- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] NFSD: Never decrement pending_async_copies on error
by Li Lingfeng 28 Nov '24

28 Nov '24

From: Chuck Lever <chuck.lever(a)oracle.com> mainline inclusion from mainline-v6.12-rc6 commit 8286f8b622990194207df9ab852e0f87c60d35e9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KQU CVE: CVE-2024-53073 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- The error flow in nfsd4_copy() calls cleanup_async_copy(), which already decrements nn->pending_async_copies. Reported-by: Olga Kornievskaia <okorniev(a)redhat.com> Fixes: aadc3bbea163 ("NFSD: Limit the number of concurrent async COPY operations") Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Conflicts: fs/nfsd/nfs4proc.c [Commit 87689df69491("NFSD: Shrink size of struct nfsd4_copy") add the allocation of cp_src.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4proc.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index 0c209443f9be..96c4e2616b51 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -1532,10 +1532,8 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, refcount_set(&async_copy->refcount, 1); /* Arbitrary cap on number of pending async copy operations */ if (atomic_inc_return(&nn->pending_async_copies) > - (int)rqstp->rq_pool->sp_nrthreads) { - atomic_dec(&nn->pending_async_copies); + (int)rqstp->rq_pool->sp_nrthreads) goto out_err; - } if (!nfs4_init_copy_state(nn, copy)) goto out_err; memcpy(&copy->cp_res.cb_stateid, &copy->cp_stateid.stid, -- 2.31.1

2 1

[PATCH OLK-6.6] NFSD: Never decrement pending_async_copies on error
by Li Lingfeng 28 Nov '24

28 Nov '24

From: Chuck Lever <chuck.lever(a)oracle.com> mainline inclusion from mainline-v6.12-rc6 commit 8286f8b622990194207df9ab852e0f87c60d35e9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KQU CVE: CVE-2024-53073 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- The error flow in nfsd4_copy() calls cleanup_async_copy(), which already decrements nn->pending_async_copies. Reported-by: Olga Kornievskaia <okorniev(a)redhat.com> Fixes: aadc3bbea163 ("NFSD: Limit the number of concurrent async COPY operations") Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Conflicts: fs/nfsd/nfs4proc.c [Commit 8adb368675cf("[Backport] NFSD: Limit the number of concurrent async COPY operations") miss partial indent before "(int)rqstp->rq_pool->sp_nrthreads"] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4proc.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index 34d9931df6a4..b48856c0aa5a 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -1827,10 +1827,8 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, refcount_set(&async_copy->refcount, 1); /* Arbitrary cap on number of pending async copy operations */ if (atomic_inc_return(&nn->pending_async_copies) > - (int)rqstp->rq_pool->sp_nrthreads) { - atomic_dec(&nn->pending_async_copies); + (int)rqstp->rq_pool->sp_nrthreads) goto out_err; - } async_copy->cp_src = kmalloc(sizeof(*async_copy->cp_src), GFP_KERNEL); if (!async_copy->cp_src) goto out_err; -- 2.31.1

2 1

[openeuler:openEuler-1.0-LTS 1308/1308] lib/.tmp_idr.o: warning: objtool: missing symbol for section .text
by kernel test robot 28 Nov '24

28 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 897ce607838618bcd783a6493748dd11891683fd commit: eaab6483a9cc9c59427c23d4b45c9990d2888f78 [1308/1308] ida: don't use BUG_ON() for debugging config: x86_64-buildonly-randconfig-001-20241126 (https://download.01.org/0day-ci/archive/20241128/202411281203.h94fcnp9-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241128/202411281203.h94fcnp9-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411281203.h94fcnp9-lkp@intel.com/ All warnings (new ones prefixed by >>): >> lib/.tmp_idr.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/6] Script execution control
by Gu Bowen 28 Nov '24

28 Nov '24

Ensure that direct file execution (e.g. ./script.sh) and indirect file execution (e.g. sh script.sh) lead to the same result to support script protection. Gu Bowen (2): IMA support script execution check fix kabi breakage due to exec is_check Kees Cook (1): exec: Check __FMODE_EXEC instead of in_execve for LSMs Linus Torvalds (2): execve: open the executable file before doing anything else uselib: remove use of __FMODE_EXEC Mickaël Salaün (1): exec: Add a new AT_CHECK flag to execveat(2) fs/exec.c | 89 ++++++++++++++++++------------- include/linux/binfmts.h | 5 ++ include/linux/ima.h | 6 +++ include/uapi/linux/fcntl.h | 31 +++++++++++ kernel/audit.h | 1 + kernel/auditsc.c | 1 + security/apparmor/lsm.c | 4 +- security/integrity/ima/ima_main.c | 11 ++++ security/security.c | 19 ++++++- security/tomoyo/tomoyo.c | 3 +- 10 files changed, 130 insertions(+), 40 deletions(-) -- 2.25.1

2 7

[PATCH OLK-6.6] RDMA/hns: Fix accessing invalid dip_ctx during destroying QP
by Chengchang Tang 28 Nov '24

28 Nov '24

driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB7ASV ---------------------------------------------------------------------- If it fails to modify QP to RTR, dip_ctx will not be attached. And during detroying QP, the invalid dip_ctx pointer will be accessed. Fixes: 5da61758eb8f ("RDMA/hns: Fix different dgids mapping to the same dip_idx") Signed-off-by: Chengchang Tang <tangchengchang(a)huawei.com> Signed-off-by: Xinghai Cen <cenxinghai(a)h-partners.com> --- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c index 052b14835643..92d053a9471b 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c @@ -6039,6 +6039,9 @@ static void put_dip_ctx_idx(struct hns_roce_dev *hr_dev, { struct hns_roce_dip *hr_dip = hr_qp->dip; + if (!hr_dip) + return; + xa_lock(&hr_dev->qp_table.dip_xa); hr_dip->qp_cnt--; -- 2.33.0

2 1

[openeuler:OLK-6.6 1540/1540] vpu_drv.c:(.bss+0x10): multiple definition of `debug'; drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.o:bma_pci.c:(.bss+0x8): first defined here
by kernel test robot 28 Nov '24

28 Nov '24

Hi Huajingjing, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 4a0359af8c9d84ec3320a8a18f41c7fddf1f7a23 commit: f0db1bf5852542c46c16d0b305193069e265f769 [1540/1540] Huawei BMA: Adding Huawei BMA driver: host_edma_drv config: loongarch-allyesconfig (https://download.01.org/0day-ci/archive/20241128/202411281141.UreVXsMU-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241128/202411281141.UreVXsMU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411281141.UreVXsMU-lkp@intel.com/ All errors (new ones prefixed by >>): loongarch64-linux-ld: drivers/net/ethernet/mucse/rnp/rnp_mbx.o:(.data.rel.local+0x0): multiple definition of `mbx_ops_generic'; drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.o:(.data.rel.ro.local+0x0): first defined here loongarch64-linux-ld: drivers/net/ethernet/mucse/rnpm/rnpm_main.o: in function `.LANCHOR3': rnpm_main.c:(.bss+0x110): multiple definition of `mpe_pkt_version'; drivers/net/ethernet/mucse/rnp/rnp_main.o:rnp_main.c:(.bss+0x60): first defined here loongarch64-linux-ld: drivers/net/ethernet/mucse/rnpm/rnpm_main.o: in function `.LANCHOR3': rnpm_main.c:(.bss+0x114): multiple definition of `mpe_src_port'; drivers/net/ethernet/mucse/rnp/rnp_main.o:rnp_main.c:(.bss+0x64): first defined here loongarch64-linux-ld: drivers/net/ethernet/mucse/rnpm/rnpm_mbx.o:(.data.rel.local+0x0): multiple definition of `mbx_ops_generic'; drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.o:(.data.rel.ro.local+0x0): first defined here loongarch64-linux-ld: drivers/net/ethernet/mucse/rnpm/rnpm_pcs.o:(.data.rel.local+0x0): multiple definition of `pcs_ops_generic'; drivers/net/ethernet/mucse/rnp/rnp_pcs.o:(.data.rel.local+0x0): first defined here loongarch64-linux-ld: drivers/net/ethernet/mucse/rnpm/rnpm_ptp.o: in function `.LANCHOR1': rnpm_ptp.c:(.data.rel.ro.local+0x0): multiple definition of `mac_ptp'; drivers/net/ethernet/mucse/rnp/rnp_ptp.o:rnp_ptp.c:(.data.rel.ro.local+0x0): first defined here loongarch64-linux-ld: drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.o: in function `.LANCHOR7': rnpgbe_main.c:(.data.rel.ro+0x0): multiple definition of `rnp10_netdev_ops'; drivers/net/ethernet/mucse/rnp/rnp_main.o:rnp_main.c:(.data.rel.ro+0x0): first defined here loongarch64-linux-ld: drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx.o:(.data.rel.local+0x0): multiple definition of `mbx_ops_generic'; drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.o:(.data.rel.ro.local+0x0): first defined here loongarch64-linux-ld: drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.o: in function `mbx_cookie_zalloc': rnpgbe_mbx_fw.c:(.text+0x128): multiple definition of `mbx_cookie_zalloc'; drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.o:rnpm_mbx_fw.c:(.text+0x6a4): first defined here loongarch64-linux-ld: drivers/net/ethernet/mucse/rnpgbe/rnpgbe_sriov.o: in function `check_ari_mode': rnpgbe_sriov.c:(.text+0x2acc): multiple definition of `check_ari_mode'; drivers/net/ethernet/mucse/rnp/rnp_sriov.o:rnp_sriov.c:(.text+0x2af8): first defined here loongarch64-linux-ld: drivers/net/ethernet/mucse/rnpgbe/rnpgbe_ptp.o: in function `.LANCHOR1': rnpgbe_ptp.c:(.data.rel.ro.local+0x0): multiple definition of `mac_ptp'; drivers/net/ethernet/mucse/rnp/rnp_ptp.o:rnp_ptp.c:(.data.rel.ro.local+0x0): first defined here loongarch64-linux-ld: drivers/media/platform/amphion/vpu_drv.o: in function `.LANCHOR2': >> vpu_drv.c:(.bss+0x10): multiple definition of `debug'; drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.o:bma_pci.c:(.bss+0x8): first defined here -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] Fix SCHED_WARN_ON(cfs_rq->throttled_clock) in throttle_cfs_rq
by liukai 28 Nov '24

28 Nov '24

From: Wenyu Huang <huangwenyu5(a)huawei.com> Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB7FU1 -------------------------------- In enqueue_entity, it assigns rq_clock(rq) to a cfs_rq when this cfs_rq is throttled by QOS, which causes SCHED_WARN_ON(cfs_rq->throttled_clock) in throttle_cfs_rq. So we add a "cfs_rq->throttled != QOS_THROTTLED" check to avoid assign rq_clock to the cfs_rq throttled by QOS. Fixes: 926b9b0cd97e ("sched: Throttle qos cfs_rq when current cpu is running online task") Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- kernel/sched/fair.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 2bf8b64182c5..7835353a583b 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -5453,13 +5453,19 @@ enqueue_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags) if (!throttled_hierarchy(cfs_rq)) { list_add_leaf_cfs_rq(cfs_rq); } else { +#ifdef CONFIG_QOS_SCHED + if (cfs_rq->throttled != QOS_THROTTLED) { +#endif #ifdef CONFIG_CFS_BANDWIDTH - struct rq *rq = rq_of(cfs_rq); + struct rq *rq = rq_of(cfs_rq); - if (cfs_rq_throttled(cfs_rq) && !cfs_rq->throttled_clock) - cfs_rq->throttled_clock = rq_clock(rq); - if (!cfs_rq->throttled_clock_self) - cfs_rq->throttled_clock_self = rq_clock(rq); + if (cfs_rq_throttled(cfs_rq) && !cfs_rq->throttled_clock) + cfs_rq->throttled_clock = rq_clock(rq); + if (!cfs_rq->throttled_clock_self) + cfs_rq->throttled_clock_self = rq_clock(rq); +#endif +#ifdef CONFIG_QOS_SCHED + } #endif } } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 V1] drm/amd/display: Check link_index before accessing dc->links[]
by quzicheng 28 Nov '24

28 Nov '24

From: Zicheng Qu <quzicheng(a)huawei.com> mainline inclusion from mainline-v6.11 commit 8aa2864044b9d13e95fe224f32e808afbf79ecdf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9QT CVE: CVE-2024-46813 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [WHY & HOW] dc->links[] has max size of MAX_LINKS and NULL is return when trying to access with out-of-bound index. This fixes 3 OVERRUN and 1 RESOURCE_LEAK issues reported by Coverity. Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/core/dc_link_exports.c drivers/gpu/drm/amd/display/dc/dc_link.h [dc_get_link_at_index is in dc_link.h, not moved to dc_link_exports.c. MAX_LINKS not defined, use MAX_PIPES * 2 + 2.] Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dc_link.h | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/amd/display/dc/dc_link.h b/drivers/gpu/drm/amd/display/dc/dc_link.h index 266b93a705d5..1c110a7e159e 100644 --- a/drivers/gpu/drm/amd/display/dc/dc_link.h +++ b/drivers/gpu/drm/amd/display/dc/dc_link.h @@ -177,6 +177,9 @@ const struct dc_link_status *dc_link_get_status(const struct dc_link *dc_link); */ static inline struct dc_link *dc_get_link_at_index(struct dc *dc, uint32_t link_index) { + if (link_index >= MAX_PIPES * 2 + 2) + return NULL; + return dc->links[link_index]; } -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1308/1308] arch/x86/mm/.tmp_maccess.o: warning: objtool: missing symbol for section .text
by kernel test robot 28 Nov '24

28 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4f763890ac28e4d36527b22a830c5e95cae55470 commit: 22058d2bdaf6b0526395ceec2736c72c3b5f435a [1308/1308] uaccess: Add strict non-pagefault kernel-space read function config: x86_64-buildonly-randconfig-002-20241126 (https://download.01.org/0day-ci/archive/20241128/202411281042.al4D2CD2-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241128/202411281042.al4D2CD2-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411281042.al4D2CD2-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/x86/mm/.tmp_maccess.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 V1] drm/amd/display: Check link_index before accessing dc->links[]
by quzicheng 28 Nov '24

28 Nov '24

From: Alex Hung <alex.hung(a)amd.com> mainline inclusion from mainline-v6.11 commit 8aa2864044b9d13e95fe224f32e808afbf79ecdf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9QT CVE: CVE-2024-46813 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [WHY & HOW] dc->links[] has max size of MAX_LINKS and NULL is return when trying to access with out-of-bound index. This fixes 3 OVERRUN and 1 RESOURCE_LEAK issues reported by Coverity. Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/core/dc_link_exports.c drivers/gpu/drm/amd/display/dc/dc_link.h [dc_get_link_at_index is in dc_link.h, not moved to dc_link_exports.c. MAX_LINKS not defined, use MAX_PIPES * 2 + 2.] Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dc_link.h | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/amd/display/dc/dc_link.h b/drivers/gpu/drm/amd/display/dc/dc_link.h index 266b93a705d5..a00882f9cf60 100644 --- a/drivers/gpu/drm/amd/display/dc/dc_link.h +++ b/drivers/gpu/drm/amd/display/dc/dc_link.h @@ -177,6 +177,9 @@ const struct dc_link_status *dc_link_get_status(const struct dc_link *dc_link); */ static inline struct dc_link *dc_get_link_at_index(struct dc *dc, uint32_t link_index) { + if (link_index >= MAX_PIPES * 2 + 2) + return NULL; + return dc->links[link_index]; } -- 2.34.1

2 4