- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 1667/1667] drivers/iommu/loongarch_iommu.c:101:1: sparse: sparse: symbol 'la_rlookup_iommu_list' was not declared. Should it be static?
by kernel test robot 27 Dec '24

27 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 16a0cbac6609f8ba10a91a9d52b15bf28243c3ee commit: 72fe4978ee346c10869113410da1b61710dd8d8f [1667/1667] LoongArch: add iommu support config: loongarch-randconfig-r121-20241227 (https://download.01.org/0day-ci/archive/20241227/202412271142.yFd4x2L2-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20241227/202412271142.yFd4x2L2-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412271142.yFd4x2L2-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/iommu/loongarch_iommu.c: note: in included file: drivers/iommu/loongarch_iommu.h:137:3: sparse: sparse: symbol 'loongarch_iommu' was not declared. Should it be static? drivers/iommu/loongarch_iommu.h:152:3: sparse: sparse: symbol 'iommu_info' was not declared. Should it be static? drivers/iommu/loongarch_iommu.h:161:3: sparse: sparse: symbol 'dom_info' was not declared. Should it be static? drivers/iommu/loongarch_iommu.h:166:3: sparse: sparse: symbol 'dom_entry' was not declared. Should it be static? >> drivers/iommu/loongarch_iommu.c:101:1: sparse: sparse: symbol 'la_rlookup_iommu_list' was not declared. Should it be static? >> drivers/iommu/loongarch_iommu.c:108:9: sparse: sparse: symbol 'la_iommu_last_bdf' was not declared. Should it be static? >> drivers/iommu/loongarch_iommu.c:112:5: sparse: sparse: symbol 'loongarch_iommu_disable' was not declared. Should it be static? >> drivers/iommu/loongarch_iommu.c:130:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:130:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:130:15: sparse: got void * >> drivers/iommu/loongarch_iommu.c:132:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:132:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:132:9: sparse: got void * drivers/iommu/loongarch_iommu.c:135:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:135:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:135:15: sparse: got void * drivers/iommu/loongarch_iommu.c:137:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:137:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:137:9: sparse: got void * drivers/iommu/loongarch_iommu.c:150:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:150:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:150:15: sparse: got void * drivers/iommu/loongarch_iommu.c:152:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:152:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:152:9: sparse: got void * drivers/iommu/loongarch_iommu.c:155:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:155:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:155:15: sparse: got void * drivers/iommu/loongarch_iommu.c:157:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:157:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:157:9: sparse: got void * drivers/iommu/loongarch_iommu.c:160:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:160:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:160:15: sparse: got void * drivers/iommu/loongarch_iommu.c:162:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:162:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:162:9: sparse: got void * drivers/iommu/loongarch_iommu.c:190:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:190:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:190:15: sparse: got void * drivers/iommu/loongarch_iommu.c:193:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:193:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:193:9: sparse: got void * drivers/iommu/loongarch_iommu.c:196:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:196:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:196:15: sparse: got void * drivers/iommu/loongarch_iommu.c:199:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:199:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:199:9: sparse: got void * drivers/iommu/loongarch_iommu.c:206:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:206:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:206:15: sparse: got void * drivers/iommu/loongarch_iommu.c:306:17: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:306:17: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:306:17: sparse: got void * drivers/iommu/loongarch_iommu.c:310:17: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:310:17: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:310:17: sparse: got void * drivers/iommu/loongarch_iommu.c:312:23: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:312:23: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:312:23: sparse: got void * drivers/iommu/loongarch_iommu.c:314:17: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:314:17: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:314:17: sparse: got void * drivers/iommu/loongarch_iommu.c:322:23: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:322:23: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:322:23: sparse: got void * drivers/iommu/loongarch_iommu.c:325:17: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:325:17: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:325:17: sparse: got void * drivers/iommu/loongarch_iommu.c:327:23: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:327:23: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:327:23: sparse: got void * drivers/iommu/loongarch_iommu.c:329:17: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:329:17: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:329:17: sparse: got void * drivers/iommu/loongarch_iommu.c:349:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:349:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:349:15: sparse: got void * drivers/iommu/loongarch_iommu.c:352:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:352:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:352:9: sparse: got void * >> drivers/iommu/loongarch_iommu.c:610:6: sparse: sparse: symbol 'domain_deattach_iommu' was not declared. Should it be static? >> drivers/iommu/loongarch_iommu.c:651:28: sparse: sparse: symbol 'lookup_rlooptable' was not declared. Should it be static? >> drivers/iommu/loongarch_iommu.c:662:24: sparse: sparse: symbol 'find_iommu_by_dev' was not declared. Should it be static? >> drivers/iommu/loongarch_iommu.c:721:21: sparse: sparse: symbol 'la_iommu_probe_device' was not declared. Should it be static? >> drivers/iommu/loongarch_iommu.c:752:19: sparse: sparse: symbol 'get_iommu_info_from_dom' was not declared. Should it be static? drivers/iommu/loongarch_iommu.c:794:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:794:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:794:9: sparse: got void * drivers/iommu/loongarch_iommu.c:795:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:795:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:795:9: sparse: got void * drivers/iommu/loongarch_iommu.c:796:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:796:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:796:9: sparse: got void * >> drivers/iommu/loongarch_iommu.c:1178:24: sparse: sparse: symbol 'la_iommu_ops' was not declared. Should it be static? >> drivers/iommu/loongarch_iommu.c:1197:24: sparse: sparse: symbol 'loongarch_get_iommu_by_devid' was not declared. Should it be static? >> drivers/iommu/loongarch_iommu.c:1215:6: sparse: sparse: symbol 'check_device_compat' was not declared. Should it be static? >> drivers/iommu/loongarch_iommu.c:1259:25: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *confbase @@ got void [noderef] __iomem * @@ drivers/iommu/loongarch_iommu.c:1259:25: sparse: expected void *confbase drivers/iommu/loongarch_iommu.c:1259:25: sparse: got void [noderef] __iomem * >> drivers/iommu/loongarch_iommu.c:1344:28: sparse: sparse: symbol 'create_rlookup_entry' was not declared. Should it be static? vim +/la_rlookup_iommu_list +101 drivers/iommu/loongarch_iommu.c 100 > 101 LIST_HEAD(la_rlookup_iommu_list); 102 LIST_HEAD(la_iommu_list); /* list of all loongarch 103 * IOMMUs in the system 104 */ 105 106 static u32 rlookup_table_size; /* size if the rlookup table */ 107 static int la_iommu_target_ivhd_type; > 108 u16 la_iommu_last_bdf; /* largest PCI device id 109 * we have to handle 110 */ 111 > 112 int loongarch_iommu_disable; 113 114 #define iommu_write_regl(iommu, off, val) \ 115 writel(val, iommu->confbase + off) 116 #define iommu_read_regl(iommu, off) readl(iommu->confbase + off) 117 118 static void switch_huge_to_page(unsigned long *ptep, unsigned long start); 119 120 static void iommu_translate_disable(struct loongarch_iommu *iommu) 121 { 122 u32 val; 123 124 if (iommu == NULL) { 125 pr_err("%s iommu is NULL", __func__); 126 return; 127 } 128 129 /* Disable */ > 130 val = iommu_read_regl(iommu, LA_IOMMU_PFM_CNT_EN); 131 val &= ~(1 << 31); > 132 iommu_write_regl(iommu, LA_IOMMU_PFM_CNT_EN, val); 133 134 /* Write cmd */ 135 val = iommu_read_regl(iommu, LA_IOMMU_CMD); 136 val &= 0xfffffffc; 137 iommu_write_regl(iommu, LA_IOMMU_CMD, val); 138 } 139 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] zram: fix NULL pointer in comp_algorithm_show()
by Liu Shixin 27 Dec '24

27 Dec '24

mainline inclusion from mainline-v6.13-rc1 commit f364cdeb38938f9d03061682b8ff3779dd1730e5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB35M9 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- LTP reported a NULL pointer dereference as followed: CPU: 7 UID: 0 PID: 5995 Comm: cat Kdump: loaded Not tainted 6.12.0-rc6+ #3 Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __pi_strcmp+0x24/0x140 lr : zcomp_available_show+0x60/0x100 [zram] sp : ffff800088b93b90 x29: ffff800088b93b90 x28: 0000000000000001 x27: 0000000000400cc0 x26: 0000000000000ffe x25: ffff80007b3e2388 x24: 0000000000000000 x23: ffff80007b3e2390 x22: ffff0004041a9000 x21: ffff80007b3e2900 x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: ffff80007b3e2900 x9 : ffff80007b3cb280 x8 : 0101010101010101 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000040 x4 : 0000000000000000 x3 : 00656c722d6f7a6c x2 : 0000000000000000 x1 : ffff80007b3e2900 x0 : 0000000000000000 Call trace: __pi_strcmp+0x24/0x140 comp_algorithm_show+0x40/0x70 [zram] dev_attr_show+0x28/0x80 sysfs_kf_seq_show+0x90/0x140 kernfs_seq_show+0x34/0x48 seq_read_iter+0x1d4/0x4e8 kernfs_fop_read_iter+0x40/0x58 new_sync_read+0x9c/0x168 vfs_read+0x1a8/0x1f8 ksys_read+0x74/0x108 __arm64_sys_read+0x24/0x38 invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0xc8/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x38/0x138 el0t_64_sync_handler+0xc0/0xc8 el0t_64_sync+0x188/0x190 The zram->comp_algs[ZRAM_PRIMARY_COMP] can be NULL in zram_add() if comp_algorithm_set() has not been called. User can access the zram device by sysfs after device_add_disk(), so there is a time window to trigger the NULL pointer dereference. Move it ahead device_add_disk() to make sure when user can access the zram device, it is ready. comp_algorithm_set() is protected by zram->init_lock in other places and no such problem. Link: https://lkml.kernel.org/r/20241108100147.3776123-1-liushixin2@huawei.com Fixes: 7ac07a26dea7 ("zram: preparation for multi-zcomp support") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Reviewed-by: Sergey Senozhatsky <senozhatsky(a)chromium.org> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: Minchan Kim <minchan(a)kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: drivers/block/zram/zram_drv.c [ Context conflict. ] Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- drivers/block/zram/zram_drv.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c index 1ffc53ff5ecc..5e29a9cb923b 100644 --- a/drivers/block/zram/zram_drv.c +++ b/drivers/block/zram/zram_drv.c @@ -2218,6 +2218,7 @@ static int zram_add(void) zram->disk->fops = &zram_devops; zram->disk->private_data = zram; snprintf(zram->disk->disk_name, 16, "zram%d", device_id); + comp_algorithm_set(zram, ZRAM_PRIMARY_COMP, default_compressor); /* Actual capacity set using sysfs (/sys/block/zram<id>/disksize */ set_capacity(zram->disk, 0); @@ -2253,8 +2254,6 @@ static int zram_add(void) if (ret) goto out_cleanup_disk; - comp_algorithm_set(zram, ZRAM_PRIMARY_COMP, default_compressor); - zram_debugfs_register(zram); pr_info("Added device: %s\n", zram->disk->disk_name); return device_id; -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] back some mainline patches for damon
by Ze Zuo 27 Dec '24

27 Dec '24

back some mainline patches for damon Alex Rusuf (1): mm/damon/core: fix return value from damos_wmark_metric_value Huan Yang (1): mm/damon/core: remove unnecessary si_meminfo invoke. mm/damon/core.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 00/11] back some mainline patches for damon
by Ze Zuo 27 Dec '24

27 Dec '24

back some mainline patches for damon Alex Rusuf (1): mm/damon/core: fix return value from damos_wmark_metric_value Huan Yang (1): mm/damon/core: remove unnecessary si_meminfo invoke. Ryan Roberts (1): mm/damon/ops-common: atomically test and clear young on ptes and pmds SeongJae Park (7): mm/damon/sysfs: check DAMOS regions update progress from before_terminate() mm/damon: implement a function for max nr_accesses safe calculation mm/damon/ops-common: avoid divide-by-zero during region hotness calculation mm/damon/lru_sort: avoid divide-by-zero in hot threshold calculation mm/damon/sysfs-schemes: handle tried regions sysfs directory allocation failure mm/damon/sysfs-schemes: handle tried region directory allocation failure mm/damon/core: merge regions aggressively when max_nr_regions is unmet Ze Zuo (1): mm/damon/core: fix the compilation warning in kdamond_merge_regions include/linux/damon.h | 7 +++++++ mm/damon/core.c | 36 ++++++++++++++++++++++++++---------- mm/damon/lru_sort.c | 4 +--- mm/damon/ops-common.c | 21 ++++++++------------- mm/damon/ops-common.h | 4 ++-- mm/damon/paddr.c | 4 ++-- mm/damon/sysfs-schemes.c | 5 +++++ mm/damon/sysfs.c | 7 +++++-- mm/damon/vaddr.c | 4 ++-- 9 files changed, 58 insertions(+), 34 deletions(-) -- 2.25.1

2 12

[openeuler:OLK-5.10 2600/2600] mm/clear_freelist_page.c:141:50: sparse: sparse: incorrect type in argument 3 (different address spaces)
by kernel test robot 27 Dec '24

27 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 951151c7a27bc2a9436c2c49ae12510c82137ec1 commit: 426b9efea56f9b065151d165caab2ebd32906505 [2600/2600] mm: Add sysctl to clear free list pages config: arm64-randconfig-r133-20241227 (https://download.01.org/0day-ci/archive/20241227/202412271034.6jlVqgfq-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20241227/202412271034.6jlVqgfq-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412271034.6jlVqgfq-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/clear_freelist_page.c:141:50: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void * @@ got void [noderef] __user *buffer @@ mm/clear_freelist_page.c:141:50: sparse: expected void * mm/clear_freelist_page.c:141:50: sparse: got void [noderef] __user *buffer >> mm/clear_freelist_page.c:155:36: sparse: sparse: incorrect type in initializer (incompatible argument 3 (different address spaces)) @@ expected int ( [usertype] *proc_handler )( ... ) @@ got int ( * )( ... ) @@ mm/clear_freelist_page.c:155:36: sparse: expected int ( [usertype] *proc_handler )( ... ) mm/clear_freelist_page.c:155:36: sparse: got int ( * )( ... ) vim +141 mm/clear_freelist_page.c 133 134 static int sysctl_clear_freelist_handler(struct ctl_table *table, int write, 135 void __user *buffer, size_t *lenp, loff_t *ppos) 136 { 137 int ret; 138 int val; 139 140 table->data = &val; > 141 ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); 142 143 if (!ret && write) 144 clear_freelist_pages(); 145 146 return ret; 147 } 148 149 static struct ctl_table clear_freelist_table[] = { 150 { 151 .procname = "clear_freelist_pages", 152 .data = NULL, 153 .maxlen = sizeof(int), 154 .mode = 0200, > 155 .proc_handler = &sysctl_clear_freelist_handler, 156 .extra1 = SYSCTL_ONE, 157 .extra2 = SYSCTL_ONE, 158 }, 159 { } 160 }; 161 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] exfat: fix out-of-bounds access of directory entries
by Long Li 27 Dec '24

27 Dec '24

From: Yuezhang Mo <Yuezhang.Mo(a)sony.com> mainline inclusion from mainline-v6.10-rc2 commit 184fa506e392eb78364d9283c961217ff2c0617b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGB CVE: CVE-2024-53147 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In the case of the directory size is greater than or equal to the cluster size, if start_clu becomes an EOF cluster(an invalid cluster) due to file system corruption, then the directory entry where ei->hint_femp.eidx hint is outside the directory, resulting in an out-of-bounds access, which may cause further file system corruption. This commit adds a check for start_clu, if it is an invalid cluster, the file or directory will be treated as empty. Cc: stable(a)vger.kernel.org Signed-off-by: Yuezhang Mo <Yuezhang.Mo(a)sony.com> Co-developed-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Conflicts: fs/exfat/namei.c [Conflicts due to not merge 11a347fb6cef ("exfat: change to get file size from DataLength")] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/exfat/namei.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/fs/exfat/namei.c b/fs/exfat/namei.c index 95c51b025b91..89b458b9482c 100644 --- a/fs/exfat/namei.c +++ b/fs/exfat/namei.c @@ -656,13 +656,19 @@ static int exfat_find(struct inode *dir, struct qstr *qname, info->type = exfat_get_entry_type(ep); info->attr = le16_to_cpu(ep->dentry.file.attr); info->size = le64_to_cpu(ep2->dentry.stream.valid_size); + + info->start_clu = le32_to_cpu(ep2->dentry.stream.start_clu); + if (!is_valid_cluster(sbi, info->start_clu) && info->size) { + exfat_warn(sb, "start_clu is invalid cluster(0x%x)", + info->start_clu); + info->size = 0; + } + if (info->size == 0) { info->flags = ALLOC_NO_FAT_CHAIN; info->start_clu = EXFAT_EOF_CLUSTER; } else { info->flags = ep2->dentry.stream.flags; - info->start_clu = - le32_to_cpu(ep2->dentry.stream.start_clu); } exfat_get_entry_time(sbi, &info->crtime, -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1 0/2] Fix CVE-2024-53147
by Long Li 27 Dec '24

27 Dec '24

This patch set fix CVE-2024-53147. Yuezhang Mo (2): exfat: support handle zero-size directory exfat: fix out-of-bounds access of directory entries fs/exfat/namei.c | 39 ++++++++++++++++++++++++++++++--------- 1 file changed, 30 insertions(+), 9 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10] exfat: fix out-of-bounds access of directory entries
by Long Li 27 Dec '24

27 Dec '24

From: Yuezhang Mo <Yuezhang.Mo(a)sony.com> mainline inclusion from mainline-v6.10-rc2 commit 184fa506e392eb78364d9283c961217ff2c0617b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGB CVE: CVE-2024-53147 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In the case of the directory size is greater than or equal to the cluster size, if start_clu becomes an EOF cluster(an invalid cluster) due to file system corruption, then the directory entry where ei->hint_femp.eidx hint is outside the directory, resulting in an out-of-bounds access, which may cause further file system corruption. This commit adds a check for start_clu, if it is an invalid cluster, the file or directory will be treated as empty. Cc: stable(a)vger.kernel.org Signed-off-by: Yuezhang Mo <Yuezhang.Mo(a)sony.com> Co-developed-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Conflicts: fs/exfat/namei.c [Conflicts due to not merge 11a347fb6cef ("exfat: change to get file size from DataLength")] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/exfat/namei.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/fs/exfat/namei.c b/fs/exfat/namei.c index d62d961e278d..5b78b9ba417e 100644 --- a/fs/exfat/namei.c +++ b/fs/exfat/namei.c @@ -655,13 +655,19 @@ static int exfat_find(struct inode *dir, struct qstr *qname, info->type = exfat_get_entry_type(ep); info->attr = le16_to_cpu(ep->dentry.file.attr); info->size = le64_to_cpu(ep2->dentry.stream.valid_size); + + info->start_clu = le32_to_cpu(ep2->dentry.stream.start_clu); + if (!is_valid_cluster(sbi, info->start_clu) && info->size) { + exfat_warn(sb, "start_clu is invalid cluster(0x%x)", + info->start_clu); + info->size = 0; + } + if (info->size == 0) { info->flags = ALLOC_NO_FAT_CHAIN; info->start_clu = EXFAT_EOF_CLUSTER; } else { info->flags = ep2->dentry.stream.flags; - info->start_clu = - le32_to_cpu(ep2->dentry.stream.start_clu); } exfat_get_entry_time(sbi, &info->crtime, -- 2.39.2

2 1

[PATCH] ALSA: usb-audio: Fix out of bounds reads when finding clock sources
by Luo Gengkun 27 Dec '24

27 Dec '24

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.231 commit 45a92cbc88e4013bfed7fd2ccab3ade45f8e896b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGG CVE: CVE-2024-53150 Reference: https://git.kernel.org/stable/c/45a92cbc88e4013bfed7fd2ccab3ade45f8e896b -------------------------------- commit a3dd4d63eeb452cfb064a13862fb376ab108f6a6 upstream. The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check. Reported-by: Benoît Sevens <bsevens(a)google.com> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/20241121140613.3651-1-bsevens@google.com Link: https://patch.msgid.link/20241125144629.20757-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Benoît Sevens <bsevens(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- sound/usb/clock.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/sound/usb/clock.c b/sound/usb/clock.c index 95b019f15224..6ccea6d1727f 100644 --- a/sound/usb/clock.c +++ b/sound/usb/clock.c @@ -21,6 +21,10 @@ #include "clock.h" #include "quirks.h" +/* check whether the descriptor bLength has the minimal length */ +#define DESC_LENGTH_CHECK(p) \ + (p->bLength >= sizeof(*p)) + static void *find_uac_clock_desc(struct usb_host_interface *iface, int id, bool (*validator)(void *, int), u8 type) { @@ -38,36 +42,60 @@ static void *find_uac_clock_desc(struct usb_host_interface *iface, int id, static bool validate_clock_source_v2(void *p, int id) { struct uac_clock_source_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } static bool validate_clock_source_v3(void *p, int id) { struct uac3_clock_source_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } static bool validate_clock_selector_v2(void *p, int id) { struct uac_clock_selector_descriptor *cs = p; - return cs->bClockID == id; + if (!DESC_LENGTH_CHECK(cs)) + return false; + if (cs->bClockID != id) + return false; + /* additional length check for baCSourceID array (in bNrInPins size) + * and two more fields (which sizes depend on the protocol) + */ + return cs->bLength >= sizeof(*cs) + cs->bNrInPins + + 1 /* bmControls */ + 1 /* iClockSelector */; } static bool validate_clock_selector_v3(void *p, int id) { struct uac3_clock_selector_descriptor *cs = p; - return cs->bClockID == id; + if (!DESC_LENGTH_CHECK(cs)) + return false; + if (cs->bClockID != id) + return false; + /* additional length check for baCSourceID array (in bNrInPins size) + * and two more fields (which sizes depend on the protocol) + */ + return cs->bLength >= sizeof(*cs) + cs->bNrInPins + + 4 /* bmControls */ + 2 /* wCSelectorDescrStr */; } static bool validate_clock_multiplier_v2(void *p, int id) { struct uac_clock_multiplier_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } static bool validate_clock_multiplier_v3(void *p, int id) { struct uac3_clock_multiplier_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } -- 2.34.1

1 0

[PATCH] ALSA: usb-audio: Fix out of bounds reads when finding clock sources
by Luo Gengkun 27 Dec '24

27 Dec '24

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v6.6.64 commit 74cb86e1006c5437b1d90084d22018da30fddc77 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGG CVE: CVE-2024-53150 Reference: https://git.kernel.org/stable/c/74cb86e1006c5437b1d90084d22018da30fddc77 commit a3dd4d63eeb452cfb064a13862fb376ab108f6a6 upstream. The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check. Reported-by: Benoît Sevens <bsevens(a)google.com> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/20241121140613.3651-1-bsevens@google.com Link: https://patch.msgid.link/20241125144629.20757-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- sound/usb/clock.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/sound/usb/clock.c b/sound/usb/clock.c index a676ad093d18..f0f1e445cc56 100644 --- a/sound/usb/clock.c +++ b/sound/usb/clock.c @@ -36,6 +36,12 @@ union uac23_clock_multiplier_desc { struct uac_clock_multiplier_descriptor v3; }; +/* check whether the descriptor bLength has the minimal length */ +#define DESC_LENGTH_CHECK(p, proto) \ + ((proto) == UAC_VERSION_3 ? \ + ((p)->v3.bLength >= sizeof((p)->v3)) : \ + ((p)->v2.bLength >= sizeof((p)->v2))) + #define GET_VAL(p, proto, field) \ ((proto) == UAC_VERSION_3 ? (p)->v3.field : (p)->v2.field) @@ -58,6 +64,8 @@ static bool validate_clock_source(void *p, int id, int proto) { union uac23_clock_source_desc *cs = p; + if (!DESC_LENGTH_CHECK(cs, proto)) + return false; return GET_VAL(cs, proto, bClockID) == id; } @@ -65,13 +73,27 @@ static bool validate_clock_selector(void *p, int id, int proto) { union uac23_clock_selector_desc *cs = p; - return GET_VAL(cs, proto, bClockID) == id; + if (!DESC_LENGTH_CHECK(cs, proto)) + return false; + if (GET_VAL(cs, proto, bClockID) != id) + return false; + /* additional length check for baCSourceID array (in bNrInPins size) + * and two more fields (which sizes depend on the protocol) + */ + if (proto == UAC_VERSION_3) + return cs->v3.bLength >= sizeof(cs->v3) + cs->v3.bNrInPins + + 4 /* bmControls */ + 2 /* wCSelectorDescrStr */; + else + return cs->v2.bLength >= sizeof(cs->v2) + cs->v2.bNrInPins + + 1 /* bmControls */ + 1 /* iClockSelector */; } static bool validate_clock_multiplier(void *p, int id, int proto) { union uac23_clock_multiplier_desc *cs = p; + if (!DESC_LENGTH_CHECK(cs, proto)) + return false; return GET_VAL(cs, proto, bClockID) == id; } -- 2.34.1

1 0