April 2025 - Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 0/2] CVE-2021-47668
by Gu Bowen 29 Apr '25

29 Apr '25

CVE fix. Alejandro Concepcion Rodriguez (1): can: dev: can_restart(): post buffer from the right context Vincent Mailhol (1): can: dev: can_restart: fix use after free bug drivers/net/can/dev/dev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] Revert "LoongArch: Set hugetlb mmap base address aligned with pmd size"
by Hongchen Zhang 29 Apr '25

29 Apr '25

LoongArch inclusion category: feature bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC4SOE CVE: NA -------------------------------- This reverts commit fac59827a853a747becd1234249a3d64b7916fa8. Signed-off-by: Bibo Mao <maobibo(a)loongson.cn> Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> --- arch/loongarch/mm/mmap.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/arch/loongarch/mm/mmap.c b/arch/loongarch/mm/mmap.c index 01c20564f4b6..a9630a81b38a 100644 --- a/arch/loongarch/mm/mmap.c +++ b/arch/loongarch/mm/mmap.c @@ -3,7 +3,6 @@ * Copyright (C) 2020-2022 Loongson Technology Corporation Limited */ #include <linux/export.h> -#include <linux/hugetlb.h> #include <linux/io.h> #include <linux/memblock.h> #include <linux/mm.h> @@ -63,11 +62,8 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp, } info.length = len; + info.align_mask = do_color_align ? (PAGE_MASK & SHM_ALIGN_MASK) : 0; info.align_offset = pgoff << PAGE_SHIFT; - if (filp && is_file_hugepages(filp)) - info.align_mask = huge_page_mask_align(filp); - else - info.align_mask = do_color_align ? (PAGE_MASK & SHM_ALIGN_MASK) : 0; if (dir == DOWN) { info.flags = VM_UNMAPPED_AREA_TOPDOWN; -- 2.33.0

2 1

[openeuler:openEuler-1.0-LTS 1365/1365] drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed.
by kernel test robot 29 Apr '25

29 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 7bd21c560a6f5df598200cc367cad1a683cef8ef commit: b8815fbbe89b0d15fa3296c3e57d2197a92f5bc0 [1365/1365] ACPI: CPPC: Fix cppc_cpufreq_init failed in CPU Hotplug situation config: x86_64-randconfig-102-20250103 (https://download.01.org/0day-ci/archive/20250429/202504291127.BVuV3Rjt-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504291127.BVuV3Rjt-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed. vim +614 drivers/acpi/cppc_acpi.c 576 577 int acpi_get_psd_map(struct cppc_cpudata **all_cpu_data) 578 { 579 struct cpc_desc **cpc_pptr, *cpc_ptr; 580 int parsed_core_num = 0; 581 int i, ret; 582 583 cpc_pptr = kcalloc(num_possible_cpus(), sizeof(void *), GFP_KERNEL); 584 if (!cpc_pptr) 585 return -ENOMEM; 586 for_each_possible_cpu(i) { 587 cpc_pptr[i] = kzalloc(sizeof(struct cpc_desc), GFP_KERNEL); 588 if (!cpc_pptr[i]) { 589 ret = -ENOMEM; 590 goto out; 591 } 592 } 593 594 /* 595 * We can not use acpi_get_devices() to walk the processor devices 596 * because some processor device is not present. 597 */ 598 ret = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, 599 ACPI_UINT32_MAX, acpi_parse_cpc, NULL, 600 cpc_pptr, (void **)&parsed_core_num); 601 if (ret) 602 goto out; 603 if (parsed_core_num != num_possible_cpus()) { 604 ret = -EINVAL; 605 goto out; 606 } 607 608 ret = __acpi_get_psd_map(all_cpu_data, cpc_pptr); 609 610 out: 611 for_each_possible_cpu(i) { 612 cpc_ptr = cpc_pptr[i]; 613 if (cpc_ptr) > 614 kfree(cpc_ptr); 615 } 616 kfree(cpc_pptr); 617 618 return ret; 619 } 620 EXPORT_SYMBOL_GPL(acpi_get_psd_map); 621 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] PCI/ASPM: Fix link state exit during switch upstream function removal
by Qi Xi 29 Apr '25

29 Apr '25

From: Daniel Stodden <daniel.stodden(a)gmail.com> mainline inclusion from mainline-v6.15-rc1 commit cbf937dcadfd571a434f8074d057b32cd14fbea5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QT2 CVE: CVE-2024-58093 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Before 456d8aa37d0f ("PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free"), we would free the ASPM link only after the last function on the bus pertaining to the given link was removed. That was too late. If function 0 is removed before sibling function, link->downstream would point to free'd memory after. After above change, we freed the ASPM parent link state upon any function removal on the bus pertaining to a given link. That is too early. If the link is to a PCIe switch with MFD on the upstream port, then removing functions other than 0 first would free a link which still remains parent_link to the remaining downstream ports. The resulting GPFs are especially frequent during hot-unplug, because pciehp removes devices on the link bus in reverse order. On that switch, function 0 is the virtual P2P bridge to the internal bus. Free exactly when function 0 is removed -- before the parent link is obsolete, but after all subordinate links are gone. Link: https://lore.kernel.org/r/e12898835f25234561c9d7de4435590d957b85d9.17349248… Fixes: 456d8aa37d0f ("PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free") Signed-off-by: Daniel Stodden <dns(a)arista.com> Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> [kwilczynski: commit log] Signed-off-by: Krzysztof Wilczyński <kwilczynski(a)kernel.org> Conflicts: drivers/pci/pcie/aspm.c [Context conflicts] Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/pci/pcie/aspm.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c index a4b78c2bfc40..5add61365b2b 100644 --- a/drivers/pci/pcie/aspm.c +++ b/drivers/pci/pcie/aspm.c @@ -977,16 +977,16 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev) parent_link = link->parent; /* - * link->downstream is a pointer to the pci_dev of function 0. If - * we remove that function, the pci_dev is about to be deallocated, - * so we can't use link->downstream again. Free the link state to - * avoid this. + * Free the parent link state, no later than function 0 (i.e. + * link->downstream) being removed. * - * If we're removing a non-0 function, it's possible we could - * retain the link state, but PCIe r6.0, sec 7.5.3.7, recommends - * programming the same ASPM Control value for all functions of - * multi-function devices, so disable ASPM for all of them. + * Do not free the link state any earlier. If function 0 is a + * switch upstream port, this link state is parent_link to all + * subordinate ones. */ + if (pdev != link->downstream) + goto out; + pcie_config_aspm_link(link, 0); list_del(&link->sibling); free_link_state(link); @@ -999,6 +999,7 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev) pcie_aspm_update_sysfs_visibility(parent); +out: mutex_unlock(&aspm_lock); up_read(&pci_bus_sem); } -- 2.33.0

2 1

[PATCH OLK-6.6 v2] tracing: Verify event formats that have "%*p.."
by Pu Lehui 29 Apr '25

29 Apr '25

From: Steven Rostedt <rostedt(a)goodmis.org> mainline inclusion from mainline-v6.15-rc1 commit ea8d7647f9ddf1f81e2027ed305299797299aa03 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC4TFV Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The trace event verifier checks the formats of trace events to make sure that they do not point at memory that is not in the trace event itself or in data that will never be freed. If an event references data that was allocated when the event triggered and that same data is freed before the event is read, then the kernel can crash by reading freed memory. The verifier runs at boot up (or module load) and scans the print formats of the events and checks their arguments to make sure that dereferenced pointers are safe. If the format uses "%*p.." the verifier will ignore it, and that could be dangerous. Cover this case as well. Also add to the sample code a use case of "%*pbl". Link: https://lore.kernel.org/all/bcba4d76-2c3f-4d11-baf0-02905db953dd@oracle.com/ Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Fixes: 5013f454a352c ("tracing: Add check of trace event print fmts for dereferencing pointers") Link: https://lore.kernel.org/20250327195311.2d89ec66@gandalf.local.home Reported-by: Libo Chen <libo.chen(a)oracle.com> Reviewed-by: Libo Chen <libo.chen(a)oracle.com> Tested-by: Libo Chen <libo.chen(a)oracle.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Conflicts: kernel/trace/trace_events.c samples/trace_events/trace-events-sample.h [The conflicts were due to some minor issues] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/trace/trace_events.c | 7 +++++++ samples/trace_events/trace-events-sample.h | 8 ++++++-- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index 9d22745cdea5..f2e07d470784 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -470,6 +470,7 @@ static void test_event_printk(struct trace_event_call *call) case '%': continue; case 'p': + do_pointer: /* Find dereferencing fields */ switch (fmt[i + 1]) { case 'B': case 'R': case 'r': @@ -498,6 +499,12 @@ static void test_event_printk(struct trace_event_call *call) continue; if (fmt[i + j] == '*') { star = true; + /* Handle %*pbl case */ + if (!j && fmt[i + 1] == 'p') { + arg++; + i++; + goto do_pointer; + } continue; } if ((fmt[i + j] == 's')) { diff --git a/samples/trace_events/trace-events-sample.h b/samples/trace_events/trace-events-sample.h index 1c6b843b8c4e..6a5d4717f37a 100644 --- a/samples/trace_events/trace-events-sample.h +++ b/samples/trace_events/trace-events-sample.h @@ -315,7 +315,8 @@ TRACE_EVENT(foo_bar, __assign_cpumask(cpum, cpumask_bits(mask)); ), - TP_printk("foo %s %d %s %s %s %s (%s) (%s) %s", __entry->foo, __entry->bar, + TP_printk("foo %s %d %s %s %s %s (%s) (%s) %s [%d] %*pbl", + __entry->foo, __entry->bar, /* * Notice here the use of some helper functions. This includes: @@ -360,7 +361,10 @@ TRACE_EVENT(foo_bar, __get_dynamic_array_len(list) / sizeof(int), sizeof(int)), __get_str(str), __get_bitmask(cpus), __get_cpumask(cpum), - __get_str(vstr)) + __get_str(vstr), + __get_dynamic_array_len(cpus), + __get_dynamic_array_len(cpus), + __get_dynamic_array(cpus)) ); /* -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/1] CVE-2022-49429
by Yongqiang Liu 29 Apr '25

29 Apr '25

CVE-2022-49429 Douglas Miller (1): RDMA/hfi1: Prevent panic when SDMA is disabled drivers/infiniband/hw/hfi1/file_ops.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-49626
by Yongqiang Liu 29 Apr '25

29 Apr '25

CVE-2022-49626 Íñigo Huguet (2): sfc: error code if SRIOV cannot be disabled sfc: fix use after free when disabling sriov drivers/net/ethernet/sfc/ef10_sriov.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] mpage: fix softlockup in mpage_readahead()
by Zheng Qixing 29 Apr '25

29 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBYXQD --------------------------- When using null_blk with a large readahead window, calling madvise to trigger readahead can lead to system softlocks. This occurs because the CPU can remain in the mpage_readahead loop for extended periods without rescheduling, preventing other processes from running. The issue manifests as follows: Call Trace: bio_add_page+0x7f/0x120 bio_add_folio+0x24/0x40 do_mpage_readpage+0x6de/0xbc0 xas_load+0x1e/0x240 xa_load+0x8f/0xf0 mpage_readahead+0xe7/0x230 __pfx_blkdev_get_block+0x10/0x10 blkdev_readahead+0x14/0x30 read_pages+0x71/0x460 folio_add_lru+0x6a/0x140 ? filemap_add_folio+0xb6/0x190 page_cache_ra_unbounded+0x197/0x2a0 do_page_cache_ra+0x42/0x70 page_cache_ra_order+0x360/0x610 filemap_fault+0x7d8/0x1200 __do_fault+0x3e/0x380 do_pte_missing+0x628/0x1cd0 ? __pte_offset_map+0x1a/0x200 __handle_mm_fault+0x7f2/0x19b0 ? __pte_offset_map+0x1a/0x200 ? __pte_offset_map_lock+0x78/0x170 handle_mm_fault+0x275/0x560 __get_user_pages+0x1f0/0xbd0 faultin_page_range+0xae/0x460 madvise_vma_behavior+0x62e/0xfa0 ? find_vma_prev+0x85/0xe0 do_madvise+0x1eb/0x5a0 __x64_sys_madvise+0x2b/0x40 x64_sys_call+0x23b3/0x4620 do_syscall_64+0x9e/0x1b0 ? irqentry_exit_to_user_mode+0x7d/0x300 entry_SYSCALL_64_after_hwframe+0x78/0xe2 Add a cond_resched() call at the beginning of each loop iteration to allow the CPU to schedule other tasks when necessary, avoiding potential softlocks during heavy readahead operations. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- fs/mpage.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/mpage.c b/fs/mpage.c index 242e213ee064..73947fc8ff1e 100644 --- a/fs/mpage.c +++ b/fs/mpage.c @@ -376,6 +376,7 @@ void mpage_readahead(struct readahead_control *rac, get_block_t get_block) }; while ((folio = readahead_folio(rac))) { + cond_resched(); prefetchw(&folio->flags); args.folio = folio; args.nr_pages = readahead_count(rac); -- 2.39.2

2 1

[PATCH OLK-6.6] x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs
by Qi Xi 29 Apr '25

29 Apr '25

From: Jann Horn <jannh(a)google.com> mainline inclusion from mainline-v6.15-rc1 commit 3ef938c3503563bfc2ac15083557f880d29c2e64 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QSV CVE: CVE-2025-22045 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- On the following path, flush_tlb_range() can be used for zapping normal PMD entries (PMD entries that point to page tables) together with the PTE entries in the pointed-to page table: collapse_pte_mapped_thp pmdp_collapse_flush flush_tlb_range The arm64 version of flush_tlb_range() has a comment describing that it can be used for page table removal, and does not use any last-level invalidation optimizations. Fix the X86 version by making it behave the same way. Currently, X86 only uses this information for the following two purposes, which I think means the issue doesn't have much impact: - In native_flush_tlb_multi() for checking if lazy TLB CPUs need to be IPI'd to avoid issues with speculative page table walks. - In Hyper-V TLB paravirtualization, again for lazy TLB stuff. The patch "x86/mm: only invalidate final translations with INVLPGB" which is currently under review (see <https://lore.kernel.org/all/20241230175550.4046587-13-riel@surriel.com/>) would probably be making the impact of this a lot worse. Fixes: 016c4d92cd16 ("x86/mm/tlb: Add freed_tables argument to flush_tlb_mm_range") Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Cc: stable(a)vger.kernel.org Link: https://lkml.kernel.org/r/20250103-x86-collapse-flush-fix-v1-1-3c521856cfa6… Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- arch/x86/include/asm/tlbflush.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h index 25726893c6f4..4bd3c1a1b355 100644 --- a/arch/x86/include/asm/tlbflush.h +++ b/arch/x86/include/asm/tlbflush.h @@ -241,7 +241,7 @@ void flush_tlb_multi(const struct cpumask *cpumask, flush_tlb_mm_range((vma)->vm_mm, start, end, \ ((vma)->vm_flags & VM_HUGETLB) \ ? huge_page_shift(hstate_vma(vma)) \ - : PAGE_SHIFT, false) + : PAGE_SHIFT, true) extern void flush_tlb_all(void); extern void flush_tlb_mm_range(struct mm_struct *mm, unsigned long start, -- 2.33.0

2 1

[PATCH OLK-6.6] acpi: nfit: fix narrowing conversion in acpi_nfit_ctl
by Qi Xi 29 Apr '25

29 Apr '25

From: Murad Masimov <m.masimov(a)mt-integration.ru> mainline inclusion from mainline-v6.15-rc1 commit 2ff0e408db36c21ed3fa5e3c1e0e687c82cf132f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QRM CVE: CVE-2025-22044 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Syzkaller has reported a warning in to_nfit_bus_uuid(): "only secondary bus families can be translated". This warning is emited if the argument is equal to NVDIMM_BUS_FAMILY_NFIT == 0. Function acpi_nfit_ctl() first verifies that a user-provided value call_pkg->nd_family of type u64 is not equal to 0. Then the value is converted to int, and only after that is compared to NVDIMM_BUS_FAMILY_MAX. This can lead to passing an invalid argument to acpi_nfit_ctl(), if call_pkg->nd_family is non-zero, while the lower 32 bits are zero. Furthermore, it is best to return EINVAL immediately upon seeing the invalid user input. The WARNING is insufficient to prevent further undefined behavior based on other invalid user input. All checks of the input value should be applied to the original variable call_pkg->nd_family. [iweiny: update commit message] Fixes: 6450ddbd5d8e ("ACPI: NFIT: Define runtime firmware activation commands") Cc: stable(a)vger.kernel.org Reported-by: syzbot+c80d8dc0d9fa81a3cd8c(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c80d8dc0d9fa81a3cd8c Signed-off-by: Murad Masimov <m.masimov(a)mt-integration.ru> Link: https://patch.msgid.link/20250123163945.251-1-m.masimov@mt-integration.ru Signed-off-by: Ira Weiny <ira.weiny(a)intel.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/acpi/nfit/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c index 7918923e3b74..a466ad6e5d93 100644 --- a/drivers/acpi/nfit/core.c +++ b/drivers/acpi/nfit/core.c @@ -485,7 +485,7 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm, cmd_mask = nd_desc->cmd_mask; if (cmd == ND_CMD_CALL && call_pkg->nd_family) { family = call_pkg->nd_family; - if (family > NVDIMM_BUS_FAMILY_MAX || + if (call_pkg->nd_family > NVDIMM_BUS_FAMILY_MAX || !test_bit(family, &nd_desc->bus_family_mask)) return -EINVAL; family = array_index_nospec(family, -- 2.33.0

2 1