- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] vxlan: vnifilter: Fix unlocked deletion of default FDB entry
by Wang Hai 04 Jun '25

04 Jun '25

From: Ido Schimmel <idosch(a)nvidia.com> stable inclusion from stable-v6.6.90 commit 3576e9a80b6c4381b01ce0cbaa07f5e92d4492ed category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC9926 CVE: CVE-2025-37921 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 087a9eb9e5978e3ba362e1163691e41097e8ca20 ] When a VNI is deleted from a VXLAN device in 'vnifilter' mode, the FDB entry associated with the default remote (assuming one was configured) is deleted without holding the hash lock. This is wrong and will result in a warning [1] being generated by the lockdep annotation that was added by commit ebe642067455 ("vxlan: Create wrappers for FDB lookup"). Reproducer: # ip link add vx0 up type vxlan dstport 4789 external vnifilter local 192.0.2.1 # bridge vni add vni 10010 remote 198.51.100.1 dev vx0 # bridge vni del vni 10010 dev vx0 Fix by acquiring the hash lock before the deletion and releasing it afterwards. Blame the original commit that introduced the issue rather than the one that exposed it. [1] WARNING: CPU: 3 PID: 392 at drivers/net/vxlan/vxlan_core.c:417 vxlan_find_mac+0x17f/0x1a0 [...] RIP: 0010:vxlan_find_mac+0x17f/0x1a0 [...] Call Trace: <TASK> __vxlan_fdb_delete+0xbe/0x560 vxlan_vni_delete_group+0x2ba/0x940 vxlan_vni_del.isra.0+0x15f/0x580 vxlan_process_vni_filter+0x38b/0x7b0 vxlan_vnifilter_process+0x3bb/0x510 rtnetlink_rcv_msg+0x2f7/0xb70 netlink_rcv_skb+0x131/0x360 netlink_unicast+0x426/0x710 netlink_sendmsg+0x75a/0xc20 __sock_sendmsg+0xc1/0x150 ____sys_sendmsg+0x5aa/0x7b0 ___sys_sendmsg+0xfc/0x180 __sys_sendmsg+0x121/0x1b0 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Fixes: f9c4bb0b245c ("vxlan: vni filtering support on collect metadata device") Signed-off-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Nikolay Aleksandrov <razor(a)blackwall.org> Link: https://patch.msgid.link/20250423145131.513029-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/net/vxlan/vxlan_vnifilter.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/net/vxlan/vxlan_vnifilter.c b/drivers/net/vxlan/vxlan_vnifilter.c index 6e6e9f05509a..06d19e90eadb 100644 --- a/drivers/net/vxlan/vxlan_vnifilter.c +++ b/drivers/net/vxlan/vxlan_vnifilter.c @@ -625,18 +625,24 @@ static void vxlan_vni_delete_group(struct vxlan_dev *vxlan, /* if per vni remote_ip not present, delete the * default dst remote_ip previously added for this vni */ if (!vxlan_addr_any(&vninode->remote_ip) || - !vxlan_addr_any(&dst->remote_ip)) + !vxlan_addr_any(&dst->remote_ip)) { + u32 hash_index = fdb_head_index(vxlan, all_zeros_mac, + vninode->vni); + + spin_lock_bh(&vxlan->hash_lock[hash_index]); __vxlan_fdb_delete(vxlan, all_zeros_mac, (vxlan_addr_any(&vninode->remote_ip) ? dst->remote_ip : vninode->remote_ip), vxlan->cfg.dst_port, vninode->vni, vninode->vni, dst->remote_ifindex, true); + spin_unlock_bh(&vxlan->hash_lock[hash_index]); + } if (vxlan->dev->flags & IFF_UP) { if (vxlan_addr_multicast(&vninode->remote_ip) && !vxlan_group_used(vn, vxlan, vninode->vni, &vninode->remote_ip, -- 2.17.1

2 1

[PATCH OLK-5.10 v4 00/11] arm64: Support xcall prefetch
by Jinjie Ruan 04 Jun '25

04 Jun '25

Support xcall prefetch. Changes in v4: - Enable FAST_SYSCALL/IRQ and XCALL_PREFETCH by default. - Fix xint sleeping function called from invalid context bug. - free_prefetch_item() in file_free() instead of filp_close(), which fix the alloc-queue and free competition. - Fix kernel_read() warning for FMODE_READ not set. - Add sock_from_file() limit for prefetch. - Check NULL for rc_work. - Simplfy the cpumask interface code, and rename to "/proc/xcall/mask_list". - Remove the xcall_cache_pages_order interface. - tracepoint update: fd -> file. - Simplify the xcall_read() function again. - Handle copy_to_user() return value. - Remove unused XCALL_CACHE_QUEUED. - Update the commit message. Changes in v3: - Add XCALL_PREFETCH config to isolate feature code. - Split the /proc/xxx interface code out to independent patches, which will make it clear. - Update the cpumask interface to "/proc/xcall/numa_mask", and it can set the numa mask of all numas one time. - Add xcall select count to make xcall_cache_pages_order adjust safe. - Introduce xcall_read_start/end() to make it clear. - Simplify the xcall_read() function. - Use cpumask_next() instead of get_nth_cpu_in_cpumask() function. - Use independent cpu select policy function. - Remove some unnecessary pr_err(). - Update the commit message. Changes in v2: - Upadte the xcall prefetch state machine, remove the queued state and add prefetch, cancel states. - Remove the pfi lock and use atomic variables. - Change the 'xcall select' semantics and simplify the code a lot. - Remove keep_running, remove unrelated code. - Remove the count in struct read_cache_entry, and use percpu hit/miss count. - Remove sync mode, so remove struct read_cache_entry in struct task_struct. - Use hash table to find prefetch item for a file, which will not change the file struct KABI. - Use rwlock instead of spinlock for hash table. - Use alloc_page() instead kmalloc() to align 4KB. - Update the commit message. Jinjie Ruan (7): arm64: Introduce Xint software solution arm64: Add debugfs dir for xint eventpoll: xcall: Support async prefetch data in epoll xcall: Add /proc/xcall/prefetch dir for performance tuning xcall: Add /proc/xcall/mask_list for performance tuning xcall: eventpoll: add tracepoint config: Enable FAST_SYSCALL/IRQ and XCALL_PREFETCH by default Liao Chen (1): revert kpti bypass Yipeng Zou (3): arm64: Introduce xcall a faster svc exception handling arm64: Faster SVC exception handler with xcall xcall: Introduce xcall_select to mark special syscall arch/Kconfig | 80 +++++ arch/arm64/Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 7 + arch/arm64/include/asm/cpucaps.h | 2 + arch/arm64/include/asm/exception.h | 3 + arch/arm64/kernel/asm-offsets.c | 3 + arch/arm64/kernel/cpufeature.c | 54 ++++ arch/arm64/kernel/entry-common.c | 22 ++ arch/arm64/kernel/entry.S | 183 +++++++++++- arch/arm64/kernel/syscall.c | 57 ++++ drivers/irqchip/irq-gic-v3.c | 130 +++++++++ fs/eventpoll.c | 387 +++++++++++++++++++++++++ fs/file_table.c | 1 + fs/proc/base.c | 152 ++++++++++ fs/read_write.c | 6 + include/linux/fs.h | 35 +++ include/linux/hardirq.h | 5 + include/linux/irqchip/arm-gic-v3.h | 13 + include/linux/sched.h | 5 + include/trace/events/fs.h | 93 ++++++ kernel/fork.c | 32 ++ kernel/irq/debugfs.c | 33 +++ kernel/irq/internals.h | 18 ++ kernel/irq/irqdesc.c | 19 ++ kernel/irq/proc.c | 10 + kernel/softirq.c | 73 +++++ 26 files changed, 1423 insertions(+), 2 deletions(-) -- 2.34.1

2 12

[openeuler:OLK-6.6 2357/2357] drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ethtool.c:2022:5: error: no previous prototype for 'sxe_reg_test'
by kernel test robot 04 Jun '25

04 Jun '25

Hi liujie_answer, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a9e6ec001662a376522f36604dfec47c30530549 commit: dd013ad487534c1838afc2f55efdb5daec15aace [2357/2357] Ethernet: Linkdata: Supports Linkdata ethernet Controllers config: x86_64-buildonly-randconfig-005-20250604 (https://download.01.org/0day-ci/archive/20250604/202506041859.bN9GgUIO-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250604/202506041859.bN9GgUIO-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202506041859.bN9GgUIO-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.c:88:6: error: no previous prototype for 'sxevf_tx_ring_free' [-Werror=missing-prototypes] 88 | void sxevf_tx_ring_free(struct sxevf_ring *ring) | ^~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.c:127:5: error: no previous prototype for 'sxevf_tx_ring_alloc' [-Werror=missing-prototypes] 127 | s32 sxevf_tx_ring_alloc(struct sxevf_ring *ring) | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.c: In function 'sxevf_xmit_pkt': >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.c:703:66: error: suggest braces around empty body in an 'if' statement [-Werror=empty-body] 703 | ring->idx, SXEVF_TX_DESC_NEEDED); | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.c: In function 'sxevf_ring_xmit': drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.c:803:74: error: suggest braces around empty body in an 'if' statement [-Werror=empty-body] 803 | LOG_ERROR("tx dma mapping err, ring idx=%u\n", ring->idx); | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.c: In function 'sxevf_xmit': >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.c:838:71: error: suggest braces around empty body in an 'else' statement [-Werror=empty-body] 838 | LOG_DEBUG("sxe xmit end, ring idx=%u\n", tx_ring->idx); | ^ cc1: all warnings being treated as errors -- >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:160:6: error: no previous prototype for 'sxevf_hw_stop' [-Werror=missing-prototypes] 160 | void sxevf_hw_stop(struct sxevf_hw *hw) | ^~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:187:6: error: no previous prototype for 'sxevf_msg_write' [-Werror=missing-prototypes] 187 | void sxevf_msg_write(struct sxevf_hw *hw, u8 index, u32 msg) | ^~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:196:5: error: no previous prototype for 'sxevf_msg_read' [-Werror=missing-prototypes] 196 | u32 sxevf_msg_read(struct sxevf_hw *hw, u8 index) | ^~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:206:5: error: no previous prototype for 'sxevf_mailbox_read' [-Werror=missing-prototypes] 206 | u32 sxevf_mailbox_read(struct sxevf_hw *hw) | ^~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:211:6: error: no previous prototype for 'sxevf_mailbox_write' [-Werror=missing-prototypes] 211 | void sxevf_mailbox_write(struct sxevf_hw *hw, u32 value) | ^~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:216:6: error: no previous prototype for 'sxevf_pf_req_irq_trigger' [-Werror=missing-prototypes] 216 | void sxevf_pf_req_irq_trigger(struct sxevf_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:221:6: error: no previous prototype for 'sxevf_pf_ack_irq_trigger' [-Werror=missing-prototypes] 221 | void sxevf_pf_ack_irq_trigger(struct sxevf_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:226:6: error: no previous prototype for 'sxevf_event_irq_map' [-Werror=missing-prototypes] 226 | void sxevf_event_irq_map(struct sxevf_hw *hw, u16 vector) | ^~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:240:6: error: no previous prototype for 'sxevf_specific_irq_enable' [-Werror=missing-prototypes] 240 | void sxevf_specific_irq_enable(struct sxevf_hw *hw, u32 value) | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:245:6: error: no previous prototype for 'sxevf_irq_enable' [-Werror=missing-prototypes] 245 | void sxevf_irq_enable(struct sxevf_hw *hw, u32 mask) | ^~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:251:6: error: no previous prototype for 'sxevf_irq_disable' [-Werror=missing-prototypes] 251 | void sxevf_irq_disable(struct sxevf_hw *hw) | ^~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:259:6: error: no previous prototype for 'sxevf_hw_ring_irq_map' [-Werror=missing-prototypes] 259 | void sxevf_hw_ring_irq_map(struct sxevf_hw *hw, bool is_tx, u16 hw_ring_idx, | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:276:6: error: no previous prototype for 'sxevf_ring_irq_interval_set' [-Werror=missing-prototypes] 276 | void sxevf_ring_irq_interval_set(struct sxevf_hw *hw, u16 irq_idx, u32 interval) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:313:6: error: no previous prototype for 'sxevf_hw_reset' [-Werror=missing-prototypes] 313 | void sxevf_hw_reset(struct sxevf_hw *hw) | ^~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:324:5: error: no previous prototype for 'sxevf_link_state_get' [-Werror=missing-prototypes] 324 | u32 sxevf_link_state_get(struct sxevf_hw *hw) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:539:6: error: no previous prototype for 'sxevf_tx_ring_switch' [-Werror=missing-prototypes] 539 | void sxevf_tx_ring_switch(struct sxevf_hw *hw, u8 reg_idx, bool is_on) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:594:6: error: no previous prototype for 'sxevf_rx_ring_switch' [-Werror=missing-prototypes] 594 | void sxevf_rx_ring_switch(struct sxevf_hw *hw, u8 reg_idx, bool is_on) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:626:6: error: no previous prototype for 'sxevf_rx_ring_desc_configure' [-Werror=missing-prototypes] 626 | void sxevf_rx_ring_desc_configure(struct sxevf_hw *hw, u32 desc_mem_len, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:640:6: error: no previous prototype for 'sxevf_rx_rcv_ctl_configure' [-Werror=missing-prototypes] 640 | void sxevf_rx_rcv_ctl_configure(struct sxevf_hw *hw, u8 reg_idx, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:697:6: error: no previous prototype for 'sxevf_32bit_counter_update' [-Werror=missing-prototypes] 697 | void sxevf_32bit_counter_update(struct sxevf_hw *hw, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:710:6: error: no previous prototype for 'sxevf_36bit_counter_update' [-Werror=missing-prototypes] 710 | void sxevf_36bit_counter_update(struct sxevf_hw *hw, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:726:6: error: no previous prototype for 'sxevf_packet_stats_get' [-Werror=missing-prototypes] 726 | void sxevf_packet_stats_get(struct sxevf_hw *hw, struct sxevf_hw_stats *stats) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:740:6: error: no previous prototype for 'sxevf_stats_init_value_get' [-Werror=missing-prototypes] 740 | void sxevf_stats_init_value_get(struct sxevf_hw *hw, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_rx_proc.c:362:6: error: no previous prototype for 'sxevf_rx_ring_buffers_alloc' [-Werror=missing-prototypes] 362 | void sxevf_rx_ring_buffers_alloc(struct sxevf_ring *rx_ring, u16 cleaned_count) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ethtool.c:2022:5: error: no previous prototype for 'sxe_reg_test' [-Werror=missing-prototypes] 2022 | int sxe_reg_test(struct sxe_adapter *adapter) | ^~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ethtool.c:2644:5: error: no previous prototype for 'sxe_phys_id_set' [-Werror=missing-prototypes] 2644 | int sxe_phys_id_set(struct net_device *netdev, enum ethtool_phys_id_state state) | ^~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ethtool.c: In function 'sxe_get_module_eeprom': >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ethtool.c:2736:47: error: suggest braces around empty body in an 'if' statement [-Werror=empty-body] 2736 | LOG_ERROR("read sfp failed\n"); | ^ cc1: all warnings being treated as errors -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_rx_proc.c:1431:6: error: no previous prototype for 'sxe_headers_cleanup' [-Werror=missing-prototypes] 1431 | bool sxe_headers_cleanup(struct sxe_ring *rx_ring, | ^~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_rx_proc.c:1569:6: error: no previous prototype for 'sxe_rx_buffer_page_offset_update' [-Werror=missing-prototypes] 1569 | void sxe_rx_buffer_page_offset_update(struct sxe_ring *rx_ring, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_main.c:70:6: error: no previous prototype for 'sxe_allow_inval_mac' [-Werror=missing-prototypes] 70 | bool sxe_allow_inval_mac(void) | ^~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_irq.c:136:5: error: no previous prototype for 'sxe_msi_irq_init' [-Werror=missing-prototypes] 136 | int sxe_msi_irq_init(struct sxe_adapter *adapter) | ^~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_irq.c:182:6: error: no previous prototype for 'sxe_disable_dcb' [-Werror=missing-prototypes] 182 | void sxe_disable_dcb(struct sxe_adapter *adapter) | ^~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_irq.c:212:6: error: no previous prototype for 'sxe_disable_rss' [-Werror=missing-prototypes] 212 | void sxe_disable_rss(struct sxe_adapter *adapter) | ^~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_irq.c:729:6: error: no previous prototype for 'sxe_lsc_irq_handler' [-Werror=missing-prototypes] 729 | void sxe_lsc_irq_handler(struct sxe_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_irq.c:745:6: error: no previous prototype for 'sxe_mailbox_irq_handler' [-Werror=missing-prototypes] 745 | void sxe_mailbox_irq_handler(struct sxe_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_xdp.c:410:6: error: no previous prototype for 'sxe_txrx_ring_enable' [-Werror=missing-prototypes] 410 | void sxe_txrx_ring_enable(struct sxe_adapter *adapter, u32 ring_idx) | ^~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:230:6: error: no previous prototype for 'sxe_hw_no_snoop_disable' [-Werror=missing-prototypes] 230 | void sxe_hw_no_snoop_disable(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:262:6: error: no previous prototype for 'sxe_hw_uc_addr_pool_del' [-Werror=missing-prototypes] 262 | void sxe_hw_uc_addr_pool_del(struct sxe_hw *hw, u32 rar_idx, u32 pool_idx) | ^~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:283:5: error: no previous prototype for 'sxe_hw_uc_addr_pool_enable' [-Werror=missing-prototypes] 283 | s32 sxe_hw_uc_addr_pool_enable(struct sxe_hw *hw, u8 rar_idx, u8 pool_idx) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:337:5: error: no previous prototype for 'sxe_hw_nic_reset' [-Werror=missing-prototypes] 337 | s32 sxe_hw_nic_reset(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:367:6: error: no previous prototype for 'sxe_hw_pf_rst_done_set' [-Werror=missing-prototypes] 367 | void sxe_hw_pf_rst_done_set(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:735:5: error: no previous prototype for 'sxe_hw_pending_irq_read_clear' [-Werror=missing-prototypes] 735 | u32 sxe_hw_pending_irq_read_clear(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:740:6: error: no previous prototype for 'sxe_hw_pending_irq_write_clear' [-Werror=missing-prototypes] 740 | void sxe_hw_pending_irq_write_clear(struct sxe_hw *hw, u32 value) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:745:5: error: no previous prototype for 'sxe_hw_irq_cause_get' [-Werror=missing-prototypes] 745 | u32 sxe_hw_irq_cause_get(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:765:6: error: no previous prototype for 'sxe_hw_ring_irq_auto_disable' [-Werror=missing-prototypes] 765 | void sxe_hw_ring_irq_auto_disable(struct sxe_hw *hw, bool is_msix) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:775:6: error: no previous prototype for 'sxe_hw_irq_general_reg_set' [-Werror=missing-prototypes] 775 | void sxe_hw_irq_general_reg_set(struct sxe_hw *hw, u32 value) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:780:5: error: no previous prototype for 'sxe_hw_irq_general_reg_get' [-Werror=missing-prototypes] 780 | u32 sxe_hw_irq_general_reg_get(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:790:6: error: no previous prototype for 'sxe_hw_event_irq_map' [-Werror=missing-prototypes] 790 | void sxe_hw_event_irq_map(struct sxe_hw *hw, u8 offset, u16 irq_idx) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:806:6: error: no previous prototype for 'sxe_hw_ring_irq_map' [-Werror=missing-prototypes] 806 | void sxe_hw_ring_irq_map(struct sxe_hw *hw, bool is_tx, u16 reg_idx, | ^~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:823:6: error: no previous prototype for 'sxe_hw_ring_irq_interval_set' [-Werror=missing-prototypes] 823 | void sxe_hw_ring_irq_interval_set(struct sxe_hw *hw, u16 irq_idx, u32 interval) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:838:6: error: no previous prototype for 'sxe_hw_event_irq_auto_clear_set' [-Werror=missing-prototypes] 838 | void sxe_hw_event_irq_auto_clear_set(struct sxe_hw *hw, u32 value) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:843:6: error: no previous prototype for 'sxe_hw_specific_irq_disable' [-Werror=missing-prototypes] 843 | void sxe_hw_specific_irq_disable(struct sxe_hw *hw, u32 value) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:848:6: error: no previous prototype for 'sxe_hw_specific_irq_enable' [-Werror=missing-prototypes] 848 | void sxe_hw_specific_irq_enable(struct sxe_hw *hw, u32 value) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:876:6: error: no previous prototype for 'sxe_hw_all_irq_disable' [-Werror=missing-prototypes] 876 | void sxe_hw_all_irq_disable(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:994:5: error: no previous prototype for 'sxe_hw_link_speed_get' [-Werror=missing-prototypes] 994 | u32 sxe_hw_link_speed_get(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1014:6: error: no previous prototype for 'sxe_hw_link_speed_set' [-Werror=missing-prototypes] 1014 | void sxe_hw_link_speed_set(struct sxe_hw *hw, u32 speed) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1033:6: error: no previous prototype for 'sxe_hw_is_link_state_up' [-Werror=missing-prototypes] 1033 | bool sxe_hw_is_link_state_up(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1055:6: error: no previous prototype for 'sxe_hw_mac_pad_enable' [-Werror=missing-prototypes] 1055 | void sxe_hw_mac_pad_enable(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1064:5: error: no previous prototype for 'sxe_hw_fc_enable' [-Werror=missing-prototypes] 1064 | s32 sxe_hw_fc_enable(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1135:6: error: no previous prototype for 'sxe_fc_autoneg_localcap_set' [-Werror=missing-prototypes] 1135 | void sxe_fc_autoneg_localcap_set(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1164:5: error: no previous prototype for 'sxe_hw_pfc_enable' [-Werror=missing-prototypes] 1164 | s32 sxe_hw_pfc_enable(struct sxe_hw *hw, u8 tc_idx) | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1256:6: error: no previous prototype for 'sxe_hw_crc_configure' [-Werror=missing-prototypes] 1256 | void sxe_hw_crc_configure(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1264:6: error: no previous prototype for 'sxe_hw_loopback_switch' [-Werror=missing-prototypes] 1264 | void sxe_hw_loopback_switch(struct sxe_hw *hw, bool is_enable) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1276:6: error: no previous prototype for 'sxe_hw_mac_txrx_enable' [-Werror=missing-prototypes] 1276 | void sxe_hw_mac_txrx_enable(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1285:6: error: no previous prototype for 'sxe_hw_mac_max_frame_set' [-Werror=missing-prototypes] 1285 | void sxe_hw_mac_max_frame_set(struct sxe_hw *hw, u32 max_frame) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1298:5: error: no previous prototype for 'sxe_hw_mac_max_frame_get' [-Werror=missing-prototypes] 1298 | u32 sxe_hw_mac_max_frame_get(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1330:6: error: no previous prototype for 'sxe_hw_fc_tc_high_water_mark_set' [-Werror=missing-prototypes] 1330 | void sxe_hw_fc_tc_high_water_mark_set(struct sxe_hw *hw, u8 tc_idx, u32 mark) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1335:6: error: no previous prototype for 'sxe_hw_fc_tc_low_water_mark_set' [-Werror=missing-prototypes] 1335 | void sxe_hw_fc_tc_low_water_mark_set(struct sxe_hw *hw, u8 tc_idx, u32 mark) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1340:6: error: no previous prototype for 'sxe_hw_is_fc_autoneg_disabled' [-Werror=missing-prototypes] 1340 | bool sxe_hw_is_fc_autoneg_disabled(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1345:6: error: no previous prototype for 'sxe_hw_fc_autoneg_disable_set' [-Werror=missing-prototypes] 1345 | void sxe_hw_fc_autoneg_disable_set(struct sxe_hw *hw, bool is_disabled) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1360:6: error: no previous prototype for 'sxe_hw_fc_requested_mode_set' [-Werror=missing-prototypes] 1360 | void sxe_hw_fc_requested_mode_set(struct sxe_hw *hw, enum sxe_fc_mode mode) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1388:5: error: no previous prototype for 'sxe_hw_rx_mode_get' [-Werror=missing-prototypes] 1388 | u32 sxe_hw_rx_mode_get(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1393:5: error: no previous prototype for 'sxe_hw_pool_rx_mode_get' [-Werror=missing-prototypes] 1393 | u32 sxe_hw_pool_rx_mode_get(struct sxe_hw *hw, u16 pool_idx) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1398:6: error: no previous prototype for 'sxe_hw_rx_mode_set' [-Werror=missing-prototypes] 1398 | void sxe_hw_rx_mode_set(struct sxe_hw *hw, u32 filter_ctrl) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1403:6: error: no previous prototype for 'sxe_hw_pool_rx_mode_set' [-Werror=missing-prototypes] 1403 | void sxe_hw_pool_rx_mode_set(struct sxe_hw *hw, u32 vmolr, u16 pool_idx) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1408:6: error: no previous prototype for 'sxe_hw_rx_lro_enable' [-Werror=missing-prototypes] 1408 | void sxe_hw_rx_lro_enable(struct sxe_hw *hw, bool is_enable) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1420:6: error: no previous prototype for 'sxe_hw_rx_nfs_filter_disable' [-Werror=missing-prototypes] 1420 | void sxe_hw_rx_nfs_filter_disable(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1428:6: error: no previous prototype for 'sxe_hw_rx_udp_frag_checksum_disable' [-Werror=missing-prototypes] 1428 | void sxe_hw_rx_udp_frag_checksum_disable(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1437:6: error: no previous prototype for 'sxe_hw_fc_mac_addr_set' [-Werror=missing-prototypes] 1437 | void sxe_hw_fc_mac_addr_set(struct sxe_hw *hw, u8 *mac_addr) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1449:5: error: no previous prototype for 'sxe_hw_uc_addr_add' [-Werror=missing-prototypes] 1449 | s32 sxe_hw_uc_addr_add(struct sxe_hw *hw, u32 rar_idx, u8 *addr, u32 pool_idx) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1484:5: error: no previous prototype for 'sxe_hw_uc_addr_del' [-Werror=missing-prototypes] 1484 | s32 sxe_hw_uc_addr_del(struct sxe_hw *hw, u32 index) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1510:6: error: no previous prototype for 'sxe_hw_mta_hash_table_set' [-Werror=missing-prototypes] 1510 | void sxe_hw_mta_hash_table_set(struct sxe_hw *hw, u8 index, u32 value) | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1515:6: error: no previous prototype for 'sxe_hw_mta_hash_table_update' [-Werror=missing-prototypes] 1515 | void sxe_hw_mta_hash_table_update(struct sxe_hw *hw, u8 reg_idx, u8 bit_idx) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1525:5: error: no previous prototype for 'sxe_hw_mc_filter_get' [-Werror=missing-prototypes] 1525 | u32 sxe_hw_mc_filter_get(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1530:6: error: no previous prototype for 'sxe_hw_mc_filter_enable' [-Werror=missing-prototypes] 1530 | void sxe_hw_mc_filter_enable(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1554:6: error: no previous prototype for 'sxe_hw_uc_addr_clear' [-Werror=missing-prototypes] 1554 | void sxe_hw_uc_addr_clear(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1587:6: error: no previous prototype for 'sxe_hw_vt_ctrl_cfg' [-Werror=missing-prototypes] 1587 | void sxe_hw_vt_ctrl_cfg(struct sxe_hw *hw, u8 default_pool) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1601:6: error: no previous prototype for 'sxe_hw_vt_disable' [-Werror=missing-prototypes] 1601 | void sxe_hw_vt_disable(struct sxe_hw *hw) | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:1675:5: error: no previous prototype for 'sxe_hw_vlan_pool_filter_read' [-Werror=missing-prototypes] 1675 | u32 sxe_hw_vlan_pool_filter_read(struct sxe_hw *hw, u16 reg_index) .. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PTP_1588_CLOCK Depends on [n]: NET [=y] && POSIX_TIMERS [=n] Selected by [y]: - SXE [=y] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_LINKDATA [=y] && (X86 [=y] || ARM64) && PCI [=y] - SXE_VF [=y] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_LINKDATA [=y] && (X86 [=y] || ARM64) && PCI [=y] vim +/sxe_reg_test +2022 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ethtool.c 2021 > 2022 int sxe_reg_test(struct sxe_adapter *adapter) 2023 { 2024 s32 ret; 2025 struct sxe_hw *hw = &adapter->hw; 2026 2027 if (sxe_is_hw_fault(hw)) { 2028 LOG_MSG_ERR(drv, "nic hw fault - register test blocked\n"); 2029 ret = -SXE_DIAG_TEST_BLOCKED; 2030 goto l_end; 2031 } 2032 2033 ret = hw->setup.ops->regs_test(hw); 2034 if (ret) { 2035 LOG_ERROR_BDF("register test failed\n"); 2036 goto l_end; 2037 } 2038 2039 l_end: 2040 return ret; 2041 } 2042 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS V1] ipc: fix to protect IPCS lookups using RCU
by Wang Tao 04 Jun '25

04 Jun '25

From: Jeongjun Park <aha310510(a)gmail.com> mainline inclusion from mainline-v6.16-rc1 commit d66adabe91803ef34a8b90613c81267b5ded1472 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICCDPO Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot reported that it discovered a use-after-free vulnerability, [0] [0]: https://lore.kernel.org/all/67af13f8.050a0220.21dd3.0038.GAE@google.com/ idr_for_each() is protected by rwsem, but this is not enough. If it is not protected by RCU read-critical region, when idr_for_each() calls radix_tree_node_free() through call_rcu() to free the radix_tree_node structure, the node will be freed immediately, and when reading the next node in radix_tree_for_each_slot(), the already freed memory may be read. Therefore, we need to add code to make sure that idr_for_each() is protected within the RCU read-critical region when we call it in shm_destroy_orphaned(). Link: https://lkml.kernel.org/r/20250424143322.18830-1-aha310510@gmail.com Fixes: b34a6b1da371 ("ipc: introduce shm_rmid_forced sysctl") Signed-off-by: Jeongjun Park <aha310510(a)gmail.com> Reported-by: syzbot+a2b84e569d06ca3a949c(a)syzkaller.appspotmail.com Cc: Jeongjun Park <aha310510(a)gmail.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: Vasiliy Kulikov <segoon(a)openwall.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- ipc/shm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ipc/shm.c b/ipc/shm.c index 0a5053f5726f..14282b7f9800 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -417,8 +417,11 @@ static int shm_try_destroy_orphaned(int id, void *p, void *data) void shm_destroy_orphaned(struct ipc_namespace *ns) { down_write(&shm_ids(ns).rwsem); - if (shm_ids(ns).in_use) + if (shm_ids(ns).in_use) { + rcu_read_lock(); idr_for_each(&shm_ids(ns).ipcs_idr, &shm_try_destroy_orphaned, ns); + rcu_read_unlock(); + } up_write(&shm_ids(ns).rwsem); } -- 2.34.1

2 1

[PATCH OLK-5.10 V1] ipc: fix to protect IPCS lookups using RCU
by Wang Tao 04 Jun '25

04 Jun '25

From: Jeongjun Park <aha310510(a)gmail.com> mainline inclusion from mainline-v6.16-rc1 commit d66adabe91803ef34a8b90613c81267b5ded1472 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICCDPO Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot reported that it discovered a use-after-free vulnerability, [0] [0]: https://lore.kernel.org/all/67af13f8.050a0220.21dd3.0038.GAE@google.com/ idr_for_each() is protected by rwsem, but this is not enough. If it is not protected by RCU read-critical region, when idr_for_each() calls radix_tree_node_free() through call_rcu() to free the radix_tree_node structure, the node will be freed immediately, and when reading the next node in radix_tree_for_each_slot(), the already freed memory may be read. Therefore, we need to add code to make sure that idr_for_each() is protected within the RCU read-critical region when we call it in shm_destroy_orphaned(). Link: https://lkml.kernel.org/r/20250424143322.18830-1-aha310510@gmail.com Fixes: b34a6b1da371 ("ipc: introduce shm_rmid_forced sysctl") Signed-off-by: Jeongjun Park <aha310510(a)gmail.com> Reported-by: syzbot+a2b84e569d06ca3a949c(a)syzkaller.appspotmail.com Cc: Jeongjun Park <aha310510(a)gmail.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: Vasiliy Kulikov <segoon(a)openwall.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- ipc/shm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ipc/shm.c b/ipc/shm.c index b418731d66e8..323a5810a947 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -417,8 +417,11 @@ static int shm_try_destroy_orphaned(int id, void *p, void *data) void shm_destroy_orphaned(struct ipc_namespace *ns) { down_write(&shm_ids(ns).rwsem); - if (shm_ids(ns).in_use) + if (shm_ids(ns).in_use) { + rcu_read_lock(); idr_for_each(&shm_ids(ns).ipcs_idr, &shm_try_destroy_orphaned, ns); + rcu_read_unlock(); + } up_write(&shm_ids(ns).rwsem); } -- 2.34.1

2 1

[PATCH OLK-6.6 V1] ipc: fix to protect IPCS lookups using RCU
by Wang Tao 04 Jun '25

04 Jun '25

From: Jeongjun Park <aha310510(a)gmail.com> mainline inclusion from mainline-v6.16-rc1 commit d66adabe91803ef34a8b90613c81267b5ded1472 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICCDPO Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot reported that it discovered a use-after-free vulnerability, [0] [0]: https://lore.kernel.org/all/67af13f8.050a0220.21dd3.0038.GAE@google.com/ idr_for_each() is protected by rwsem, but this is not enough. If it is not protected by RCU read-critical region, when idr_for_each() calls radix_tree_node_free() through call_rcu() to free the radix_tree_node structure, the node will be freed immediately, and when reading the next node in radix_tree_for_each_slot(), the already freed memory may be read. Therefore, we need to add code to make sure that idr_for_each() is protected within the RCU read-critical region when we call it in shm_destroy_orphaned(). Link: https://lkml.kernel.org/r/20250424143322.18830-1-aha310510@gmail.com Fixes: b34a6b1da371 ("ipc: introduce shm_rmid_forced sysctl") Signed-off-by: Jeongjun Park <aha310510(a)gmail.com> Reported-by: syzbot+a2b84e569d06ca3a949c(a)syzkaller.appspotmail.com Cc: Jeongjun Park <aha310510(a)gmail.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: Vasiliy Kulikov <segoon(a)openwall.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- ipc/shm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ipc/shm.c b/ipc/shm.c index 0a02bc6d7cdf..fdc248663b2b 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -430,8 +430,11 @@ static int shm_try_destroy_orphaned(int id, void *p, void *data) void shm_destroy_orphaned(struct ipc_namespace *ns) { down_write(&shm_ids(ns).rwsem); - if (shm_ids(ns).in_use) + if (shm_ids(ns).in_use) { + rcu_read_lock(); idr_for_each(&shm_ids(ns).ipcs_idr, &shm_try_destroy_orphaned, ns); + rcu_read_unlock(); + } up_write(&shm_ids(ns).rwsem); } -- 2.34.1

2 1

[PATCH OLK-6.6] dlm: prevent NPD when writing a positive value to event_done
by Xia Fukun 04 Jun '25

04 Jun '25

From: Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> mainline inclusion from mainline-v6.15-rc1 commit 8e2bad543eca5c25cd02cbc63d72557934d45f13 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QSS CVE: CVE-2025-23131 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- do_uevent returns the value written to event_done. In case it is a positive value, new_lockspace would undo all the work, and lockspace would not be set. __dlm_new_lockspace, however, would treat that positive value as a success due to commit 8511a2728ab8 ("dlm: fix use count with multiple joins"). Down the line, device_create_lockspace would pass that NULL lockspace to dlm_find_lockspace_local, leading to a NULL pointer dereference. Treating such positive values as successes prevents the problem. Given this has been broken for so long, this is unlikely to break userspace expectations. Fixes: 8511a2728ab8 ("dlm: fix use count with multiple joins") Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> Signed-off-by: David Teigland <teigland(a)redhat.com> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- fs/dlm/lockspace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c index 0455dddb0797..81fa59be7808 100644 --- a/fs/dlm/lockspace.c +++ b/fs/dlm/lockspace.c @@ -631,7 +631,7 @@ static int new_lockspace(const char *name, const char *cluster, lockspace to start running (via sysfs) in dlm_ls_start(). */ error = do_uevent(ls, 1); - if (error) + if (error < 0) goto out_recoverd; /* wait until recovery is successful or failed */ -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] tracing: Fix oob write in trace_seq_to_buffer()
by Pan Taixi 04 Jun '25

04 Jun '25

Fix the issue where trace_seq_to_buffer() tries to copy more data than PAGE_SIZE to buf. Jeongjun Park (1): tracing: Fix oob write in trace_seq_to_buffer() Pan Taixi (1): tracing: Fix compilation warning on arm32 kernel/trace/trace.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] tracing: Fix oob write in trace_seq_to_buffer()
by Pan Taixi 04 Jun '25

04 Jun '25

Fix the issue where trace_seq_to_buffer() tries to copy more data than PAGE_SIZE to buf. Jeongjun Park (1): tracing: Fix oob write in trace_seq_to_buffer() Pan Taixi (1): tracing: Fix compilation warning on arm32 kernel/trace/trace.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] module: ensure that kobject_put() is safe for module type kobjects
by Pan Taixi 04 Jun '25

04 Jun '25

From: Dmitry Antipov <dmantipov(a)yandex.ru> stable inclusion from stable-v5.15.183 commit f1c71b4bd721a4ea21da408806964b10468623f2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICBIZQ CVE: CVE-2025-37995 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a6aeb739974ec73e5217c75a7c008a688d3d5cf1 upstream. In 'lookup_or_create_module_kobject()', an internal kobject is created using 'module_ktype'. So call to 'kobject_put()' on error handling path causes an attempt to use an uninitialized completion pointer in 'module_kobject_release()'. In this scenario, we just want to release kobject without an extra synchronization required for a regular module unloading process, so adding an extra check whether 'complete()' is actually required makes 'kobject_put()' safe. Reported-by: syzbot+7fb8a372e1f6add936dd(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7fb8a372e1f6add936dd Fixes: 942e443127e9 ("module: Fix mod->mkobj.kobj potentially freed too early") Cc: stable(a)vger.kernel.org Suggested-by: Petr Pavlu <petr.pavlu(a)suse.com> Signed-off-by: Dmitry Antipov <dmantipov(a)yandex.ru> Link: https://lore.kernel.org/r/20250507065044.86529-1-dmantipov@yandex.ru Signed-off-by: Petr Pavlu <petr.pavlu(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- kernel/params.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/params.c b/kernel/params.c index 8299bd764e42e7..1b856942d82d40 100644 --- a/kernel/params.c +++ b/kernel/params.c @@ -945,7 +945,9 @@ int module_sysfs_initialized; static void module_kobj_release(struct kobject *kobj) { struct module_kobject *mk = to_module_kobject(kobj); - complete(mk->kobj_completion); + + if (mk->kobj_completion) + complete(mk->kobj_completion); } struct kobj_type module_ktype = { -- cgit 1.2.3-korg

2 1