- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-49871
by Zhang Changzhong 04 Jul '25

04 Jul '25

Eric Dumazet (1): net: tun: call napi_schedule_prep() to ensure we own a napi Wang Yufen (1): net: tun: Fix memory leaks of napi_get_frags drivers/net/tun.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) -- 2.9.5

2 3

[PATCH openEuler-1.0-LTS] wifi: cfg80211: fix memory leak in query_regdb_file()
by Zhang Changzhong 04 Jul '25

04 Jul '25

From: Arend van Spriel <arend.vanspriel(a)broadcom.com> stable inclusion from stable-v4.19.267 commit 219446396786330937bcd382a7bc4ccd767383bc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BSR CVE: CVE-2022-49881 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 57b962e627ec0ae53d4d16d7bd1033e27e67677a ] In the function query_regdb_file() the alpha2 parameter is duplicated using kmemdup() and subsequently freed in regdb_fw_cb(). However, request_firmware_nowait() can fail without calling regdb_fw_cb() and thus leak memory. Fixes: 007f6c5e6eb4 ("cfg80211: support loading regulatory database as firmware file") Signed-off-by: Arend van Spriel <arend.vanspriel(a)broadcom.com> Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/wireless/reg.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/net/wireless/reg.c b/net/wireless/reg.c index 6484123..d2bf20017 100644 --- a/net/wireless/reg.c +++ b/net/wireless/reg.c @@ -1050,6 +1050,8 @@ static void regdb_fw_cb(const struct firmware *fw, void *context) static int query_regdb_file(const char *alpha2) { + int err; + ASSERT_RTNL(); if (regdb) @@ -1059,9 +1061,13 @@ static int query_regdb_file(const char *alpha2) if (!alpha2) return -ENOMEM; - return request_firmware_nowait(THIS_MODULE, true, "regulatory.db", - &reg_pdev->dev, GFP_KERNEL, - (void *)alpha2, regdb_fw_cb); + err = request_firmware_nowait(THIS_MODULE, true, "regulatory.db", + &reg_pdev->dev, GFP_KERNEL, + (void *)alpha2, regdb_fw_cb); + if (err) + kfree(alpha2); + + return err; } int reg_reload_regdb(void) -- 2.9.5

2 1

[openeuler:OLK-6.6 2459/2459] mm/memcontrol.c:3147:6: warning: no previous prototype for 'hisi_oom_recover'
by kernel test robot 04 Jul '25

04 Jul '25

Hi Weilong, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 673b27ee13cb811b3f418669e6826b95459c32f4 commit: b498d9f1bacd40d583c0970cab02ad522127a7e7 [2459/2459] arm64/ascend: Add new enable_oom_killer interface for oom contrl config: arm64-randconfig-004-20250704 (https://download.01.org/0day-ci/archive/20250704/202507041600.4d0iiWmN-lkp@…) compiler: aarch64-linux-gcc (GCC) 10.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250704/202507041600.4d0iiWmN-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507041600.4d0iiWmN-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/memcontrol.c:3147:6: warning: no previous prototype for 'hisi_oom_recover' [-Wmissing-prototypes] 3147 | void hisi_oom_recover(struct obj_cgroup *objcg) | ^~~~~~~~~~~~~~~~ vim +/hisi_oom_recover +3147 mm/memcontrol.c 3145 3146 #ifdef CONFIG_ASCEND_OOM > 3147 void hisi_oom_recover(struct obj_cgroup *objcg) 3148 { 3149 struct mem_cgroup *memcg; 3150 3151 memcg = get_mem_cgroup_from_objcg(objcg); 3152 if (!mem_cgroup_is_root(memcg)) 3153 memcg_oom_recover(memcg); 3154 css_put(&memcg->css); 3155 } 3156 #else 3157 static inline void hisi_oom_recover(struct obj_cgroup *objcg) { } 3158 #endif 3159 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH 1/7] arm64/sysreg: Update ID_AA64MMFR1_EL1 register
by Qi Xi 04 Jul '25

04 Jul '25

From: Yicong Yang <yangyicong(a)hisilicon.com> mainline inclusion from mainline-v6.13-rc1 commit aa47dcda2708e571695dae2e3f9537d9a8eb804c category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB4YD4 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- Update ID_AA64MMFR1_EL1 register fields definition per DDI0601 (ID092424) 2024-09. ID_AA64MMFR1_EL1.ETS adds definition for FEAT_ETS2 and FEAT_ETS3. ID_AA64MMFR1_EL1.HAFDBS adds definition for FEAT_HAFT and FEAT_HDBSS. Reviewed-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Yicong Yang <yangyicong(a)hisilicon.com> Link: https://lore.kernel.org/r/20241102104235.62560-2-yangyicong@huawei.com Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Signed-off-by: JiangShui Yang <yangjiangshui(a)h-partners.com> --- arch/arm64/include/asm/sysreg.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h index 8609fa094bc4..d728408df058 100644 --- a/arch/arm64/include/asm/sysreg.h +++ b/arch/arm64/include/asm/sysreg.h @@ -1073,6 +1073,12 @@ #define ID_PFR1_SECURITY_SHIFT 4 #define ID_PFR1_PROGMOD_SHIFT 0 +#define ID_AA64MMFR1_EL1_ETS_ETS2 UL(0b0010) +#define ID_AA64MMFR1_EL1_ETS_ETS3 UL(0b0011) + +#define ID_AA64MMFR1_EL1_HAFDBS_HAFT UL(0b0011) +#define ID_AA64MMFR1_EL1_HAFDBS_HDBSS UL(0b0100) + #if defined(CONFIG_ARM64_4K_PAGES) #define ID_AA64MMFR0_TGRAN_SHIFT ID_AA64MMFR0_TGRAN4_SHIFT #define ID_AA64MMFR0_TGRAN_SUPPORTED_MIN ID_AA64MMFR0_TGRAN4_SUPPORTED_MIN -- 2.33.0

1 6

[PATCH openEuler-1.0-LTS] PCI/GPU: fix hard lockup in vga_arb_release
by Zhang Yuwei 04 Jul '25

04 Jul '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICCT8Z -------------------------------- Commit deb2d2ecd43df ("PCI/GPU: implement VGA arbitration on Linux") In the vga_arb_release(), it iterates through the vga_arb_user_card array held by the user to release io_cnt and mem_cnt resources one by one. If the values of io_cnt or mem_cnt are excessively large, prolonged CPU occupation may occur, leading to hard lock. lock protection is only added when deleting entries from the list, also add cond_resched() during the release of io_cnt and mem_cnt. Fixes: 281327c99bca ("lib: make bitmap_parselist_user() a wrapper on bitmap_parselist()") Reviewed-by: Chen Jun <chenjun102(a)huawei.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/gpu/vga/vgaarb.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c index c61b04555779..db21ae342bd8 100644 --- a/drivers/gpu/vga/vgaarb.c +++ b/drivers/gpu/vga/vgaarb.c @@ -1312,18 +1312,22 @@ static int vga_arb_release(struct inode *inode, struct file *file) spin_lock_irqsave(&vga_user_lock, flags); list_del(&priv->list); + spin_unlock_irqrestore(&vga_user_lock, flags); for (i = 0; i < MAX_USER_CARDS; i++) { uc = &priv->cards[i]; if (uc->pdev == NULL) continue; vgaarb_dbg(&uc->pdev->dev, "uc->io_cnt == %d, uc->mem_cnt == %d\n", uc->io_cnt, uc->mem_cnt); - while (uc->io_cnt--) + while (uc->io_cnt--) { vga_put(uc->pdev, VGA_RSRC_LEGACY_IO); - while (uc->mem_cnt--) + cond_resched(); + } + while (uc->mem_cnt--) { vga_put(uc->pdev, VGA_RSRC_LEGACY_MEM); + cond_resched(); + } } - spin_unlock_irqrestore(&vga_user_lock, flags); kfree(priv); -- 2.22.0

2 1

[openeuler:OLK-5.10 3011/3011] drivers/net/ethernet/mucse/rnpm/rnpm_sysfs.c:1524:2: warning: 'strncpy' specified bound 100 equals destination size
by kernel test robot 04 Jul '25

04 Jul '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 41b7827f33a9fc1fe425b85029312de34b0f0abe commit: a0c5bfdbc099daf30cbadb9657803f0cb3f89d0b [3011/3011] drivers: support for rnpm drivers from Mucse Technology N10/N400 config: arm64-randconfig-004-20250704 (https://download.01.org/0day-ci/archive/20250704/202507041638.fqBxner2-lkp@…) compiler: aarch64-linux-gcc (GCC) 10.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250704/202507041638.fqBxner2-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507041638.fqBxner2-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/net/ethernet/mucse/rnpm/rnpm_sysfs.c:263:5: warning: no previous prototype for 'rnpm_mbx_get_pn_sn' [-Wmissing-prototypes] 263 | int rnpm_mbx_get_pn_sn(struct rnpm_hw *hw, char pn[33], char sn[33]) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_sysfs.c: In function '_switch_loopback': >> drivers/net/ethernet/mucse/rnpm/rnpm_sysfs.c:1524:2: warning: 'strncpy' specified bound 100 equals destination size [-Wstringop-truncation] 1524 | strncpy(name, peer_eth, sizeof(name)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/strncpy +1524 drivers/net/ethernet/mucse/rnpm/rnpm_sysfs.c 1515 1516 static ssize_t _switch_loopback(struct rnpm_adapter *adapter, 1517 const char *peer_eth, int en) 1518 { 1519 struct net_device *peer_netdev = NULL; 1520 struct rnpm_adapter *peer_adapter = NULL; 1521 int i; 1522 char name[100]; 1523 > 1524 strncpy(name, peer_eth, sizeof(name)); 1525 strim(name); 1526 1527 peer_netdev = dev_get_by_name(&init_net, name); 1528 if (!peer_netdev) { 1529 e_dev_info("canot' find [%s]\n", name); 1530 return -EINVAL; 1531 } 1532 peer_adapter = netdev_priv(peer_netdev); 1533 1534 // check if in same slot 1535 if (PCI_SLOT(peer_adapter->pdev->devfn) != 1536 PCI_SLOT(adapter->pdev->devfn)) { 1537 e_dev_info("%s %s not in same slot\n", 1538 netdev_name(adapter->netdev), 1539 netdev_name(peer_adapter->netdev)); 1540 dev_put(peer_netdev); 1541 return -EINVAL; 1542 } 1543 1544 e_dev_info("%s: %s(%d,%d) <-> %s(%d,%d) en:%d\n", __func__, 1545 netdev_name(adapter->netdev), adapter->lane, adapter->port, 1546 netdev_name(peer_adapter->netdev), peer_adapter->lane, 1547 peer_adapter->port, en); 1548 1549 /* clear pf0/pf1 input port policy eth reg */ 1550 for (i = 0; i < MAX_PORT_NUM; i++) { 1551 wr32(&adapter->hw, RNPM_ETH_INPORT_POLICY_REG(i), 0); 1552 wr32(&peer_adapter->hw, RNPM_ETH_INPORT_POLICY_REG(i), 0); 1553 } 1554 1555 wr32(&adapter->hw, RNPM_ETH_INPORT_POLICY_VAL, 0); 1556 wr32(&peer_adapter->hw, RNPM_ETH_INPORT_POLICY_VAL, 0); 1557 1558 do_switch_loopback_set(adapter, en, adapter->lane, 1559 to_switch_port(peer_adapter)); 1560 1561 do_switch_loopback_set(peer_adapter, en, peer_adapter->lane, 1562 to_switch_port(adapter)); 1563 1564 if (peer_netdev) 1565 dev_put(peer_netdev); 1566 1567 return 0; 1568 } 1569 static ssize_t switch_loopback_on_store(struct device *dev, 1570 struct device_attribute *attr, 1571 const char *buf, size_t count) 1572 { 1573 struct rnpm_adapter *adapter = netdev_priv(to_net_device(dev)); 1574 1575 return _switch_loopback(adapter, buf, 1) == 0 ? count : -EINVAL; 1576 } 1577 static DEVICE_ATTR_WO(switch_loopback_on); 1578 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] scsi: target: iscsi: Fix timeout on deleted connection
by Yifan Qiao 04 Jul '25

04 Jul '25

From: Dmitry Bogdanov <d.bogdanov(a)yadro.com> stable inclusion from stable-v6.6.93 commit fe8421e853ef289e1324fcda004751c89dd9c18a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAEJ CVE: CVE-2025-38075 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7f533cc5ee4c4436cee51dc58e81dfd9c3384418 ] NOPIN response timer may expire on a deleted connection and crash with such logs: Did not receive response to NOPIN on CID: 0, failing connection for I_T Nexus (null),i,0x00023d000125,iqn.2017-01.com.iscsi.target,t,0x3d BUG: Kernel NULL pointer dereference on read at 0x00000000 NIP strlcpy+0x8/0xb0 LR iscsit_fill_cxn_timeout_err_stats+0x5c/0xc0 [iscsi_target_mod] Call Trace: iscsit_handle_nopin_response_timeout+0xfc/0x120 [iscsi_target_mod] call_timer_fn+0x58/0x1f0 run_timer_softirq+0x740/0x860 __do_softirq+0x16c/0x420 irq_exit+0x188/0x1c0 timer_interrupt+0x184/0x410 That is because nopin response timer may be re-started on nopin timer expiration. Stop nopin timer before stopping the nopin response timer to be sure that no one of them will be re-started. Signed-off-by: Dmitry Bogdanov <d.bogdanov(a)yadro.com> Link: https://lore.kernel.org/r/20241224101757.32300-1-d.bogdanov@yadro.com Reviewed-by: Maurizio Lombardi <mlombard(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- drivers/target/iscsi/iscsi_target.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c index b516c2893420..b756d4cfecfe 100644 --- a/drivers/target/iscsi/iscsi_target.c +++ b/drivers/target/iscsi/iscsi_target.c @@ -4323,8 +4323,8 @@ int iscsit_close_connection( spin_unlock(&iscsit_global->ts_bitmap_lock); iscsit_stop_timers_for_cmds(conn); - iscsit_stop_nopin_response_timer(conn); iscsit_stop_nopin_timer(conn); + iscsit_stop_nopin_response_timer(conn); if (conn->conn_transport->iscsit_wait_conn) conn->conn_transport->iscsit_wait_conn(conn); -- 2.39.2

2 1

[PATCH OLK-6.6] f2fs: fix to do sanity check on sbi->total_valid_block_count
by Yifan Qiao 04 Jul '25

04 Jul '25

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v6.6.94 commit a39cc43efc1bca74ed9d6cf9e60b995071f7d178 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICJT6T CVE: CVE-2025-38163 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 05872a167c2cab80ef186ef23cc34a6776a1a30c ] syzbot reported a f2fs bug as below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/f2fs.h:2521! RIP: 0010:dec_valid_block_count+0x3b2/0x3c0 fs/f2fs/f2fs.h:2521 Call Trace: f2fs_truncate_data_blocks_range+0xc8c/0x11a0 fs/f2fs/file.c:695 truncate_dnode+0x417/0x740 fs/f2fs/node.c:973 truncate_nodes+0x3ec/0xf50 fs/f2fs/node.c:1014 f2fs_truncate_inode_blocks+0x8e3/0x1370 fs/f2fs/node.c:1197 f2fs_do_truncate_blocks+0x840/0x12b0 fs/f2fs/file.c:810 f2fs_truncate_blocks+0x10d/0x300 fs/f2fs/file.c:838 f2fs_truncate+0x417/0x720 fs/f2fs/file.c:888 f2fs_setattr+0xc4f/0x12f0 fs/f2fs/file.c:1112 notify_change+0xbca/0xe90 fs/attr.c:552 do_truncate+0x222/0x310 fs/open.c:65 handle_truncate fs/namei.c:3466 [inline] do_open fs/namei.c:3849 [inline] path_openat+0x2e4f/0x35d0 fs/namei.c:4004 do_filp_open+0x284/0x4e0 fs/namei.c:4031 do_sys_openat2+0x12b/0x1d0 fs/open.c:1429 do_sys_open fs/open.c:1444 [inline] __do_sys_creat fs/open.c:1522 [inline] __se_sys_creat fs/open.c:1516 [inline] __x64_sys_creat+0x124/0x170 fs/open.c:1516 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94 The reason is: in fuzzed image, sbi->total_valid_block_count is inconsistent w/ mapped blocks indexed by inode, so, we should not trigger panic for such case, instead, let's print log and set fsck flag. Fixes: 39a53e0ce0df ("f2fs: add superblock and major in-memory structure") Reported-by: syzbot+8b376a77b2f364097fbe(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-f2fs-devel/67f3c0b2.050a0220.396535.0547.GAE@… Signed-off-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/f2fs/f2fs.h | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h index c5297bb8968d..c47243818ef1 100644 --- a/fs/f2fs/f2fs.h +++ b/fs/f2fs/f2fs.h @@ -2445,8 +2445,14 @@ static inline void dec_valid_block_count(struct f2fs_sb_info *sbi, blkcnt_t sectors = count << F2FS_LOG_SECTORS_PER_BLOCK; spin_lock(&sbi->stat_lock); - f2fs_bug_on(sbi, sbi->total_valid_block_count < (block_t) count); - sbi->total_valid_block_count -= (block_t)count; + if (unlikely(sbi->total_valid_block_count < count)) { + f2fs_warn(sbi, "Inconsistent total_valid_block_count:%u, ino:%lu, count:%u", + sbi->total_valid_block_count, inode->i_ino, count); + sbi->total_valid_block_count = 0; + set_sbi_flag(sbi, SBI_NEED_FSCK); + } else { + sbi->total_valid_block_count -= count; + } if (sbi->reserved_blocks && sbi->current_reserved_blocks < sbi->reserved_blocks) sbi->current_reserved_blocks = min(sbi->reserved_blocks, -- 2.39.2

2 1

[PATCH v3 OLK-6.6] config: Enable CONFIG_VIRT_DRIVERS
by Cai Xinchen 04 Jul '25

04 Jul '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IBWQ24 -------------------------------- To use tsm report for arm cca guest, enable CONFIG_VIRT_DRIVERS in openeuler_defconfig by default. ARM_CCA_GUEST and TSM_REPORTS will open as module by default. CONFIG_VMGENID will enable by default. Set VMGENID disable. All of CONFIG_NITRO_ENCLAVES dependencies are enable, but this patch only wants to enable CONFIG_ARM_CCA_GUEST, so set CONFIG_NITRO_ENCLAVES disable. Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index f048a1b098d1..4e1e6a5a62b8 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -6491,7 +6491,9 @@ CONFIG_VFIO_PLATFORM=m # end of VFIO platform reset drivers # end of VFIO support for platform devices -# CONFIG_VIRT_DRIVERS is not set +CONFIG_VIRT_DRIVERS=y +# CONFIG_VMGENID is not set +# CONFIG_NITRO_ENCLAVES is not set CONFIG_VIRTIO_ANCHOR=y CONFIG_VIRTIO=m CONFIG_VIRTIO_PCI_LIB=m -- 2.18.0.huawei.25

2 1

[PATCH openEuler-1.0-LTS] dm raid: fix address sanitizer warning in raid_resume
by Wang ShaoBo 04 Jul '25

04 Jul '25

From: Mikulas Patocka <mpatocka(a)redhat.com> stable inclusion from stable-v4.19.256 commit 3bfdc95466f5be4d8d95db5a5b470d61641a7c24 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGA8J CVE: CVE-2022-50085 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7dad24db59d2d2803576f2e3645728866a056dab upstream. There is a KASAN warning in raid_resume when running the lvm test lvconvert-raid.sh. The reason for the warning is that mddev->raid_disks is greater than rs->raid_disks, so the loop touches one entry beyond the allocated length. Cc: stable(a)vger.kernel.org Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> --- drivers/md/dm-raid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c index 9a5d65d2223b..49209dae7fdd 100644 --- a/drivers/md/dm-raid.c +++ b/drivers/md/dm-raid.c @@ -3801,7 +3801,7 @@ static void attempt_restore_of_faulty_devices(struct raid_set *rs) memset(cleared_failed_devices, 0, sizeof(cleared_failed_devices)); - for (i = 0; i < mddev->raid_disks; i++) { + for (i = 0; i < rs->raid_disks; i++) { r = &rs->dev[i].rdev; /* HM FIXME: enhance journal device recovery processing */ if (test_bit(Journal, &r->flags)) -- 2.25.1

2 1