- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/4] misc for fd
by Chen Ridong 27 Jan '24

27 Jan '24

V2: Add a new misc resource for controlling fd. Chen Ridong (4): filescgroup: remove files of dfl_cftypes. filecgroup: move code of filescontrol.c to files-cgroup.c misc: add MISC_CG_RES_FD resource to control fd. Documentation: add misc resource statement. Documentation/admin-guide/cgroup-v2.rst | 7 + fs/Makefile | 2 + fs/file.c | 16 +- fs/files-cgroup.c | 335 +++++++++++++++++++++++ fs/filescontrol.c | 339 +++--------------------- fs/misc-fd.c | 92 +++++++ include/linux/fdtable.h | 1 + include/linux/files-cgroup.h | 33 +++ include/linux/filescontrol.h | 45 ++-- include/linux/misc-fd.h | 23 ++ include/linux/misc_cgroup.h | 2 + kernel/cgroup/misc.c | 2 + 12 files changed, 563 insertions(+), 334 deletions(-) create mode 100644 fs/files-cgroup.c create mode 100644 fs/misc-fd.c create mode 100644 include/linux/files-cgroup.h create mode 100644 include/linux/misc-fd.h -- 2.34.1

1 4

[openeuler:openEuler-1.0-LTS 20703/21579] kernel/sched/core.c:5845:2: error: implicit declaration of function 'tg_update_affinity_domains'
by kernel test robot 27 Jan '24

27 Jan '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: acf72db532a7791fde53af3dc7b4d0a6adcf6eff commit: 713cfd2684fa5ea08b144d92b9858b932c0f1705 [20703/21579] sched: Introduce smart grid scheduling strategy for cfs config: x86_64-randconfig-001-20240125 (https://download.01.org/0day-ci/archive/20240127/202401271837.ND9zSaBY-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240127/202401271837.ND9zSaBY-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202401271837.ND9zSaBY-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from kernel/sched/core.c:8: In file included from kernel/sched/sched.h:39: In file included from include/linux/blkdev.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from kernel/sched/core.c:8: kernel/sched/sched.h:1249:15: warning: cast from 'void (*)(struct rq *)' to 'void (*)(struct callback_head *)' converts to incompatible function type [-Wcast-function-type-strict] 1249 | head->func = (void (*)(struct callback_head *))func; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/core.c:1587:6: warning: no previous prototype for function 'sched_set_stop_task' [-Wmissing-prototypes] 1587 | void sched_set_stop_task(int cpu, struct task_struct *stop) | ^ kernel/sched/core.c:1587:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1587 | void sched_set_stop_task(int cpu, struct task_struct *stop) | ^ | static kernel/sched/core.c:2741:10: warning: cast from 'void (*)(struct callback_head *)' to 'void (*)(struct rq *)' converts to incompatible function type [-Wcast-function-type-strict] 2741 | func = (void (*)(struct rq *))head->func; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/core.c:3771:35: warning: no previous prototype for function 'preempt_schedule_irq' [-Wmissing-prototypes] 3771 | asmlinkage __visible void __sched preempt_schedule_irq(void) | ^ kernel/sched/core.c:3771:22: note: declare 'static' if the function is not intended to be used outside of this translation unit 3771 | asmlinkage __visible void __sched preempt_schedule_irq(void) | ^ | static >> kernel/sched/core.c:5845:2: error: implicit declaration of function 'tg_update_affinity_domains' [-Werror,-Wimplicit-function-declaration] 5845 | tg_update_affinity_domains(cpu, 1); | ^ kernel/sched/core.c:5904:2: error: implicit declaration of function 'tg_update_affinity_domains' [-Werror,-Wimplicit-function-declaration] 5904 | tg_update_affinity_domains(cpu, 0); | ^ >> kernel/sched/core.c:5976:2: error: implicit declaration of function 'init_auto_affinity' [-Werror,-Wimplicit-function-declaration] 5976 | init_auto_affinity(&root_task_group); | ^ kernel/sched/core.c:5976:2: note: did you mean 'irq_set_affinity'? include/linux/interrupt.h:292:1: note: 'irq_set_affinity' declared here 292 | irq_set_affinity(unsigned int irq, const struct cpumask *cpumask) | ^ >> kernel/sched/core.c:5976:22: error: use of undeclared identifier 'root_task_group'; did you mean 'task_group'? 5976 | init_auto_affinity(&root_task_group); | ^~~~~~~~~~~~~~~ | task_group kernel/sched/sched.h:1444:34: note: 'task_group' declared here 1444 | static inline struct task_group *task_group(struct task_struct *p) | ^ kernel/sched/core.c:6029:32: warning: variable 'ptr' set but not used [-Wunused-but-set-variable] 6029 | unsigned long alloc_size = 0, ptr; | ^ 6 warnings and 4 errors generated. vim +/tg_update_affinity_domains +5845 kernel/sched/core.c 5831 5832 int sched_cpu_activate(unsigned int cpu) 5833 { 5834 struct rq *rq = cpu_rq(cpu); 5835 struct rq_flags rf; 5836 5837 #ifdef CONFIG_SCHED_SMT 5838 /* 5839 * When going up, increment the number of cores with SMT present. 5840 */ 5841 if (cpumask_weight(cpu_smt_mask(cpu)) == 2) 5842 static_branch_inc_cpuslocked(&sched_smt_present); 5843 #endif 5844 set_cpu_active(cpu, true); > 5845 tg_update_affinity_domains(cpu, 1); 5846 5847 if (sched_smp_initialized) { 5848 sched_domains_numa_masks_set(cpu); 5849 cpuset_cpu_active(); 5850 } 5851 5852 /* 5853 * Put the rq online, if not already. This happens: 5854 * 5855 * 1) In the early boot process, because we build the real domains 5856 * after all CPUs have been brought up. 5857 * 5858 * 2) At runtime, if cpuset_cpu_active() fails to rebuild the 5859 * domains. 5860 */ 5861 rq_lock_irqsave(rq, &rf); 5862 if (rq->rd) { 5863 BUG_ON(!cpumask_test_cpu(cpu, rq->rd->span)); 5864 set_rq_online(rq); 5865 } 5866 rq_unlock_irqrestore(rq, &rf); 5867 5868 update_max_interval(); 5869 5870 return 0; 5871 } 5872 5873 int sched_cpu_deactivate(unsigned int cpu) 5874 { 5875 int ret; 5876 5877 set_cpu_active(cpu, false); 5878 /* 5879 * We've cleared cpu_active_mask, wait for all preempt-disabled and RCU 5880 * users of this state to go away such that all new such users will 5881 * observe it. 5882 * 5883 * Do sync before park smpboot threads to take care the rcu boost case. 5884 */ 5885 synchronize_rcu_mult(call_rcu, call_rcu_sched); 5886 5887 #ifdef CONFIG_SCHED_SMT 5888 /* 5889 * When going down, decrement the number of cores with SMT present. 5890 */ 5891 if (cpumask_weight(cpu_smt_mask(cpu)) == 2) 5892 static_branch_dec_cpuslocked(&sched_smt_present); 5893 #endif 5894 5895 if (!sched_smp_initialized) 5896 return 0; 5897 5898 ret = cpuset_cpu_inactive(cpu); 5899 if (ret) { 5900 set_cpu_active(cpu, true); 5901 return ret; 5902 } 5903 sched_domains_numa_masks_clear(cpu); 5904 tg_update_affinity_domains(cpu, 0); 5905 return 0; 5906 } 5907 5908 static void sched_rq_cpu_starting(unsigned int cpu) 5909 { 5910 struct rq *rq = cpu_rq(cpu); 5911 5912 rq->calc_load_update = calc_load_update; 5913 update_max_interval(); 5914 } 5915 5916 int sched_cpu_starting(unsigned int cpu) 5917 { 5918 sched_rq_cpu_starting(cpu); 5919 sched_tick_start(cpu); 5920 return 0; 5921 } 5922 5923 #ifdef CONFIG_HOTPLUG_CPU 5924 int sched_cpu_dying(unsigned int cpu) 5925 { 5926 struct rq *rq = cpu_rq(cpu); 5927 struct rq_flags rf; 5928 5929 /* Handle pending wakeups and then migrate everything off */ 5930 sched_ttwu_pending(); 5931 sched_tick_stop(cpu); 5932 5933 rq_lock_irqsave(rq, &rf); 5934 if (rq->rd) { 5935 BUG_ON(!cpumask_test_cpu(cpu, rq->rd->span)); 5936 set_rq_offline(rq); 5937 } 5938 migrate_tasks(rq, &rf); 5939 BUG_ON(rq->nr_running != 1); 5940 rq_unlock_irqrestore(rq, &rf); 5941 5942 calc_load_migrate(rq); 5943 update_max_interval(); 5944 nohz_balance_exit_idle(rq); 5945 hrtick_clear(rq); 5946 return 0; 5947 } 5948 #endif 5949 5950 void __init sched_init_smp(void) 5951 { 5952 sched_init_numa(); 5953 5954 /* 5955 * There's no userspace yet to cause hotplug operations; hence all the 5956 * CPU masks are stable and all blatant races in the below code cannot 5957 * happen. The hotplug lock is nevertheless taken to satisfy lockdep, 5958 * but there won't be any contention on it. 5959 */ 5960 cpus_read_lock(); 5961 mutex_lock(&sched_domains_mutex); 5962 sched_init_domains(cpu_active_mask); 5963 mutex_unlock(&sched_domains_mutex); 5964 cpus_read_unlock(); 5965 5966 /* Move init over to a non-isolated CPU */ 5967 if (set_cpus_allowed_ptr(current, housekeeping_cpumask(HK_FLAG_DOMAIN)) < 0) 5968 BUG(); 5969 sched_init_granularity(); 5970 5971 init_sched_rt_class(); 5972 init_sched_dl_class(); 5973 5974 sched_smp_initialized = true; 5975 > 5976 init_auto_affinity(&root_task_group); 5977 } 5978 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] nfc: nci: fix possible NULL pointer dereference in send_acknowledge()
by Ziyang Xuan 27 Jan '24

27 Jan '24

From: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> stable inclusion from stable-v5.10.199 commit c95fa5b20fe03609e0894656fa43c18045b5097e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8YCSH CVE: CVE-2023-46343 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7937609cd387246aed994e81aa4fa951358fba41 upstream. Handle memory allocation failure from nci_skb_alloc() (calling alloc_skb()) to avoid possible NULL pointer dereference. Reported-by: 黄思聪 <huangsicong(a)iie.ac.cn> Fixes: 391d8a2da787 ("NFC: Add NCI over SPI receive") Cc: <stable(a)vger.kernel.org> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://lore.kernel.org/r/20231013184129.18738-1-krzysztof.kozlowski@linaro… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- net/nfc/nci/spi.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/nfc/nci/spi.c b/net/nfc/nci/spi.c index 7d8e10e27c20..0651640d6868 100644 --- a/net/nfc/nci/spi.c +++ b/net/nfc/nci/spi.c @@ -151,6 +151,8 @@ static int send_acknowledge(struct nci_spi *nspi, u8 acknowledge) int ret; skb = nci_skb_alloc(nspi->ndev, 0, GFP_KERNEL); + if (!skb) + return -ENOMEM; /* add the NCI SPI header to the start of the buffer */ hdr = skb_push(skb, NCI_SPI_HDR_LEN); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS v2] drm/amdgpu: Fix potential fence use-after-free v2
by GUO Zihua 27 Jan '24

27 Jan '24

From: shanzhulig <shanzhulig(a)gmail.com> mainline inclusion from mainline-v6.5-rc1 commit 2e54154b9f27262efd0cb4f903cc7d5ad1fe9628 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8YD58 CVE: CVE-2023-51042 Reference: https://github.com/torvalds/linux/commit/2e54154b9f27262efd0cb4f903cc7d5ad1… -------------------------------- fence Decrements the reference count before exiting. Avoid Race Vulnerabilities for fence use-after-free. v2 (chk): actually fix the use after free and not just move it. Signed-off-by: shanzhulig <shanzhulig(a)gmail.com> Signed-off-by: Christian König <christian.koenig(a)amd.com> Reviewed-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: GUO Zihua <guozihua(a)huawei.com> --- v2: Removed second Reference line in commit message. --- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c index 81001d879322..aa2731848c3a 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c @@ -1501,15 +1501,15 @@ static int amdgpu_cs_wait_all_fences(struct amdgpu_device *adev, continue; r = dma_fence_wait_timeout(fence, true, timeout); + if (r > 0 && fence->error) + r = fence->error; + dma_fence_put(fence); if (r < 0) return r; if (r == 0) break; - - if (fence->error) - return fence->error; } memset(wait, 0, sizeof(*wait)); -- 2.34.1

2 1

[PATCH OLK-5.10 00/13] scsi: core: Always send batch on reset or error handling command
by Li Lingfeng 27 Jan '24

27 Jan '24

Always send batch on reset or error handling command. Alexander Atanasov (2): scsi: core: Always send batch on reset or error handling command scsi: core: Always send batch on reset or error handling command Bart Van Assche (3): scsi: core: Introduce scsi_get_sector() scsi: core: Use scsi_cmd_to_rq() instead of scsi_cmnd.request scsi: core: Use a structure member to track the SCSI command submitter Greg Kroah-Hartman (6): Revert "scsi: core: Always send batch on reset or error handling command" Revert "scsi: core: Use a structure member to track the SCSI command submitter" Revert "scsi: core: Use scsi_cmd_to_rq() instead of scsi_cmnd.request" Revert "scsi: core: Make scsi_get_lba() return the LBA" Revert "scsi: core: Introduce scsi_get_sector()" Revert "scsi: core: Add scsi_prot_ref_tag() helper" Martin K. Petersen (2): scsi: core: Add scsi_prot_ref_tag() helper scsi: core: Make scsi_get_lba() return the LBA drivers/scsi/scsi_error.c | 2 ++ 1 file changed, 2 insertions(+) -- 2.31.1

1 13

[PATCH openEuler-1.0-LTS v2] rtc: check if __rtc_read_time was successful
by Yu Liao 27 Jan '24

27 Jan '24

From: Tom Rix <trix(a)redhat.com> mainline inclusion from mainline-v5.18-rc1 commit 915593a7a663b2ad08b895a5f3ba8b19d89d4ebf category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8ZCJG CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------- Clang static analysis reports this issue interface.c:810:8: warning: Passed-by-value struct argument contains uninitialized data now = rtc_tm_to_ktime(tm); ^~~~~~~~~~~~~~~~~~~ tm is set by a successful call to __rtc_read_time() but its return status is not checked. Check if it was successful before setting the enabled flag. Move the decl of err to function scope. Fixes: 2b2f5ff00f63 ("rtc: interface: ignore expired timers when enqueuing new timers") Signed-off-by: Tom Rix <trix(a)redhat.com> Signed-off-by: Alexandre Belloni <alexandre.belloni(a)bootlin.com> Link: https://lore.kernel.org/r/20220326194236.2916310-1-trix@redhat.com Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- drivers/rtc/interface.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c index ce051f91829f..e62b341bdc9e 100644 --- a/drivers/rtc/interface.c +++ b/drivers/rtc/interface.c @@ -820,9 +820,13 @@ static int rtc_timer_enqueue(struct rtc_device *rtc, struct rtc_timer *timer) struct timerqueue_node *next = timerqueue_getnext(&rtc->timerqueue); struct rtc_time tm; ktime_t now; + int err; + + err = __rtc_read_time(rtc, &tm); + if (err) + return err; timer->enabled = 1; - __rtc_read_time(rtc, &tm); now = rtc_tm_to_ktime(tm); /* Skip over expired timers */ @@ -836,7 +840,6 @@ static int rtc_timer_enqueue(struct rtc_device *rtc, struct rtc_timer *timer) trace_rtc_timer_enqueue(timer); if (!next || ktime_before(timer->node.expires, next->expires)) { struct rtc_wkalrm alarm; - int err; alarm.time = rtc_ktime_to_tm(timer->node.expires); alarm.enabled = 1; err = __rtc_set_alarm(rtc, &alarm); -- 2.33.0

1 0

[PATCH OLK-6.6] kabi: reserve space for struct acpi_device and acpi_scan_handler
by Xiongfeng Wang 27 Jan '24

27 Jan '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8ZCY9 CVE: NA ------------------------------- reserve space for struct acpi_device, struct acpi_device_power and struct acpi_scan_handler Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- include/acpi/acpi_bus.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h index 0b7eab0ef7d7..66639ce5056e 100644 --- a/include/acpi/acpi_bus.h +++ b/include/acpi/acpi_bus.h @@ -130,6 +130,8 @@ struct acpi_scan_handler { void (*bind)(struct device *phys_dev); void (*unbind)(struct device *phys_dev); struct acpi_hotplug_profile hotplug; + KABI_RESERVE(1) + KABI_RESERVE(2) }; /* @@ -282,6 +284,8 @@ struct acpi_device_power { struct acpi_device_power_flags flags; struct acpi_device_power_state states[ACPI_D_STATE_COUNT]; /* Power states (D0-D3Cold) */ u8 state_for_enumeration; /* Deepest power state for enumeration */ + KABI_RESERVE(1) + KABI_RESERVE(2) }; struct acpi_dep_data { @@ -389,6 +393,8 @@ struct acpi_device { struct list_head physical_node_list; struct mutex physical_node_lock; void (*remove)(struct acpi_device *); + KABI_RESERVE(1) + KABI_RESERVE(2) }; /* Non-device subnode */ -- 2.20.1

1 0

[PATCH OLK-6.6] kabi: reserve space for struct device
by Xiongfeng Wang 27 Jan '24

27 Jan '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8ZD0E CVE: NA ------------------------------- reserve space for struct device. Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- include/linux/device.h | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/include/linux/device.h b/include/linux/device.h index 56d93a1ffb7b..c3a36b0eb784 100644 --- a/include/linux/device.h +++ b/include/linux/device.h @@ -805,6 +805,15 @@ struct device { #ifdef CONFIG_DMA_OPS_BYPASS bool dma_ops_bypass : 1; #endif + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + KABI_RESERVE(8) + KABI_AUX_PTR(device_extended) }; /** -- 2.20.1

2 1

[PATCH OLK-6.6 0/5] Add support for ecmdq
by Zhang Zekun 27 Jan '24

27 Jan '24

Add support for ecmdq trim the whit spaces Zhen Lei (5): iommu/arm-smmu-v3: Add support for ECMDQ register mode iommu/arm-smmu-v3: Ensure that a set of associated commands are inserted in the same ECMDQ iommu/arm-smmu-v3: Add arm_smmu_ecmdq_issue_cmdlist() for non-shared ECMDQ iommu/arm-smmu-v3: Add support for less than one ECMDQ per core iommu/arm-smmu-v3: Allow disabling ECMDQs at boot time drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 434 +++++++++++++++++++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 39 ++ 2 files changed, 465 insertions(+), 8 deletions(-) -- 2.17.1

1 5

[PATCH openEuler-1.0-LTS] crypto: scomp - fix req->dst buffer overflow
by felix 27 Jan '24

27 Jan '24

From: Chengming Zhou <zhouchengming(a)bytedance.com> mainline inclusion from mainline-v6.8-rc1 commit 744e1885922a9943458954cfea917b31064b4131 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8ZBUC CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The req->dst buffer size should be checked before copying from the scomp_scratch->dst to avoid req->dst buffer overflow problem. Fixes: 1ab53a77b772 ("crypto: acomp - add driver-side scomp interface") Reported-by: syzbot+3eff5e51bf1db122a16e(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/0000000000000b05cd060d6b5511@google.com/ Signed-off-by: Chengming Zhou <zhouchengming(a)bytedance.com> Reviewed-by: Barry Song <v-songbaohua(a)oppo.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- crypto/scompress.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/crypto/scompress.c b/crypto/scompress.c index 968bbcf65c94..3ade31df4f22 100644 --- a/crypto/scompress.c +++ b/crypto/scompress.c @@ -149,6 +149,7 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) const int cpu = get_cpu(); u8 *scratch_src = *per_cpu_ptr(scomp_src_scratches, cpu); u8 *scratch_dst = *per_cpu_ptr(scomp_dst_scratches, cpu); + unsigned int dlen; int ret; if (!req->src || !req->slen || req->slen > SCOMP_SCRATCH_SIZE) { @@ -164,6 +165,8 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) if (!req->dlen || req->dlen > SCOMP_SCRATCH_SIZE) req->dlen = SCOMP_SCRATCH_SIZE; + dlen = req->dlen; + scatterwalk_map_and_copy(scratch_src, req->src, 0, req->slen, 0); if (dir) ret = crypto_scomp_compress(scomp, scratch_src, req->slen, @@ -176,6 +179,9 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) req->dst = sgl_alloc(req->dlen, GFP_ATOMIC, NULL); if (!req->dst) goto out; + } else if (req->dlen > dlen) { + ret = -ENOSPC; + goto out; } scatterwalk_map_and_copy(scratch_dst, req->dst, 0, req->dlen, 1); -- 2.34.1

2 1