- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] drm/amdgpu: fix usage slab after free
by Cui GaoSheng 18 Feb '25

18 Feb '25

From: Vitaly Prosyak <vitaly.prosyak(a)amd.com> stable inclusion from stable-v6.6.64 commit 3990ef742c064e22189b954522930db04fc6b1a7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMA CVE: CVE-2024-56551 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b61badd20b443eabe132314669bb51a263982e5c upstream. [ +0.000021] BUG: KASAN: slab-use-after-free in drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched] [ +0.000027] Read of size 8 at addr ffff8881b8605f88 by task amd_pci_unplug/2147 [ +0.000023] CPU: 6 PID: 2147 Comm: amd_pci_unplug Not tainted 6.10.0+ #1 [ +0.000016] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020 [ +0.000016] Call Trace: [ +0.000008] <TASK> [ +0.000009] dump_stack_lvl+0x76/0xa0 [ +0.000017] print_report+0xce/0x5f0 [ +0.000017] ? drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched] [ +0.000019] ? srso_return_thunk+0x5/0x5f [ +0.000015] ? kasan_complete_mode_report_info+0x72/0x200 [ +0.000016] ? drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched] [ +0.000019] kasan_report+0xbe/0x110 [ +0.000015] ? drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched] [ +0.000023] __asan_report_load8_noabort+0x14/0x30 [ +0.000014] drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched] [ +0.000020] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? __kasan_check_write+0x14/0x30 [ +0.000016] ? __pfx_drm_sched_entity_flush+0x10/0x10 [gpu_sched] [ +0.000020] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? __kasan_check_write+0x14/0x30 [ +0.000013] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? enable_work+0x124/0x220 [ +0.000015] ? __pfx_enable_work+0x10/0x10 [ +0.000013] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? free_large_kmalloc+0x85/0xf0 [ +0.000016] drm_sched_entity_destroy+0x18/0x30 [gpu_sched] [ +0.000020] amdgpu_vce_sw_fini+0x55/0x170 [amdgpu] [ +0.000735] ? __kasan_check_read+0x11/0x20 [ +0.000016] vce_v4_0_sw_fini+0x80/0x110 [amdgpu] [ +0.000726] amdgpu_device_fini_sw+0x331/0xfc0 [amdgpu] [ +0.000679] ? mutex_unlock+0x80/0xe0 [ +0.000017] ? __pfx_amdgpu_device_fini_sw+0x10/0x10 [amdgpu] [ +0.000662] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? __kasan_check_write+0x14/0x30 [ +0.000013] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? mutex_unlock+0x80/0xe0 [ +0.000016] amdgpu_driver_release_kms+0x16/0x80 [amdgpu] [ +0.000663] drm_minor_release+0xc9/0x140 [drm] [ +0.000081] drm_release+0x1fd/0x390 [drm] [ +0.000082] __fput+0x36c/0xad0 [ +0.000018] __fput_sync+0x3c/0x50 [ +0.000014] __x64_sys_close+0x7d/0xe0 [ +0.000014] x64_sys_call+0x1bc6/0x2680 [ +0.000014] do_syscall_64+0x70/0x130 [ +0.000014] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? irqentry_exit_to_user_mode+0x60/0x190 [ +0.000015] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? irqentry_exit+0x43/0x50 [ +0.000012] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? exc_page_fault+0x7c/0x110 [ +0.000015] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ +0.000014] RIP: 0033:0x7ffff7b14f67 [ +0.000013] Code: ff e8 0d 16 02 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 73 ba f7 ff [ +0.000026] RSP: 002b:00007fffffffe378 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ +0.000019] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ffff7b14f67 [ +0.000014] RDX: 0000000000000000 RSI: 00007ffff7f6f47a RDI: 0000000000000003 [ +0.000014] RBP: 00007fffffffe3a0 R08: 0000555555569890 R09: 0000000000000000 [ +0.000014] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffffffe5c8 [ +0.000013] R13: 00005555555552a9 R14: 0000555555557d48 R15: 00007ffff7ffd040 [ +0.000020] </TASK> [ +0.000016] Allocated by task 383 on cpu 7 at 26.880319s: [ +0.000014] kasan_save_stack+0x28/0x60 [ +0.000008] kasan_save_track+0x18/0x70 [ +0.000007] kasan_save_alloc_info+0x38/0x60 [ +0.000007] __kasan_kmalloc+0xc1/0xd0 [ +0.000007] kmalloc_trace_noprof+0x180/0x380 [ +0.000007] drm_sched_init+0x411/0xec0 [gpu_sched] [ +0.000012] amdgpu_device_init+0x695f/0xa610 [amdgpu] [ +0.000658] amdgpu_driver_load_kms+0x1a/0x120 [amdgpu] [ +0.000662] amdgpu_pci_probe+0x361/0xf30 [amdgpu] [ +0.000651] local_pci_probe+0xe7/0x1b0 [ +0.000009] pci_device_probe+0x248/0x890 [ +0.000008] really_probe+0x1fd/0x950 [ +0.000008] __driver_probe_device+0x307/0x410 [ +0.000007] driver_probe_device+0x4e/0x150 [ +0.000007] __driver_attach+0x223/0x510 [ +0.000006] bus_for_each_dev+0x102/0x1a0 [ +0.000007] driver_attach+0x3d/0x60 [ +0.000006] bus_add_driver+0x2ac/0x5f0 [ +0.000006] driver_register+0x13d/0x490 [ +0.000008] __pci_register_driver+0x1ee/0x2b0 [ +0.000007] llc_sap_close+0xb0/0x160 [llc] [ +0.000009] do_one_initcall+0x9c/0x3e0 [ +0.000008] do_init_module+0x241/0x760 [ +0.000008] load_module+0x51ac/0x6c30 [ +0.000006] __do_sys_init_module+0x234/0x270 [ +0.000007] __x64_sys_init_module+0x73/0xc0 [ +0.000006] x64_sys_call+0xe3/0x2680 [ +0.000006] do_syscall_64+0x70/0x130 [ +0.000007] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ +0.000015] Freed by task 2147 on cpu 6 at 160.507651s: [ +0.000013] kasan_save_stack+0x28/0x60 [ +0.000007] kasan_save_track+0x18/0x70 [ +0.000007] kasan_save_free_info+0x3b/0x60 [ +0.000007] poison_slab_object+0x115/0x1c0 [ +0.000007] __kasan_slab_free+0x34/0x60 [ +0.000007] kfree+0xfa/0x2f0 [ +0.000007] drm_sched_fini+0x19d/0x410 [gpu_sched] [ +0.000012] amdgpu_fence_driver_sw_fini+0xc4/0x2f0 [amdgpu] [ +0.000662] amdgpu_device_fini_sw+0x77/0xfc0 [amdgpu] [ +0.000653] amdgpu_driver_release_kms+0x16/0x80 [amdgpu] [ +0.000655] drm_minor_release+0xc9/0x140 [drm] [ +0.000071] drm_release+0x1fd/0x390 [drm] [ +0.000071] __fput+0x36c/0xad0 [ +0.000008] __fput_sync+0x3c/0x50 [ +0.000007] __x64_sys_close+0x7d/0xe0 [ +0.000007] x64_sys_call+0x1bc6/0x2680 [ +0.000007] do_syscall_64+0x70/0x130 [ +0.000007] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ +0.000014] The buggy address belongs to the object at ffff8881b8605f80 which belongs to the cache kmalloc-64 of size 64 [ +0.000020] The buggy address is located 8 bytes inside of freed 64-byte region [ffff8881b8605f80, ffff8881b8605fc0) [ +0.000028] The buggy address belongs to the physical page: [ +0.000011] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1b8605 [ +0.000008] anon flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff) [ +0.000007] page_type: 0xffffefff(slab) [ +0.000009] raw: 0017ffffc0000000 ffff8881000428c0 0000000000000000 dead000000000001 [ +0.000006] raw: 0000000000000000 0000000000200020 00000001ffffefff 0000000000000000 [ +0.000006] page dumped because: kasan: bad access detected [ +0.000012] Memory state around the buggy address: [ +0.000011] ffff8881b8605e80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ +0.000015] ffff8881b8605f00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ +0.000015] >ffff8881b8605f80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ +0.000013] ^ [ +0.000011] ffff8881b8606000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc [ +0.000014] ffff8881b8606080: fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb fb [ +0.000013] ================================================================== The issue reproduced on VG20 during the IGT pci_unplug test. The root cause of the issue is that the function drm_sched_fini is called before drm_sched_entity_kill. In drm_sched_fini, the drm_sched_rq structure is freed, but this structure is later accessed by each entity within the run queue, leading to invalid memory access. To resolve this, the order of cleanup calls is updated: Before: amdgpu_fence_driver_sw_fini amdgpu_device_ip_fini After: amdgpu_device_ip_fini amdgpu_fence_driver_sw_fini This updated order ensures that all entities in the IPs are cleaned up first, followed by proper cleanup of the schedulers. Additional Investigation: During debugging, another issue was identified in the amdgpu_vce_sw_fini function. The vce.vcpu_bo buffer must be freed only as the final step in the cleanup process to prevent any premature access during earlier cleanup stages. v2: Using Christian suggestion call drm_sched_entity_destroy before drm_sched_fini. Cc: Christian König <christian.koenig(a)amd.com> Cc: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Vitaly Prosyak <vitaly.prosyak(a)amd.com> Reviewed-by: Christian König <christian.koenig(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/gpu/drm/amd/amdgpu/amdgpu_device.c drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c [Uaf issue in amdgpu_device_fini_sw since commit 56e449603f0a "drm/sched: Convert the GPU scheduler to variable number of run-queues", which is not merged into 4.19 kernel. The vce.vcpu_bo buffer must be freed only as the final step in the cleanup process, keep this change in 4.19 kernel, Context conflict from commits, such as 52215e2a5d4a "drm/amd: Use `amdgpu_ucode_*` helpers for VCE"] Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c index 9c8ce75c760a..b480ae86ca22 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c @@ -213,15 +213,15 @@ int amdgpu_vce_sw_fini(struct amdgpu_device *adev) drm_sched_entity_destroy(&adev->vce.entity); - amdgpu_bo_free_kernel(&adev->vce.vcpu_bo, &adev->vce.gpu_addr, - (void **)&adev->vce.cpu_addr); - for (i = 0; i < adev->vce.num_rings; i++) amdgpu_ring_fini(&adev->vce.ring[i]); release_firmware(adev->vce.fw); mutex_destroy(&adev->vce.idle_mutex); + amdgpu_bo_free_kernel(&adev->vce.vcpu_bo, &adev->vce.gpu_addr, + (void **)&adev->vce.cpu_addr); + return 0; } -- 2.34.1

2 1

[PATCH OLK-5.10] net/mlx5: Fix variable not being completed when function returns
by Zhang Zekun 18 Feb '25

18 Feb '25

From: Chenguang Zhao <zhaochenguang(a)kylinos.cn> mainline inclusion from mainline-v6.13-rc7 commit 0e2909c6bec9048f49d0c8e16887c63b50b14647 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJ6RC CVE: CVE-2025-21662 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------- When cmd_alloc_index(), fails cmd_work_handler() needs to complete ent->slotted before returning early. Otherwise the task which issued the command may hang: mlx5_core 0000:01:00.0: cmd_work_handler:877:(pid 3880418): failed to allocate command entry INFO: task kworker/13:2:4055883 blocked for more than 120 seconds. Not tainted 4.19.90-25.44.v2101.ky10.aarch64 #1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kworker/13:2 D 0 4055883 2 0x00000228 Workqueue: events mlx5e_tx_dim_work [mlx5_core] Call trace: __switch_to+0xe8/0x150 __schedule+0x2a8/0x9b8 schedule+0x2c/0x88 schedule_timeout+0x204/0x478 wait_for_common+0x154/0x250 wait_for_completion+0x28/0x38 cmd_exec+0x7a0/0xa00 [mlx5_core] mlx5_cmd_exec+0x54/0x80 [mlx5_core] mlx5_core_modify_cq+0x6c/0x80 [mlx5_core] mlx5_core_modify_cq_moderation+0xa0/0xb8 [mlx5_core] mlx5e_tx_dim_work+0x54/0x68 [mlx5_core] process_one_work+0x1b0/0x448 worker_thread+0x54/0x468 kthread+0x134/0x138 ret_from_fork+0x10/0x18 Fixes: 485d65e13571 ("net/mlx5: Add a timeout to acquire the command queue semaphore") Signed-off-by: Chenguang Zhao <zhaochenguang(a)kylinos.cn> Reviewed-by: Moshe Shemesh <moshe(a)nvidia.com> Acked-by: Tariq Toukan <tariqt(a)nvidia.com> Link: https://patch.msgid.link/20250108030009.68520-1-zhaochenguang@kylinos.cn Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/mellanox/mlx5/core/cmd.c [Context difference only, no functional change] Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c index 6a744ab1795d..d078af8072b7 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c @@ -937,6 +937,7 @@ static void cmd_work_handler(struct work_struct *work) complete(&ent->done); } up(&cmd->sem); + complete(&ent->slotted); return; } ent->idx = alloc_ret; -- 2.22.0

2 1

[PATCH OLK-5.10] crypto: caam - Fix the pointer passed to caam_qi_shutdown()
by Zhang Zekun 18 Feb '25

18 Feb '25

From: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> stable inclusion from stable-v5.10.231 commit cc386170b3312fd7b5bc4a69a9f52d7f50814526 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEGFF CVE: CVE-2024-56754 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ad980b04f51f7fb503530bd1cb328ba5e75a250e ] The type of the last parameter given to devm_add_action_or_reset() is "struct caam_drv_private *", but in caam_qi_shutdown(), it is casted to "struct device *". Pass the correct parameter to devm_add_action_or_reset() so that the resources are released as expected. Fixes: f414de2e2fff ("crypto: caam - use devres to de-initialize QI") Signed-off-by: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/crypto/caam/qi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/crypto/caam/qi.c b/drivers/crypto/caam/qi.c index ec53528d8205..8e9f6097114e 100644 --- a/drivers/crypto/caam/qi.c +++ b/drivers/crypto/caam/qi.c @@ -768,7 +768,7 @@ int caam_qi_init(struct platform_device *caam_pdev) caam_debugfs_qi_init(ctrlpriv); - err = devm_add_action_or_reset(qidev, caam_qi_shutdown, ctrlpriv); + err = devm_add_action_or_reset(qidev, caam_qi_shutdown, qidev); if (err) return err; -- 2.22.0

2 1

[PATCH OLK-5.10] iommu/arm-smmu: Defer probe of clients after smmu device bound
by Zhang Zekun 18 Feb '25

18 Feb '25

From: Pratyush Brahma <quic_pbrahma(a)quicinc.com> stable inclusion from stable-v5.10.231 commit c2527d07c7e9cda2c6165d5edccf74752baac1b0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAME CVE: CVE-2024-56568 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 229e6ee43d2a160a1592b83aad620d6027084aad upstream. Null pointer dereference occurs due to a race between smmu driver probe and client driver probe, when of_dma_configure() for client is called after the iommu_device_register() for smmu driver probe has executed but before the driver_bound() for smmu driver has been called. Following is how the race occurs: T1:Smmu device probe T2: Client device probe really_probe() arm_smmu_device_probe() iommu_device_register() really_probe() platform_dma_configure() of_dma_configure() of_dma_configure_id() of_iommu_configure() iommu_probe_device() iommu_init_device() arm_smmu_probe_device() arm_smmu_get_by_fwnode() driver_find_device_by_fwnode() driver_find_device() next_device() klist_next() /* null ptr assigned to smmu */ /* null ptr dereference while smmu->streamid_mask */ driver_bound() klist_add_tail() When this null smmu pointer is dereferenced later in arm_smmu_probe_device, the device crashes. Fix this by deferring the probe of the client device until the smmu device has bound to the arm smmu driver. Fixes: 021bb8420d44 ("iommu/arm-smmu: Wire up generic configuration support") Cc: stable(a)vger.kernel.org Co-developed-by: Prakash Gupta <quic_guptap(a)quicinc.com> Signed-off-by: Prakash Gupta <quic_guptap(a)quicinc.com> Signed-off-by: Pratyush Brahma <quic_pbrahma(a)quicinc.com> Link: https://lore.kernel.org/r/20241004090428.2035-1-quic_pbrahma@quicinc.com [will: Add comment] Signed-off-by: Will Deacon <will(a)kernel.org> [rm: backport for context conflict prior to 6.8] Signed-off-by: Robin Murphy <robin.murphy(a)arm.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/iommu/arm/arm-smmu/arm-smmu.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu.c b/drivers/iommu/arm/arm-smmu/arm-smmu.c index b57536b024ac..39cc38876d87 100644 --- a/drivers/iommu/arm/arm-smmu/arm-smmu.c +++ b/drivers/iommu/arm/arm-smmu/arm-smmu.c @@ -1372,6 +1372,17 @@ static struct iommu_device *arm_smmu_probe_device(struct device *dev) goto out_free; } else if (fwspec && fwspec->ops == &arm_smmu_ops) { smmu = arm_smmu_get_by_fwnode(fwspec->iommu_fwnode); + + /* + * Defer probe if the relevant SMMU instance hasn't finished + * probing yet. This is a fragile hack and we'd ideally + * avoid this race in the core code. Until that's ironed + * out, however, this is the most pragmatic option on the + * table. + */ + if (!smmu) + return ERR_PTR(dev_err_probe(dev, -EPROBE_DEFER, + "smmu dev has not bound yet\n")); } else { return ERR_PTR(-ENODEV); } -- 2.22.0

2 1

[PATCH OLK-5.10] usb: typec: altmode should keep reference to parent
by Zhang Zekun 18 Feb '25

18 Feb '25

From: Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> stable inclusion from stable-v5.10.229 commit 6af43ec3bf40f8b428d9134ffa7a291aecd60da8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2SU4 CVE: CVE-2024-50150 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------------------------ [ Upstream commit befab3a278c59db0cc88c8799638064f6d3fd6f8 ] The altmode device release refers to its parent device, but without keeping a reference to it. When registering the altmode, get a reference to the parent and put it in the release function. Before this fix, when using CONFIG_DEBUG_KOBJECT_RELEASE, we see issues like this: [ 43.572860] kobject: 'port0.0' (ffff8880057ba008): kobject_release, parent 0000000000000000 (delayed 3000) [ 43.573532] kobject: 'port0.1' (ffff8880057bd008): kobject_release, parent 0000000000000000 (delayed 1000) [ 43.574407] kobject: 'port0' (ffff8880057b9008): kobject_release, parent 0000000000000000 (delayed 3000) [ 43.575059] kobject: 'port1.0' (ffff8880057ca008): kobject_release, parent 0000000000000000 (delayed 4000) [ 43.575908] kobject: 'port1.1' (ffff8880057c9008): kobject_release, parent 0000000000000000 (delayed 4000) [ 43.576908] kobject: 'typec' (ffff8880062dbc00): kobject_release, parent 0000000000000000 (delayed 4000) [ 43.577769] kobject: 'port1' (ffff8880057bf008): kobject_release, parent 0000000000000000 (delayed 3000) [ 46.612867] ================================================================== [ 46.613402] BUG: KASAN: slab-use-after-free in typec_altmode_release+0x38/0x129 [ 46.614003] Read of size 8 at addr ffff8880057b9118 by task kworker/2:1/48 [ 46.614538] [ 46.614668] CPU: 2 UID: 0 PID: 48 Comm: kworker/2:1 Not tainted 6.12.0-rc1-00138-gedbae730ad31 #535 [ 46.615391] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 [ 46.616042] Workqueue: events kobject_delayed_cleanup [ 46.616446] Call Trace: [ 46.616648] <TASK> [ 46.616820] dump_stack_lvl+0x5b/0x7c [ 46.617112] ? typec_altmode_release+0x38/0x129 [ 46.617470] print_report+0x14c/0x49e [ 46.617769] ? rcu_read_unlock_sched+0x56/0x69 [ 46.618117] ? __virt_addr_valid+0x19a/0x1ab [ 46.618456] ? kmem_cache_debug_flags+0xc/0x1d [ 46.618807] ? typec_altmode_release+0x38/0x129 [ 46.619161] kasan_report+0x8d/0xb4 [ 46.619447] ? typec_altmode_release+0x38/0x129 [ 46.619809] ? process_scheduled_works+0x3cb/0x85f [ 46.620185] typec_altmode_release+0x38/0x129 [ 46.620537] ? process_scheduled_works+0x3cb/0x85f [ 46.620907] device_release+0xaf/0xf2 [ 46.621206] kobject_delayed_cleanup+0x13b/0x17a [ 46.621584] process_scheduled_works+0x4f6/0x85f [ 46.621955] ? __pfx_process_scheduled_works+0x10/0x10 [ 46.622353] ? hlock_class+0x31/0x9a [ 46.622647] ? lock_acquired+0x361/0x3c3 [ 46.622956] ? move_linked_works+0x46/0x7d [ 46.623277] worker_thread+0x1ce/0x291 [ 46.623582] ? __kthread_parkme+0xc8/0xdf [ 46.623900] ? __pfx_worker_thread+0x10/0x10 [ 46.624236] kthread+0x17e/0x190 [ 46.624501] ? kthread+0xfb/0x190 [ 46.624756] ? __pfx_kthread+0x10/0x10 [ 46.625015] ret_from_fork+0x20/0x40 [ 46.625268] ? __pfx_kthread+0x10/0x10 [ 46.625532] ret_from_fork_asm+0x1a/0x30 [ 46.625805] </TASK> [ 46.625953] [ 46.626056] Allocated by task 678: [ 46.626287] kasan_save_stack+0x24/0x44 [ 46.626555] kasan_save_track+0x14/0x2d [ 46.626811] __kasan_kmalloc+0x3f/0x4d [ 46.627049] __kmalloc_noprof+0x1bf/0x1f0 [ 46.627362] typec_register_port+0x23/0x491 [ 46.627698] cros_typec_probe+0x634/0xbb6 [ 46.628026] platform_probe+0x47/0x8c [ 46.628311] really_probe+0x20a/0x47d [ 46.628605] device_driver_attach+0x39/0x72 [ 46.628940] bind_store+0x87/0xd7 [ 46.629213] kernfs_fop_write_iter+0x1aa/0x218 [ 46.629574] vfs_write+0x1d6/0x29b [ 46.629856] ksys_write+0xcd/0x13b [ 46.630128] do_syscall_64+0xd4/0x139 [ 46.630420] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 46.630820] [ 46.630946] Freed by task 48: [ 46.631182] kasan_save_stack+0x24/0x44 [ 46.631493] kasan_save_track+0x14/0x2d [ 46.631799] kasan_save_free_info+0x3f/0x4d [ 46.632144] __kasan_slab_free+0x37/0x45 [ 46.632474] kfree+0x1d4/0x252 [ 46.632725] device_release+0xaf/0xf2 [ 46.633017] kobject_delayed_cleanup+0x13b/0x17a [ 46.633388] process_scheduled_works+0x4f6/0x85f [ 46.633764] worker_thread+0x1ce/0x291 [ 46.634065] kthread+0x17e/0x190 [ 46.634324] ret_from_fork+0x20/0x40 [ 46.634621] ret_from_fork_asm+0x1a/0x30 Fixes: 8a37d87d72f0 ("usb: typec: Bus type for alternate modes") Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Link: https://lore.kernel.org/r/20241004123738.2964524-1-cascardo@igalia.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/usb/typec/class.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c index 7fa95e701244..dec83edb09de 100644 --- a/drivers/usb/typec/class.c +++ b/drivers/usb/typec/class.c @@ -430,6 +430,7 @@ static void typec_altmode_release(struct device *dev) typec_altmode_put_partner(alt); altmode_id_remove(alt->adev.dev.parent, alt->id); + put_device(alt->adev.dev.parent); kfree(alt); } @@ -479,6 +480,8 @@ typec_register_altmode(struct device *parent, alt->adev.dev.type = &typec_altmode_dev_type; dev_set_name(&alt->adev.dev, "%s.%u", dev_name(parent), id); + get_device(alt->adev.dev.parent); + /* Link partners and plugs with the ports */ if (!is_port) typec_altmode_set_partner(alt); -- 2.22.0

2 1

[PATCH OLK-6.6 0/2] CVE-2024-56607 fix
by Gu Bowen 18 Feb '25

18 Feb '25

CVE-2024-56607 Kalle Valo (1): wifi: ath12k: fix atomic calls in ath12k_mac_op_set_bitrate_mask() Rory Little (1): wifi: mac80211: Add non-atomic station iterator drivers/net/wireless/ath/ath12k/mac.c | 18 +++++++++--------- include/net/mac80211.h | 18 ++++++++++++++++++ net/mac80211/util.c | 16 +++++++++++++++- 3 files changed, 42 insertions(+), 10 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] xsk: fix OOB map writes when deleting elements
by Wang Liang 18 Feb '25

18 Feb '25

From: Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> mainline inclusion from mainline-v6.13-rc2 commit 32cd3db7de97c0c7a018756ce66244342fd583f0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAPK CVE: CVE-2024-56614 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Jordy says: " In the xsk_map_delete_elem function an unsigned integer (map->max_entries) is compared with a user-controlled signed integer (k). Due to implicit type conversion, a large unsigned value for map->max_entries can bypass the intended bounds check: if (k >= map->max_entries) return -EINVAL; This allows k to hold a negative value (between -2147483648 and -2), which is then used as an array index in m->xsk_map[k], which results in an out-of-bounds access. spin_lock_bh(&m->lock); map_entry = &m->xsk_map[k]; // Out-of-bounds map_entry old_xs = unrcu_pointer(xchg(map_entry, NULL)); // Oob write if (old_xs) xsk_map_sock_delete(old_xs, map_entry); spin_unlock_bh(&m->lock); The xchg operation can then be used to cause an out-of-bounds write. Moreover, the invalid map_entry passed to xsk_map_sock_delete can lead to further memory corruption. " It indeed results in following splat: [76612.897343] BUG: unable to handle page fault for address: ffffc8fc2e461108 [76612.904330] #PF: supervisor write access in kernel mode [76612.909639] #PF: error_code(0x0002) - not-present page [76612.914855] PGD 0 P4D 0 [76612.917431] Oops: Oops: 0002 [#1] PREEMPT SMP [76612.921859] CPU: 11 UID: 0 PID: 10318 Comm: a.out Not tainted 6.12.0-rc1+ #470 [76612.929189] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [76612.939781] RIP: 0010:xsk_map_delete_elem+0x2d/0x60 [76612.944738] Code: 00 00 41 54 55 53 48 63 2e 3b 6f 24 73 38 4c 8d a7 f8 00 00 00 48 89 fb 4c 89 e7 e8 2d bf 05 00 48 8d b4 eb 00 01 00 00 31 ff <48> 87 3e 48 85 ff 74 05 e8 16 ff ff ff 4c 89 e7 e8 3e bc 05 00 31 [76612.963774] RSP: 0018:ffffc9002e407df8 EFLAGS: 00010246 [76612.969079] RAX: 0000000000000000 RBX: ffffc9002e461000 RCX: 0000000000000000 [76612.976323] RDX: 0000000000000001 RSI: ffffc8fc2e461108 RDI: 0000000000000000 [76612.983569] RBP: ffffffff80000001 R08: 0000000000000000 R09: 0000000000000007 [76612.990812] R10: ffffc9002e407e18 R11: ffff888108a38858 R12: ffffc9002e4610f8 [76612.998060] R13: ffff888108a38858 R14: 00007ffd1ae0ac78 R15: ffffc9002e4610c0 [76613.005303] FS: 00007f80b6f59740(0000) GS:ffff8897e0ec0000(0000) knlGS:0000000000000000 [76613.013517] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [76613.019349] CR2: ffffc8fc2e461108 CR3: 000000011e3ef001 CR4: 00000000007726f0 [76613.026595] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [76613.033841] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [76613.041086] PKRU: 55555554 [76613.043842] Call Trace: [76613.046331] <TASK> [76613.048468] ? __die+0x20/0x60 [76613.051581] ? page_fault_oops+0x15a/0x450 [76613.055747] ? search_extable+0x22/0x30 [76613.059649] ? search_bpf_extables+0x5f/0x80 [76613.063988] ? exc_page_fault+0xa9/0x140 [76613.067975] ? asm_exc_page_fault+0x22/0x30 [76613.072229] ? xsk_map_delete_elem+0x2d/0x60 [76613.076573] ? xsk_map_delete_elem+0x23/0x60 [76613.080914] __sys_bpf+0x19b7/0x23c0 [76613.084555] __x64_sys_bpf+0x1a/0x20 [76613.088194] do_syscall_64+0x37/0xb0 [76613.091832] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [76613.096962] RIP: 0033:0x7f80b6d1e88d [76613.100592] Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 b5 0f 00 f7 d8 64 89 01 48 [76613.119631] RSP: 002b:00007ffd1ae0ac68 EFLAGS: 00000206 ORIG_RAX: 0000000000000141 [76613.131330] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f80b6d1e88d [76613.142632] RDX: 0000000000000098 RSI: 00007ffd1ae0ad20 RDI: 0000000000000003 [76613.153967] RBP: 00007ffd1ae0adc0 R08: 0000000000000000 R09: 0000000000000000 [76613.166030] R10: 00007f80b6f77040 R11: 0000000000000206 R12: 00007ffd1ae0aed8 [76613.177130] R13: 000055ddf42ce1e9 R14: 000055ddf42d0d98 R15: 00007f80b6fab040 [76613.188129] </TASK> Fix this by simply changing key type from int to u32. Fixes: fbfc504a24f5 ("bpf: introduce new bpf AF_XDP map type BPF_MAP_TYPE_XSKMAP") CC: stable(a)vger.kernel.org Reported-by: Jordy Zomer <jordyzomer(a)google.com> Suggested-by: Jordy Zomer <jordyzomer(a)google.com> Reviewed-by: Toke Høiland-Jørgensen <toke(a)redhat.com> Acked-by: John Fastabend <john.fastabend(a)gmail.com> Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> Link: https://lore.kernel.org/r/20241122121030.716788-2-maciej.fijalkowski@intel.… Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: kernel/bpf/xskmap.c net/xdp/xskmap.c [conflicts due to not mergered d20a1676df7e ("xsk: Move xskmap.c to net/xdp/"), conflicts due to not mergered d7ba4cc900bf ("bpf: return long from bpf_map_ops funcs"), conflicts due to not mergered 0402acd683c6 ("xsk: remove AF_XDP socket from map when the socket is released")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- kernel/bpf/xskmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/bpf/xskmap.c b/kernel/bpf/xskmap.c index 47147c9e184d..e37cc1741db8 100644 --- a/kernel/bpf/xskmap.c +++ b/kernel/bpf/xskmap.c @@ -203,7 +203,7 @@ static int xsk_map_delete_elem(struct bpf_map *map, void *key) { struct xsk_map *m = container_of(map, struct xsk_map, map); struct xdp_sock *old_xs; - int k = *(u32 *)key; + u32 k = *(u32 *)key; if (k >= map->max_entries) return -EINVAL; -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION bd6fde5ff5b73d04068bdad2dc7730479d4df355
by kernel test robot 18 Feb '25

18 Feb '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: bd6fde5ff5b73d04068bdad2dc7730479d4df355 !15058 net: let net.core.dev_weight always be non-zero Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202502171430.Coc968oj-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202502171533.xL4t91Bt-lkp@intel.com mm/memory_hotplug.c:926:23: warning: unused variable 'start_pfn' [-Wunused-variable] mm/memory_hotplug.c:971:13: warning: 'rollback_node_hotadd' defined but not used [-Wunused-function] mm/page_alloc.c:1645:3: warning: cast from 'int (*)(unsigned long, unsigned long, struct deferred_args *)' to 'ktask_thread_func' (aka 'int (*)(void *, void *, void *)') converts to incompatible function type [-Wcast-function-type-strict] mm/swap.c: linux/memremap.h is included more than once. Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- drivers-net-ethernet-netswift-ngbe-ngbe_main.c:warning:unused-variable-len | |-- include-asm-generic-bitops-non-atomic.h:warning:array-subscript-long-unsigned-int-is-partly-outside-array-bounds-of-u32-aka-unsigned-int | |-- include-linux-thread_info.h:warning:b-may-be-used-uninitialized | |-- include-net-netns-generic.h:warning:array-subscript-id-is-outside-array-bounds-of-void | |-- include-scsi-scsi_cmnd.h:warning:scsi_cmnd-may-be-used-uninitialized | |-- mm-kasan-kasan_init.c:warning:variable-p4d-set-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | `-- mm-memcontrol.c:warning:bad-line:otherwise. |-- arm64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-CRYPTO_AES-when-selected-by-RTLLIB_CRYPTO_CCMP | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-CRYPTO_ARC4-when-selected-by-RTLLIB_CRYPTO_TKIP | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-CRYPTO_ARC4-when-selected-by-RTLLIB_CRYPTO_WEP | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-CRYPTO_MICHAEL_MIC-when-selected-by-RTLLIB_CRYPTO_TKIP | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-FB_BACKLIGHT-when-selected-by-DRM_NOUVEAU | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-HARDLOCKUP_DETECTOR-when-selected-by-SDEI_WATCHDOG | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-IIO_BUFFER_CB-when-selected-by-TOUCHSCREEN_ADC | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-PINCTRL_EXYNOS-when-selected-by-ARCH_EXYNOS | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-SPI_PHYTIUM-when-selected-by-SPI_PHYTIUM_PCI | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-SPI_PHYTIUM-when-selected-by-SPI_PHYTIUM_PLAT | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-UACCE-when-selected-by-CRYPTO_DEV_HISI_QM | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-defconfig | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-long-long-unsigned-int-long-long-unsigne | |-- include-net-netns-generic.h:warning:array-subscript-id-is-outside-array-bounds-of-void | |-- include-scsi-scsi_cmnd.h:warning:scsi_cmnd-may-be-used-uninitialized | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | `-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free |-- arm64-randconfig-001-20250217 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-net-netns-generic.h:warning:array-subscript-id-is-outside-array-bounds-of-void | `-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read |-- arm64-randconfig-002-20250217 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-long-long-unsigned-int-long-long-unsigne | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-003-20250217 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-list.h:warning:storing-the-address-of-local-variable-tmp-in-((struct-list_head-)lip)-.prev | |-- include-scsi-scsi_cmnd.h:warning:scsi_cmnd-may-be-used-uninitialized | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | `-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free |-- arm64-randconfig-004-20250217 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-long-long-unsigned-int-long-long-unsigne | |-- include-net-netns-generic.h:warning:array-subscript-id-is-outside-array-bounds-of-void | |-- include-scsi-scsi_cmnd.h:warning:scsi_cmnd-may-be-used-uninitialized | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | `-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read |-- arm64-randconfig-r051-20250217 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-long-long-unsigned-int-long-long-unsigne | |-- mm-kasan-kasan_init.c:warning:variable-p4d-set-but-not-used | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-r113-20250217 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-long-long-unsigned-int-long-long-unsigne | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-allnoconfig | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-BACKLIGHT_CLASS_DEVICE-when-selected-by-DRM_GMA500 | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-CRYPTO_AES-when-selected-by-RTLLIB_CRYPTO_CCMP | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-CRYPTO_ARC4-when-selected-by-RTLLIB_CRYPTO_TKIP | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-CRYPTO_ARC4-when-selected-by-RTLLIB_CRYPTO_WEP | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-CRYPTO_MICHAEL_MIC-when-selected-by-RTLLIB_CRYPTO_TKIP | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-FB_BACKLIGHT-when-selected-by-DRM_NOUVEAU | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-IIO_BUFFER_CB-when-selected-by-TOUCHSCREEN_ADC | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-LEDS_CLASS-when-selected-by-FUJITSU_LAPTOP | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-LEDS_TRIGGERS-when-selected-by-BT_LEDS | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-LEDS_TRIGGERS-when-selected-by-IWLWIFI_LEDS | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-LEDS_TRIGGERS-when-selected-by-MAC80211_LEDS | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-SPI_PHYTIUM-when-selected-by-SPI_PHYTIUM_PCI | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-SPI_PHYTIUM-when-selected-by-SPI_PHYTIUM_PLAT | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-VIDEO_ADV7180-when-selected-by-STA2X11_VIP | |-- mm-hugetlb.c:linux-share_pool.h-is-included-more-than-once. | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-swap.c:linux-memremap.h-is-included-more-than-once. | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-net-ethernet-netswift-ngbe-ngbe_main.c:warning:unused-variable-len | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-.tmp_ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | `-- mm-memcontrol.c:warning:bad-line:otherwise. |-- x86_64-buildonly-randconfig-001-20250217 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-long-long-unsigned-int-long-long-unsigne | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-buildonly-randconfig-002-20250217 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-003-20250217 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- sound-isa-es1688-es1688.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-004-20250217 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-long-long-unsigned-int-long-long-unsigne | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-buildonly-randconfig-005-20250217 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-long-long-unsigned-int-long-long-unsigne | |-- include-linux-thread_info.h:warning:ctl-may-be-used-uninitialized | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-buildonly-randconfig-006-20250217 | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-memcontrol.c:warning:bad-line:otherwise. | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-defconfig | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-long-long-unsigned-int-long-long-unsigne | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | `-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read |-- x86_64-randconfig-161-20250217 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-long-long-unsigned-int-long-long-unsigne | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled `-- x86_64-randconfig-r123-20250217 |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read |-- mm-memcontrol.c:warning:bad-line:otherwise. |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used `-- mm-memory_hotplug.c:warning:unused-variable-start_pfn elapsed time: 722m configs tested: 16 configs skipped: 128 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250217 gcc-14.2.0 arm64 randconfig-002-20250217 gcc-14.2.0 arm64 randconfig-003-20250217 gcc-14.2.0 arm64 randconfig-004-20250217 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250217 gcc-12 x86_64 buildonly-randconfig-002-20250217 clang-19 x86_64 buildonly-randconfig-003-20250217 clang-19 x86_64 buildonly-randconfig-004-20250217 gcc-12 x86_64 buildonly-randconfig-005-20250217 gcc-12 x86_64 buildonly-randconfig-006-20250217 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] comedi: Flush partial mappings in error case
by Chen Ridong 17 Feb '25

17 Feb '25

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-v5.10.231 commit b9322408d83accc8b96322bc7356593206288c56 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGS CVE: CVE-2024-53148 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit ce8f9fb651fac95dd41f69afe54d935420b945bd upstream. If some remap_pfn_range() calls succeeded before one failed, we still have buffer pages mapped into the userspace page tables when we drop the buffer reference with comedi_buf_map_put(bm). The userspace mappings are only cleaned up later in the mmap error path. Fix it by explicitly flushing all mappings in our VMA on the error path. See commit 79a61cc3fc04 ("mm: avoid leaving partial pfn mappings around in error case"). Cc: stable(a)vger.kernel.org Fixes: ed9eccbe8970 ("Staging: add comedi core") Signed-off-by: Jann Horn <jannh(a)google.com> Link: https://lore.kernel.org/r/20241017-comedi-tlb-v3-1-16b82f9372ce@google.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Ridong <chenridong(a)huawei.com> --- drivers/staging/comedi/comedi_fops.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c index 9858fae816f7..8f896e6208a8 100644 --- a/drivers/staging/comedi/comedi_fops.c +++ b/drivers/staging/comedi/comedi_fops.c @@ -2402,6 +2402,18 @@ static int comedi_mmap(struct file *file, struct vm_area_struct *vma) start += PAGE_SIZE; } + +#ifdef CONFIG_MMU + /* + * Leaving behind a partial mapping of a buffer we're about to + * drop is unsafe, see remap_pfn_range_notrack(). + * We need to zap the range here ourselves instead of relying + * on the automatic zapping in remap_pfn_range() because we call + * remap_pfn_range() in a loop. + */ + if (retval) + zap_vma_ptes(vma, vma->vm_start, size); +#endif } if (retval == 0) { -- 2.34.1

2 1

[PATCH OLK-6.6] ALSA: seq: oss: Fix races at processing SysEx messages
by Gu Bowen 17 Feb '25

17 Feb '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v6.6.70 commit d2392b79d8af3714ea8878b71c66dc49d3110f44 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBID2T CVE: CVE-2024-57893 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0179488ca992d79908b8e26b9213f1554fc5bacc upstream. OSS sequencer handles the SysEx messages split in 6 bytes packets, and ALSA sequencer OSS layer tries to combine those. It stores the data in the internal buffer and this access is racy as of now, which may lead to the out-of-bounds access. As a temporary band-aid fix, introduce a mutex for serializing the process of the SysEx message packets. Reported-by: Kun Hu <huk23(a)m.fudan.edu.cn> Closes: https://lore.kernel.org/2B7E93E4-B13A-4AE4-8E87-306A8EE9BBB7@m.fudan.edu.cn Cc: <stable(a)vger.kernel.org> Link: https://patch.msgid.link/20241230110543.32454-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- sound/core/seq/oss/seq_oss_synth.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c index e3394919daa0..51ee4c00a843 100644 --- a/sound/core/seq/oss/seq_oss_synth.c +++ b/sound/core/seq/oss/seq_oss_synth.c @@ -66,6 +66,7 @@ static struct seq_oss_synth midi_synth_dev = { }; static DEFINE_SPINLOCK(register_lock); +static DEFINE_MUTEX(sysex_mutex); /* * prototypes @@ -497,6 +498,7 @@ snd_seq_oss_synth_sysex(struct seq_oss_devinfo *dp, int dev, unsigned char *buf, if (!info) return -ENXIO; + guard(mutex)(&sysex_mutex); sysex = info->sysex; if (sysex == NULL) { sysex = kzalloc(sizeof(*sysex), GFP_KERNEL); -- 2.25.1

2 1