- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] wifi: wilc1000: fix RCU usage in connect path
by Jinjiang Tu 19 Jun '24

19 Jun '24

From: Alexis Lothoré <alexis.lothore(a)bootlin.com> stable inclusion from stable-v5.10.214 commit b4bbf38c350acb6500cbe667b1e2e68f896e4b38 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9OG CVE: CVE-2024-27053 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 205c50306acf58a335eb19fa84e40140f4fe814f ] With lockdep enabled, calls to the connect function from cfg802.11 layer lead to the following warning: ============================= WARNING: suspicious RCU usage 6.7.0-rc1-wt+ #333 Not tainted ----------------------------- drivers/net/wireless/microchip/wilc1000/hif.c:386 suspicious rcu_dereference_check() usage! [...] stack backtrace: CPU: 0 PID: 100 Comm: wpa_supplicant Not tainted 6.7.0-rc1-wt+ #333 Hardware name: Atmel SAMA5 unwind_backtrace from show_stack+0x18/0x1c show_stack from dump_stack_lvl+0x34/0x48 dump_stack_lvl from wilc_parse_join_bss_param+0x7dc/0x7f4 wilc_parse_join_bss_param from connect+0x2c4/0x648 connect from cfg80211_connect+0x30c/0xb74 cfg80211_connect from nl80211_connect+0x860/0xa94 nl80211_connect from genl_rcv_msg+0x3fc/0x59c genl_rcv_msg from netlink_rcv_skb+0xd0/0x1f8 netlink_rcv_skb from genl_rcv+0x2c/0x3c genl_rcv from netlink_unicast+0x3b0/0x550 netlink_unicast from netlink_sendmsg+0x368/0x688 netlink_sendmsg from ____sys_sendmsg+0x190/0x430 ____sys_sendmsg from ___sys_sendmsg+0x110/0x158 ___sys_sendmsg from sys_sendmsg+0xe8/0x150 sys_sendmsg from ret_fast_syscall+0x0/0x1c This warning is emitted because in the connect path, when trying to parse target BSS parameters, we dereference a RCU pointer whithout being in RCU critical section. Fix RCU dereference usage by moving it to a RCU read critical section. To avoid wrapping the whole wilc_parse_join_bss_param under the critical section, just use the critical section to copy ies data Fixes: c460495ee072 ("staging: wilc1000: fix incorrent type in initializer") Signed-off-by: Alexis Lothoré <alexis.lothore(a)bootlin.com> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://msgid.link/20240105075733.36331-3-alexis.lothore@bootlin.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/net/wireless/microchip/wilc1000/hif.c [Context conflicts.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/net/wireless/microchip/wilc1000/hif.c | 36 ++++++++++++------- 1 file changed, 24 insertions(+), 12 deletions(-) diff --git a/drivers/net/wireless/microchip/wilc1000/hif.c b/drivers/net/wireless/microchip/wilc1000/hif.c index 884f45e627a7..7e5574b1df9c 100644 --- a/drivers/net/wireless/microchip/wilc1000/hif.c +++ b/drivers/net/wireless/microchip/wilc1000/hif.c @@ -361,36 +361,47 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss, { struct wilc_join_bss_param *param; struct ieee80211_p2p_noa_attr noa_attr; - u8 rates_len = 0; - const u8 *tim_elm, *ssid_elm, *rates_ie, *supp_rates_ie; + u8 rates_len = 0, ies_len; + const u8 *ies_data, *tim_elm, *ssid_elm, *rates_ie, *supp_rates_ie; const u8 *ht_ie, *wpa_ie, *wmm_ie, *rsn_ie; int ret; - const struct cfg80211_bss_ies *ies = rcu_dereference(bss->ies); + const struct cfg80211_bss_ies *ies; param = kzalloc(sizeof(*param), GFP_KERNEL); if (!param) return NULL; + rcu_read_lock(); + ies = rcu_dereference(bss->ies); + ies_data = kmemdup(ies->data, ies->len, GFP_ATOMIC); + if (!ies_data) { + rcu_read_unlock(); + kfree(param); + return NULL; + } + ies_len = ies->len; + rcu_read_unlock(); + param->beacon_period = cpu_to_le16(bss->beacon_interval); param->cap_info = cpu_to_le16(bss->capability); param->bss_type = WILC_FW_BSS_TYPE_INFRA; param->ch = ieee80211_frequency_to_channel(bss->channel->center_freq); ether_addr_copy(param->bssid, bss->bssid); - ssid_elm = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len); + ssid_elm = cfg80211_find_ie(WLAN_EID_SSID, ies_data, ies_len); if (ssid_elm) { if (ssid_elm[1] <= IEEE80211_MAX_SSID_LEN) memcpy(param->ssid, ssid_elm + 2, ssid_elm[1]); } - tim_elm = cfg80211_find_ie(WLAN_EID_TIM, ies->data, ies->len); + tim_elm = cfg80211_find_ie(WLAN_EID_TIM, ies_data, ies_len); if (tim_elm && tim_elm[1] >= 2) param->dtim_period = tim_elm[3]; memset(param->p_suites, 0xFF, 3); memset(param->akm_suites, 0xFF, 3); - rates_ie = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies->data, ies->len); + rates_ie = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies_data, ies_len); if (rates_ie) { rates_len = rates_ie[1]; if (rates_len > WILC_MAX_RATES_SUPPORTED) @@ -401,7 +412,7 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss, if (rates_len < WILC_MAX_RATES_SUPPORTED) { supp_rates_ie = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, - ies->data, ies->len); + ies_data, ies_len); if (supp_rates_ie) { u8 ext_rates = supp_rates_ie[1]; @@ -416,11 +427,11 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss, } } - ht_ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies->data, ies->len); + ht_ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies_data, ies_len); if (ht_ie) param->ht_capable = true; - ret = cfg80211_get_p2p_attr(ies->data, ies->len, + ret = cfg80211_get_p2p_attr(ies_data, ies_len, IEEE80211_P2P_ATTR_ABSENCE_NOTICE, (u8 *)&noa_attr, sizeof(noa_attr)); if (ret > 0) { @@ -444,7 +455,7 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss, } wmm_ie = cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT, WLAN_OUI_TYPE_MICROSOFT_WMM, - ies->data, ies->len); + ies_data, ies_len); if (wmm_ie) { struct ieee80211_wmm_param_ie *ie; @@ -459,13 +470,13 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss, wpa_ie = cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT, WLAN_OUI_TYPE_MICROSOFT_WPA, - ies->data, ies->len); + ies_data, ies_len); if (wpa_ie) { param->mode_802_11i = 1; param->rsn_found = true; } - rsn_ie = cfg80211_find_ie(WLAN_EID_RSN, ies->data, ies->len); + rsn_ie = cfg80211_find_ie(WLAN_EID_RSN, ies_data, ies_len); if (rsn_ie) { int rsn_ie_len = sizeof(struct element) + rsn_ie[1]; int offset = 8; @@ -499,6 +510,7 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss, param->akm_suites[i] = crypto->akm_suites[i] & 0xFF; } + kfree(ies_data); return (void *)param; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/3] CVE-2021-47232
by Zhang Changzhong 19 Jun '24

19 Jun '24

Oleksij Rempel (3): can: j1939: transport: add j1939_session_skb_find_by_offset() function can: j1939: transport: j1939_session_tx_dat(): fix use-after-free read in j1939_tp_txtimer() can: j1939: fix Use-after-Free, hold skb ref while in use net/can/j1939/transport.c | 77 ++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 63 insertions(+), 14 deletions(-) -- 2.9.5

2 4

[PATCH OLK-6.6] sched: smart_grid: fix potential NULL pointer dereference
by Yipeng Zou 19 Jun '24

19 Jun '24

hulk inclusion Category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA6J1H CVE: NA ---------------------------------------- There is a low probability that kernel panic will occur when we test with smart_grid. The log show below: [65160.746953] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 [65160.746990] Unable to handle kernel NULL pointer dereference at virtual address 000000000000000 [65160.756974] Mem abort info: [65160.766849] Mem abort info: [65160.770660] ESR = 0x96000004 [65160.770663] EC = 0x25: DABT (current EL), IL = 32 bits [65160.774374] ESR = 0x96000004 [65160.774377] EC = 0x25: DABT (current EL), IL = 32 bits [65160.778428] SET = 0, FnV = 0 [65160.778430] EA = 0, S1PTW = 0 [65160.784728] SET = 0, FnV = 0 [65160.784731] EA = 0, S1PTW = 0 [65160.786018] Detected VIPT I-cache on CPU104 [65160.786070] GICv3: CPU104: found redistributor 3a0000 region 104: 0x00002000aa300000 [65160.786240] CPU104: Booted secondary processor 0x00003a0000 [0x481fd010] [65160.788696] Data abort info: [65160.788699] ISV = 0, ISS = 0x00000004 [65160.794911] Data abort info: [65160.794913] ISV = 0, ISS = 0x00000004 [65160.798965] CM = 0, WnR = 0 [65160.798967] user pgtable: 4k pages, 48-bit VAs, pgdp=00000030059b2000 [65160.803102] CM = 0, WnR = 0 [65160.803104] user pgtable: 4k pages, 48-bit VAs, pgdp=00000020ab07c000 [65160.807066] [0000000000000008] pgd=0000000000000000, p4d=0000000000000000 [65160.811113] [0000000000000008] pgd=0000000000000000, p4d=0000000000000000 [65160.816199] Internal error: Oops: 0000000096000004 [#1] SMP [65160.832723] Modules linked in: [65161.006841] CPU: 39 PID: 195931 Comm: (hrottler) Kdump: loaded Nottainted 5.10.0 #51 [65161.016660] Hardware name: Huawei TaiShan 200 (Model 5280)/BC82AMDD, BIOS 1.08 12/14/2019 [65161.026146] pstate: 80400089 (Nzcv daIf +PAN -UAO -TCO BTYPE=--) [65161.033199] pc : set_task_select_cpus+0x8c/0x3d0 [65161.038865] lr : select_task_rq_fair+0x1c8/0x5cc [65161.044528] sp : ffff800172673ba0 [65161.048888] x29: ffff800172673ba0 x28: ffff00303f22cd00 [65161.055237] x27: 0000000000000027 x26: 0000000000000027 [65161.061583] x25: 0000aaaafd32b180 x24: 0000000000000002 [65161.067925] x23: ffff00303f22cd00 x22: 0000000000000000 [65161.074264] x21: ffff800172673cc4 x20: ffff00303f22cd00 [65161.080603] x19: ffff00303f22d7f4 x18: 0000000000000000 [65161.086938] x17: 0000000000000000 x16: 0000000000000000 [65161.093266] x15: 0000aaaafd365130 x14: 0000000000000000 [65161.099584] x13: 0000000000000000 x12: 0000000000000000 [65161.105892] x11: 0000000000000000 x10: 0000000000000000 [65161.112194] x9 : ffff800010129e80 x8 : 0000000000000000 [65161.118489] x7 : ffff00303f22cd00 x6 : 0000000000000001 [65161.124776] x5 : 0000000000000000 x4 : ffff8000118f5008 [65161.131058] x3 : 0000000000000000 x2 : 0000000000000002 [65161.137331] x1 : ffff800172673cc4 x0 : 0000000000000000 [65161.143598] Call trace: [65161.147005] set_task_select_cpus+0x8c/0x3d0 [65161.152225] select_task_rq_fair+0x1c8/0x5cc [65161.157439] sched_exec+0x94/0x1bc [65161.161782] bprm_execve.part.0+0x60/0x164 [65161.166813] bprm_execve+0x78/0xc0 [65161.171143] do_execveat_common+0x1c4/0x250 [65161.176244] __arm64_sys_execve+0x48/0x70 [65161.181167] invoke_syscall+0x50/0x130 [65161.185824] el0_svc_common.constprop.0+0x158/0x180 [65161.191601] do_el0_svc+0x34/0xe0 [65161.195816] el0_svc+0x20/0x30 [65161.199773] el0_sync_handler+0xb8/0xc0 [65161.204502] el0_sync+0x1e8/0x200 [65161.208712] Code: d50323bf d65f03c0 f941ac00 f941c400 (f9400400) It's panic on task_group(current)->auto_affinity dereference. In the scenario like: CPU0 CPU1 rmdir cgroup free auto_affinity try to wake up select_task_rq_fair auto_affinity(NULL) dereference panic Because there is no protect when remove task from one cgroup with task wakeup, so we need to check auto_affinity is NULL in task_prefer_cpus. Fixes: 6eb07f9925a9 ("sched: Introduce smart grid scheduling strategy for cfs") Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- kernel/sched/fair.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 84af50f4285f..d2efd40fb784 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -6833,7 +6833,8 @@ static void smart_grid_usage_dec(void) static inline struct cpumask *task_prefer_cpus(struct task_struct *p) { - if (!smart_grid_used()) + if (!smart_grid_used() || + !task_group(p)->auto_affinity) return p->prefer_cpus; if (task_group(p)->auto_affinity->mode == 0) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] sched: smart_grid: fix potential NULL pointer dereference
by Yipeng Zou 19 Jun '24

19 Jun '24

hulk inclusion Category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA6J1H ---------------------------------------- There is a low probability that kernel panic will occur when we test with smart_grid. The log show below: [65160.746953] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 [65160.746990] Unable to handle kernel NULL pointer dereference at virtual address 000000000000000 [65160.756974] Mem abort info: [65160.766849] Mem abort info: [65160.770660] ESR = 0x96000004 [65160.770663] EC = 0x25: DABT (current EL), IL = 32 bits [65160.774374] ESR = 0x96000004 [65160.774377] EC = 0x25: DABT (current EL), IL = 32 bits [65160.778428] SET = 0, FnV = 0 [65160.778430] EA = 0, S1PTW = 0 [65160.784728] SET = 0, FnV = 0 [65160.784731] EA = 0, S1PTW = 0 [65160.786018] Detected VIPT I-cache on CPU104 [65160.786070] GICv3: CPU104: found redistributor 3a0000 region 104: 0x00002000aa300000 [65160.786240] CPU104: Booted secondary processor 0x00003a0000 [0x481fd010] [65160.788696] Data abort info: [65160.788699] ISV = 0, ISS = 0x00000004 [65160.794911] Data abort info: [65160.794913] ISV = 0, ISS = 0x00000004 [65160.798965] CM = 0, WnR = 0 [65160.798967] user pgtable: 4k pages, 48-bit VAs, pgdp=00000030059b2000 [65160.803102] CM = 0, WnR = 0 [65160.803104] user pgtable: 4k pages, 48-bit VAs, pgdp=00000020ab07c000 [65160.807066] [0000000000000008] pgd=0000000000000000, p4d=0000000000000000 [65160.811113] [0000000000000008] pgd=0000000000000000, p4d=0000000000000000 [65160.816199] Internal error: Oops: 0000000096000004 [#1] SMP [65160.832723] Modules linked in: [65161.006841] CPU: 39 PID: 195931 Comm: (hrottler) Kdump: loaded Nottainted 5.10.0 #51 [65161.016660] Hardware name: Huawei TaiShan 200 (Model 5280)/BC82AMDD, BIOS 1.08 12/14/2019 [65161.026146] pstate: 80400089 (Nzcv daIf +PAN -UAO -TCO BTYPE=--) [65161.033199] pc : set_task_select_cpus+0x8c/0x3d0 [65161.038865] lr : select_task_rq_fair+0x1c8/0x5cc [65161.044528] sp : ffff800172673ba0 [65161.048888] x29: ffff800172673ba0 x28: ffff00303f22cd00 [65161.055237] x27: 0000000000000027 x26: 0000000000000027 [65161.061583] x25: 0000aaaafd32b180 x24: 0000000000000002 [65161.067925] x23: ffff00303f22cd00 x22: 0000000000000000 [65161.074264] x21: ffff800172673cc4 x20: ffff00303f22cd00 [65161.080603] x19: ffff00303f22d7f4 x18: 0000000000000000 [65161.086938] x17: 0000000000000000 x16: 0000000000000000 [65161.093266] x15: 0000aaaafd365130 x14: 0000000000000000 [65161.099584] x13: 0000000000000000 x12: 0000000000000000 [65161.105892] x11: 0000000000000000 x10: 0000000000000000 [65161.112194] x9 : ffff800010129e80 x8 : 0000000000000000 [65161.118489] x7 : ffff00303f22cd00 x6 : 0000000000000001 [65161.124776] x5 : 0000000000000000 x4 : ffff8000118f5008 [65161.131058] x3 : 0000000000000000 x2 : 0000000000000002 [65161.137331] x1 : ffff800172673cc4 x0 : 0000000000000000 [65161.143598] Call trace: [65161.147005] set_task_select_cpus+0x8c/0x3d0 [65161.152225] select_task_rq_fair+0x1c8/0x5cc [65161.157439] sched_exec+0x94/0x1bc [65161.161782] bprm_execve.part.0+0x60/0x164 [65161.166813] bprm_execve+0x78/0xc0 [65161.171143] do_execveat_common+0x1c4/0x250 [65161.176244] __arm64_sys_execve+0x48/0x70 [65161.181167] invoke_syscall+0x50/0x130 [65161.185824] el0_svc_common.constprop.0+0x158/0x180 [65161.191601] do_el0_svc+0x34/0xe0 [65161.195816] el0_svc+0x20/0x30 [65161.199773] el0_sync_handler+0xb8/0xc0 [65161.204502] el0_sync+0x1e8/0x200 [65161.208712] Code: d50323bf d65f03c0 f941ac00 f941c400 (f9400400) It's panic on task_group(current)->auto_affinity dereference. In the scenario like: CPU0 CPU1 rmdir cgroup free auto_affinity try to wake up select_task_rq_fair auto_affinity(NULL) dereference panic Because there is no protect when remove task from one cgroup with task wakeup, so we need to check auto_affinity is NULL in task_prefer_cpus. Fixes: 21e5d85e205f ("sched: Fix possible deadlock in tg_set_dynamic_affinity_mode") Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- kernel/sched/fair.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index aee13d30a7de..63f4344ac344 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -5329,7 +5329,8 @@ static inline struct cpumask *task_prefer_cpus(struct task_struct *p) { struct affinity_domain *ad; - if (!smart_grid_used()) + if (!smart_grid_used() || + !task_group(p)->auto_affinity) return p->prefer_cpus; if (task_group(p)->auto_affinity->mode == 0) -- 2.34.1

2 1

[PATCH OLK-5.10] sched: smart_grid: fix potential NULL pointer dereference
by Yipeng Zou 19 Jun '24

19 Jun '24

hulk inclusion Category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA6J1H CVE: NA ---------------------------------------- There is a low probability that kernel panic will occur when we test with smart_grid. The log show below: [65160.746953] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 [65160.746990] Unable to handle kernel NULL pointer dereference at virtual address 000000000000000 [65160.756974] Mem abort info: [65160.766849] Mem abort info: [65160.770660] ESR = 0x96000004 [65160.770663] EC = 0x25: DABT (current EL), IL = 32 bits [65160.774374] ESR = 0x96000004 [65160.774377] EC = 0x25: DABT (current EL), IL = 32 bits [65160.778428] SET = 0, FnV = 0 [65160.778430] EA = 0, S1PTW = 0 [65160.784728] SET = 0, FnV = 0 [65160.784731] EA = 0, S1PTW = 0 [65160.786018] Detected VIPT I-cache on CPU104 [65160.786070] GICv3: CPU104: found redistributor 3a0000 region 104: 0x00002000aa300000 [65160.786240] CPU104: Booted secondary processor 0x00003a0000 [0x481fd010] [65160.788696] Data abort info: [65160.788699] ISV = 0, ISS = 0x00000004 [65160.794911] Data abort info: [65160.794913] ISV = 0, ISS = 0x00000004 [65160.798965] CM = 0, WnR = 0 [65160.798967] user pgtable: 4k pages, 48-bit VAs, pgdp=00000030059b2000 [65160.803102] CM = 0, WnR = 0 [65160.803104] user pgtable: 4k pages, 48-bit VAs, pgdp=00000020ab07c000 [65160.807066] [0000000000000008] pgd=0000000000000000, p4d=0000000000000000 [65160.811113] [0000000000000008] pgd=0000000000000000, p4d=0000000000000000 [65160.816199] Internal error: Oops: 0000000096000004 [#1] SMP [65160.832723] Modules linked in: [65161.006841] CPU: 39 PID: 195931 Comm: (hrottler) Kdump: loaded Nottainted 5.10.0 #51 [65161.016660] Hardware name: Huawei TaiShan 200 (Model 5280)/BC82AMDD, BIOS 1.08 12/14/2019 [65161.026146] pstate: 80400089 (Nzcv daIf +PAN -UAO -TCO BTYPE=--) [65161.033199] pc : set_task_select_cpus+0x8c/0x3d0 [65161.038865] lr : select_task_rq_fair+0x1c8/0x5cc [65161.044528] sp : ffff800172673ba0 [65161.048888] x29: ffff800172673ba0 x28: ffff00303f22cd00 [65161.055237] x27: 0000000000000027 x26: 0000000000000027 [65161.061583] x25: 0000aaaafd32b180 x24: 0000000000000002 [65161.067925] x23: ffff00303f22cd00 x22: 0000000000000000 [65161.074264] x21: ffff800172673cc4 x20: ffff00303f22cd00 [65161.080603] x19: ffff00303f22d7f4 x18: 0000000000000000 [65161.086938] x17: 0000000000000000 x16: 0000000000000000 [65161.093266] x15: 0000aaaafd365130 x14: 0000000000000000 [65161.099584] x13: 0000000000000000 x12: 0000000000000000 [65161.105892] x11: 0000000000000000 x10: 0000000000000000 [65161.112194] x9 : ffff800010129e80 x8 : 0000000000000000 [65161.118489] x7 : ffff00303f22cd00 x6 : 0000000000000001 [65161.124776] x5 : 0000000000000000 x4 : ffff8000118f5008 [65161.131058] x3 : 0000000000000000 x2 : 0000000000000002 [65161.137331] x1 : ffff800172673cc4 x0 : 0000000000000000 [65161.143598] Call trace: [65161.147005] set_task_select_cpus+0x8c/0x3d0 [65161.152225] select_task_rq_fair+0x1c8/0x5cc [65161.157439] sched_exec+0x94/0x1bc [65161.161782] bprm_execve.part.0+0x60/0x164 [65161.166813] bprm_execve+0x78/0xc0 [65161.171143] do_execveat_common+0x1c4/0x250 [65161.176244] __arm64_sys_execve+0x48/0x70 [65161.181167] invoke_syscall+0x50/0x130 [65161.185824] el0_svc_common.constprop.0+0x158/0x180 [65161.191601] do_el0_svc+0x34/0xe0 [65161.195816] el0_svc+0x20/0x30 [65161.199773] el0_sync_handler+0xb8/0xc0 [65161.204502] el0_sync+0x1e8/0x200 [65161.208712] Code: d50323bf d65f03c0 f941ac00 f941c400 (f9400400) It's panic on task_group(current)->auto_affinity dereference. In the scenario like: CPU0 CPU1 rmdir cgroup free auto_affinity try to wake up select_task_rq_fair auto_affinity(NULL) dereference panic Because there is no protect when remove task from one cgroup with task wakeup, so we need to check auto_affinity is NULL in task_prefer_cpus. Fixes: 90ef693102cc ("sched: Fix possible deadlock in tg_set_dynamic_affinity_mode") Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- kernel/sched/fair.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 273f6844bc2a..a6145cc1426d 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -5988,7 +5988,8 @@ static void smart_grid_usage_dec(void) static inline struct cpumask *task_prefer_cpus(struct task_struct *p) { - if (!smart_grid_used()) + if (!smart_grid_used() || + !task_group(p)->auto_affinity) return p->prefer_cpus; if (task_group(p)->auto_affinity->mode == 0) -- 2.34.1

2 1

[PATCH OLK-5.10] crypto: jitter - change subsys_initcall(jent_mod_init) back to module_init(jent_mod_init)
by Xiang Yang 19 Jun '24

19 Jun '24

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA6GL4 -------------------------------- jent_entropy_init depend on the clocksource being initialized, with the subsys_initcall(jent_mod_init) called in arm32, the initialization of clocksource is after jent_mod_init, so change the subsys_initcall in arm32 to module_init. And the fips depend on jitter init, this feature is controlled by CONFIG_CRYPTO_FIPS, so use CONFIG_CRYPTO_FIPS to isolate the case of the fips problem for arm64/x86 with the dependance of clocksource for arm32. Fixes: 793bff91b406 ("[Huawei] crypto: jitter - change module_init(jent_mod_init) to subsys_initcall(jent_mod_init)") Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- crypto/jitterentropy-kcapi.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/crypto/jitterentropy-kcapi.c b/crypto/jitterentropy-kcapi.c index b1d7b5a6e61c..4424664496e1 100644 --- a/crypto/jitterentropy-kcapi.c +++ b/crypto/jitterentropy-kcapi.c @@ -214,7 +214,11 @@ static void __exit jent_mod_exit(void) crypto_unregister_rng(&jent_alg); } +#if defined(CONFIG_CRYPTO_FIPS) && (defined(CONFIG_ARM64) || defined(CONFIG_X86)) subsys_initcall(jent_mod_init); +#else +module_init(jent_mod_init); +#endif module_exit(jent_mod_exit); MODULE_LICENSE("Dual BSD/GPL"); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] spi: Fix deadlock when adding SPI controllers on SPI buses
by Zeng Heng 19 Jun '24

19 Jun '24

Mark Brown (1): spi: Fix deadlock when adding SPI controllers on SPI buses Zeng Heng (1): spi: fix kabi breakage in struct spi_controller drivers/spi/spi.c | 15 +++++---------- include/linux/device.h | 8 ++++++++ 2 files changed, 13 insertions(+), 10 deletions(-) -- 2.25.1

2 3

openEuler Kernel SIG双周例会
by openEuler conference 19 Jun '24

19 Jun '24

您好！ Kernel 邀请您参加 2024-06-21 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中（新增议题可回复本邮件申请，或直接填写至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/960944013 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2024-06-21 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 议题征集中（新增议题可回复本邮件申请，或直接填写至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/960944013. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. More information: https://www.openeuler.org/en/

1 0

[openeuler:openEuler-1.0-LTS 14909/22966] drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9556:5: sparse: sparse: symbol 'hclge_reset_tqp_cmd' was not declared. Should it be static?
by kernel test robot 19 Jun '24

19 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 26bfb7d9b0ef31487312e8e9e6eb097acaf5d739 commit: 729f96a4e0c32f1c1bfa60e4ff485aa91890963d [14909/22966] net: hns3: optimize the process of queue reset config: arm64-randconfig-r111-20240615 (https://download.01.org/0day-ci/archive/20240619/202406191011.L7AJtzLw-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240619/202406191011.L7AJtzLw-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406191011.L7AJtzLw-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3345:5: sparse: sparse: symbol 'hclge_set_all_vf_rst' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9556:5: sparse: sparse: symbol 'hclge_reset_tqp_cmd' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9603:5: sparse: sparse: symbol 'hclge_reset_rcb' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:11592:21: sparse: sparse: symbol 'hclge_ops' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3345:5: warning: no previous prototype for 'hclge_set_all_vf_rst' [-Wmissing-prototypes] 3345 | int hclge_set_all_vf_rst(struct hclge_dev *hdev, bool reset) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9556:5: warning: no previous prototype for 'hclge_reset_tqp_cmd' [-Wmissing-prototypes] 9556 | int hclge_reset_tqp_cmd(struct hnae3_handle *handle) | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9603:5: warning: no previous prototype for 'hclge_reset_rcb' [-Wmissing-prototypes] 9603 | int hclge_reset_rcb(struct hnae3_handle *handle) | ^~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:11699:5: warning: no previous prototype for 'hclge_init' [-Wmissing-prototypes] 11699 | int hclge_init(void) | ^~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c: In function 'hclge_get_strings': drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:668:50: warning: '%s' directive output may be truncated writing up to 3359 bytes into a region of size 32 [-Wformat-truncation=] 668 | snprintf(buff, ETH_GSTRING_LEN, "%s", strs[i].desc); | ^~ In function 'hclge_comm_get_strings', inlined from 'hclge_get_strings' at drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:774:7: drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:668:17: note: 'snprintf' output between 1 and 3360 bytes into a destination of size 32 668 | snprintf(buff, ETH_GSTRING_LEN, "%s", strs[i].desc); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h:9, from drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:18: In function 'hclge_func_reset_cmd', inlined from 'hclge_reset_prepare_wait' at drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3608:9: drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3467:26: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 3467 | hnae3_set_bit(req->mac_func_reset, HCLGE_CFG_RESET_FUNC_B, 1); drivers/net/ethernet/hisilicon/hns3/hnae3.h:720:18: note: in definition of macro 'hnae3_set_field' 720 | (origin) &= (~(mask)); 35- | ^~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3467:9: note: in expansion of macro 'hnae3_set_bit' 3467 | hnae3_set_bit(req->mac_func_reset, HCLGE_CFG_RESET_FUNC_B, 1); | ^~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c: In function 'hclge_reset_prepare_wait': drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3462:27: note: at offset 8 into object 'desc' of size 32 3462 | struct hclge_desc desc; | ^~~~ In function 'hclge_func_reset_cmd', inlined from 'hclge_reset_prepare_wait' at drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3608:9: drivers/net/ethernet/hisilicon/hns3/hnae3.h:721:26: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 721 | (origin) |= ((val) << (shift)) & (mask); 47- | ~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hnae3.h:726:9: note: in expansion of macro 'hnae3_set_field' 726 | hnae3_set_field((origin), (0x1 << (shift)), (shift), (val)) | ^~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3467:9: note: in expansion of macro 'hnae3_set_bit' 3467 | hnae3_set_bit(req->mac_func_reset, HCLGE_CFG_RESET_FUNC_B, 1); | ^~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c: In function 'hclge_reset_prepare_wait': drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3462:27: note: at offset 8 into object 'desc' of size 32 3462 | struct hclge_desc desc; | ^~~~ In function 'hclge_func_reset_cmd', inlined from 'hclge_reset_prepare_wait' at drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3608:9: drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3468:29: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 3468 | req->fun_reset_vfid = func_id; | ~~~~~~~~~~~~~~~~~~~~^~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c: In function 'hclge_reset_prepare_wait': drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3462:27: note: at offset 8 into object 'desc' of size 32 3462 | struct hclge_desc desc; | ^~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c: In function 'hclge_func_reset_cmd': drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3467:26: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 3467 | hnae3_set_bit(req->mac_func_reset, HCLGE_CFG_RESET_FUNC_B, 1); | ^~ drivers/net/ethernet/hisilicon/hns3/hnae3.h:720:18: note: in definition of macro 'hnae3_set_field' 720 | (origin) &= (~(mask)); 73- | ^~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3467:9: note: in expansion of macro 'hnae3_set_bit' 3467 | hnae3_set_bit(req->mac_func_reset, HCLGE_CFG_RESET_FUNC_B, 1); | ^~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3462:27: note: at offset 8 into object 'desc' of size 32 3462 | struct hclge_desc desc; | ^~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3467:26: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 3467 | hnae3_set_bit(req->mac_func_reset, HCLGE_CFG_RESET_FUNC_B, 1); | ^~ drivers/net/ethernet/hisilicon/hns3/hnae3.h:721:18: note: in definition of macro 'hnae3_set_field' 721 | (origin) |= ((val) << (shift)) & (mask); 85- | ^~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3467:9: note: in expansion of macro 'hnae3_set_bit' 3467 | hnae3_set_bit(req->mac_func_reset, HCLGE_CFG_RESET_FUNC_B, 1); | ^~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3462:27: note: at offset 8 into object 'desc' of size 32 3462 | struct hclge_desc desc; | ^~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3468:12: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 3468 | req->fun_reset_vfid = func_id; | ^~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3462:27: note: at offset 8 into object 'desc' of size 32 3462 | struct hclge_desc desc; | ^~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c: In function 'hclge_reset_rcb': drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9619:26: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 9619 | hnae3_set_bit(req->fun_reset_rcb, HCLGE_CFG_RESET_RCB_B, 1); | ^~ drivers/net/ethernet/hisilicon/hns3/hnae3.h:720:18: note: in definition of macro 'hnae3_set_field' vim +/hclge_reset_tqp_cmd +9556 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c 9555 > 9556 int hclge_reset_tqp_cmd(struct hnae3_handle *handle) 9557 { 9558 struct hclge_vport *vport = hclge_get_vport(handle); 9559 struct hclge_dev *hdev = vport->back; 9560 u16 reset_try_times = 0; 9561 int reset_status; 9562 u16 queue_gid; 9563 int ret; 9564 u16 i; 9565 9566 for (i = 0; i < handle->kinfo.num_tqps; i++) { 9567 queue_gid = hclge_covert_handle_qid_global(handle, i); 9568 ret = hclge_reset_tqp_cmd_send(hdev, queue_gid, true); 9569 if (ret) { 9570 dev_err(&hdev->pdev->dev, 9571 "failed to send reset tqp cmd, ret = %d\n", 9572 ret); 9573 return ret; 9574 } 9575 9576 while (reset_try_times++ < HCLGE_TQP_RESET_TRY_TIMES) { 9577 reset_status = hclge_get_reset_status(hdev, queue_gid); 9578 if (reset_status) 9579 break; 9580 9581 /* Wait for tqp hw reset */ 9582 usleep_range(1000, 1200); 9583 } 9584 9585 if (reset_try_times >= HCLGE_TQP_RESET_TRY_TIMES) { 9586 dev_err(&hdev->pdev->dev, 9587 "wait for tqp hw reset timeout\n"); 9588 return -ETIME; 9589 } 9590 9591 ret = hclge_reset_tqp_cmd_send(hdev, queue_gid, false); 9592 if (ret) { 9593 dev_err(&hdev->pdev->dev, 9594 "failed to deassert soft reset, ret = %d\n", 9595 ret); 9596 return ret; 9597 } 9598 reset_try_times = 0; 9599 } 9600 return 0; 9601 } 9602 > 9603 int hclge_reset_rcb(struct hnae3_handle *handle) 9604 { 9605 #define HCLGE_RESET_RCB_NOT_SUPPORT 0U 9606 #define HCLGE_RESET_RCB_SUCCESS 1U 9607 struct hclge_vport *vport = hclge_get_vport(handle); 9608 struct hclge_dev *hdev = vport->back; 9609 struct hclge_reset_cmd *req; 9610 struct hclge_desc desc; 9611 u8 return_status; 9612 u16 queue_gid; 9613 int ret; 9614 9615 queue_gid = hclge_covert_handle_qid_global(handle, 0); 9616 9617 req = (struct hclge_reset_cmd *)desc.data; 9618 hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_CFG_RST_TRIGGER, false); 9619 hnae3_set_bit(req->fun_reset_rcb, HCLGE_CFG_RESET_RCB_B, 1); 9620 req->fun_reset_rcb_vqid_start = cpu_to_le16(queue_gid); 9621 req->fun_reset_rcb_vqid_num = cpu_to_le16(handle->kinfo.num_tqps); 9622 9623 ret = hclge_cmd_send(&hdev->hw, &desc, 1); 9624 if (ret) { 9625 dev_err(&hdev->pdev->dev, 9626 "failed to send rcb reset cmd, ret = %d\n", ret); 9627 return ret; 9628 } 9629 9630 return_status = req->fun_reset_rcb_return_status; 9631 if (return_status == HCLGE_RESET_RCB_SUCCESS) 9632 return 0; 9633 9634 if (return_status != HCLGE_RESET_RCB_NOT_SUPPORT) { 9635 dev_err(&hdev->pdev->dev, "failed to reset rcb, ret = %u\n", 9636 return_status); 9637 return -EIO; 9638 } 9639 9640 /* if reset rcb cmd is unsupported, we need to send reset tqp cmd 9641 * again to reset all tqps 9642 */ 9643 return hclge_reset_tqp_cmd(handle); 9644 } 9645 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/5] cachefiles: Introduce failover mechanism for on-demand mode
by Zizhi Wo 19 Jun '24

19 Jun '24

Introduce failover mechanism for on-demand mode Jia Zhu (5): cachefiles: introduce object ondemand state cachefiles: extract ondemand info field from cachefiles_object cachefiles: resend an open request if the read request's object is closed cachefiles: narrow the scope of triggering EPOLLIN events in ondemand mode cachefiles: add restore command to recover inflight ondemand read requests fs/cachefiles/daemon.c | 15 +++- fs/cachefiles/interface.c | 7 +- fs/cachefiles/internal.h | 59 +++++++++++++- fs/cachefiles/ondemand.c | 166 ++++++++++++++++++++++++++++---------- 4 files changed, 201 insertions(+), 46 deletions(-) -- 2.39.2

2 6