- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/2] CVE-2024-50056
by Heyuan Wang 11 Nov '24

11 Nov '24

Abhishek Tamboli (1): usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c Michael Grzeschik (1): usb: gadget: uvc: fix try format returns on uncompressed formats drivers/usb/gadget/function/uvc_v4l2.c | 34 ++++++++++++++++++++++---- 1 file changed, 29 insertions(+), 5 deletions(-) -- 2.25.1

2 3

[openeuler:OLK-5.10 2415/2415] arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r2' in asm
by kernel test robot 11 Nov '24

11 Nov '24

Hi Andre, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: a2a2cb652cf3f4686ab13778fb11f4591b5cfb17 commit: 78d8f4f7a298a5d259b2163121ea20b9e60e93f7 [2415/2415] arm64: Add support for SMCCC TRNG entropy source config: arm64-randconfig-003-20241111 (https://download.01.org/0day-ci/archive/20241111/202411111507.aqaGF8sw-lkp@…) compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project 592c0fe55f6d9a811028b5f3507be91458ab2713) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241111/202411111507.aqaGF8sw-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411111507.aqaGF8sw-lkp@intel.com/ All errors (new ones prefixed by >>): arch/arm64/Makefile:44: Detected assembler with broken .inst; disassembly will be unreliable In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:17: In file included from include/linux/lockdep.h:14: In file included from include/linux/smp.h:102: In file included from include/linux/preempt.h:78: In file included from arch/arm64/include/asm/preempt.h:5: In file included from include/linux/thread_info.h:14: In file included from include/linux/thread_bits.h:32: In file included from arch/arm64/include/asm/thread_info.h:18: arch/arm64/include/asm/stack_pointer.h:8:51: error: register 'sp' unsuitable for global register variables on this target 8 | register unsigned long current_stack_pointer asm ("sp"); | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:45: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:121: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r0' in asm 20 | arm_smccc_1_1_invoke(ARM_SMCCC_TRNG_VERSION, &res); | ^ include/linux/arm-smccc.h:412:4: note: expanded from macro 'arm_smccc_1_1_invoke' 412 | arm_smccc_1_1_hvc(__VA_ARGS__); \ | ^ include/linux/arm-smccc.h:378:32: note: expanded from macro 'arm_smccc_1_1_hvc' 378 | #define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:336:33: note: expanded from macro '__arm_smccc_1_1' 336 | register unsigned long r0 asm("r0"); \ | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:45: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:121: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r1' in asm include/linux/arm-smccc.h:412:4: note: expanded from macro 'arm_smccc_1_1_invoke' 412 | arm_smccc_1_1_hvc(__VA_ARGS__); \ | ^ include/linux/arm-smccc.h:378:32: note: expanded from macro 'arm_smccc_1_1_hvc' 378 | #define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:337:33: note: expanded from macro '__arm_smccc_1_1' 337 | register unsigned long r1 asm("r1"); \ | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:45: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:121: >> arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r2' in asm include/linux/arm-smccc.h:412:4: note: expanded from macro 'arm_smccc_1_1_invoke' 412 | arm_smccc_1_1_hvc(__VA_ARGS__); \ | ^ include/linux/arm-smccc.h:378:32: note: expanded from macro 'arm_smccc_1_1_hvc' 378 | #define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:338:33: note: expanded from macro '__arm_smccc_1_1' 338 | register unsigned long r2 asm("r2"); \ | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:45: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:121: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r3' in asm include/linux/arm-smccc.h:412:4: note: expanded from macro 'arm_smccc_1_1_invoke' 412 | arm_smccc_1_1_hvc(__VA_ARGS__); \ | ^ include/linux/arm-smccc.h:378:32: note: expanded from macro 'arm_smccc_1_1_hvc' 378 | #define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:339:33: note: expanded from macro '__arm_smccc_1_1' 339 | register unsigned long r3 asm("r3"); \ | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:45: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:121: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r0' in asm include/linux/arm-smccc.h:412:4: note: expanded from macro 'arm_smccc_1_1_invoke' 412 | arm_smccc_1_1_hvc(__VA_ARGS__); \ | ^ include/linux/arm-smccc.h:378:32: note: expanded from macro 'arm_smccc_1_1_hvc' 378 | #define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:340:3: note: expanded from macro '__arm_smccc_1_1' 340 | __declare_args(__count_args(__VA_ARGS__), __VA_ARGS__); \ | ^ note: (skipping 1 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all) include/linux/arm-smccc.h:321:37: note: expanded from macro '___declare_args' 321 | #define ___declare_args(count, ...) __declare_arg_ ## count(__VA_ARGS__) | ^ <scratch space>:168:1: note: expanded from here 168 | __declare_arg_0 | ^ include/linux/arm-smccc.h:275:34: note: expanded from macro '__declare_arg_0' 275 | register unsigned long arg0 asm("r0") = (u32)a0 | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:45: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:121: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r0' in asm include/linux/arm-smccc.h:415:4: note: expanded from macro 'arm_smccc_1_1_invoke' 415 | arm_smccc_1_1_smc(__VA_ARGS__); \ | ^ include/linux/arm-smccc.h:362:32: note: expanded from macro 'arm_smccc_1_1_smc' 362 | #define arm_smccc_1_1_smc(...) __arm_smccc_1_1(SMCCC_SMC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:336:33: note: expanded from macro '__arm_smccc_1_1' 336 | register unsigned long r0 asm("r0"); \ | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:45: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:121: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r1' in asm include/linux/arm-smccc.h:415:4: note: expanded from macro 'arm_smccc_1_1_invoke' 415 | arm_smccc_1_1_smc(__VA_ARGS__); \ | ^ include/linux/arm-smccc.h:362:32: note: expanded from macro 'arm_smccc_1_1_smc' 362 | #define arm_smccc_1_1_smc(...) __arm_smccc_1_1(SMCCC_SMC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:337:33: note: expanded from macro '__arm_smccc_1_1' 337 | register unsigned long r1 asm("r1"); \ | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:45: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:121: >> arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r2' in asm include/linux/arm-smccc.h:415:4: note: expanded from macro 'arm_smccc_1_1_invoke' 415 | arm_smccc_1_1_smc(__VA_ARGS__); \ | ^ include/linux/arm-smccc.h:362:32: note: expanded from macro 'arm_smccc_1_1_smc' 362 | #define arm_smccc_1_1_smc(...) __arm_smccc_1_1(SMCCC_SMC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:338:33: note: expanded from macro '__arm_smccc_1_1' 338 | register unsigned long r2 asm("r2"); \ | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:45: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:121: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r3' in asm include/linux/arm-smccc.h:415:4: note: expanded from macro 'arm_smccc_1_1_invoke' 415 | arm_smccc_1_1_smc(__VA_ARGS__); \ | ^ include/linux/arm-smccc.h:362:32: note: expanded from macro 'arm_smccc_1_1_smc' 362 | #define arm_smccc_1_1_smc(...) __arm_smccc_1_1(SMCCC_SMC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:339:33: note: expanded from macro '__arm_smccc_1_1' 339 | register unsigned long r3 asm("r3"); \ | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:45: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:121: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r0' in asm include/linux/arm-smccc.h:415:4: note: expanded from macro 'arm_smccc_1_1_invoke' 415 | arm_smccc_1_1_smc(__VA_ARGS__); \ | ^ include/linux/arm-smccc.h:362:32: note: expanded from macro 'arm_smccc_1_1_smc' 362 | #define arm_smccc_1_1_smc(...) __arm_smccc_1_1(SMCCC_SMC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:340:3: note: expanded from macro '__arm_smccc_1_1' 340 | __declare_args(__count_args(__VA_ARGS__), __VA_ARGS__); \ | ^ note: (skipping 1 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all) include/linux/arm-smccc.h:321:37: note: expanded from macro '___declare_args' 321 | #define ___declare_args(count, ...) __declare_arg_ ## count(__VA_ARGS__) | ^ <scratch space>:170:1: note: expanded from here 170 | __declare_arg_0 | ^ include/linux/arm-smccc.h:275:34: note: expanded from macro '__declare_arg_0' 275 | register unsigned long arg0 asm("r0") = (u32)a0 | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:45: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:121: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r0' in asm include/linux/arm-smccc.h:418:4: note: expanded from macro 'arm_smccc_1_1_invoke' 418 | __fail_smccc_1_1(__VA_ARGS__); \ | ^ include/linux/arm-smccc.h:387:3: note: expanded from macro '__fail_smccc_1_1' 387 | __declare_args(__count_args(__VA_ARGS__), __VA_ARGS__); \ | ^ include/linux/arm-smccc.h:322:37: note: expanded from macro '__declare_args' 322 | #define __declare_args(count, ...) ___declare_args(count, __VA_ARGS__) | ^ include/linux/arm-smccc.h:321:37: note: expanded from macro '___declare_args' 321 | #define ___declare_args(count, ...) __declare_arg_ ## count(__VA_ARGS__) | ^ <scratch space>:172:1: note: expanded from here 172 | __declare_arg_0 | ^ include/linux/arm-smccc.h:275:34: note: expanded from macro '__declare_arg_0' 275 | register unsigned long arg0 asm("r0") = (u32)a0 | ^ vim +/r2 +20 arch/arm64/include/asm/archrandom.h 15 16 static inline bool __init smccc_probe_trng(void) 17 { 18 struct arm_smccc_res res; 19 > 20 arm_smccc_1_1_invoke(ARM_SMCCC_TRNG_VERSION, &res); 21 if ((s32)res.a0 < 0) 22 return false; 23 24 return res.a0 >= ARM_SMCCC_TRNG_MIN_VERSION; 25 } 26 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] fs: call fsnotify_sb_delete after evict_inodes
by Zizhi Wo 11 Nov '24

11 Nov '24

From: Eric Sandeen <sandeen(a)redhat.com> mainline inclusion from mainline-v5.5-rc3 commit 1edc8eb2e93130e36ac74ac9c80913815a57d413 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB3D4A CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When a filesystem is unmounted, we currently call fsnotify_sb_delete() before evict_inodes(), which means that fsnotify_unmount_inodes() must iterate over all inodes on the superblock looking for any inodes with watches. This is inefficient and can lead to livelocks as it iterates over many unwatched inodes. At this point, SB_ACTIVE is gone and dropping refcount to zero kicks the inode out out immediately, so anything processed by fsnotify_sb_delete / fsnotify_unmount_inodes gets evicted in that loop. After that, the call to evict_inodes will evict everything else with a zero refcount. This should speed things up overall, and avoid livelocks in fsnotify_unmount_inodes(). Signed-off-by: Eric Sandeen <sandeen(a)redhat.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Conflicts: fs/super.c [Simple context conflict, direct adaptation.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/notify/fsnotify.c | 3 +++ fs/super.c | 4 +++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c index e8ee4263d7b2..48caa1af5301 100644 --- a/fs/notify/fsnotify.c +++ b/fs/notify/fsnotify.c @@ -70,6 +70,9 @@ void fsnotify_unmount_inodes(struct super_block *sb) * doing an __iget/iput with SB_ACTIVE clear would actually * evict all inodes with zero i_count from icache which is * unnecessarily violent and may in fact be illegal to do. + * However, we should have been called /after/ evict_inodes + * removed all zero refcount inodes, in any case. Test to + * be sure. */ if (!atomic_read(&inode->i_count)) { spin_unlock(&inode->i_lock); diff --git a/fs/super.c b/fs/super.c index 8dc26e23f1a3..a916bfe228dd 100644 --- a/fs/super.c +++ b/fs/super.c @@ -442,10 +442,12 @@ void generic_shutdown_super(struct super_block *sb) sync_filesystem(sb); sb->s_flags &= ~SB_ACTIVE; - fsnotify_unmount_inodes(sb); cgroup_writeback_umount(); + /* evict all inodes with zero refcount */ evict_inodes(sb); + /* only nonzero refcount inodes can have marks */ + fsnotify_unmount_inodes(sb); if (sb->s_dio_done_wq) { destroy_workqueue(sb->s_dio_done_wq); -- 2.46.1

2 1

[PATCH OLK-6.6] drm/amd/display: Check null pointers before multiple uses
by Gu Bowen 11 Nov '24

11 Nov '24

From: Alex Hung <alex.hung(a)amd.com> mainline inclusion from mainline-v6.12-rc1 commit fdd5ecbbff751c3b9061d8ebb08e5c96119915b4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR8O CVE: CVE-2024-49920 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [WHAT & HOW] Poniters, such as stream_enc and dc->bw_vbios, are null checked previously in the same function, so Coverity warns "implies that stream_enc and dc->bw_vbios might be null". They are used multiple times in the subsequent code and need to be checked. This fixes 10 FORWARD_NULL issues reported by Coverity. Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> Signed-off-by: Jerry Zuo <jerry.zuo(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c drivers/gpu/drm/amd/display/dc/link/hwss/link_hwss_dio.c drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c drivers/gpu/drm/amd/display/dc/resource/dce112/dce112_resource.c drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource_helpers.c drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource_helpers.c [Due to commit e53524cdcc02 (drm/amd/display: Refactor HWSS into component folder) rename related files, which not merge. And context conflicts in link_hwss_dio.c and dc_hw_sequencer.c.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- .../drm/amd/display/dc/core/dc_hw_sequencer.c | 82 ++++++++++--------- .../amd/display/dc/dce112/dce112_resource.c | 5 +- .../drm/amd/display/dc/dcn20/dcn20_hwseq.c | 8 +- .../drm/amd/display/dc/dcn32/dcn32_resource.c | 3 + .../display/dc/dcn32/dcn32_resource_helpers.c | 10 +-- .../display/dc/link/accessories/link_dp_cts.c | 5 +- .../amd/display/dc/link/hwss/link_hwss_dio.c | 5 +- 7 files changed, 69 insertions(+), 49 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c index f99ec1b0efaf..02d2d3f7b15b 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c @@ -512,48 +512,50 @@ void hwss_build_fast_sequence(struct dc *dc, while (current_pipe) { current_mpc_pipe = current_pipe; while (current_mpc_pipe) { - if (dc->hwss.set_flip_control_gsl && current_mpc_pipe->plane_state && current_mpc_pipe->plane_state->update_flags.raw) { - block_sequence[*num_steps].params.set_flip_control_gsl_params.pipe_ctx = current_mpc_pipe; - block_sequence[*num_steps].params.set_flip_control_gsl_params.flip_immediate = current_mpc_pipe->plane_state->flip_immediate; - block_sequence[*num_steps].func = HUBP_SET_FLIP_CONTROL_GSL; - (*num_steps)++; - } - if (dc->hwss.program_triplebuffer && dc->debug.enable_tri_buf && current_mpc_pipe->plane_state->update_flags.raw) { - block_sequence[*num_steps].params.program_triplebuffer_params.dc = dc; - block_sequence[*num_steps].params.program_triplebuffer_params.pipe_ctx = current_mpc_pipe; - block_sequence[*num_steps].params.program_triplebuffer_params.enableTripleBuffer = current_mpc_pipe->plane_state->triplebuffer_flips; - block_sequence[*num_steps].func = HUBP_PROGRAM_TRIPLEBUFFER; - (*num_steps)++; - } - if (dc->hwss.update_plane_addr && current_mpc_pipe->plane_state->update_flags.bits.addr_update) { - block_sequence[*num_steps].params.update_plane_addr_params.dc = dc; - block_sequence[*num_steps].params.update_plane_addr_params.pipe_ctx = current_mpc_pipe; - block_sequence[*num_steps].func = HUBP_UPDATE_PLANE_ADDR; - (*num_steps)++; - } + if (current_mpc_pipe->plane_state) { + if (dc->hwss.set_flip_control_gsl && current_mpc_pipe->plane_state->update_flags.raw) { + block_sequence[*num_steps].params.set_flip_control_gsl_params.pipe_ctx = current_mpc_pipe; + block_sequence[*num_steps].params.set_flip_control_gsl_params.flip_immediate = current_mpc_pipe->plane_state->flip_immediate; + block_sequence[*num_steps].func = HUBP_SET_FLIP_CONTROL_GSL; + (*num_steps)++; + } + if (dc->hwss.program_triplebuffer && dc->debug.enable_tri_buf && current_mpc_pipe->plane_state->update_flags.raw) { + block_sequence[*num_steps].params.program_triplebuffer_params.dc = dc; + block_sequence[*num_steps].params.program_triplebuffer_params.pipe_ctx = current_mpc_pipe; + block_sequence[*num_steps].params.program_triplebuffer_params.enableTripleBuffer = current_mpc_pipe->plane_state->triplebuffer_flips; + block_sequence[*num_steps].func = HUBP_PROGRAM_TRIPLEBUFFER; + (*num_steps)++; + } + if (dc->hwss.update_plane_addr && current_mpc_pipe->plane_state->update_flags.bits.addr_update) { + block_sequence[*num_steps].params.update_plane_addr_params.dc = dc; + block_sequence[*num_steps].params.update_plane_addr_params.pipe_ctx = current_mpc_pipe; + block_sequence[*num_steps].func = HUBP_UPDATE_PLANE_ADDR; + (*num_steps)++; + } - if (hws->funcs.set_input_transfer_func && current_mpc_pipe->plane_state->update_flags.bits.gamma_change) { - block_sequence[*num_steps].params.set_input_transfer_func_params.dc = dc; - block_sequence[*num_steps].params.set_input_transfer_func_params.pipe_ctx = current_mpc_pipe; - block_sequence[*num_steps].params.set_input_transfer_func_params.plane_state = current_mpc_pipe->plane_state; - block_sequence[*num_steps].func = DPP_SET_INPUT_TRANSFER_FUNC; - (*num_steps)++; - } + if (hws->funcs.set_input_transfer_func && current_mpc_pipe->plane_state->update_flags.bits.gamma_change) { + block_sequence[*num_steps].params.set_input_transfer_func_params.dc = dc; + block_sequence[*num_steps].params.set_input_transfer_func_params.pipe_ctx = current_mpc_pipe; + block_sequence[*num_steps].params.set_input_transfer_func_params.plane_state = current_mpc_pipe->plane_state; + block_sequence[*num_steps].func = DPP_SET_INPUT_TRANSFER_FUNC; + (*num_steps)++; + } - if (dc->hwss.program_gamut_remap && current_mpc_pipe->plane_state->update_flags.bits.gamut_remap_change) { - block_sequence[*num_steps].params.program_gamut_remap_params.pipe_ctx = current_mpc_pipe; - block_sequence[*num_steps].func = DPP_PROGRAM_GAMUT_REMAP; - (*num_steps)++; - } - if (current_mpc_pipe->plane_state->update_flags.bits.input_csc_change) { - block_sequence[*num_steps].params.setup_dpp_params.pipe_ctx = current_mpc_pipe; - block_sequence[*num_steps].func = DPP_SETUP_DPP; - (*num_steps)++; - } - if (current_mpc_pipe->plane_state->update_flags.bits.coeff_reduction_change) { - block_sequence[*num_steps].params.program_bias_and_scale_params.pipe_ctx = current_mpc_pipe; - block_sequence[*num_steps].func = DPP_PROGRAM_BIAS_AND_SCALE; - (*num_steps)++; + if (dc->hwss.program_gamut_remap && current_mpc_pipe->plane_state->update_flags.bits.gamut_remap_change) { + block_sequence[*num_steps].params.program_gamut_remap_params.pipe_ctx = current_mpc_pipe; + block_sequence[*num_steps].func = DPP_PROGRAM_GAMUT_REMAP; + (*num_steps)++; + } + if (current_mpc_pipe->plane_state->update_flags.bits.input_csc_change) { + block_sequence[*num_steps].params.setup_dpp_params.pipe_ctx = current_mpc_pipe; + block_sequence[*num_steps].func = DPP_SETUP_DPP; + (*num_steps)++; + } + if (current_mpc_pipe->plane_state->update_flags.bits.coeff_reduction_change) { + block_sequence[*num_steps].params.program_bias_and_scale_params.pipe_ctx = current_mpc_pipe; + block_sequence[*num_steps].func = DPP_PROGRAM_BIAS_AND_SCALE; + (*num_steps)++; + } } if (hws->funcs.set_output_transfer_func && current_mpc_pipe->stream->update_flags.bits.out_tf) { block_sequence[*num_steps].params.set_output_transfer_func_params.dc = dc; diff --git a/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c b/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c index 2b20180f1a32..18c942cfe530 100644 --- a/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c @@ -1069,7 +1069,10 @@ static void bw_calcs_data_update_from_pplib(struct dc *dc) struct dm_pp_clock_levels clks = {0}; int memory_type_multiplier = MEMORY_TYPE_MULTIPLIER_CZ; - if (dc->bw_vbios && dc->bw_vbios->memory_type == bw_def_hbm) + if (!dc->bw_vbios) + return; + + if (dc->bw_vbios->memory_type == bw_def_hbm) memory_type_multiplier = MEMORY_TYPE_HBM; /*do system clock TODO PPLIB: after PPLIB implement, diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c index b680742baad7..de0f8fc316fe 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c @@ -2008,6 +2008,9 @@ void dcn20_post_unlock_program_front_end( } } + if (!hwseq) + return; + /* P-State support transitions: * Natural -> FPO: P-State disabled in prepare, force disallow anytime is safe * FPO -> Natural: Unforce anytime after FW disable is safe (P-State will assert naturally) @@ -2015,7 +2018,7 @@ void dcn20_post_unlock_program_front_end( * FPO -> Unsupported: P-State disabled in prepare, unforce disallow anytime is safe * FPO <-> SubVP: Force disallow is maintained on the FPO / SubVP pipes */ - if (hwseq && hwseq->funcs.update_force_pstate) + if (hwseq->funcs.update_force_pstate) dc->hwseq->funcs.update_force_pstate(dc, context); /* Only program the MALL registers after all the main and phantom pipes @@ -2253,6 +2256,9 @@ bool dcn20_wait_for_blank_complete( { int counter; + if (!opp) + return false; + for (counter = 0; counter < 1000; counter++) { if (opp->funcs->dpg_is_blanked(opp)) break; diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c index d96c1d953593..dc0ff24e9a66 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c @@ -1645,6 +1645,9 @@ static void dcn32_enable_phantom_plane(struct dc *dc, else phantom_plane = dc_create_plane_state(dc); + if (!phantom_plane) + continue; + memcpy(&phantom_plane->address, &curr_pipe->plane_state->address, sizeof(phantom_plane->address)); memcpy(&phantom_plane->scaling_quality, &curr_pipe->plane_state->scaling_quality, sizeof(phantom_plane->scaling_quality)); diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource_helpers.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource_helpers.c index 3ad2b48954e0..57a662fc99ef 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource_helpers.c +++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource_helpers.c @@ -233,12 +233,12 @@ bool dcn32_is_center_timing(struct pipe_ctx *pipe) pipe->stream->timing.v_addressable != pipe->stream->src.height) { is_center_timing = true; } - } - if (pipe->plane_state) { - if (pipe->stream->timing.v_addressable != pipe->plane_state->dst_rect.height && - pipe->stream->timing.v_addressable != pipe->plane_state->src_rect.height) { - is_center_timing = true; + if (pipe->plane_state) { + if (pipe->stream->timing.v_addressable != pipe->plane_state->dst_rect.height && + pipe->stream->timing.v_addressable != pipe->plane_state->src_rect.height) { + is_center_timing = true; + } } } diff --git a/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c b/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c index 8a97d96f7d8b..3aeb0f864d9e 100644 --- a/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c +++ b/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c @@ -879,8 +879,11 @@ bool dp_set_test_pattern( break; } + if (!pipe_ctx->stream) + return false; + if (pipe_ctx->stream_res.tg->funcs->lock_doublebuffer_enable) { - if (pipe_ctx->stream && should_use_dmub_lock(pipe_ctx->stream->link)) { + if (should_use_dmub_lock(pipe_ctx->stream->link)) { union dmub_hw_lock_flags hw_locks = { 0 }; struct dmub_hw_lock_inst_flags inst_flags = { 0 }; diff --git a/drivers/gpu/drm/amd/display/dc/link/hwss/link_hwss_dio.c b/drivers/gpu/drm/amd/display/dc/link/hwss/link_hwss_dio.c index 1328a0ade342..a52a0eef06b3 100644 --- a/drivers/gpu/drm/amd/display/dc/link/hwss/link_hwss_dio.c +++ b/drivers/gpu/drm/amd/display/dc/link/hwss/link_hwss_dio.c @@ -58,7 +58,10 @@ void reset_dio_stream_encoder(struct pipe_ctx *pipe_ctx) struct link_encoder *link_enc = link_enc_cfg_get_link_enc(pipe_ctx->stream->link); struct stream_encoder *stream_enc = pipe_ctx->stream_res.stream_enc; - if (stream_enc && stream_enc->funcs->disable_fifo) + if (!stream_enc) + return; + + if (stream_enc->funcs->disable_fifo) stream_enc->funcs->disable_fifo(stream_enc); link_enc->funcs->connect_dig_be_to_fe( -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/4] Fix 'cgroup/cpuset: Prevent UAF in proc_cpuset_show()' issue with commmunity patches
by Chen Ridong 11 Nov '24

11 Nov '24

Fix 'cgroup/cpuset: Prevent UAF in proc_cpuset_show()' issue with commmunity patches Chen Ridong (3): Revert "cgroup: fix uaf when proc_cpuset_show" cgroup/cpuset: Prevent UAF in proc_cpuset_show() cgroup: add cgroup_root_ext to keep kabi Yafang Shao (1): cgroup: Make operations on the cgroup root_list RCU safe include/linux/cgroup-defs.h | 9 +++++++++ kernel/cgroup/cgroup-internal.h | 3 ++- kernel/cgroup/cgroup-v1.c | 6 ++++-- kernel/cgroup/cgroup.c | 17 ++++++++++------- kernel/cgroup/cpuset.c | 33 +++++++-------------------------- 5 files changed, 32 insertions(+), 36 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10 0/4] Fix 'cgroup/cpuset: Prevent UAF in proc_cpuset_show()' issue with commmunity patches
by Chen Ridong 11 Nov '24

11 Nov '24

Fix 'cgroup/cpuset: Prevent UAF in proc_cpuset_show()' issue with commmunity patches Chen Ridong (3): Revert "cgroup: fix uaf when proc_cpuset_show" cgroup/cpuset: Prevent UAF in proc_cpuset_show() cgroup: add cgroup_root_ext to keep kabi Yafang Shao (1): cgroup: Make operations on the cgroup root_list RCU safe include/linux/cgroup-defs.h | 9 +++++++++ kernel/cgroup/cgroup-internal.h | 3 ++- kernel/cgroup/cgroup-v1.c | 6 ++++-- kernel/cgroup/cgroup.c | 17 ++++++++++------- kernel/cgroup/cpuset.c | 33 +++++++-------------------------- 5 files changed, 32 insertions(+), 36 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6 0/2] CVE-2024-50145
by Luo Gengkun 11 Nov '24

11 Nov '24

*** BLURB HERE *** Aleksandr Mishin (2): octeon_ep: Implement helper for iterating packets in Rx queue octeon_ep: Add SKB allocation failures handling in __octep_oq_process_rx() .../net/ethernet/marvell/octeon_ep/octep_rx.c | 82 +++++++++++++------ 1 file changed, 59 insertions(+), 23 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] iio: gts-helper: Fix memory leaks in iio_gts_build_avail_scale_table()
by Liu Chuang 11 Nov '24

11 Nov '24

From: Jinjie Ruan <ruanjinjie(a)huawei.com> stable inclusion from stable-v6.6.60 commit 38d6e8be234d87b0eedca50309e25051888b39d1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37B8 CVE: CVE-2024-50231 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 691e79ffc42154a9c91dc3b7e96a307037b4be74 upstream. modprobe iio-test-gts and rmmod it, then the following memory leak occurs: unreferenced object 0xffffff80c810be00 (size 64): comm "kunit_try_catch", pid 1654, jiffies 4294913981 hex dump (first 32 bytes): 02 00 00 00 08 00 00 00 20 00 00 00 40 00 00 00 ........ ...@... 80 00 00 00 00 02 00 00 00 04 00 00 00 08 00 00 ................ backtrace (crc a63d875e): [<0000000028c1b3c2>] kmemleak_alloc+0x34/0x40 [<000000001d6ecc87>] __kmalloc_noprof+0x2bc/0x3c0 [<00000000393795c1>] devm_iio_init_iio_gts+0x4b4/0x16f4 [<0000000071bb4b09>] 0xffffffdf052a62e0 [<000000000315bc18>] 0xffffffdf052a6488 [<00000000f9dc55b5>] kunit_try_run_case+0x13c/0x3ac [<00000000175a3fd4>] kunit_generic_run_threadfn_adapter+0x80/0xec [<00000000f505065d>] kthread+0x2e8/0x374 [<00000000bbfb0e5d>] ret_from_fork+0x10/0x20 unreferenced object 0xffffff80cbfe9e70 (size 16): comm "kunit_try_catch", pid 1658, jiffies 4294914015 hex dump (first 16 bytes): 10 00 00 00 40 00 00 00 80 00 00 00 00 00 00 00 ....@........... backtrace (crc 857f0cb4): [<0000000028c1b3c2>] kmemleak_alloc+0x34/0x40 [<000000001d6ecc87>] __kmalloc_noprof+0x2bc/0x3c0 [<00000000393795c1>] devm_iio_init_iio_gts+0x4b4/0x16f4 [<0000000071bb4b09>] 0xffffffdf052a62e0 [<000000007d089d45>] 0xffffffdf052a6864 [<00000000f9dc55b5>] kunit_try_run_case+0x13c/0x3ac [<00000000175a3fd4>] kunit_generic_run_threadfn_adapter+0x80/0xec [<00000000f505065d>] kthread+0x2e8/0x374 [<00000000bbfb0e5d>] ret_from_fork+0x10/0x20 ...... It includes 5*5 times "size 64" memory leaks, which correspond to 5 times test_init_iio_gain_scale() calls with gts_test_gains size 10 (10*size(int)) and gts_test_itimes size 5. It also includes 5*1 times "size 16" memory leak, which correspond to one time __test_init_iio_gain_scale() call with gts_test_gains_gain_low size 3 (3*size(int)) and gts_test_itimes size 5. The reason is that the per_time_gains[i] is not freed which is allocated in the "gts->num_itime" for loop in iio_gts_build_avail_scale_table(). Cc: stable(a)vger.kernel.org Fixes: 38416c28e168 ("iio: light: Add gain-time-scale helpers") Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> Reviewed-by: Matti Vaittinen <mazziesaccount(a)gmail.com> Link: https://patch.msgid.link/20241011095512.3667549-1-ruanjinjie@huawei.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/iio/industrialio-gts-helper.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/iio/industrialio-gts-helper.c b/drivers/iio/industrialio-gts-helper.c index 1aaa254aaf51..5f131bc1a01e 100644 --- a/drivers/iio/industrialio-gts-helper.c +++ b/drivers/iio/industrialio-gts-helper.c @@ -307,6 +307,8 @@ static int iio_gts_build_avail_scale_table(struct iio_gts *gts) if (ret) goto err_free_out; + for (i = 0; i < gts->num_itime; i++) + kfree(per_time_gains[i]); kfree(per_time_gains); gts->per_time_avail_scale_tables = per_time_scales; -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1288/1288] mm/sparse.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 10 Nov '24

10 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: bafa65a8c91fb9c99706d2d22210690199f95779 commit: 34b64663e85dec8dac9dd02d94a50d90000a51a7 [1288/1288] mm/memory_hotplug: allow arch_remove_memory() without CONFIG_MEMORY_HOTREMOVE config: x86_64-buildonly-randconfig-004-20241106 (https://download.01.org/0day-ci/archive/20241110/202411101122.3P9UBhzq-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241110/202411101122.3P9UBhzq-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411101122.3P9UBhzq-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/sparse.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1288/1288] net/ipv6/output_core.o: warning: objtool: missing symbol for section .text
by kernel test robot 10 Nov '24

10 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: bafa65a8c91fb9c99706d2d22210690199f95779 commit: 643ec9dfcfa248b19ed1a1acce12f05d6dda6de4 [1288/1288] inet: switch IP ID generator to siphash config: x86_64-buildonly-randconfig-004-20241106 (https://download.01.org/0day-ci/archive/20241110/202411100806.TVwoc5Jt-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241110/202411100806.TVwoc5Jt-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411100806.TVwoc5Jt-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/ipv6/output_core.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0