- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
by Ze Zuo 10 Apr '24

10 Apr '24

From: Zach O'Keefe <zokeefe(a)google.com> stable inclusion from stable-v5.10.210 commit 81e7d2530d458548b90a5c5e76b77ad5e5d1c0df category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2EC CVE: CVE-2024-26720 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 9319b647902cbd5cc884ac08a8a6d54ce111fc78 upstream. (struct dirty_throttle_control *)->thresh is an unsigned long, but is passed as the u32 divisor argument to div_u64(). On architectures where unsigned long is 64 bytes, the argument will be implicitly truncated. Use div64_u64() instead of div_u64() so that the value used in the "is this a safe division" check is the same as the divisor. Also, remove redundant cast of the numerator to u64, as that should happen implicitly. This would be difficult to exploit in memcg domain, given the ratio-based arithmetic domain_drity_limits() uses, but is much easier in global writeback domain with a BDI_CAP_STRICTLIMIT-backing device, using e.g. vm.dirty_bytes=(1<<32)*PAGE_SIZE so that dtc->thresh == (1<<32) Link: https://lkml.kernel.org/r/20240118181954.1415197-1-zokeefe@google.com Fixes: f6789593d5ce ("mm/page-writeback.c: fix divide by zero in bdi_dirty_limits()") Signed-off-by: Zach O'Keefe <zokeefe(a)google.com> Cc: Maxim Patlasov <MPatlasov(a)parallels.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- mm/page-writeback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/page-writeback.c b/mm/page-writeback.c index b72da123f242..e969667e8d62 100644 --- a/mm/page-writeback.c +++ b/mm/page-writeback.c @@ -1519,7 +1519,7 @@ static inline void wb_dirty_limits(struct dirty_throttle_control *dtc) */ dtc->wb_thresh = __wb_calc_thresh(dtc); dtc->wb_bg_thresh = dtc->thresh ? - div_u64((u64)dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0; + div64_u64(dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0; /* * In order to avoid the stacked BDI deadlock we need -- 2.25.1

2 1

[openeuler:OLK-5.10 20978/30000] drivers/video/fbdev/ls2k500sfb.c:140:27: sparse: sparse: incorrect type in assignment (different address spaces)
by kernel test robot 10 Apr '24

10 Apr '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: f1776d0ca22cf72bfcdc93dced47d9dde9934d97 commit: d74f3b70d73220d919db010ec1c81aa1d89082b6 [20978/30000] fbdev: add ls2k500sfb driver for ls2k500 bmc. config: x86_64-randconfig-r122-20240410 (https://download.01.org/0day-ci/archive/20240410/202404102205.GZY9jAYq-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240410/202404102205.GZY9jAYq-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404102205.GZY9jAYq-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/video/fbdev/ls2k500sfb.c:140:27: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *static p @@ got void [noderef] __iomem * @@ drivers/video/fbdev/ls2k500sfb.c:140:27: sparse: expected void *static p drivers/video/fbdev/ls2k500sfb.c:140:27: sparse: got void [noderef] __iomem * >> drivers/video/fbdev/ls2k500sfb.c:142:30: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void *static p @@ drivers/video/fbdev/ls2k500sfb.c:142:30: sparse: expected void const volatile [noderef] __iomem *addr drivers/video/fbdev/ls2k500sfb.c:142:30: sparse: got void *static p >> drivers/video/fbdev/ls2k500sfb.c:196:36: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void *static p @@ drivers/video/fbdev/ls2k500sfb.c:196:36: sparse: expected void volatile [noderef] __iomem *addr drivers/video/fbdev/ls2k500sfb.c:196:36: sparse: got void *static p >> drivers/video/fbdev/ls2k500sfb.c:198:37: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/video/fbdev/ls2k500sfb.c:198:37: sparse: expected void const volatile [noderef] __iomem *addr drivers/video/fbdev/ls2k500sfb.c:198:37: sparse: got void * >> drivers/video/fbdev/ls2k500sfb.c:251:13: sparse: sparse: symbol 'ls2k500sfb_interrupt' was not declared. Should it be static? >> drivers/video/fbdev/ls2k500sfb.c:453:28: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got char *preg @@ drivers/video/fbdev/ls2k500sfb.c:453:28: sparse: expected void const volatile [noderef] __iomem *addr drivers/video/fbdev/ls2k500sfb.c:453:28: sparse: got char *preg >> drivers/video/fbdev/ls2k500sfb.c:454:32: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got char *preg @@ drivers/video/fbdev/ls2k500sfb.c:454:32: sparse: expected void volatile [noderef] __iomem *addr drivers/video/fbdev/ls2k500sfb.c:454:32: sparse: got char *preg >> drivers/video/fbdev/ls2k500sfb.c:566:19: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected char *penv @@ got void [noderef] __iomem * @@ drivers/video/fbdev/ls2k500sfb.c:566:19: sparse: expected char *penv drivers/video/fbdev/ls2k500sfb.c:566:19: sparse: got void [noderef] __iomem * >> drivers/video/fbdev/ls2k500sfb.c:567:19: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected char *preg @@ got void [noderef] __iomem * @@ drivers/video/fbdev/ls2k500sfb.c:567:19: sparse: expected char *preg drivers/video/fbdev/ls2k500sfb.c:567:19: sparse: got void [noderef] __iomem * drivers/video/fbdev/ls2k500sfb.c:668:14: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected char *penv @@ got void [noderef] __iomem * @@ drivers/video/fbdev/ls2k500sfb.c:668:14: sparse: expected char *penv drivers/video/fbdev/ls2k500sfb.c:668:14: sparse: got void [noderef] __iomem * vim +140 drivers/video/fbdev/ls2k500sfb.c 110 111 static void ls2k500sfb_events_fn(struct work_struct *work) 112 { 113 struct ls2k500sfb_struct *priv = container_of(work, struct ls2k500sfb_struct, work); 114 struct pci_dev *pdev = priv->dev; 115 struct pci_dev *ppdev = pdev->bus->self; 116 uint32_t i, d, timeout, retry = 0; 117 static const uint32_t index[] = { 118 0x10, 0x14, 0x18, 0x1c, 0x20, 0x24, 0x30, 0x3c, 0x54, 0x58, 0x78, 0x7c, 0x80, 4 119 }; 120 121 static uint32_t data[sizeof(index) / 4]; 122 static const uint32_t cindex[] = { 0x10, 0x3c, 4 }; 123 124 static uint32_t cdata[sizeof(cindex) / 4]; 125 static uint32_t d80c, d71c, ctrl; 126 static void *p; 127 128 if (!priv->running) { 129 for (i = 0; i < ARRAY_SIZE(index); i++) 130 pci_read_config_dword(ppdev, index[i], &data[i]); 131 for (i = 0; i < ARRAY_SIZE(cindex); i++) 132 pci_read_config_dword(pdev, cindex[i], &cdata[i]); 133 if (ppdev->vendor == 0x14) { 134 pci_read_config_dword(ppdev, 0x80c, &d80c); 135 d80c = (d80c & ~(3 << 17)) | (1 << 17); 136 137 pci_read_config_dword(ppdev, 0x71c, &d71c); 138 d71c |= 1 << 26; 139 > 140 p = pci_iomap(ppdev, 0, 0x100); 141 } > 142 ctrl = readl(p); 143 return; 144 } 145 local_bh_disable(); 146 pciebreak_smp_send_stop(100); 147 wmb(); /* flush all write before we disable pcie window */ 148 pci_write_config_dword(ppdev, 0x18, 0); 149 pci_write_config_dword(ppdev, 0x1c, 0); 150 pci_write_config_dword(ppdev, 0x20, 0); 151 atomic_set(&waiting_for_pciebreak_ipi, 0); 152 wmb(); /* flush all write after change pcie window */ 153 local_bh_enable(); 154 if (ppdev->vendor == 0x14) { 155 timeout = 10000; 156 while (timeout) { 157 pci_read_config_dword(ppdev, 0x10, &d); 158 d &= ~0xf; 159 if (!d) 160 break; 161 mdelay(1); 162 timeout--; 163 }; 164 if (!timeout) 165 pr_info("bar not clear 0\n"); 166 167 pci_read_config_dword(ppdev, 0x0, &d); 168 pr_info("pcie port deviceid=0x%x recover begin\n", d); 169 retrain: 170 while (1) { 171 pci_write_config_dword(ppdev, index[0], data[0]); 172 pci_read_config_dword(ppdev, index[0], &d); 173 d &= ~0xf; 174 if (d) 175 break; 176 mdelay(1); 177 } 178 179 while (1) { 180 for (i = 0; i < ARRAY_SIZE(index); i++) { 181 if (index[i] != 0x18 && index[i] != 0x1c && index[i] != 0x20) 182 pci_write_config_dword(ppdev, index[i], data[i]); 183 } 184 pci_write_config_dword(ppdev, 0x80c, d80c); 185 pci_write_config_dword(ppdev, 0x71c, d71c); 186 187 pci_read_config_dword(ppdev, 0x10, &d); 188 d &= ~0xf; 189 if (d) 190 break; 191 mdelay(1); 192 } 193 194 timeout = 10000; 195 > 196 writel(ctrl | 0x8, p); 197 while (1) { > 198 d = readl(p + 0xc); 199 if ((d & 0x11) == 0x11) { 200 break; 201 } else if (!timeout) { 202 pr_info("pcie train failed status=0x%x\n", d); 203 goto out; 204 } 205 mdelay(1); 206 timeout--; 207 } 208 209 210 pr_info("pcie recovered done\n"); 211 212 if (!retry) { 213 /*wait u-boot ddr config */ 214 set_current_state(TASK_UNINTERRUPTIBLE); 215 schedule_timeout(HZ*resetbootwait); 216 set_current_state(TASK_RUNNING); 217 pci_read_config_dword(ppdev, 0x10, &d); 218 d &= ~0xf; 219 if (!d) { 220 retry = 1; 221 goto retrain; 222 } 223 } 224 } else { 225 set_current_state(TASK_UNINTERRUPTIBLE); 226 schedule_timeout(HZ*resetbootwait); 227 set_current_state(TASK_RUNNING); 228 } 229 local_bh_disable(); 230 pciebreak_smp_send_stop(10000); 231 wmb(); /* flush all write before we update pcie window */ 232 for (i = 0; i < ARRAY_SIZE(index); i++) 233 pci_write_config_dword(ppdev, index[i], data[i]); 234 235 for (i = 0; i < ARRAY_SIZE(cindex); i++) 236 pci_write_config_dword(pdev, cindex[i], cdata[i]); 237 atomic_set(&waiting_for_pciebreak_ipi, 0); 238 wmb(); /* flush all write after we update pcie window */ 239 local_bh_enable(); 240 241 242 pr_info("redraw console\n"); 243 244 saved_console = fg_console; 245 switch_console(fg_console > 0?fg_console - 1 : fg_console + 1); 246 queue_delayed_work(priv->wq, &priv->redraw_work, HZ); 247 out: 248 priv->running = 0; 249 } 250 > 251 irqreturn_t ls2k500sfb_interrupt(int irq, void *arg) 252 { 253 struct ls2k500sfb_struct *priv = arg; 254 struct pci_dev *pdev = priv->dev; 255 256 if (irq == pdev->irq) 257 pr_info("ls2k500sfb pcie interrupt\n"); 258 else 259 pr_info("ls2k500sfb gpio interrupt\n"); 260 if (system_state != SYSTEM_RUNNING) 261 return IRQ_HANDLED; 262 263 if (!priv->running) { 264 if (!resetdelay || time_after(jiffies, priv->reset_time + resetdelay * HZ)) { 265 priv->running = 1; 266 queue_work(priv->wq, &priv->work); 267 } 268 priv->reset_time = jiffies; 269 } 270 return IRQ_HANDLED; 271 } 272 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 00/23] arm64 bpf trampoline for olk-5.10
by Pu Lehui 10 Apr '24

10 Apr '24

Alexander Duyck (1): bpf, arm64: Fix BTI type used for freplace attached functions Dmitrii Banshchikov (1): bpf: Use MAX_BPF_FUNC_REG_ARGS macro Florent Revest (1): bpf, arm64: Support struct arguments in the BPF trampoline Nathan Chancellor (1): bpf, arm64: Mark dummy_tramp as global Peter Zijlstra (1): x86/ibt,ftrace: Search for __fentry__ location Xu Kuohai (12): arm64, insn: Add ldr/str with immediate offset bpf, arm64: Optimize BPF store/load using arm64 str/ldr(immediate offset) bpf, arm64: Adjust the offset of str/ldr(immediate) to positive number arm64: Add LDR (literal) instruction bpf, arm64: Implement bpf_arch_text_poke() for arm64 bpf, arm64: Add bpf trampoline for arm64 bpf, arm64: Fix compile error in dummy_tramp() bpf, arm64: Fix bpf trampoline instruction endianness ftrace: Allow users to disable ftrace direct call arm64: ftrace: Support long jump for ftrace direct call arm64: ftrace: Add ftrace direct call support arm64: ftrace: Support direct call for no literal module functions Yonghong Song (6): bpf: Always return corresponding btf_type in __get_type_size() bpf: Allow struct argument in trampoline based programs bpf: x86: Support in-register struct arguments in trampoline programs bpf: arm64: No support of struct argument in trampoline programs libbpf: Add new BPF_PROG2 macro selftests/bpf: Add struct argument tests with fentry/fexit programs. arch/arm64/Kconfig | 2 + arch/arm64/Makefile | 4 + arch/arm64/include/asm/ftrace.h | 31 +- arch/arm64/include/asm/insn.h | 14 + arch/arm64/kernel/asm-offsets.c | 1 + arch/arm64/kernel/entry-ftrace.S | 39 +- arch/arm64/kernel/ftrace.c | 248 ++++- arch/arm64/kernel/insn.c | 111 ++- arch/arm64/net/bpf_jit.h | 21 + arch/arm64/net/bpf_jit_comp.c | 881 +++++++++++++++++- arch/x86/kernel/kprobes/core.c | 11 +- arch/x86/net/bpf_jit_comp.c | 60 +- include/linux/bpf.h | 9 + include/linux/ftrace.h | 3 + kernel/bpf/btf.c | 77 +- kernel/bpf/trampoline.c | 20 +- kernel/bpf/verifier.c | 2 +- kernel/kprobes.c | 8 +- kernel/trace/Kconfig | 7 +- kernel/trace/ftrace.c | 65 +- net/bpf/test_run.c | 57 +- tools/lib/bpf/bpf_tracing.h | 79 ++ .../selftests/bpf/prog_tests/tracing_struct.c | 71 ++ .../selftests/bpf/progs/tracing_struct.c | 127 +++ 24 files changed, 1796 insertions(+), 152 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/tracing_struct.c create mode 100644 tools/testing/selftests/bpf/progs/tracing_struct.c -- 2.34.1

2 24

[PATCH OLK-5.10] btrfs: dev-replace: properly validate device names
by Long Li 10 Apr '24

10 Apr '24

From: David Sterba <dsterba(a)suse.com> stable inclusion from stable-v5.10.167 commit 2886fe308a83968dde252302884a1e63351cf16d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E469 CVE: CVE-2024-26791 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 9845664b9ee47ce7ee7ea93caf47d39a9d4552c4 upstream. There's a syzbot report that device name buffers passed to device replace are not properly checked for string termination which could lead to a read out of bounds in getname_kernel(). Add a helper that validates both source and target device name buffers. For devid as the source initialize the buffer to empty string in case something tries to read it later. This was originally analyzed and fixed in a different way by Edward Adam Davis (see links). Link: https://lore.kernel.org/linux-btrfs/000000000000d1a1d1060cc9c5e7@google.com/ Link: https://lore.kernel.org/linux-btrfs/tencent_44CA0665C9836EF9EEC80CB9E7E206D… CC: stable(a)vger.kernel.org # 4.19+ CC: Edward Adam Davis <eadavis(a)qq.com> Reported-and-tested-by: syzbot+33f23b49ac24f986c9e8(a)syzkaller.appspotmail.com Reviewed-by: Boris Burkov <boris(a)bur.io> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/btrfs/dev-replace.c | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c index be6935d19197..9a6055659c1a 100644 --- a/fs/btrfs/dev-replace.c +++ b/fs/btrfs/dev-replace.c @@ -566,6 +566,23 @@ static int btrfs_dev_replace_start(struct btrfs_fs_info *fs_info, return ret; } +static int btrfs_check_replace_dev_names(struct btrfs_ioctl_dev_replace_args *args) +{ + if (args->start.srcdevid == 0) { + if (memchr(args->start.srcdev_name, 0, + sizeof(args->start.srcdev_name)) == NULL) + return -ENAMETOOLONG; + } else { + args->start.srcdev_name[0] = 0; + } + + if (memchr(args->start.tgtdev_name, 0, + sizeof(args->start.tgtdev_name)) == NULL) + return -ENAMETOOLONG; + + return 0; +} + int btrfs_dev_replace_by_ioctl(struct btrfs_fs_info *fs_info, struct btrfs_ioctl_dev_replace_args *args) { @@ -578,10 +595,9 @@ int btrfs_dev_replace_by_ioctl(struct btrfs_fs_info *fs_info, default: return -EINVAL; } - - if ((args->start.srcdevid == 0 && args->start.srcdev_name[0] == '\0') || - args->start.tgtdev_name[0] == '\0') - return -EINVAL; + ret = btrfs_check_replace_dev_names(args); + if (ret < 0) + return ret; ret = btrfs_dev_replace_start(fs_info, args->start.tgtdev_name, args->start.srcdevid, -- 2.31.1

2 1

[PATCH OLK-5.10] dm-crypt: don't modify the data when using authenticated encryption
by Li Lingfeng 10 Apr '24

10 Apr '24

From: Mikulas Patocka <mpatocka(a)redhat.com> stable inclusion from stable-v5.10.211 commit 3c652f6fa1e1f9f02c3fbf359d260ad153ec5f90 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2LW CVE: CVE-2024-26763 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 50c70240097ce41fe6bce6478b80478281e4d0f7 upstream. It was said that authenticated encryption could produce invalid tag when the data that is being encrypted is modified [1]. So, fix this problem by copying the data into the clone bio first and then encrypt them inside the clone bio. This may reduce performance, but it is needed to prevent the user from corrupting the device by writing data with O_DIRECT and modifying them at the same time. [1] https://lore.kernel.org/all/20240207004723.GA35324@sol.localdomain/T/ Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Cc: stable(a)vger.kernel.org Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/md/dm-crypt.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c index 5d772f322a24..5edcdcee91c2 100644 --- a/drivers/md/dm-crypt.c +++ b/drivers/md/dm-crypt.c @@ -2064,6 +2064,12 @@ static void kcryptd_crypt_write_convert(struct dm_crypt_io *io) io->ctx.bio_out = clone; io->ctx.iter_out = clone->bi_iter; + if (crypt_integrity_aead(cc)) { + bio_copy_data(clone, io->base_bio); + io->ctx.bio_in = clone; + io->ctx.iter_in = clone->bi_iter; + } + sector += bio_sectors(clone); crypt_inc_pending(io); -- 2.31.1

2 1

[PATCH OLK-5.10] EDAC/thunderx: Fix possible out-of-bounds string access
by Lu Jialin 10 Apr '24

10 Apr '24

From: Arnd Bergmann <arnd(a)arndb.de> stable inclusion from stable-v5.10.209 commit 6aa7865ba7ff7f0ede0035180fb3b9400ceb405a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EBW CVE: CVE-2023-52464 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 475c58e1a471e9b873e3e39958c64a2d278275c8 ] Enabling -Wstringop-overflow globally exposes a warning for a common bug in the usage of strncat(): drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr': drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=] 1136 | strncat(msg, other, OCX_MESSAGE_SIZE); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ... 1145 | strncat(msg, other, OCX_MESSAGE_SIZE); ... 1150 | strncat(msg, other, OCX_MESSAGE_SIZE); ... Apparently the author of this driver expected strncat() to behave the way that strlcat() does, which uses the size of the destination buffer as its third argument rather than the length of the source buffer. The result is that there is no check on the size of the allocated buffer. Change it to strlcat(). [ bp: Trim compiler output, fixup commit message. ] Fixes: 41003396f932 ("EDAC, thunderx: Add Cavium ThunderX EDAC driver") Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Reviewed-by: Gustavo A. R. Silva <gustavoars(a)kernel.org> Link: https://lore.kernel.org/r/20231122222007.3199885-1-arnd@kernel.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- drivers/edac/thunderx_edac.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/edac/thunderx_edac.c b/drivers/edac/thunderx_edac.c index 0eb5eb97fd74..3b0e1fe27d93 100644 --- a/drivers/edac/thunderx_edac.c +++ b/drivers/edac/thunderx_edac.c @@ -1133,7 +1133,7 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) decode_register(other, OCX_OTHER_SIZE, ocx_com_errors, ctx->reg_com_int); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); for (lane = 0; lane < OCX_RX_LANES; lane++) if (ctx->reg_com_int & BIT(lane)) { @@ -1142,12 +1142,12 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) lane, ctx->reg_lane_int[lane], lane, ctx->reg_lane_stat11[lane]); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); decode_register(other, OCX_OTHER_SIZE, ocx_lane_errors, ctx->reg_lane_int[lane]); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); } if (ctx->reg_com_int & OCX_COM_INT_CE) @@ -1217,7 +1217,7 @@ static irqreturn_t thunderx_ocx_lnk_threaded_isr(int irq, void *irq_id) decode_register(other, OCX_OTHER_SIZE, ocx_com_link_errors, ctx->reg_com_link_int); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); if (ctx->reg_com_link_int & OCX_COM_LINK_INT_UE) edac_device_handle_ue(ocx->edac_dev, 0, 0, msg); @@ -1896,7 +1896,7 @@ static irqreturn_t thunderx_l2c_threaded_isr(int irq, void *irq_id) decode_register(other, L2C_OTHER_SIZE, l2_errors, ctx->reg_int); - strncat(msg, other, L2C_MESSAGE_SIZE); + strlcat(msg, other, L2C_MESSAGE_SIZE); if (ctx->reg_int & mask_ue) edac_device_handle_ue(l2c->edac_dev, 0, 0, msg); -- 2.34.1

2 1

[PATCH 1/7] Update kernel headers
by Chengchang Tang 10 Apr '24

10 Apr '24

driver inclusion category: feature bugzilla: https://gitee.com/src-openeuler/rdma-core/issues/I9C2AQ ------------------------------------------------------------------ To commit ?? ("RDMA/hns: Fixes concurrent ressetting and post_recv in DCA mode"). Signed-off-by: Chengchang Tang <tangchengchang(a)huawei.com> Reviewed-by: Yangyang Li <liyangyang20(a)huawei.com> --- kernel-headers/rdma/hns-abi.h | 73 ++++++++++++++++++++++++++++++++++- 1 file changed, 72 insertions(+), 1 deletion(-) diff --git a/kernel-headers/rdma/hns-abi.h b/kernel-headers/rdma/hns-abi.h index 1d51612..8a8f2e4 100644 --- a/kernel-headers/rdma/hns-abi.h +++ b/kernel-headers/rdma/hns-abi.h @@ -102,7 +102,9 @@ enum hns_roce_qp_cap_flags { HNS_ROCE_QP_CAP_RQ_RECORD_DB = 1 << 0, HNS_ROCE_QP_CAP_SQ_RECORD_DB = 1 << 1, HNS_ROCE_QP_CAP_OWNER_DB = 1 << 2, + HNS_ROCE_QP_CAP_DYNAMIC_CTX_ATTACH = 1 << 4, HNS_ROCE_QP_CAP_DIRECT_WQE = 1 << 5, + HNS_ROCE_QP_CAP_DYNAMIC_CTX_DETACH = 1 << 6, }; struct hns_roce_ib_create_qp_resp { @@ -114,12 +116,15 @@ struct hns_roce_ib_modify_qp_resp { __u8 tc_mode; __u8 priority; __u8 reserved[6]; + __u32 dcan; + __u32 rsv2; }; enum { HNS_ROCE_EXSGE_FLAGS = 1 << 0, HNS_ROCE_RQ_INLINE_FLAGS = 1 << 1, HNS_ROCE_CQE_INLINE_FLAGS = 1 << 2, + HNS_ROCE_UCTX_CONFIG_DCA = 1 << 3, HNS_ROCE_UCTX_DYN_QP_PGSZ = 1 << 4, }; @@ -127,6 +132,7 @@ enum { HNS_ROCE_RSP_EXSGE_FLAGS = 1 << 0, HNS_ROCE_RSP_RQ_INLINE_FLAGS = 1 << 1, HNS_ROCE_RSP_CQE_INLINE_FLAGS = 1 << 2, + HNS_ROCE_UCTX_RSP_DCA_FLAGS = HNS_ROCE_UCTX_CONFIG_DCA, HNS_ROCE_UCTX_RSP_DYN_QP_PGSZ = HNS_ROCE_UCTX_DYN_QP_PGSZ, }; @@ -139,12 +145,20 @@ struct hns_roce_ib_alloc_ucontext_resp { __u32 max_inline_data; __u8 congest_type; __u8 reserved0[7]; - __aligned_u64 rsv_for_dca[2]; + __u32 dca_qps; + __u32 dca_mmap_size; + __aligned_u64 dca_mmap_key; __aligned_u64 reset_mmap_key; }; +enum hns_roce_uctx_comp_mask { + HNS_ROCE_ALLOC_UCTX_COMP_DCA_MAX_QPS = 1 << 0, +}; + struct hns_roce_ib_alloc_ucontext { __u32 config; + __u32 comp; /* use hns_roce_uctx_comp_mask */ + __u32 dca_max_qps; __u32 reserved; }; @@ -158,4 +172,61 @@ struct hns_roce_ib_create_ah_resp { __u8 tc_mode; }; +#define UVERBS_ID_NS_MASK 0xF000 +#define UVERBS_ID_NS_SHIFT 12 + +enum hns_ib_objects { + HNS_IB_OBJECT_DCA_MEM = (1U << UVERBS_ID_NS_SHIFT), +}; + +enum hns_ib_dca_mem_methods { + HNS_IB_METHOD_DCA_MEM_REG = (1U << UVERBS_ID_NS_SHIFT), + HNS_IB_METHOD_DCA_MEM_DEREG, + HNS_IB_METHOD_DCA_MEM_SHRINK, + HNS_IB_METHOD_DCA_MEM_ATTACH, + HNS_IB_METHOD_DCA_MEM_DETACH, + HNS_IB_METHOD_DCA_MEM_QUERY, +}; + +enum hns_ib_dca_mem_reg_attrs { + HNS_IB_ATTR_DCA_MEM_REG_HANDLE = (1U << UVERBS_ID_NS_SHIFT), + HNS_IB_ATTR_DCA_MEM_REG_FLAGS, + HNS_IB_ATTR_DCA_MEM_REG_LEN, + HNS_IB_ATTR_DCA_MEM_REG_ADDR, + HNS_IB_ATTR_DCA_MEM_REG_KEY, +}; + +enum hns_ib_dca_mem_dereg_attrs { + HNS_IB_ATTR_DCA_MEM_DEREG_HANDLE = (1U << UVERBS_ID_NS_SHIFT), +}; + +enum hns_ib_dca_mem_shrink_attrs { + HNS_IB_ATTR_DCA_MEM_SHRINK_HANDLE = (1U << UVERBS_ID_NS_SHIFT), + HNS_IB_ATTR_DCA_MEM_SHRINK_RESERVED_SIZE, + HNS_IB_ATTR_DCA_MEM_SHRINK_OUT_FREE_KEY, + HNS_IB_ATTR_DCA_MEM_SHRINK_OUT_FREE_MEMS, +}; + +enum hns_ib_dca_mem_attach_attrs { + HNS_IB_ATTR_DCA_MEM_ATTACH_HANDLE = (1U << UVERBS_ID_NS_SHIFT), + HNS_IB_ATTR_DCA_MEM_ATTACH_SQ_OFFSET, + HNS_IB_ATTR_DCA_MEM_ATTACH_SGE_OFFSET, + HNS_IB_ATTR_DCA_MEM_ATTACH_RQ_OFFSET, + HNS_IB_ATTR_DCA_MEM_ATTACH_OUT_ALLOC_FLAGS, + HNS_IB_ATTR_DCA_MEM_ATTACH_OUT_ALLOC_PAGES, +}; + +enum hns_ib_dca_mem_detach_attrs { + HNS_IB_ATTR_DCA_MEM_DETACH_HANDLE = (1U << UVERBS_ID_NS_SHIFT), + HNS_IB_ATTR_DCA_MEM_DETACH_SQ_INDEX, +}; + +enum hns_ib_dca_mem_query_attrs { + HNS_IB_ATTR_DCA_MEM_QUERY_HANDLE = (1U << UVERBS_ID_NS_SHIFT), + HNS_IB_ATTR_DCA_MEM_QUERY_PAGE_INDEX, + HNS_IB_ATTR_DCA_MEM_QUERY_OUT_KEY, + HNS_IB_ATTR_DCA_MEM_QUERY_OUT_OFFSET, + HNS_IB_ATTR_DCA_MEM_QUERY_OUT_PAGE_COUNT, +}; + #endif /* HNS_ABI_USER_H */ -- 2.33.0

1 6

[OLK-6.6 00/12] Support hns roce DCA mode
by Chengchang Tang 10 Apr '24

10 Apr '24

From: Juan Zhou <zhoujuan51(a)h-partners.com> Support hns roce DCA mode. Chengchang Tang (12): RDMA/hns: Introduce DCA for RC QP RDMA/hns: Add method for shrinking DCA memory pool RDMA/hns: Configure DCA mode for the userspace QP RDMA/hns: Add method for attaching WQE buffer RDMA/hns: Setup the configuration of WQE addressing to QPC RDMA/hns: Add method to detach WQE buffer RDMA/hns: Add method to query WQE buffer's address RDMA/hns: Add DCA support for kernel space RDMA/hns: Add debugfs support for DCA RDMA/hns: Optimize user DCA perfermance by sharing DCA status RDMA/hns: Fixes concurrent ressetting and post_recv in DCA mode RDMA/hns: Fix DCA's dependence on ib_uverbs drivers/infiniband/hw/hns/Makefile | 2 +- drivers/infiniband/hw/hns/hns_roce_dca.c | 1875 ++++++++++++++++++ drivers/infiniband/hw/hns/hns_roce_dca.h | 78 + drivers/infiniband/hw/hns/hns_roce_debugfs.c | 406 ++++ drivers/infiniband/hw/hns/hns_roce_debugfs.h | 19 + drivers/infiniband/hw/hns/hns_roce_device.h | 69 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 304 ++- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 5 + drivers/infiniband/hw/hns/hns_roce_main.c | 196 +- drivers/infiniband/hw/hns/hns_roce_mr.c | 12 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 197 +- include/uapi/rdma/hns-abi.h | 73 +- 12 files changed, 3099 insertions(+), 137 deletions(-) create mode 100644 drivers/infiniband/hw/hns/hns_roce_dca.c create mode 100644 drivers/infiniband/hw/hns/hns_roce_dca.h -- 2.30.0

1 12

[PATCH OLK-5.10 0/1] fixup CVE-2024-26751
by Yuntao Liu 10 Apr '24

10 Apr '24

fixup CVE-2024-26751 Nikita Shubin (1): ARM: ep93xx: Add terminator to gpiod_lookup_table arch/arm/mach-ep93xx/core.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 2

[PATCH OLK-5.10] fbdev: savage: Error out if pixclock equals zero
by Cai Xinchen 10 Apr '24

10 Apr '24

From: Fullway Wang <fullwaywang(a)outlook.com> stable inclusion from stable-v5.10.211 commit 512ee6d6041e007ef5bf200c6e388e172a2c5b24 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2Y8 CVE: CVE-2024-26778 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 04e5eac8f3ab2ff52fa191c187a46d4fdbc1e288 ] The userspace program could pass any values to the driver through ioctl() interface. If the driver doesn't check the value of pixclock, it may cause divide-by-zero error. Although pixclock is checked in savagefb_decode_var(), but it is not checked properly in savagefb_probe(). Fix this by checking whether pixclock is zero in the function savagefb_check_var() before info->var.pixclock is used as the divisor. This is similar to CVE-2022-3061 in i740fb which was fixed by commit 15cf0b8. Signed-off-by: Fullway Wang <fullwaywang(a)outlook.com> Signed-off-by: Helge Deller <deller(a)gmx.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/video/fbdev/savage/savagefb_driver.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/video/fbdev/savage/savagefb_driver.c b/drivers/video/fbdev/savage/savagefb_driver.c index 0ac750cc5ea1..94ebd8af50cf 100644 --- a/drivers/video/fbdev/savage/savagefb_driver.c +++ b/drivers/video/fbdev/savage/savagefb_driver.c @@ -868,6 +868,9 @@ static int savagefb_check_var(struct fb_var_screeninfo *var, DBG("savagefb_check_var"); + if (!var->pixclock) + return -EINVAL; + var->transp.offset = 0; var->transp.length = 0; switch (var->bits_per_pixel) { -- 2.34.1

2 1