- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] vt: fix unicode buffer corruption when deleting characters
by Xiang Yang 23 May '24

23 May '24

From: Nicolas Pitre <nico(a)fluxnic.net> stable inclusion from stable-v5.10.215 commit 1ce408f75ccf1e25b3fddef75cca878b55f2ac90 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q994 CVE: CVE-2024-35823 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1581dafaf0d34bc9c428a794a22110d7046d186d upstream. This is the same issue that was fixed for the VGA text buffer in commit 39cdb68c64d8 ("vt: fix memory overlapping when deleting chars in the buffer"). The cure is also the same i.e. replace memcpy() with memmove() due to the overlaping buffers. Signed-off-by: Nicolas Pitre <nico(a)fluxnic.net> Fixes: 81732c3b2fed ("tty vt: Fix line garbage in virtual console on command line edition") Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/sn184on2-3p0q-0qrq-0218-895349s4753o@syhkavp.arg Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- drivers/tty/vt/vt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 0252c0562dbc..33fb7b6555f4 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -398,7 +398,7 @@ static void vc_uniscr_delete(struct vc_data *vc, unsigned int nr) char32_t *ln = uniscr->lines[vc->state.y]; unsigned int x = vc->state.x, cols = vc->vc_cols; - memcpy(&ln[x], &ln[x + nr], (cols - x - nr) * sizeof(*ln)); + memmove(&ln[x], &ln[x + nr], (cols - x - nr) * sizeof(*ln)); memset32(&ln[cols - nr], ' ', nr); } } -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Load balance fixes
by Zhang Qiao 23 May '24

23 May '24

Zhang Qiao (2): sched/numa: Fix numa imbalance in load_balance() config: Disable COBFIG_ARCH_CUSTOM_NUMA_DISTANCE for arm64 arch/arm64/configs/openeuler_defconfig | 2 +- kernel/sched/fair.c | 13 ++++++++----- 2 files changed, 9 insertions(+), 6 deletions(-) -- 2.18.0.huawei.25

1 2

[PATCH OLK-6.6 v3] mm: add thp anon pmd size mapping align control
by Ze Zuo 23 May '24

23 May '24

From: Kefeng Wang <wangkefeng.wang(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9R7N8 CVE: NA ------------------------------------------------- After committing df0ad0579ac9 ('mm: align larger anonymous mappings on THP boundaries'), we found a number of issues, eg, a significant increase in memory access latency on arm64, which was addressed by commit bb713c2a4a43 (arm64: mmap: disable align larger anonymous mappings on THP boundaries), but subsequently found on x86 that the patch also resulted in a significant degradation of the SPECCPU test. Commit 449846913eb6('mm: huge_memory: add thp mapping align control') has implemented the sysfs interface control of 64 KB aligned mapping in arm64, based on this for thp_align_mapping to add a new bit to control pmd size page alignment, where the 64K alignment anouymous mapping enable for arm64 will depend on the new bits being turned on. it is disabled by default, and could be enabled by /sys/kernel/mm/transparent_hugepage/thp_mapping_align. Signed-off-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- Documentation/admin-guide/mm/transhuge.rst | 15 +++++++++------ include/linux/huge_mm.h | 7 +++++++ mm/huge_memory.c | 13 +++++++++++-- mm/mmap.c | 2 +- 4 files changed, 28 insertions(+), 9 deletions(-) diff --git a/Documentation/admin-guide/mm/transhuge.rst b/Documentation/admin-guide/mm/transhuge.rst index 54046f487f15..e66d1d7ee711 100644 --- a/Documentation/admin-guide/mm/transhuge.rst +++ b/Documentation/admin-guide/mm/transhuge.rst @@ -211,14 +211,17 @@ possible to enable/disable it by configurate the corresponding bit:: echo 0x2 >/sys/kernel/mm/transparent_hugepage/thp_exec_enabled echo 0x3 >/sys/kernel/mm/transparent_hugepage/thp_exec_enabled -The kernel could try to enable other larger size mappings align other -than THP size, eg, 64K on arm64, BIT0 for file mapping, BIT1 for anon -mapping, it is disabled by default, and could enable this feature by -writing the corresponding bit to 1:: +The kernel could try to enable mappings for different sizes, eg, 64K on +arm64, BIT0 for file mapping, BIT1 for anonymous mapping, and THP size +page, BIT3 for anonymous mapping, where 64K anonymous mapping for arm64 +is dependent on BIT3 being turned on, the above feature are disabled by +default, and could enable the above feature by writing the corresponding +bit to 1:: echo 0x1 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align - echo 0x2 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align - echo 0x3 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + echo 0x4 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + echo 0x6 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + The kernel could enable high-orders(greated than PAGE_ALLOC_COSTLY_ORDER, only support order 4 for now) be stored on PCP lists(except PMD order), which could diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h index 3e5f7064e2de..58ce4efb2019 100644 --- a/include/linux/huge_mm.h +++ b/include/linux/huge_mm.h @@ -54,6 +54,7 @@ enum transparent_hugepage_flag { TRANSPARENT_HUGEPAGE_FILE_EXEC_MTHP_FLAG, TRANSPARENT_HUGEPAGE_FILE_MAPPING_ALIGN_FLAG, TRANSPARENT_HUGEPAGE_ANON_MAPPING_ALIGN_FLAG, + TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG, }; struct kobject; @@ -288,6 +289,10 @@ static inline void count_mthp_stat(int order, enum mthp_stat_item item) (transparent_hugepage_flags & \ (1<<TRANSPARENT_HUGEPAGE_USE_ZERO_PAGE_FLAG)) +#define thp_anon_mapping_pmd_align() \ + (transparent_hugepage_flags & \ + (1<<TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG)) + unsigned long thp_get_unmapped_area(struct file *filp, unsigned long addr, unsigned long len, unsigned long pgoff, unsigned long flags); @@ -443,6 +448,8 @@ static inline void folio_prep_large_rmappable(struct folio *folio) {} #define transparent_hugepage_flags 0UL +#define thp_anon_mapping_pmd_align() NULL + #define thp_get_unmapped_area NULL static inline bool diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 763bb25e4f99..63438200f3da 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -518,7 +518,9 @@ static struct kobj_attribute thp_exec_enabled_attr = #define FILE_MAPPING_ALIGN BIT(0) #define ANON_MAPPING_ALIGN BIT(1) -#define THP_MAPPING_ALIGN_ALL (FILE_MAPPING_ALIGN | ANON_MAPPING_ALIGN) +#define ANON_MAPPING_PMD_ALIGN BIT(2) +#define THP_MAPPING_ALIGN_ALL \ + (FILE_MAPPING_ALIGN | ANON_MAPPING_ALIGN | ANON_MAPPING_PMD_ALIGN) static ssize_t thp_mapping_align_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf) @@ -533,6 +535,10 @@ static ssize_t thp_mapping_align_show(struct kobject *kobj, &transparent_hugepage_flags)) val |= ANON_MAPPING_ALIGN; + if (test_bit(TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG, + &transparent_hugepage_flags)) + val |= ANON_MAPPING_PMD_ALIGN; + return sysfs_emit(buf, "0x%lx\n", val); } static ssize_t thp_mapping_align_store(struct kobject *kobj, @@ -544,13 +550,16 @@ static ssize_t thp_mapping_align_store(struct kobject *kobj, ret = kstrtoul(buf, 16, &val); if (ret < 0) return ret; - if (val & ~THP_MAPPING_ALIGN_ALL) + if ((val & ~THP_MAPPING_ALIGN_ALL) || (!(val & ANON_MAPPING_PMD_ALIGN) && + (val & ANON_MAPPING_ALIGN))) return -EINVAL; thp_flag_set(TRANSPARENT_HUGEPAGE_FILE_MAPPING_ALIGN_FLAG, val & FILE_MAPPING_ALIGN); thp_flag_set(TRANSPARENT_HUGEPAGE_ANON_MAPPING_ALIGN_FLAG, val & ANON_MAPPING_ALIGN); + thp_flag_set(TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG, + val & ANON_MAPPING_PMD_ALIGN); return count; } diff --git a/mm/mmap.c b/mm/mmap.c index 1c256f38128e..1d8def3db125 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1857,7 +1857,7 @@ get_unmapped_area(struct file *file, unsigned long addr, unsigned long len, */ get_area = shmem_get_unmapped_area; } else if (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) && - !IS_ENABLED(CONFIG_ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT)) { + thp_anon_mapping_pmd_align()) { /* Ensures that larger anonymous mappings are THP aligned. */ get_area = thp_get_unmapped_area; } -- 2.33.0

2 1

[PATCH OLK-6.6 v3] mm: add thp anon pmd size mapping align control
by Ze Zuo 23 May '24

23 May '24

From: Kefeng Wang <wangkefeng.wang(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9R7N8 CVE: NA ------------------------------------------------- After committing df0ad0579ac9 ('mm: align larger anonymous mappings on THP boundaries'), we found a number of issues, eg, a significant increase in memory access latency on arm64, which was addressed by commit bb713c2a4a43 (arm64: mmap: disable align larger anonymous mappings on THP boundaries), but subsequently found on x86 that the patch also resulted in a significant degradation of the SPECCPU test. Commit 449846913eb6('mm: huge_memory: add thp mapping align control') has implemented the sysfs interface control of 64 KB aligned mapping in arm64, based on this for thp_align_mapping to add a new bit to control pmd size page alignment, where the 64K alignment anouymous mapping enable for arm64 will depend on the new bits being turned on. it is disabled by default, and could be enabled by /sys/kernel/mm/transparent_hugepage/thp_mapping_align. Signed-off-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> Changes since v2: - Modify enable logic and related documentation. Changes since v1: - Fix build error without CONFIG_TRANSPARENT_HUGEPAGE. - delete some unsed define. --- Documentation/admin-guide/mm/transhuge.rst | 15 +++++++++------ include/linux/huge_mm.h | 7 +++++++ mm/huge_memory.c | 13 +++++++++++-- mm/mmap.c | 2 +- 4 files changed, 28 insertions(+), 9 deletions(-) diff --git a/Documentation/admin-guide/mm/transhuge.rst b/Documentation/admin-guide/mm/transhuge.rst index 54046f487f15..e66d1d7ee711 100644 --- a/Documentation/admin-guide/mm/transhuge.rst +++ b/Documentation/admin-guide/mm/transhuge.rst @@ -211,14 +211,17 @@ possible to enable/disable it by configurate the corresponding bit:: echo 0x2 >/sys/kernel/mm/transparent_hugepage/thp_exec_enabled echo 0x3 >/sys/kernel/mm/transparent_hugepage/thp_exec_enabled -The kernel could try to enable other larger size mappings align other -than THP size, eg, 64K on arm64, BIT0 for file mapping, BIT1 for anon -mapping, it is disabled by default, and could enable this feature by -writing the corresponding bit to 1:: +The kernel could try to enable mappings for different sizes, eg, 64K on +arm64, BIT0 for file mapping, BIT1 for anonymous mapping, and THP size +page, BIT3 for anonymous mapping, where 64K anonymous mapping for arm64 +is dependent on BIT3 being turned on, the above feature are disabled by +default, and could enable the above feature by writing the corresponding +bit to 1:: echo 0x1 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align - echo 0x2 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align - echo 0x3 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + echo 0x4 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + echo 0x6 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + The kernel could enable high-orders(greated than PAGE_ALLOC_COSTLY_ORDER, only support order 4 for now) be stored on PCP lists(except PMD order), which could diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h index 3e5f7064e2de..58ce4efb2019 100644 --- a/include/linux/huge_mm.h +++ b/include/linux/huge_mm.h @@ -54,6 +54,7 @@ enum transparent_hugepage_flag { TRANSPARENT_HUGEPAGE_FILE_EXEC_MTHP_FLAG, TRANSPARENT_HUGEPAGE_FILE_MAPPING_ALIGN_FLAG, TRANSPARENT_HUGEPAGE_ANON_MAPPING_ALIGN_FLAG, + TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG, }; struct kobject; @@ -288,6 +289,10 @@ static inline void count_mthp_stat(int order, enum mthp_stat_item item) (transparent_hugepage_flags & \ (1<<TRANSPARENT_HUGEPAGE_USE_ZERO_PAGE_FLAG)) +#define thp_anon_mapping_pmd_align() \ + (transparent_hugepage_flags & \ + (1<<TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG)) + unsigned long thp_get_unmapped_area(struct file *filp, unsigned long addr, unsigned long len, unsigned long pgoff, unsigned long flags); @@ -443,6 +448,8 @@ static inline void folio_prep_large_rmappable(struct folio *folio) {} #define transparent_hugepage_flags 0UL +#define thp_anon_mapping_pmd_align() NULL + #define thp_get_unmapped_area NULL static inline bool diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 763bb25e4f99..63438200f3da 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -518,7 +518,9 @@ static struct kobj_attribute thp_exec_enabled_attr = #define FILE_MAPPING_ALIGN BIT(0) #define ANON_MAPPING_ALIGN BIT(1) -#define THP_MAPPING_ALIGN_ALL (FILE_MAPPING_ALIGN | ANON_MAPPING_ALIGN) +#define ANON_MAPPING_PMD_ALIGN BIT(2) +#define THP_MAPPING_ALIGN_ALL \ + (FILE_MAPPING_ALIGN | ANON_MAPPING_ALIGN | ANON_MAPPING_PMD_ALIGN) static ssize_t thp_mapping_align_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf) @@ -533,6 +535,10 @@ static ssize_t thp_mapping_align_show(struct kobject *kobj, &transparent_hugepage_flags)) val |= ANON_MAPPING_ALIGN; + if (test_bit(TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG, + &transparent_hugepage_flags)) + val |= ANON_MAPPING_PMD_ALIGN; + return sysfs_emit(buf, "0x%lx\n", val); } static ssize_t thp_mapping_align_store(struct kobject *kobj, @@ -544,13 +550,16 @@ static ssize_t thp_mapping_align_store(struct kobject *kobj, ret = kstrtoul(buf, 16, &val); if (ret < 0) return ret; - if (val & ~THP_MAPPING_ALIGN_ALL) + if ((val & ~THP_MAPPING_ALIGN_ALL) || (!(val & ANON_MAPPING_PMD_ALIGN) && + (val & ANON_MAPPING_ALIGN))) return -EINVAL; thp_flag_set(TRANSPARENT_HUGEPAGE_FILE_MAPPING_ALIGN_FLAG, val & FILE_MAPPING_ALIGN); thp_flag_set(TRANSPARENT_HUGEPAGE_ANON_MAPPING_ALIGN_FLAG, val & ANON_MAPPING_ALIGN); + thp_flag_set(TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG, + val & ANON_MAPPING_PMD_ALIGN); return count; } diff --git a/mm/mmap.c b/mm/mmap.c index 1c256f38128e..1d8def3db125 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1857,7 +1857,7 @@ get_unmapped_area(struct file *file, unsigned long addr, unsigned long len, */ get_area = shmem_get_unmapped_area; } else if (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) && - !IS_ENABLED(CONFIG_ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT)) { + thp_anon_mapping_pmd_align()) { /* Ensures that larger anonymous mappings are THP aligned. */ get_area = thp_get_unmapped_area; } -- 2.33.0

2 1

[PATCH OLK-5.10] [Backport] drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag
by Wang Hai 23 May '24

23 May '24

From: Philip Yang <Philip.Yang(a)amd.com> stable inclusion from stable-v5.15.154 commit 5d5f1a7f3b1039925f79c7894f153c2a905201fb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q94F CVE: CVE-2024-35817 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6c6064cbe58b43533e3451ad6a8ba9736c109ac3 ] Otherwise after the GTT bo is released, the GTT and gart space is freed but amdgpu_ttm_backend_unbind will not clear the gart page table entry and leave valid mapping entry pointing to the stale system page. Then if GPU access the gart address mistakely, it will read undefined value instead page fault, harder to debug and reproduce the real issue. Cc: stable(a)vger.kernel.org Signed-off-by: Philip Yang <Philip.Yang(a)amd.com> Reviewed-by: Christian König <christian.koenig(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c [commit 942ab769c51d wasn't merged, which lead to context conflicts] Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c index 0b162928a248..7d4a54025e18 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c @@ -1092,6 +1092,7 @@ static int amdgpu_ttm_gart_bind(struct amdgpu_device *adev, r = amdgpu_gart_bind(adev, gtt->offset, ttm->num_pages, ttm->pages, gtt->ttm.dma_address, flags); } + gtt->bound = true; gart_bind_fail: if (r) -- 2.17.1

2 1

[PATCH OLK-5.10] Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()
by Liu Chuang 23 May '24

23 May '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v5.10.201 commit 6c71e065befb2fae8f1461559b940c04e1071bd5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9RFE5 CVE: CVE-2023-52840 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- [ Upstream commit eb988e46da2e4eae89f5337e047ce372fe33d5b1 ] The put_device() calls rmi_release_function() which frees "fn" so the dereference on the next line "fn->num_of_irqs" is a use after free. Move the put_device() to the end to fix this. Fixes: 24d28e4f1271 ("Input: synaptics-rmi4 - convert irq distribution to irq_domain") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Link: https://lore.kernel.org/r/706efd36-7561-42f3-adfa-dd1d0bd4f5a1@moroto.mount… Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/input/rmi4/rmi_bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/input/rmi4/rmi_bus.c b/drivers/input/rmi4/rmi_bus.c index 47d1b97ed6cf..a1b2c86ef611 100644 --- a/drivers/input/rmi4/rmi_bus.c +++ b/drivers/input/rmi4/rmi_bus.c @@ -276,11 +276,11 @@ void rmi_unregister_function(struct rmi_function *fn) device_del(&fn->dev); of_node_put(fn->dev.of_node); - put_device(&fn->dev); for (i = 0; i < fn->num_of_irqs; i++) irq_dispose_mapping(fn->irq[i]); + put_device(&fn->dev); } /** -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] vt: fix unicode buffer corruption when deleting characters
by Xiang Yang 23 May '24

23 May '24

From: Nicolas Pitre <nico(a)fluxnic.net> stable inclusion from stable-v4.19.312 commit fc7dfe3d123f00e720be80b920da287810a1f37d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q994 CVE: CVE-2024-35823 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… commit 1581dafaf0d34bc9c428a794a22110d7046d186d upstream. This is the same issue that was fixed for the VGA text buffer in commit 39cdb68c64d8 ("vt: fix memory overlapping when deleting chars in the buffer"). The cure is also the same i.e. replace memcpy() with memmove() due to the overlaping buffers. Signed-off-by: Nicolas Pitre <nico(a)fluxnic.net> Fixes: 81732c3b2fed ("tty vt: Fix line garbage in virtual console on command line edition") Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/sn184on2-3p0q-0qrq-0218-895349s4753o@syhkavp.arg Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- drivers/tty/vt/vt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 163186cbfe79..12ddd82f0dad 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -405,7 +405,7 @@ static void vc_uniscr_delete(struct vc_data *vc, unsigned int nr) char32_t *ln = uniscr->lines[vc->vc_y]; unsigned int x = vc->vc_x, cols = vc->vc_cols; - memcpy(&ln[x], &ln[x + nr], (cols - x - nr) * sizeof(*ln)); + memmove(&ln[x], &ln[x + nr], (cols - x - nr) * sizeof(*ln)); memset32(&ln[cols - nr], ' ', nr); } } -- 2.34.1

2 1

[PATCH OLK-5.10 v3 0/4] arm64: Allow CPU0 to be nohz_full
by Xiongfeng Wang 23 May '24

23 May '24

Changelog: v1->v2: change __setup() to early_param() v2->v3: fix kabi because #include <linux/sched/isolation.h> modify defconfig Xiongfeng Wang (4): isolation: Do not check whether housekeeping CPUs are present isolation: Check whether all the housekeeping CPUs are online arm64: Kconfig: select ARCH_SUSPEND_NONZERO_CPU by default arm64: defconfig: Enable CONFIG_ARCH_SUSPEND_NONZERO_CPU arch/arm64/Kconfig | 3 ++ arch/arm64/configs/openeuler_defconfig | 2 ++ include/linux/cpu.h | 5 +++- include/linux/sched/isolation.h | 5 ++++ kernel/sched/isolation.c | 39 +++++++++++++++++++++++--- kernel/smp.c | 4 +++ kernel/time/tick-sched.c | 5 +++- 7 files changed, 57 insertions(+), 6 deletions(-) -- 2.30.0

2 5

[PATCH OLK-5.10 v4] eeprom: at24: fix memory corruption race condition
by Wenyu Huang 23 May '24

23 May '24

From: Daniel Okazaki <dtokazaki(a)google.com> stable inclusion from stable-v5.10.217 commit c850f71fca09ea41800ed55905980063d17e01da category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9F4 CVE: CVE-2024-35848 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit f42c97027fb75776e2e9358d16bf4a99aeb04cf2 ] If the eeprom is not accessible, an nvmem device will be registered, the read will fail, and the device will be torn down. If another driver accesses the nvmem device after the teardown, it will reference invalid memory. Move the failure point before registering the nvmem device. Signed-off-by: Daniel Okazaki <dtokazaki(a)google.com> Fixes: b20eb4c1f026 ("eeprom: at24: drop unnecessary label") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240422174337.2487142-1-dtokazaki@google.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/misc/eeprom/at24.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c index 305ffad131a2..c43072b2e9b6 100644 --- a/drivers/misc/eeprom/at24.c +++ b/drivers/misc/eeprom/at24.c @@ -757,14 +757,6 @@ static int at24_probe(struct i2c_client *client) pm_runtime_set_active(dev); pm_runtime_enable(dev); - at24->nvmem = devm_nvmem_register(dev, &nvmem_config); - if (IS_ERR(at24->nvmem)) { - pm_runtime_disable(dev); - if (!pm_runtime_status_suspended(dev)) - regulator_disable(at24->vcc_reg); - return PTR_ERR(at24->nvmem); - } - /* * Perform a one-byte test read to verify that the * chip is functional. @@ -777,6 +769,14 @@ static int at24_probe(struct i2c_client *client) return -ENODEV; } + at24->nvmem = devm_nvmem_register(dev, &nvmem_config); + if (IS_ERR(at24->nvmem)) { + pm_runtime_disable(dev); + if (!pm_runtime_status_suspended(dev)) + regulator_disable(at24->vcc_reg); + return PTR_ERR(at24->nvmem); + } + pm_runtime_idle(dev); if (writable) -- 2.34.1

2 1

[PATCH OLK-5.10 v3] eeprom: at24: fix memory corruption race condition
by Wenyu Huang 23 May '24

23 May '24

From: Daniel Okazaki <dtokazaki(a)google.com> stable inclusion from stable-v5.10.159 commit c850f71fca09ea41800ed55905980063d17e01da category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9F4 CVE: CVE-2024-35848 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit f42c97027fb75776e2e9358d16bf4a99aeb04cf2 ] If the eeprom is not accessible, an nvmem device will be registered, the read will fail, and the device will be torn down. If another driver accesses the nvmem device after the teardown, it will reference invalid memory. Move the failure point before registering the nvmem device. Signed-off-by: Daniel Okazaki <dtokazaki(a)google.com> Fixes: b20eb4c1f026 ("eeprom: at24: drop unnecessary label") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240422174337.2487142-1-dtokazaki@google.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/misc/eeprom/at24.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c index 305ffad131a2..c43072b2e9b6 100644 --- a/drivers/misc/eeprom/at24.c +++ b/drivers/misc/eeprom/at24.c @@ -757,14 +757,6 @@ static int at24_probe(struct i2c_client *client) pm_runtime_set_active(dev); pm_runtime_enable(dev); - at24->nvmem = devm_nvmem_register(dev, &nvmem_config); - if (IS_ERR(at24->nvmem)) { - pm_runtime_disable(dev); - if (!pm_runtime_status_suspended(dev)) - regulator_disable(at24->vcc_reg); - return PTR_ERR(at24->nvmem); - } - /* * Perform a one-byte test read to verify that the * chip is functional. @@ -777,6 +769,14 @@ static int at24_probe(struct i2c_client *client) return -ENODEV; } + at24->nvmem = devm_nvmem_register(dev, &nvmem_config); + if (IS_ERR(at24->nvmem)) { + pm_runtime_disable(dev); + if (!pm_runtime_status_suspended(dev)) + regulator_disable(at24->vcc_reg); + return PTR_ERR(at24->nvmem); + } + pm_runtime_idle(dev); if (writable) -- 2.34.1

2 1