611cbc4871c7fb1ad36c2e5a9edad63dca95c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIQQO CVE: CVE-2025-21635 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns. - current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2). The per-netns structure can be obtained from the table->data using container_of(), then the 'net' one can be retrieved from the listen socket (if available). Fixes: c6a58ffed536 ("RDS: TCP: Add sysctl tunables for sndbuf/rcvbuf on rds-tcp socket") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/67769ecb.050a0220.3a8527.003f.GAE@google.com [1] Suggested-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Matthieu Baerts (NGI0) <matttbe(a)kernel.org> Link: https://patch.msgid.link/20250108-net-sysctl-current-nsproxy-v1-9-5df34b208… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/rds/tcp.c [commit 78eb4ea25cd5 ("sysctl: treewide: constify the ctl_table argument of proc_handlers") not merged] Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/rds/tcp.c | 39 ++++++++++++++++++++++++++++++++------- 1 file changed, 32 insertions(+), 7 deletions(-) diff --git a/net/rds/tcp.c b/net/rds/tcp.c index 2dba750..fb6eaea 100644 --- a/net/rds/tcp.c +++ b/net/rds/tcp.c @@ -61,8 +61,10 @@ static atomic_t rds_tcp_unloading = ATOMIC_INIT(0); static struct kmem_cache *rds_tcp_conn_slab; -static int rds_tcp_skbuf_handler(struct ctl_table *ctl, int write, - void *buffer, size_t *lenp, loff_t *fpos); +static int rds_tcp_sndbuf_handler(struct ctl_table *ctl, int write, + void *buffer, size_t *lenp, loff_t *fpos); +static int rds_tcp_rcvbuf_handler(struct ctl_table *ctl, int write, + void *buffer, size_t *lenp, loff_t *fpos); static int rds_tcp_min_sndbuf = SOCK_MIN_SNDBUF; static int rds_tcp_min_rcvbuf = SOCK_MIN_RCVBUF; @@ -74,7 +76,7 @@ static struct ctl_table rds_tcp_sysctl_table[] = { /* data is per-net pointer */ .maxlen = sizeof(int), .mode = 0644, - .proc_handler = rds_tcp_skbuf_handler, + .proc_handler = rds_tcp_sndbuf_handler, .extra1 = &rds_tcp_min_sndbuf, }, #define RDS_TCP_RCVBUF 1 @@ -83,7 +85,7 @@ static struct ctl_table rds_tcp_sysctl_table[] = { /* data is per-net pointer */ .maxlen = sizeof(int), .mode = 0644, - .proc_handler = rds_tcp_skbuf_handler, + .proc_handler = rds_tcp_rcvbuf_handler, .extra1 = &rds_tcp_min_rcvbuf, }, { } @@ -683,10 +685,10 @@ static void rds_tcp_sysctl_reset(struct net *net) spin_unlock_irq(&rds_tcp_conn_lock); } -static int rds_tcp_skbuf_handler(struct ctl_table *ctl, int write, +static int rds_tcp_skbuf_handler(struct rds_tcp_net *rtn, + struct ctl_table *ctl, int write, void *buffer, size_t *lenp, loff_t *fpos) { - struct net *net = current->nsproxy->net_ns; int err; err = proc_dointvec_minmax(ctl, write, buffer, lenp, fpos); @@ -695,11 +697,34 @@ static int rds_tcp_skbuf_handler(struct ctl_table *ctl, int write, *(int *)(ctl->extra1)); return err; } - if (write) + + if (write && rtn->rds_tcp_listen_sock && rtn->rds_tcp_listen_sock->sk) { + struct net *net = sock_net(rtn->rds_tcp_listen_sock->sk); + rds_tcp_sysctl_reset(net); + } + return 0; } +static int rds_tcp_sndbuf_handler(struct ctl_table *ctl, int write, + void *buffer, size_t *lenp, loff_t *fpos) +{ + struct rds_tcp_net *rtn = container_of(ctl->data, struct rds_tcp_net, + sndbuf_size); + + return rds_tcp_skbuf_handler(rtn, ctl, write, buffer, lenp, fpos); +} + +static int rds_tcp_rcvbuf_handler(struct ctl_table *ctl, int write, + void *buffer, size_t *lenp, loff_t *fpos) +{ + struct rds_tcp_net *rtn = container_of(ctl->data, struct rds_tcp_net, + rcvbuf_size); + + return rds_tcp_skbuf_handler(rtn, ctl, write, buffer, lenp, fpos); +} + static void rds_tcp_exit(void) { rds_tcp_set_unloading(); -- 2.9.5

2 1

[PATCH OLK-6.6] wifi: cfg80211: cancel wiphy_work before freeing wiphy
by Zhang Changzhong 28 Apr '25

28 Apr '25

From: Miri Korenblit <miriam.rachel.korenblit(a)intel.com> stable inclusion from stable-v6.6.84 commit 75d262ad3c36d52852d764588fcd887f0fcd9138 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY431 CVE: CVE-2025-21979 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 72d520476a2fab6f3489e8388ab524985d6c4b90 ] A wiphy_work can be queued from the moment the wiphy is allocated and initialized (i.e. wiphy_new_nm). When a wiphy_work is queued, the rdev::wiphy_work is getting queued. If wiphy_free is called before the rdev::wiphy_work had a chance to run, the wiphy memory will be freed, and then when it eventally gets to run it'll use invalid memory. Fix this by canceling the work before freeing the wiphy. Fixes: a3ee4dc84c4e ("wifi: cfg80211: add a work abstraction with special semantics") Signed-off-by: Miri Korenblit <miriam.rachel.korenblit(a)intel.com> Reviewed-by: Johannes Berg <johannes.berg(a)intel.com> Link: https://patch.msgid.link/20250306123626.efd1d19f6e07.I48229f96f4067ef73f5b8… Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/wireless/core.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/wireless/core.c b/net/wireless/core.c index 3c12479..a2b1534 100644 --- a/net/wireless/core.c +++ b/net/wireless/core.c @@ -1151,6 +1151,13 @@ void cfg80211_dev_free(struct cfg80211_registered_device *rdev) { struct cfg80211_internal_bss *scan, *tmp; struct cfg80211_beacon_registration *reg, *treg; + unsigned long flags; + + spin_lock_irqsave(&rdev->wiphy_work_lock, flags); + WARN_ON(!list_empty(&rdev->wiphy_work_list)); + spin_unlock_irqrestore(&rdev->wiphy_work_lock, flags); + cancel_work_sync(&rdev->wiphy_work); + rfkill_destroy(rdev->wiphy.rfkill); list_for_each_entry_safe(reg, treg, &rdev->beacon_registrations, list) { list_del(&reg->list); -- 2.9.5

2 1

[PATCH openEuler-1.0-LTS 0/3] ndisc: Fix CVE-2025-21764
by Dong Chenchen 28 Apr '25

28 Apr '25

Fix CVE-2025-21764. Eric Dumazet (2): net: add dev_net_rcu() helper ndisc: use RCU protection in ndisc_alloc_skb() Jiri Pirko (1): net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() include/linux/netdevice.h | 6 ++++++ include/net/net_namespace.h | 15 ++++++++++++--- net/ipv6/ndisc.c | 10 ++++------ 3 files changed, 22 insertions(+), 9 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10 0/3] ndisc: Fix CVE-2025-21764
by Dong Chenchen 28 Apr '25

28 Apr '25

fix CVE-2025-21764. Eric Dumazet (2): net: add dev_net_rcu() helper ndisc: use RCU protection in ndisc_alloc_skb() Jiri Pirko (1): net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() include/linux/netdevice.h | 6 ++++++ include/net/net_namespace.h | 15 ++++++++++++--- net/ipv6/ndisc.c | 10 ++++------ 3 files changed, 22 insertions(+), 9 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6 0/5] arm64/mpam: Expanding MPAM's QoS capability
by Zeng Heng 28 Apr '25

28 Apr '25

Zeng Heng (5): fs/resctrl: As a pre-patch for expanding MPAM's QoS capability arm64/mpam: Add CMAX feature arm64/mpam: Add mbw_min and cmin features arm64/mpam: Add PRIO feature arm64/mpam: Add limit feature arch/x86/kernel/cpu/resctrl/core.c | 4 + drivers/platform/mpam/mpam_devices.c | 85 +++++-- drivers/platform/mpam/mpam_internal.h | 16 +- drivers/platform/mpam/mpam_resctrl.c | 326 +++++++++++++++++++++++--- fs/resctrl/ctrlmondata.c | 13 +- fs/resctrl/rdtgroup.c | 13 +- include/linux/resctrl.h | 19 +- include/linux/resctrl_types.h | 11 + 8 files changed, 418 insertions(+), 69 deletions(-) -- 2.25.1

2 6

[PATCH OLK-5.10 0/2] fuse: support fastpath
by chenrenhui 28 Apr '25

28 Apr '25

Support fuse fastpath by using the newly added kernel_ipc module. chenrenhui (2): ipc: add kernel_ipc module to enable fast process switching fuse: support fastpath via kernel_ipc Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 2 + fs/fuse/Kconfig | 6 + fs/fuse/dev.c | 744 +++++++++++++++++++++++++ fs/fuse/dir.c | 87 ++- fs/fuse/file.c | 244 +++++++- fs/fuse/fuse_i.h | 55 ++ fs/fuse/inode.c | 112 ++++ fs/fuse/readdir.c | 8 + include/linux/kernel_ipc.h | 48 ++ include/uapi/linux/fuse.h | 15 +- ipc/Kconfig | 5 + ipc/Makefile | 2 +- ipc/kernel_ipc.c | 305 ++++++++++ 14 files changed, 1605 insertions(+), 30 deletions(-) create mode 100644 include/linux/kernel_ipc.h create mode 100644 ipc/Kconfig create mode 100644 ipc/kernel_ipc.c -- 2.33.0

2 3

[PATCH OLK-6.6 0/5] drm: LoongArch: fix rx550/gfx6/gfx7/gfx8 error
by Hongchen Zhang 28 Apr '25

28 Apr '25

Tianrui Zhao (3): drm/amdgpu: Fix pcie order dislocation drm/amdgpu: make duplicated EOP packet for GFX6 have real content drm/amdgpu: Fix RX550 pcie order dislocation. lvjianmin (2): drm/radeon: repeat the same EOP packet for EOP workaround on CIK drm/amdgpu: make duplicated EOP packet for GFX7/8 have real content drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 5 + drivers/gpu/drm/amd/amdgpu/amdgpu_ih.c | 161 ++++++++++++++++++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_ih.h | 6 + drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 4 + drivers/gpu/drm/amd/amdgpu/amdgpu_irq.h | 3 + drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 19 +++ drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 6 + drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 6 + drivers/gpu/drm/radeon/cik.c | 4 + 9 files changed, 214 insertions(+) -- 2.33.0

2 6

[PATCH OLK-6.6 0/5] arm64/mpam: Expanding MPAM's QoS capability
by Zeng Heng 28 Apr '25

28 Apr '25

Zeng Heng (5): fs/resctrl: As a pre-patch for expanding MPAM's QoS capability arm64/mpam: Add CMAX feature arm64/mpam: Add mbw_min and cmin features arm64/mpam: Add PRIO feature arm64/mpam: Add limit feature arch/x86/kernel/cpu/resctrl/core.c | 4 + drivers/platform/mpam/mpam_devices.c | 85 +++++-- drivers/platform/mpam/mpam_internal.h | 16 +- drivers/platform/mpam/mpam_resctrl.c | 326 +++++++++++++++++++++++--- fs/resctrl/ctrlmondata.c | 13 +- fs/resctrl/rdtgroup.c | 13 +- include/linux/resctrl.h | 19 +- include/linux/resctrl_types.h | 11 + 8 files changed, 418 insertions(+), 69 deletions(-) -- 2.25.1

2 6