- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 0a813b20347c3788a30544ad2cec470b11cc197d
by kernel test robot 18 Nov '24

18 Nov '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 0a813b20347c3788a30544ad2cec470b11cc197d !13274 CVE-2024-50117 Unverified Error/Warning (likely false positive, kindly check if interested): drivers/usb/typec/tcpm.c:1864:32: sparse: sparse: restricted __le16 degrades to integer Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- arm64-allnoconfig | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- arm64-defconfig | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- arm64-randconfig-001-20241118 | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- arm64-randconfig-002-20241118 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | `-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount |-- arm64-randconfig-003-20241118 | |-- drivers-nvme-host-core.c:error:compat_uptr_t-undeclared-(first-use-in-this-function) | |-- drivers-nvme-host-core.c:error:expected-before-ptrval | |-- fs-ext4-inode.c:warning:unused-variable-sbi | |-- include-linux-uaccess.h:warning:accm-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:conf-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:config-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ctl-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:dd-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ep_ref-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:f-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ioc_data-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ioctl_header-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:karg-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:kbuf-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:key-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:mqstat-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:n-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:qd-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:qos-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:sa-may-be-used-uninitialized | `-- include-linux-uaccess.h:warning:stmpconf-may-be-used-uninitialized |-- arm64-randconfig-004-20241118 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-iommu-arm-smmu-v3.c:error:CONFIG_CMA_ALIGNMENT-undeclared-(first-use-in-this-function) | |-- drivers-nvme-host-core.c:error:compat_uptr_t-undeclared-(first-use-in-this-function) | |-- drivers-nvme-host-core.c:error:expected-before-ptrval | |-- fs-ext4-inode.c:warning:unused-variable-sbi | `-- include-linux-kernel.h:error:first-argument-to-__builtin_choose_expr-not-a-constant |-- x86_64-allyesconfig | |-- drivers-net-ethernet-stmicro-stmmac-dwmac-phytium.c:error:incompatible-pointer-to-integer-conversion-returning-void-from-a-function-with-result-type-int | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-buildonly-randconfig-001-20241118 | |-- drivers-fpga-dfl.o:warning:objtool:build_info_commit_dev:unreachable-instruction | |-- fs-aio.o:warning:objtool:aio_nr_sub:unreachable-instruction | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-buildonly-randconfig-002-20241118 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-buildonly-randconfig-003-20241118 | |-- drivers-mfd-madera-core.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-mtd-mtdpart.o:warning:objtool:missing-symbol-for-section-.text.unlikely | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-buildonly-randconfig-004-20241117 | |-- drivers-media-i2c-ak7375.o:warning:objtool:missing-symbol-for-section-.init.text | `-- sound-soc-codecs-es7241.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-004-20241118 | |-- drivers-gpu-drm-nouveau-nvkm-subdev-bios-dp.o:warning:objtool:missing-symbol-for-section-.text | `-- drivers-mtd-nand-bbt.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-005-20241117 | |-- drivers-media-i2c-ak7375.o:warning:objtool:missing-symbol-for-section-.exit.text | `-- drivers-media-i2c-dw9807-vcm.o:warning:objtool:missing-symbol-for-section-.exit.text |-- x86_64-buildonly-randconfig-005-20241118 | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount-Werror-Wimplicit-function-declaration | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-buildonly-randconfig-006-20241118 | |-- block-blk-mq-debugfs-zoned.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gnss-core.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-gpu-drm-bridge-cdns-dsi.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-gpu-drm-bridge-thc63lvd1024.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-gpu-drm-i2c-tda9950.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-hid-hid-redragon.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-afe-iio-rescale.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-leds-leds-cr0014114.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-leds-leds-sc27xx-bltc.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-dvb-frontends-dvb-pll.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-scsi-ufs-ufs-hisi.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-spi-spi-uniphier.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-usb-dwc3-debugfs.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-usb-dwc3-dwc3-qcom.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-usb-host-xhci-histb.o:warning:objtool:missing-symbol-for-section-.init.text | |-- fs-ext4-inode.c:warning:unused-variable-sbi | |-- fs-gfs2-bmap.c:warning:lblock-may-be-used-uninitialized | |-- fs-nilfs2-btree.c:warning:bh-may-be-used-uninitialized | `-- security-integrity-ima-ima_crypto.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-defconfig | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-kexec | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-001-20241118 | `-- arch-x86-events-zhaoxin-core.c:error:redefinition-of-zhaoxin_pmu_init |-- x86_64-randconfig-003-20241118 | |-- drivers-gpu-drm-nouveau-nvkm-subdev-clk-nv50.o:warning:objtool:read_pll_ref:can-t-find-switch-jump-table | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-005-20241118 | |-- arch-x86-events-zhaoxin-core.c:error:redefinition-of-zhaoxin_pmu_init | |-- drivers-gpu-drm-amd-amdgpu-amdgpu_ids.o:warning:objtool:amdgpu_vmid_grab:unreachable-instruction | |-- drivers-usb-host-ehci-hcd.o:warning:objtool:ehci_endpoint_disable:unreachable-instruction | `-- fs-debugfs-file.o:warning:objtool:full_proxy_open:unreachable-instruction |-- x86_64-randconfig-006-20241118 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-011-20241118 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-012-20241118 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-014-20241118 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-015-20241118 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-071-20241118 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-072-20241118 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-073-20241118 | |-- arch-x86-events-zhaoxin-core.c:error:redefinition-of-zhaoxin_pmu_init | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-075-20241118 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-076-20241118 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-123-20241117 | |-- drivers-gpu-drm-amd-amdkfd-kfd_int_process_v9.c:sparse:sparse:cast-to-restricted-__le32 | `-- drivers-usb-typec-tcpm.c:sparse:sparse:restricted-__le16-degrades-to-integer |-- x86_64-randconfig-161-20241118 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-rhel-9.4 | |-- drivers-net-can-usb-kvaser_usb-kvaser_usb_hydra.c:warning:new_state-may-be-used-uninitialized | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-rhel-9.4-func | `-- fs-ext4-inode.c:warning:unused-variable-sbi `-- x86_64-rhel-9.4-kselftests `-- fs-ext4-inode.c:warning:unused-variable-sbi elapsed time: 721m configs tested: 36 configs skipped: 139 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20241118 gcc-14.2.0 arm64 randconfig-002-20241118 gcc-14.2.0 arm64 randconfig-003-20241118 gcc-14.2.0 arm64 randconfig-004-20241118 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241118 clang-19 x86_64 buildonly-randconfig-002-20241118 clang-19 x86_64 buildonly-randconfig-003-20241118 gcc-12 x86_64 buildonly-randconfig-004-20241118 clang-19 x86_64 buildonly-randconfig-005-20241118 clang-19 x86_64 buildonly-randconfig-006-20241118 gcc-12 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 randconfig-001-20241118 clang-19 x86_64 randconfig-002-20241118 clang-19 x86_64 randconfig-003-20241118 clang-19 x86_64 randconfig-004-20241118 clang-19 x86_64 randconfig-005-20241118 clang-19 x86_64 randconfig-006-20241118 clang-19 x86_64 randconfig-011-20241118 gcc-12 x86_64 randconfig-012-20241118 clang-19 x86_64 randconfig-013-20241118 gcc-12 x86_64 randconfig-014-20241118 clang-19 x86_64 randconfig-015-20241118 clang-19 x86_64 randconfig-016-20241118 gcc-12 x86_64 randconfig-071-20241118 gcc-12 x86_64 randconfig-072-20241118 gcc-12 x86_64 randconfig-073-20241118 gcc-11 x86_64 randconfig-074-20241118 gcc-12 x86_64 randconfig-075-20241118 gcc-12 x86_64 randconfig-076-20241118 gcc-12 x86_64 rhel-9.4 gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 v2 0/2] fix CVE-2024-50141
by Xiangwei Li 18 Nov '24

18 Nov '24

Dan Carpenter (1): ACPI: PRM: Clean up guid type in struct prm_handler_info Koba Ko (1): ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context drivers/acpi/prmt.c | 29 +++++++++++++++++++++++------ 1 file changed, 23 insertions(+), 6 deletions(-) -- 2.25.1

2 3

[OLK-5.10 0/2] fix CVE-2024-50141
by Xiangwei Li 18 Nov '24

18 Nov '24

Dan Carpenter (1): ACPI: PRM: Clean up guid type in struct prm_handler_info Koba Ko (1): ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context drivers/acpi/prmt.c | 29 +++++++++++++++++++++++------ 1 file changed, 23 insertions(+), 6 deletions(-) -- 2.25.1

1 2

[openeuler:OLK-6.6 1474/1474] drivers/gpu/drm/amd/amdgpu/../display/dmub/src/dmub_srv.c:484:77: sparse: sparse: Using plain integer as NULL pointer
by kernel test robot 18 Nov '24

18 Nov '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 8a039651010897592567f5751c4e706ab794e9c0 commit: 2991f29868ddf9a3dd2dd132323ae2a4558b7bb0 [1474/1474] drm/amd/display: Change the DMCUB mailbox memory location from FB to inbox config: x86_64-randconfig-121-20241118 (https://download.01.org/0day-ci/archive/20241118/202411182104.9oMPXZuE-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241118/202411182104.9oMPXZuE-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411182104.9oMPXZuE-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/gpu/drm/amd/amdgpu/../display/dmub/src/dmub_srv.c:484:77: sparse: sparse: Using plain integer as NULL pointer vim +484 drivers/gpu/drm/amd/amdgpu/../display/dmub/src/dmub_srv.c 457 458 enum dmub_status dmub_srv_calc_mem_info(struct dmub_srv *dmub, 459 const struct dmub_srv_memory_params *params, 460 struct dmub_srv_fb_info *out) 461 { 462 uint8_t *cpu_base; 463 uint64_t gpu_base; 464 uint32_t i; 465 466 if (!dmub->sw_init) 467 return DMUB_STATUS_INVALID; 468 469 memset(out, 0, sizeof(*out)); 470 471 if (params->region_info->num_regions != DMUB_NUM_WINDOWS) 472 return DMUB_STATUS_INVALID; 473 474 cpu_base = (uint8_t *)params->cpu_fb_addr; 475 gpu_base = params->gpu_fb_addr; 476 477 for (i = 0; i < DMUB_NUM_WINDOWS; ++i) { 478 const struct dmub_region *reg = 479 &params->region_info->regions[i]; 480 481 out->fb[i].cpu_addr = cpu_base + reg->base; 482 out->fb[i].gpu_addr = gpu_base + reg->base; 483 > 484 if (i == DMUB_WINDOW_4_MAILBOX && params->cpu_inbox_addr != 0) { 485 out->fb[i].cpu_addr = (uint8_t *)params->cpu_inbox_addr + reg->base; 486 out->fb[i].gpu_addr = params->gpu_inbox_addr + reg->base; 487 } 488 489 out->fb[i].size = reg->top - reg->base; 490 } 491 492 out->num_fb = DMUB_NUM_WINDOWS; 493 494 return DMUB_STATUS_OK; 495 } 496 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2024-50195
by Gu Bowen 18 Nov '24

18 Nov '24

Jinjie Ruan (2): posix-clock: Fix missing timespec64 check in pc_clock_settime() posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime() kernel/time/posix-clock.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.25.1

2 3

[PATCH OLK-6.6] RDMA/bnxt_re: Avoid CPU lockups due fifo occupancy check loop
by Zhang Changzhong 18 Nov '24

18 Nov '24

From: Selvin Xavier <selvin.xavier(a)broadcom.com> mainline inclusion from mainline-v6.12-rc4 commit 8be3e5b0c96beeefe9d5486b96575d104d3e7d17 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2SU7 CVE: CVE-2024-50157 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Driver waits indefinitely for the fifo occupancy to go below a threshold as soon as the pacing interrupt is received. This can cause soft lockup on one of the processors, if the rate of DB is very high. Add a loop count for FPGA and exit the __wait_for_fifo_occupancy_below_th if the loop is taking more time. Pacing will be continuing until the occupancy is below the threshold. This is ensured by the checks in bnxt_re_pacing_timer_exp and further scheduling the work for pacing based on the fifo occupancy. Fixes: 2ad4e6303a6d ("RDMA/bnxt_re: Implement doorbell pacing algorithm") Link: https://patch.msgid.link/r/1728373302-19530-7-git-send-email-selvin.xavier@… Reviewed-by: Kalesh AP <kalesh-anakkur.purayil(a)broadcom.com> Reviewed-by: Chandramohan Akula <chandramohan.akula(a)broadcom.com> Signed-off-by: Selvin Xavier <selvin.xavier(a)broadcom.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Conflicts: drivers/infiniband/hw/bnxt_re/main.c [24943dcdc156 ("RDMA/bnxt_re: Disable doorbell moderation if hardware register read fails") not merged] Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/infiniband/hw/bnxt_re/main.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c index 0373d0e..8b032a2 100644 --- a/drivers/infiniband/hw/bnxt_re/main.c +++ b/drivers/infiniband/hw/bnxt_re/main.c @@ -484,6 +484,8 @@ static void bnxt_re_set_default_pacing_data(struct bnxt_re_dev *rdev) static void __wait_for_fifo_occupancy_below_th(struct bnxt_re_dev *rdev) { + struct bnxt_qplib_db_pacing_data *pacing_data = rdev->qplib_res.pacing_data; + u32 retry_fifo_check = 1000; u32 read_val, fifo_occup; /* loop shouldn't run infintely as the occupancy usually goes @@ -500,6 +502,14 @@ static void __wait_for_fifo_occupancy_below_th(struct bnxt_re_dev *rdev) if (fifo_occup < rdev->qplib_res.pacing_data->pacing_th) break; + if (!retry_fifo_check--) { + dev_info_once(rdev_to_dev(rdev), + "%s: fifo_occup = 0x%xfifo_max_depth = 0x%x pacing_th = 0x%x\n", + __func__, fifo_occup, pacing_data->fifo_max_depth, + pacing_data->pacing_th); + break; + } + } } -- 2.9.5

2 1

[PATCH OLK-6.6] ima: fix a compilation error with ima_bprm_creds_for_exec()
by Gu Bowen 18 Nov '24

18 Nov '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAZ996 CVE: NA ---------------------------------------------------------------------- The new feature script execution check has added a new security function ima_bprm_creds_for_exe, which causes a compilation error when ima is not enabled, we fix it. Fixes: b89997c5e3ff ("IMA support script execution check") Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- include/linux/ima.h | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/include/linux/ima.h b/include/linux/ima.h index 76d0f71d7955..eb119cd62f02 100644 --- a/include/linux/ima.h +++ b/include/linux/ima.h @@ -63,6 +63,11 @@ static inline int ima_bprm_check(struct linux_binprm *bprm) return 0; } +static inline int ima_bprm_creds_for_exec(struct linux_binprm *bprm) +{ + return 0; +} + static inline int ima_file_check(struct file *file, int mask) { return 0; -- 2.25.1

2 1

[PATCH OLK-5.10] bpf, arm64: Fix address emission with tag-based KASAN enabled
by Tengda Wu 18 Nov '24

18 Nov '24

From: Peter Collingbourne <pcc(a)google.com> mainline inclusion from mainline-v6.12-rc5 commit a552e2ef5fd1a6c78267cd4ec5a9b49aa11bbb1c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YVC CVE: CVE-2024-50203 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When BPF_TRAMP_F_CALL_ORIG is enabled, the address of a bpf_tramp_image struct on the stack is passed during the size calculation pass and an address on the heap is passed during code generation. This may cause a heap buffer overflow if the heap address is tagged because emit_a64_mov_i64() will emit longer code than it did during the size calculation pass. The same problem could occur without tag-based KASAN if one of the 16-bit words of the stack address happened to be all-ones during the size calculation pass. Fix the problem by assuming the worst case (4 instructions) when calculating the size of the bpf_tramp_image address emission. Fixes: 19d3c179a377 ("bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG") Signed-off-by: Peter Collingbourne <pcc(a)google.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Xu Kuohai <xukuohai(a)huawei.com> Link: https://linux-review.googlesource.com/id/I1496f2bc24fba7a1d492e16e2b94cf437… Link: https://lore.kernel.org/bpf/20241018221644.3240898-1-pcc@google.com Conflicts: arch/arm64/net/bpf_jit_comp.c [This conflict arises from the fact that the previous patch, 2a5ab77af7f9 ("bpf, arm64: Add bpf trampoline for arm64"), made some minor adjustments for version 5.10 without fully aligning with the community] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- arch/arm64/net/bpf_jit_comp.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c index adab5f03a306..af5760c0d2e7 100644 --- a/arch/arm64/net/bpf_jit_comp.c +++ b/arch/arm64/net/bpf_jit_comp.c @@ -1647,7 +1647,11 @@ static int prepare_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im, emit(A64_STR64I(A64_R(19), A64_SP, regs_off), ctx); if (flags & BPF_TRAMP_F_CALL_ORIG) { - emit_a64_mov_i64(A64_R(0), (const u64)im, ctx); + /* for the first pass, assume the worst case */ + if (!ctx->image) + ctx->idx += 4; + else + emit_a64_mov_i64(A64_R(0), (const u64)im, ctx); emit_call((const u64)__bpf_tramp_enter, ctx); } @@ -1688,7 +1692,11 @@ static int prepare_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im, if (flags & BPF_TRAMP_F_CALL_ORIG) { im->ip_epilogue = ctx->image + ctx->idx; - emit_a64_mov_i64(A64_R(0), (const u64)im, ctx); + /* for the first pass, assume the worst case */ + if (!ctx->image) + ctx->idx += 4; + else + emit_a64_mov_i64(A64_R(0), (const u64)im, ctx); emit_call((const u64)__bpf_tramp_exit, ctx); } -- 2.34.1

2 1

[PATCH OLK-6.6] bpf, arm64: Fix address emission with tag-based KASAN enabled
by Tengda Wu 18 Nov '24

18 Nov '24

From: Peter Collingbourne <pcc(a)google.com> mainline inclusion from mainline-v6.12-rc5 commit a552e2ef5fd1a6c78267cd4ec5a9b49aa11bbb1c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YVC CVE: CVE-2024-50203 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When BPF_TRAMP_F_CALL_ORIG is enabled, the address of a bpf_tramp_image struct on the stack is passed during the size calculation pass and an address on the heap is passed during code generation. This may cause a heap buffer overflow if the heap address is tagged because emit_a64_mov_i64() will emit longer code than it did during the size calculation pass. The same problem could occur without tag-based KASAN if one of the 16-bit words of the stack address happened to be all-ones during the size calculation pass. Fix the problem by assuming the worst case (4 instructions) when calculating the size of the bpf_tramp_image address emission. Fixes: 19d3c179a377 ("bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG") Signed-off-by: Peter Collingbourne <pcc(a)google.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Xu Kuohai <xukuohai(a)huawei.com> Link: https://linux-review.googlesource.com/id/I1496f2bc24fba7a1d492e16e2b94cf437… Link: https://lore.kernel.org/bpf/20241018221644.3240898-1-pcc@google.com Conflicts: arch/arm64/net/bpf_jit_comp.c [This conflict is due to us not merging a cache optimization commit 96b0f5addc7a ('arm64, bpf: Use bpf_prog_pack for arm64 bpf trampoline')] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- arch/arm64/net/bpf_jit_comp.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c index d6f4aebbad69..76ae4a3131ba 100644 --- a/arch/arm64/net/bpf_jit_comp.c +++ b/arch/arm64/net/bpf_jit_comp.c @@ -1949,7 +1949,11 @@ static int prepare_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im, emit(A64_STR64I(A64_R(20), A64_SP, regs_off + 8), ctx); if (flags & BPF_TRAMP_F_CALL_ORIG) { - emit_a64_mov_i64(A64_R(0), (const u64)im, ctx); + /* for the first pass, assume the worst case */ + if (!ctx->image) + ctx->idx += 4; + else + emit_a64_mov_i64(A64_R(0), (const u64)im, ctx); emit_call((const u64)__bpf_tramp_enter, ctx); } @@ -1993,7 +1997,11 @@ static int prepare_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im, if (flags & BPF_TRAMP_F_CALL_ORIG) { im->ip_epilogue = ctx->image + ctx->idx; - emit_a64_mov_i64(A64_R(0), (const u64)im, ctx); + /* for the first pass, assume the worst case */ + if (!ctx->image) + ctx->idx += 4; + else + emit_a64_mov_i64(A64_R(0), (const u64)im, ctx); emit_call((const u64)__bpf_tramp_exit, ctx); } -- 2.34.1

2 1

[PATCH OLK-6.6] sched/numa: Fix the potential null pointer dereference in task_numa_work()
by liukai 18 Nov '24

18 Nov '24

From: Shawn Wang <shawnwang(a)linux.alibaba.com> stable inclusion from stable-v6.6.60 commit ade91f6e9848b370add44d89c976e070ccb492ef category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37AS CVE: CVE-2024-50223 -------------------------------- Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… [ Upstream commit 9c70b2a33cd2aa6a5a59c5523ef053bd42265209 ] When running stress-ng-vm-segv test, we found a null pointer dereference error in task_numa_work(). Here is the backtrace: [323676.066985] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 ...... [323676.067108] CPU: 35 PID: 2694524 Comm: stress-ng-vm-se ...... [323676.067113] pstate: 23401009 (nzCv daif +PAN -UAO +TCO +DIT +SSBS BTYPE=--) [323676.067115] pc : vma_migratable+0x1c/0xd0 [323676.067122] lr : task_numa_work+0x1ec/0x4e0 [323676.067127] sp : ffff8000ada73d20 [323676.067128] x29: ffff8000ada73d20 x28: 0000000000000000 x27: 000000003e89f010 [323676.067130] x26: 0000000000080000 x25: ffff800081b5c0d8 x24: ffff800081b27000 [323676.067133] x23: 0000000000010000 x22: 0000000104d18cc0 x21: ffff0009f7158000 [323676.067135] x20: 0000000000000000 x19: 0000000000000000 x18: ffff8000ada73db8 [323676.067138] x17: 0001400000000000 x16: ffff800080df40b0 x15: 0000000000000035 [323676.067140] x14: ffff8000ada73cc8 x13: 1fffe0017cc72001 x12: ffff8000ada73cc8 [323676.067142] x11: ffff80008001160c x10: ffff000be639000c x9 : ffff8000800f4ba4 [323676.067145] x8 : ffff000810375000 x7 : ffff8000ada73974 x6 : 0000000000000001 [323676.067147] x5 : 0068000b33e26707 x4 : 0000000000000001 x3 : ffff0009f7158000 [323676.067149] x2 : 0000000000000041 x1 : 0000000000004400 x0 : 0000000000000000 [323676.067152] Call trace: [323676.067153] vma_migratable+0x1c/0xd0 [323676.067155] task_numa_work+0x1ec/0x4e0 [323676.067157] task_work_run+0x78/0xd8 [323676.067161] do_notify_resume+0x1ec/0x290 [323676.067163] el0_svc+0x150/0x160 [323676.067167] el0t_64_sync_handler+0xf8/0x128 [323676.067170] el0t_64_sync+0x17c/0x180 [323676.067173] Code: d2888001 910003fd f9000bf3 aa0003f3 (f9401000) [323676.067177] SMP: stopping secondary CPUs [323676.070184] Starting crashdump kernel... stress-ng-vm-segv in stress-ng is used to stress test the SIGSEGV error handling function of the system, which tries to cause a SIGSEGV error on return from unmapping the whole address space of the child process. Normally this program will not cause kernel crashes. But before the munmap system call returns to user mode, a potential task_numa_work() for numa balancing could be added and executed. In this scenario, since the child process has no vma after munmap, the vma_next() in task_numa_work() will return a null pointer even if the vma iterator restarts from 0. Recheck the vma pointer before dereferencing it in task_numa_work(). Fixes: 214dbc428137 ("sched: convert to vma iterator") Signed-off-by: Shawn Wang <shawnwang(a)linux.alibaba.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Cc: stable(a)vger.kernel.org # v6.2+ Link: https://lkml.kernel.org/r/20241025022208.125527-1-shawnwang@linux.alibaba.c… Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- kernel/sched/fair.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index d5ae744deb39..f1cd57e70f1f 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -3413,7 +3413,7 @@ static void task_numa_work(struct callback_head *work) vma = vma_next(&vmi); } - do { + for (; vma; vma = vma_next(&vmi)) { if (!vma_migratable(vma) || !vma_policy_mof(vma) || is_vm_hugetlb_page(vma) || (vma->vm_flags & VM_MIXEDMAP)) { continue; @@ -3499,7 +3499,7 @@ static void task_numa_work(struct callback_head *work) cond_resched(); } while (end != vma->vm_end); - } for_each_vma(vmi, vma); + } out: /* -- 2.34.1

2 1