- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 V1 0/4] add ebpf sched
by Cheng Yu 25 Nov '24

25 Nov '24

add ebpf sched Cheng Yu (1): sched/ebpf: Support task selection programmable Hui Tang (1): sched: Add kfunc to get cpu statistics Roman Gushchin (2): libbpf: add support for scheduler bpf programs bpftool: recognize scheduler programs include/linux/sched.h | 20 ++++ include/linux/sched_hook_defs.h | 4 + kernel/bpf/btf.c | 3 + kernel/sched/bpf_sched.c | 190 ++++++++++++++++++++++++++++++++ kernel/sched/fair.c | 14 +++ tools/lib/bpf/libbpf.c | 23 +++- tools/lib/bpf/libbpf.h | 2 + tools/lib/bpf/libbpf.map | 1 + 8 files changed, 256 insertions(+), 1 deletion(-) -- 2.25.1

2 5

[PATCH OLK-6.6] perf: Add PMCG platform information for HiSilicon HIP09A
by Yushan Wang 25 Nov '24

25 Nov '24

From: Qinxin Xia <xiaqinxin(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB5WVR CVE: NA ---------------------------------------------------------------------- Bugfix or Feature: Bugfix Description: HiSilicon HIP09A platforms using the same SMMU PMCG with HIP09 and thus suffers the same erratum. List them in the PMCG platform information list without introducing a new SMMU PMCG Model. Signed-off-by: Qinxin Xia <xiaqinxin(a)huawei.com> Signed-off-by: zhangqz <14294317+zhangqizhi3(a)user.noreply.gitee.com> --- Documentation/arch/arm64/silicon-errata.rst | 5 +++-- drivers/acpi/arm64/iort.c | 2 ++ 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/Documentation/arch/arm64/silicon-errata.rst b/Documentation/arch/arm64/silicon-errata.rst index ef58c86cd10b..bc1c1ba2fe56 100644 --- a/Documentation/arch/arm64/silicon-errata.rst +++ b/Documentation/arch/arm64/silicon-errata.rst @@ -202,8 +202,9 @@ stable kernels. +----------------+-----------------+-----------------+-----------------------------+ | Hisilicon | Hip08 SMMU PMCG | #162001800 | N/A | +----------------+-----------------+-----------------+-----------------------------+ -| Hisilicon | Hip{08,09,10,10C| #162001900 | N/A | -| | ,11} SMMU PMCG | | | +| Hisilicon | Hip{08,09,09A, | #162001900 | N/A | +| | 10,10C,11} | | | +| | SMMU PMCG | | | +----------------+-----------------+-----------------+-----------------------------+ | Hisilicon | LINXICORE9100 | #162100125 | HISILICON_ERRATUM_162100125 | +----------------+-----------------+-----------------+-----------------------------+ diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c index b1f483845bc0..c8d21e776342 100644 --- a/drivers/acpi/arm64/iort.c +++ b/drivers/acpi/arm64/iort.c @@ -1712,6 +1712,8 @@ static struct acpi_platform_list pmcg_plat_info[] __initdata = { /* HiSilicon Hip09 Platform */ {"HISI ", "HIP09 ", 0, ACPI_SIG_IORT, greater_than_or_equal, "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, + {"HISI ", "HIP09A ", 0, ACPI_SIG_IORT, greater_than_or_equal, + "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, /* HiSilicon Hip10/11 Platform uses the same SMMU IP with Hip09 */ {"HISI ", "HIP10 ", 0, ACPI_SIG_IORT, greater_than_or_equal, "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, -- 2.33.0

2 1

[PATCH openEuler-22.03-LTS-SP1] pinctrl: ocelot: fix system hang on level based interrupts
by Zeng Heng 25 Nov '24

25 Nov '24

From: Sergey Matsievskiy <matsievskiysv(a)gmail.com> mainline inclusion from mainline-v6.12-rc4 commit 93b8ddc54507a227087c60a0013ed833b6ae7d3c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YX2 CVE: CVE-2024-50196 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The current implementation only calls chained_irq_enter() and chained_irq_exit() if it detects pending interrupts. ``` for (i = 0; i < info->stride; i++) { uregmap_read(info->map, id_reg + 4 * i, &reg); if (!reg) continue; chained_irq_enter(parent_chip, desc); ``` However, in case of GPIO pin configured in level mode and the parent controller configured in edge mode, GPIO interrupt might be lowered by the hardware. In the result, if the interrupt is short enough, the parent interrupt is still pending while the GPIO interrupt is cleared; chained_irq_enter() never gets called and the system hangs trying to service the parent interrupt. Moving chained_irq_enter() and chained_irq_exit() outside the for loop ensures that they are called even when GPIO interrupt is lowered by the hardware. The similar code with chained_irq_enter() / chained_irq_exit() functions wrapping interrupt checking loop may be found in many other drivers: ``` grep -r -A 10 chained_irq_enter drivers/pinctrl ``` Cc: stable(a)vger.kernel.org Signed-off-by: Sergey Matsievskiy <matsievskiysv(a)gmail.com> Reviewed-by: Alexandre Belloni <alexandre.belloni(a)bootlin.com> Link: https://lore.kernel.org/20241012105743.12450-2-matsievskiysv@gmail.com Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Conflicts: drivers/pinctrl/pinctrl-ocelot.c [Fix context conflicts.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/pinctrl/pinctrl-ocelot.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/pinctrl/pinctrl-ocelot.c b/drivers/pinctrl/pinctrl-ocelot.c index a4a1b00f7f0d..e8ee2ade5293 100644 --- a/drivers/pinctrl/pinctrl-ocelot.c +++ b/drivers/pinctrl/pinctrl-ocelot.c @@ -1097,22 +1097,21 @@ static void ocelot_irq_handler(struct irq_desc *desc) unsigned int reg = 0, irq, i; unsigned long irqs; + chained_irq_enter(parent_chip, desc); + for (i = 0; i < info->stride; i++) { regmap_read(info->map, id_reg + 4 * i, &reg); if (!reg) continue; - chained_irq_enter(parent_chip, desc); - irqs = reg; for_each_set_bit(irq, &irqs, min(32U, info->desc->npins - 32 * i)) generic_handle_irq(irq_linear_revmap(chip->irq.domain, irq + 32 * i)); - - chained_irq_exit(parent_chip, desc); } + chained_irq_exit(parent_chip, desc); } static int ocelot_gpiochip_register(struct platform_device *pdev, -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 1291/1291] drivers/mmc/host/phytium-mci-pci.c:48:15: error: implicit declaration of function 'pcim_enable_device'; did you mean 'pci_enable_device'?
by kernel test robot 25 Nov '24

25 Nov '24

Hi Malloy, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 81e029d5dd0cae934243168eee37ef303ebcce38 commit: d65622e6edee11f7fcbd295bdb5aef86e12dfef3 [1291/1291] mmc: add support for Phytium MMC config: arm64-randconfig-003-20241113 (https://download.01.org/0day-ci/archive/20241125/202411251324.yzrltIBa-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241125/202411251324.yzrltIBa-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411251324.yzrltIBa-lkp@intel.com/ All error/warnings (new ones prefixed by >>): drivers/mmc/host/phytium-mci-pci.c: In function 'phytium_mci_pci_probe': >> drivers/mmc/host/phytium-mci-pci.c:48:15: error: implicit declaration of function 'pcim_enable_device'; did you mean 'pci_enable_device'? [-Werror=implicit-function-declaration] 48 | ret = pcim_enable_device(pdev); | ^~~~~~~~~~~~~~~~~~ | pci_enable_device >> drivers/mmc/host/phytium-mci-pci.c:61:9: error: implicit declaration of function 'pci_enable_msi'; did you mean 'pci_enable_sriov'? [-Werror=implicit-function-declaration] 61 | pci_enable_msi(pdev); | ^~~~~~~~~~~~~~ | pci_enable_sriov drivers/mmc/host/phytium-mci-pci.c: At top level: >> drivers/mmc/host/phytium-mci-pci.c:180:1: warning: data definition has no type or storage class 180 | module_pci_driver(phytium_mci_pci_driver); | ^~~~~~~~~~~~~~~~~ >> drivers/mmc/host/phytium-mci-pci.c:180:1: error: type defaults to 'int' in declaration of 'module_pci_driver' [-Werror=implicit-int] >> drivers/mmc/host/phytium-mci-pci.c:180:1: warning: parameter names (without types) in function declaration [-Wdeclaration-missing-parameter-type] >> drivers/mmc/host/phytium-mci-pci.c:171:26: warning: 'phytium_mci_pci_driver' defined but not used [-Wunused-variable] 171 | static struct pci_driver phytium_mci_pci_driver = { | ^~~~~~~~~~~~~~~~~~~~~~ cc1: some warnings being treated as errors vim +48 drivers/mmc/host/phytium-mci-pci.c 40 41 static int 42 phytium_mci_pci_probe(struct pci_dev *pdev, const struct pci_device_id *pid) 43 { 44 struct phytium_mci_host *host; 45 struct mmc_host *mmc; 46 int ret; 47 > 48 ret = pcim_enable_device(pdev); 49 50 if (ret) 51 return ret; 52 pci_set_master(pdev); 53 54 mmc = mmc_alloc_host(sizeof(struct phytium_mci_host), &pdev->dev); 55 56 if (!mmc) 57 return -ENOMEM; 58 59 host = mmc_priv(mmc); 60 > 61 pci_enable_msi(pdev); 62 63 host->irq = pdev->irq; 64 host->irq_flags = IRQF_SHARED; 65 host->dev = &pdev->dev; 66 ret = pcim_iomap_regions(pdev, 1 << PCI_BAR_NO, pci_name(pdev)); 67 68 if (ret) { 69 dev_err(&pdev->dev, "I/O memory remapping failed\n"); 70 goto host_free; 71 } 72 73 host->base = pcim_iomap_table(pdev)[PCI_BAR_NO]; 74 host->is_use_dma = 1; 75 host->is_device_x100 = 1; 76 77 if (pdev->devfn == 2) { 78 host->caps = emmc_caps; 79 host->caps2 = emmc_caps2; 80 } else { 81 host->caps = sd_caps; 82 host->caps2 = sd_caps2; 83 mmc->f_max = 25000000; /* stable frequency */ 84 } 85 86 host->mmc = mmc; 87 host->clk_rate = MCI_CLK; 88 89 dev_info(&pdev->dev, 90 "%s %d:[bar %d] addr:0x%llx size:0x%llx km:0x%llx devfn:%d\n", 91 __func__, __LINE__, PCI_BAR_NO, pci_resource_start(pdev, 0), 92 pci_resource_len(pdev, 0), (uint64_t)host->base, pdev->devfn); 93 94 dev_dbg(&pdev->dev, "%s %d:irq:0x%x\n", __func__, __LINE__, host->irq); 95 96 ret = phytium_mci_common_probe(host); 97 98 if (ret == MCI_REALEASE_MEM) { 99 ret = -ENOMEM; 100 goto release_mem; 101 } else if (ret) { 102 goto release; 103 } 104 pci_set_drvdata(pdev, mmc); 105 dev_info(&pdev->dev, 106 "%s %d: probe phytium mci successful.\n", __func__, __LINE__); 107 return 0; 108 109 release: 110 phytium_mci_deinit_hw(host); 111 release_mem: 112 113 if (host->dma.adma_table) { 114 dma_free_coherent(&pdev->dev, 115 MAX_BD_NUM * sizeof(struct phytium_adma2_64_desc), 116 host->dma.adma_table, host->dma.adma_addr); 117 } 118 host_free: 119 mmc_free_host(mmc); 120 pci_disable_device(pdev); 121 return ret; 122 } 123 124 static void phytium_mci_pci_remove(struct pci_dev *pdev) 125 { 126 struct phytium_mci_host *host; 127 struct mmc_host *mmc; 128 129 mmc = pci_get_drvdata(pdev); 130 if (!mmc) { 131 dev_info(&pdev->dev, 132 "%s %d: mmc is null.\n", __func__, __LINE__); 133 return; 134 } 135 host = mmc_priv(mmc); 136 if (!host) { 137 dev_info(&pdev->dev, 138 "%s %d: host is null.\n", __func__, __LINE__); 139 mmc_remove_host(mmc); 140 mmc_free_host(mmc); 141 return; 142 } 143 144 del_timer(&host->hotplug_timer); 145 146 mmc_remove_host(host->mmc); 147 148 if (host->dma.adma_table) { 149 dma_free_coherent(&pdev->dev, 150 MAX_BD_NUM * sizeof(struct phytium_adma2_64_desc), 151 host->dma.adma_table, host->dma.adma_addr); 152 } 153 phytium_mci_deinit_hw(host); 154 mmc_free_host(mmc); 155 pci_set_drvdata(pdev, NULL); 156 } 157 158 static const struct pci_device_id phytium_mci_pci_tbl[] = { 159 { 160 .vendor = 0x1DB7, 161 .device = 0xDC28, 162 .subvendor = PCI_ANY_ID, 163 .subdevice = PCI_ANY_ID, 164 .class = 0x5, 165 .class_mask = 0, 166 }, 167 {} 168 }; 169 MODULE_DEVICE_TABLE(pci, phytium_mci_pci_tbl); 170 > 171 static struct pci_driver phytium_mci_pci_driver = { 172 .name = "phytium-mci-pci", 173 .id_table = phytium_mci_pci_tbl, 174 .probe = phytium_mci_pci_probe, 175 .remove = phytium_mci_pci_remove, 176 .driver = { 177 .pm = &phytium_mci_dev_pm_ops, 178 } 179 }; > 180 module_pci_driver(phytium_mci_pci_driver); 181 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2415/2415] mm/memcontrol.c:5402:40: error: implicit declaration of function 'ksm_process_profit'
by kernel test robot 25 Nov '24

25 Nov '24

Hi Nanyong, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: c09bf9815abdd0805b9c0cd61353271d7ecf156f commit: 0f6fb3570be40b783d8c756d64297be1a8e3d2b3 [2415/2415] memcg: support ksm merge any mode per cgroup config: x86_64-buildonly-randconfig-004-20241111 (https://download.01.org/0day-ci/archive/20241125/202411251245.WgcEUBZC-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241125/202411251245.WgcEUBZC-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411251245.WgcEUBZC-lkp@intel.com/ All errors (new ones prefixed by >>): mm/memcontrol.c: In function 'memory_ksm_show': >> mm/memcontrol.c:5402:40: error: implicit declaration of function 'ksm_process_profit' [-Werror=implicit-function-declaration] 5402 | ksm_process_profits += ksm_process_profit(mm); | ^~~~~~~~~~~~~~~~~~ cc1: some warnings being treated as errors vim +/ksm_process_profit +5402 mm/memcontrol.c 5379 5380 static int memory_ksm_show(struct seq_file *m, void *v) 5381 { 5382 unsigned long ksm_merging_pages = 0; 5383 unsigned long ksm_rmap_items = 0; 5384 long ksm_process_profits = 0; 5385 unsigned int tasks = 0; 5386 struct task_struct *task; 5387 struct mm_struct *mm; 5388 struct css_task_iter it; 5389 struct mem_cgroup *memcg = mem_cgroup_from_seq(m); 5390 5391 css_task_iter_start(&memcg->css, CSS_TASK_ITER_PROCS, &it); 5392 while ((task = css_task_iter_next(&it))) { 5393 mm = get_task_mm(task); 5394 if (!mm) 5395 continue; 5396 5397 if (test_bit(MMF_VM_MERGE_ANY, &mm->flags)) 5398 tasks++; 5399 5400 ksm_rmap_items += mm->ksm_rmap_items; 5401 ksm_merging_pages += mm->ksm_merging_pages; > 5402 ksm_process_profits += ksm_process_profit(mm); 5403 mmput(mm); 5404 } 5405 css_task_iter_end(&it); 5406 5407 seq_printf(m, "merge any state: %d\n", READ_ONCE(memcg->ksm_merge_any)); 5408 seq_printf(m, "merge any tasks: %u\n", tasks); 5409 seq_printf(m, "ksm_rmap_items %lu\n", ksm_rmap_items); 5410 seq_printf(m, "ksm_merging_pages %lu\n", ksm_merging_pages); 5411 seq_printf(m, "ksm_process_profits %ld\n", ksm_process_profits); 5412 return 0; 5413 } 5414 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] pinctrl: ocelot: fix system hang on level based interrupts
by Zeng Heng 25 Nov '24

25 Nov '24

From: Sergey Matsievskiy <matsievskiysv(a)gmail.com> mainline inclusion from mainline-v6.12-rc4 commit 93b8ddc54507a227087c60a0013ed833b6ae7d3c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YX2 CVE: CVE-2024-50196 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The current implementation only calls chained_irq_enter() and chained_irq_exit() if it detects pending interrupts. ``` for (i = 0; i < info->stride; i++) { uregmap_read(info->map, id_reg + 4 * i, &reg); if (!reg) continue; chained_irq_enter(parent_chip, desc); ``` However, in case of GPIO pin configured in level mode and the parent controller configured in edge mode, GPIO interrupt might be lowered by the hardware. In the result, if the interrupt is short enough, the parent interrupt is still pending while the GPIO interrupt is cleared; chained_irq_enter() never gets called and the system hangs trying to service the parent interrupt. Moving chained_irq_enter() and chained_irq_exit() outside the for loop ensures that they are called even when GPIO interrupt is lowered by the hardware. The similar code with chained_irq_enter() / chained_irq_exit() functions wrapping interrupt checking loop may be found in many other drivers: ``` grep -r -A 10 chained_irq_enter drivers/pinctrl ``` Cc: stable(a)vger.kernel.org Signed-off-by: Sergey Matsievskiy <matsievskiysv(a)gmail.com> Reviewed-by: Alexandre Belloni <alexandre.belloni(a)bootlin.com> Link: https://lore.kernel.org/20241012105743.12450-2-matsievskiysv@gmail.com Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Conflicts: drivers/pinctrl/pinctrl-ocelot.c [Fix context conflicts.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/pinctrl/pinctrl-ocelot.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/pinctrl/pinctrl-ocelot.c b/drivers/pinctrl/pinctrl-ocelot.c index a4a1b00f7f0d..e8ee2ade5293 100644 --- a/drivers/pinctrl/pinctrl-ocelot.c +++ b/drivers/pinctrl/pinctrl-ocelot.c @@ -1097,22 +1097,21 @@ static void ocelot_irq_handler(struct irq_desc *desc) unsigned int reg = 0, irq, i; unsigned long irqs; + chained_irq_enter(parent_chip, desc); + for (i = 0; i < info->stride; i++) { regmap_read(info->map, id_reg + 4 * i, &reg); if (!reg) continue; - chained_irq_enter(parent_chip, desc); - irqs = reg; for_each_set_bit(irq, &irqs, min(32U, info->desc->npins - 32 * i)) generic_handle_irq(irq_linear_revmap(chip->irq.domain, irq + 32 * i)); - - chained_irq_exit(parent_chip, desc); } + chained_irq_exit(parent_chip, desc); } static int ocelot_gpiochip_register(struct platform_device *pdev, -- 2.25.1

2 1

[openeuler:OLK-6.6 1466/1466] loongson3-acpi-cpufreq.c:undefined reference to `acpi_processor_unregister_performance'
by kernel test robot 25 Nov '24

25 Nov '24

Hi liuyun, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: e2e6e833f0e931accd24012488ed312ed9f63150 commit: 47a0b6f372d7f05822d021f86b21a34fd2142225 [1466/1466] cpufreq: Add cpufreq driver for LoongArch config: loongarch-randconfig-r053-20241114 (https://download.01.org/0day-ci/archive/20241125/202411251114.dtutDKWn-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241125/202411251114.dtutDKWn-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411251114.dtutDKWn-lkp@intel.com/ All errors (new ones prefixed by >>): loongarch64-linux-ld: drivers/cpufreq/loongson3-acpi-cpufreq.o: in function `loongson3_cpufreq_cpu_exit': >> loongson3-acpi-cpufreq.c:(.text+0x5b4): undefined reference to `acpi_processor_unregister_performance' loongarch64-linux-ld: drivers/cpufreq/loongson3-acpi-cpufreq.o: in function `.L231': >> loongson3-acpi-cpufreq.c:(.text+0x1ba8): undefined reference to `acpi_processor_register_performance' loongarch64-linux-ld: drivers/cpufreq/loongson3-acpi-cpufreq.o: in function `.L276': loongson3-acpi-cpufreq.c:(.text+0x225c): undefined reference to `acpi_processor_unregister_performance' -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] media: av7110: fix a spectre vulnerability
by Li Huafei 25 Nov '24

25 Nov '24

From: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> mainline inclusion from mainline-v6.12-rc7 commit 458ea1c0be991573ec436aa0afa23baacfae101a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5AVC CVE: CVE-2024-50289 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As warned by smatch: drivers/staging/media/av7110/av7110_ca.c:270 dvb_ca_ioctl() warn: potential spectre issue 'av7110->ci_slot' [w] (local cap) There is a spectre-related vulnerability at the code. Fix it. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Conflicts: drivers/media/pci/ttpci/av7110.h drivers/media/pci/ttpci/av7110_ca.c drivers/staging/media/av7110/av7110.h drivers/staging/media/av7110/av7110_ca.c Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/media/pci/ttpci/av7110.h | 4 +++- drivers/media/pci/ttpci/av7110_ca.c | 26 ++++++++++++++++++-------- 2 files changed, 21 insertions(+), 9 deletions(-) diff --git a/drivers/media/pci/ttpci/av7110.h b/drivers/media/pci/ttpci/av7110.h index 809d938ae166..f77766008b97 100644 --- a/drivers/media/pci/ttpci/av7110.h +++ b/drivers/media/pci/ttpci/av7110.h @@ -86,6 +86,8 @@ struct infrared { u32 ir_config; }; +#define MAX_CI_SLOTS 2 + /* place to store all the necessary device information */ struct av7110 { @@ -166,7 +168,7 @@ struct av7110 { /* CA */ - struct ca_slot_info ci_slot[2]; + struct ca_slot_info ci_slot[MAX_CI_SLOTS]; enum av7110_video_mode vidmode; struct dmxdev dmxdev; diff --git a/drivers/media/pci/ttpci/av7110_ca.c b/drivers/media/pci/ttpci/av7110_ca.c index c1338e074a3d..7216365331a6 100644 --- a/drivers/media/pci/ttpci/av7110_ca.c +++ b/drivers/media/pci/ttpci/av7110_ca.c @@ -18,6 +18,7 @@ #include <linux/timer.h> #include <linux/poll.h> #include <linux/gfp.h> +#include <linux/nospec.h> #include "av7110.h" #include "av7110_hw.h" @@ -26,23 +27,28 @@ void CI_handle(struct av7110 *av7110, u8 *data, u16 len) { + unsigned slot_num; + dprintk(8, "av7110:%p\n",av7110); if (len < 3) return; switch (data[0]) { case CI_MSG_CI_INFO: - if (data[2] != 1 && data[2] != 2) + if (data[2] != 1 && data[2] != MAX_CI_SLOTS) break; + + slot_num = array_index_nospec(data[2] - 1, MAX_CI_SLOTS); + switch (data[1]) { case 0: - av7110->ci_slot[data[2] - 1].flags = 0; + av7110->ci_slot[slot_num].flags = 0; break; case 1: - av7110->ci_slot[data[2] - 1].flags |= CA_CI_MODULE_PRESENT; + av7110->ci_slot[slot_num].flags |= CA_CI_MODULE_PRESENT; break; case 2: - av7110->ci_slot[data[2] - 1].flags |= CA_CI_MODULE_READY; + av7110->ci_slot[slot_num].flags |= CA_CI_MODULE_READY; break; } break; @@ -264,15 +270,19 @@ static int dvb_ca_ioctl(struct file *file, unsigned int cmd, void *parg) case CA_GET_SLOT_INFO: { struct ca_slot_info *info=(struct ca_slot_info *)parg; + unsigned int slot_num; if (info->num < 0 || info->num > 1) { mutex_unlock(&av7110->ioctl_mutex); return -EINVAL; } - av7110->ci_slot[info->num].num = info->num; - av7110->ci_slot[info->num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ? - CA_CI_LINK : CA_CI; - memcpy(info, &av7110->ci_slot[info->num], sizeof(struct ca_slot_info)); + slot_num = array_index_nospec(info->num, MAX_CI_SLOTS); + + av7110->ci_slot[slot_num].num = info->num; + av7110->ci_slot[slot_num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ? + CA_CI_LINK : CA_CI; + memcpy(info, &av7110->ci_slot[slot_num], + sizeof(struct ca_slot_info)); break; } -- 2.25.1

2 1

[PATCH OLK-5.10] media: av7110: fix a spectre vulnerability
by Li Huafei 25 Nov '24

25 Nov '24

From: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> mainline inclusion from mainline-v6.12-rc7 commit 458ea1c0be991573ec436aa0afa23baacfae101a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5AVC CVE: CVE-2024-50289 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As warned by smatch: drivers/staging/media/av7110/av7110_ca.c:270 dvb_ca_ioctl() warn: potential spectre issue 'av7110->ci_slot' [w] (local cap) There is a spectre-related vulnerability at the code. Fix it. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Conflicts: drivers/media/pci/ttpci/av7110.h drivers/media/pci/ttpci/av7110_ca.c drivers/staging/media/av7110/av7110.h drivers/staging/media/av7110/av7110_ca.c Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/media/pci/ttpci/av7110.h | 4 +++- drivers/media/pci/ttpci/av7110_ca.c | 26 ++++++++++++++++++-------- 2 files changed, 21 insertions(+), 9 deletions(-) diff --git a/drivers/media/pci/ttpci/av7110.h b/drivers/media/pci/ttpci/av7110.h index 809d938ae166..f77766008b97 100644 --- a/drivers/media/pci/ttpci/av7110.h +++ b/drivers/media/pci/ttpci/av7110.h @@ -86,6 +86,8 @@ struct infrared { u32 ir_config; }; +#define MAX_CI_SLOTS 2 + /* place to store all the necessary device information */ struct av7110 { @@ -166,7 +168,7 @@ struct av7110 { /* CA */ - struct ca_slot_info ci_slot[2]; + struct ca_slot_info ci_slot[MAX_CI_SLOTS]; enum av7110_video_mode vidmode; struct dmxdev dmxdev; diff --git a/drivers/media/pci/ttpci/av7110_ca.c b/drivers/media/pci/ttpci/av7110_ca.c index c1338e074a3d..7216365331a6 100644 --- a/drivers/media/pci/ttpci/av7110_ca.c +++ b/drivers/media/pci/ttpci/av7110_ca.c @@ -18,6 +18,7 @@ #include <linux/timer.h> #include <linux/poll.h> #include <linux/gfp.h> +#include <linux/nospec.h> #include "av7110.h" #include "av7110_hw.h" @@ -26,23 +27,28 @@ void CI_handle(struct av7110 *av7110, u8 *data, u16 len) { + unsigned slot_num; + dprintk(8, "av7110:%p\n",av7110); if (len < 3) return; switch (data[0]) { case CI_MSG_CI_INFO: - if (data[2] != 1 && data[2] != 2) + if (data[2] != 1 && data[2] != MAX_CI_SLOTS) break; + + slot_num = array_index_nospec(data[2] - 1, MAX_CI_SLOTS); + switch (data[1]) { case 0: - av7110->ci_slot[data[2] - 1].flags = 0; + av7110->ci_slot[slot_num].flags = 0; break; case 1: - av7110->ci_slot[data[2] - 1].flags |= CA_CI_MODULE_PRESENT; + av7110->ci_slot[slot_num].flags |= CA_CI_MODULE_PRESENT; break; case 2: - av7110->ci_slot[data[2] - 1].flags |= CA_CI_MODULE_READY; + av7110->ci_slot[slot_num].flags |= CA_CI_MODULE_READY; break; } break; @@ -264,15 +270,19 @@ static int dvb_ca_ioctl(struct file *file, unsigned int cmd, void *parg) case CA_GET_SLOT_INFO: { struct ca_slot_info *info=(struct ca_slot_info *)parg; + unsigned int slot_num; if (info->num < 0 || info->num > 1) { mutex_unlock(&av7110->ioctl_mutex); return -EINVAL; } - av7110->ci_slot[info->num].num = info->num; - av7110->ci_slot[info->num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ? - CA_CI_LINK : CA_CI; - memcpy(info, &av7110->ci_slot[info->num], sizeof(struct ca_slot_info)); + slot_num = array_index_nospec(info->num, MAX_CI_SLOTS); + + av7110->ci_slot[slot_num].num = info->num; + av7110->ci_slot[slot_num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ? + CA_CI_LINK : CA_CI; + memcpy(info, &av7110->ci_slot[slot_num], + sizeof(struct ca_slot_info)); break; } -- 2.25.1

2 1

[PATCH OLK-6.6] media: av7110: fix a spectre vulnerability
by Li Huafei 25 Nov '24

25 Nov '24

From: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> mainline inclusion from mainline-v6.12-rc7 commit 458ea1c0be991573ec436aa0afa23baacfae101a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5AVC CVE: CVE-2024-50289 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As warned by smatch: drivers/staging/media/av7110/av7110_ca.c:270 dvb_ca_ioctl() warn: potential spectre issue 'av7110->ci_slot' [w] (local cap) There is a spectre-related vulnerability at the code. Fix it. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Conflicts: drivers/staging/media/av7110/av7110.h drivers/staging/media/av7110/av7110_ca.c [ Context conflict caused by unmerged commit f6ed8943fb06 ('media: av7110: coding style fixes: logging'). ] Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/staging/media/av7110/av7110.h | 4 +++- drivers/staging/media/av7110/av7110_ca.c | 26 ++++++++++++++++-------- 2 files changed, 21 insertions(+), 9 deletions(-) diff --git a/drivers/staging/media/av7110/av7110.h b/drivers/staging/media/av7110/av7110.h index 809d938ae166..f77766008b97 100644 --- a/drivers/staging/media/av7110/av7110.h +++ b/drivers/staging/media/av7110/av7110.h @@ -86,6 +86,8 @@ struct infrared { u32 ir_config; }; +#define MAX_CI_SLOTS 2 + /* place to store all the necessary device information */ struct av7110 { @@ -166,7 +168,7 @@ struct av7110 { /* CA */ - struct ca_slot_info ci_slot[2]; + struct ca_slot_info ci_slot[MAX_CI_SLOTS]; enum av7110_video_mode vidmode; struct dmxdev dmxdev; diff --git a/drivers/staging/media/av7110/av7110_ca.c b/drivers/staging/media/av7110/av7110_ca.c index c1338e074a3d..7216365331a6 100644 --- a/drivers/staging/media/av7110/av7110_ca.c +++ b/drivers/staging/media/av7110/av7110_ca.c @@ -18,6 +18,7 @@ #include <linux/timer.h> #include <linux/poll.h> #include <linux/gfp.h> +#include <linux/nospec.h> #include "av7110.h" #include "av7110_hw.h" @@ -26,23 +27,28 @@ void CI_handle(struct av7110 *av7110, u8 *data, u16 len) { + unsigned slot_num; + dprintk(8, "av7110:%p\n",av7110); if (len < 3) return; switch (data[0]) { case CI_MSG_CI_INFO: - if (data[2] != 1 && data[2] != 2) + if (data[2] != 1 && data[2] != MAX_CI_SLOTS) break; + + slot_num = array_index_nospec(data[2] - 1, MAX_CI_SLOTS); + switch (data[1]) { case 0: - av7110->ci_slot[data[2] - 1].flags = 0; + av7110->ci_slot[slot_num].flags = 0; break; case 1: - av7110->ci_slot[data[2] - 1].flags |= CA_CI_MODULE_PRESENT; + av7110->ci_slot[slot_num].flags |= CA_CI_MODULE_PRESENT; break; case 2: - av7110->ci_slot[data[2] - 1].flags |= CA_CI_MODULE_READY; + av7110->ci_slot[slot_num].flags |= CA_CI_MODULE_READY; break; } break; @@ -264,15 +270,19 @@ static int dvb_ca_ioctl(struct file *file, unsigned int cmd, void *parg) case CA_GET_SLOT_INFO: { struct ca_slot_info *info=(struct ca_slot_info *)parg; + unsigned int slot_num; if (info->num < 0 || info->num > 1) { mutex_unlock(&av7110->ioctl_mutex); return -EINVAL; } - av7110->ci_slot[info->num].num = info->num; - av7110->ci_slot[info->num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ? - CA_CI_LINK : CA_CI; - memcpy(info, &av7110->ci_slot[info->num], sizeof(struct ca_slot_info)); + slot_num = array_index_nospec(info->num, MAX_CI_SLOTS); + + av7110->ci_slot[slot_num].num = info->num; + av7110->ci_slot[slot_num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ? + CA_CI_LINK : CA_CI; + memcpy(info, &av7110->ci_slot[slot_num], + sizeof(struct ca_slot_info)); break; } -- 2.25.1

2 1