- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6] BUILD SUCCESS 0e6ac87df9e5122747ac5d9e7da9a45555f16374
by kernel test robot 24 Feb '24

24 Feb '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 0e6ac87df9e5122747ac5d9e7da9a45555f16374 !3880 ima: Add IMA digest lists extension Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-randconfig-001-20240224 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- loongarch-allmodconfig | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- loongarch-randconfig-001-20240224 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- loongarch-randconfig-002-20240224 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device `-- x86_64-randconfig-161-20240224 `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device clang_recent_errors |-- arm64-allmodconfig | |-- WARNING:modpost:vmlinux:section-mismatch-in-reference:resctrl_init-(section:.text)-rdtgroup_setup_default-(section:.init.text) | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_config_pix_clock | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_fb_format_check | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_plane_get_cursor_format | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_plane_get_primary_format | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_reset | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_update_cursor_hi_addr | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_update_primary_hi_addr | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_vram_init | |-- drivers-gpu-drm-phytium-pe22_dp.c:warning:no-previous-prototype-for-function-pe22_dp_hw_get_source_lane_count | |-- drivers-gpu-drm-phytium-pe22_dp.c:warning:no-previous-prototype-for-function-pe22_dp_hw_reset | |-- drivers-gpu-drm-phytium-pe22_dp.c:warning:no-previous-prototype-for-function-pe22_dp_hw_spread_is_enable | |-- drivers-gpu-drm-phytium-phytium_crtc.c:warning:no-previous-prototype-for-function-phytium_crtc_atomic_destroy_state | |-- drivers-gpu-drm-phytium-phytium_crtc.c:warning:no-previous-prototype-for-function-phytium_crtc_atomic_duplicate_state | |-- drivers-gpu-drm-phytium-phytium_debugfs.c:warning:no-previous-prototype-for-function-phytium_debugfs_connector_add | |-- drivers-gpu-drm-phytium-phytium_debugfs.c:warning:no-previous-prototype-for-function-phytium_debugfs_display_register | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_adjust_link_train_parameter | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_coding_8b10b_need_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_dpcd_sink_dpms | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_encoder_destroy | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_fast_link_train | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_get_link_train_fallback_values | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hpd_poll_handler | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_config_video | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_disable_input_source | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_disable_output | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_disable_video | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_audio | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_input_source | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_output | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_video | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_hpd_irq_setup | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_init | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_output_is_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_video_is_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_scrambled_need_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_start_link_train | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_encoder_mode_valid | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_get_encoder_crtc_mask | |-- drivers-gpu-drm-phytium-phytium_fbdev.c:warning:no-previous-prototype-for-function-phytium_drm_fbdev_fini | |-- drivers-gpu-drm-phytium-phytium_fbdev.c:warning:no-previous-prototype-for-function-phytium_drm_fbdev_init | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_dma_transfer | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_gem_prime_vmap | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_gem_prime_vunmap | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_memory_pool_alloc | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_memory_pool_free | |-- drivers-gpu-drm-phytium-phytium_panel.c:warning:no-previous-prototype-for-function-phytium_dp_panel_release_backlight_funcs | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_dma_fini | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_dma_init | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_vram_fini | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_vram_hw_init | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_vram_init | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_atomic_destroy_state | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_atomic_duplicate_state | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_atomic_set_property | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_destroy | |-- drivers-gpu-drm-phytium-phytium_platform.c:warning:no-previous-prototype-for-function-phytium_platform_carveout_mem_fini | |-- drivers-gpu-drm-phytium-phytium_platform.c:warning:no-previous-prototype-for-function-phytium_platform_carveout_mem_init | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_clear_msi_irq | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_config_pix_clock | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_disable | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_fb_format_check | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_plane_get_cursor_format | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_plane_get_primary_format | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_update_dcreq | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_update_primary_hi_addr | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_vram_init | |-- drivers-gpu-drm-phytium-px210_dp.c:warning:no-previous-prototype-for-function-px210_dp_hw_get_source_lane_count | |-- drivers-gpu-drm-phytium-px210_dp.c:warning:no-previous-prototype-for-function-px210_dp_hw_reset | |-- drivers-gpu-drm-phytium-px210_dp.c:warning:no-previous-prototype-for-function-px210_dp_hw_spread_is_enable | `-- drivers-iommu-arm-arm-smmu-v3-arm-smmu-v3.c:warning:variable-pre_addr-is-uninitialized-when-used-here |-- arm64-randconfig-003-20240224 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- arm64-randconfig-004-20240224 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-allyesconfig | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-sm3_generic_block_fn | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-zx_sm3_finup | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-zx_sm3_update | |-- arch-x86-crypto-sm4-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-gmi_sm4_set_key | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-base_offset-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-pin-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-value_back-set-but-not-used | `-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-value_read-set-but-not-used `-- x86_64-rhel-8.3-rust `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device elapsed time: 993m configs tested: 16 configs skipped: 126 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240224 gcc arm64 randconfig-002-20240224 gcc arm64 randconfig-003-20240224 clang arm64 randconfig-004-20240224 clang loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240224 gcc loongarch randconfig-002-20240224 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 17747/21632] drivers/dax/pmem/.tmp_core.o: warning: objtool: missing symbol for section .text
by kernel test robot 24 Feb '24

24 Feb '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b97b63500af297c36f80416fd1f1193d227cf51a commit: 31251a62e6358cf3a099926bfecf4170263b4bf8 [17747/21632] Intel: device-dax: Add /sys/class/dax backwards compatibility config: x86_64-buildonly-randconfig-003-20240220 (https://download.01.org/0day-ci/archive/20240224/202402240932.WccokBnQ-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240224/202402240932.WccokBnQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402240932.WccokBnQ-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/dax/pmem/.tmp_core.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS 4fee6fdef7d687d6ce43289fd7e7f96fde039af0
by kernel test robot 24 Feb '24

24 Feb '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 4fee6fdef7d687d6ce43289fd7e7f96fde039af0 !4662 v3 CVE-2023-52435 elapsed time: 822m configs tested: 11 configs skipped: 131 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240224 gcc arm64 randconfig-002-20240224 gcc arm64 randconfig-003-20240224 clang arm64 randconfig-004-20240224 clang x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH V5 OLK-6.6 00/13] Backport vDPA migration support patches
by Jiang Dongxu 23 Feb '24

23 Feb '24

From: shaodenghui <shaodenghui(a)huawei.com> Backport vDPA migration support patches merged on branch OLK-5.10 V5: fix compile error of kernel-6.6 new vdpa driver eni_vdpa V4: add CONFIG_VHOST_VDPA_MIGRATION to control vdpa migration code compile or not. V3: fix compile error of kernel-6.6 new vdpa driver pds_vdpa V2: fix compile error of kernel-6.6 new vdpa driver vduse and snet_vdpa jiangdongxu (13): vdpa: add log operations vhost-vdpa: add uAPI for logging vdpa: add device state operations vhost-vdpa: add uAPI for device buffer vdpa: add vdpa device migration status ops vhost-vdpa: add uAPI for device migration status vhost: add VHOST feature VHOST_BACKEND_F_BYTEMAPLOG vhost-vdpa: Allow transparent MSI IOV vhost-vdpa: fix msi irq request err vhost-vdpa: allow set feature VHOST_F_LOG_ALL when been negotiated. vhost-vdpa: add reset state params to indicate reset level vdpa: add vmstate header file vdpa: add CONFIG_VHOST_VDPA_MIGRATION arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + drivers/vdpa/alibaba/eni_vdpa.c | 2 +- drivers/vdpa/ifcvf/ifcvf_main.c | 2 +- drivers/vdpa/mlx5/net/mlx5_vnet.c | 2 +- drivers/vdpa/pds/vdpa_dev.c | 2 +- drivers/vdpa/solidrun/snet_main.c | 2 +- drivers/vdpa/vdpa_sim/vdpa_sim.c | 2 +- drivers/vdpa/vdpa_user/vduse_dev.c | 2 +- drivers/vdpa/virtio_pci/vp_vdpa.c | 2 +- drivers/vhost/Kconfig | 11 ++ drivers/vhost/vdpa.c | 238 ++++++++++++++++++++++--- drivers/virtio/virtio_vdpa.c | 2 +- include/linux/vdpa.h | 56 +++++- include/linux/vdpa_vmstate.h | 182 +++++++++++++++++++ include/uapi/linux/vhost.h | 12 ++ include/uapi/linux/vhost_types.h | 19 ++ 17 files changed, 506 insertions(+), 32 deletions(-) create mode 100644 include/linux/vdpa_vmstate.h -- 2.27.0

2 14

[PATCH OLK-6.6] kvm: kabi: KABI reservation for RME
by Guangwei Zhou 23 Feb '24

23 Feb '24

driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I92TT5 CVE: NA ---------------------------------------------------------------------- Reserve KABI for struct kvm_arch and struct kvm_vcpu_arch for ARMv9 RME feature. Signed-off-by: Guangwei Zhou <zhouguangwei5(a)huawei.com> --- arch/arm64/include/asm/kvm_host.h | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h index bd7552746f9e..69d4d9466a4f 100644 --- a/arch/arm64/include/asm/kvm_host.h +++ b/arch/arm64/include/asm/kvm_host.h @@ -27,6 +27,7 @@ #include <asm/fpsimd.h> #include <asm/kvm.h> #include <asm/kvm_asm.h> +#include <linux/kabi.h> #define __KVM_HAVE_ARCH_INTC_INITIALIZED @@ -279,6 +280,15 @@ struct kvm_arch { * the associated pKVM instance in the hypervisor. */ struct kvm_protected_vm pkvm; + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + KABI_RESERVE(8) }; struct kvm_vcpu_fault_info { @@ -591,6 +601,26 @@ struct kvm_vcpu_arch { /* Per-vcpu CCSIDR override or NULL */ u32 *ccsidr; + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + KABI_RESERVE(8) + KABI_RESERVE(9) + KABI_RESERVE(10) + KABI_RESERVE(11) + KABI_RESERVE(12) + KABI_RESERVE(13) + KABI_RESERVE(14) + KABI_RESERVE(15) + KABI_RESERVE(16) + KABI_RESERVE(17) + KABI_RESERVE(18) + KABI_RESERVE(19) }; /* -- 2.33.0

2 1

[PATCH OLK-5.10] uio: Fix use-after-free in uio_open
by Guo Mengqi 23 Feb '24

23 Feb '24

From: Guanghui Feng <guanghuifeng(a)linux.alibaba.com> stable inclusion from stable-v5.10.209 commit 5e0be1229ae199ebb90b33102f74a0f22d152570 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I92HXN CVE: CVE-2023-52439 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0c9ae0b8605078eafc3bea053cc78791e97ba2e2 upstream. core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev = idr_find() device_unregister(&idev->dev) put_device(&idev->dev) uio_device_release get_device(&idev->dev) kfree(idev) uio_free_minor(minor) uio_release put_device(&idev->dev) kfree(idev) ------------------------------------------------------- In the core-1 uio_unregister_device(), the device_unregister will kfree idev when the idev->dev kobject ref is 1. But after core-1 device_unregister, put_device and before doing kfree, the core-2 may get_device. Then: 1. After core-1 kfree idev, the core-2 will do use-after-free for idev. 2. When core-2 do uio_release and put_device, the idev will be double freed. To address this issue, we can get idev atomic & inc idev reference with minor_lock. Fixes: 57c5f4df0a5a ("uio: fix crash after the device is unregistered") Cc: stable <stable(a)kernel.org> Signed-off-by: Guanghui Feng <guanghuifeng(a)linux.alibaba.com> Reviewed-by: Baolin Wang <baolin.wang(a)linux.alibaba.com> Link: https://lore.kernel.org/r/1703152663-59949-1-git-send-email-guanghuifeng@li… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/uio/uio.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c index be06f1a961c2..f453b3c7ee42 100644 --- a/drivers/uio/uio.c +++ b/drivers/uio/uio.c @@ -464,13 +464,13 @@ static int uio_open(struct inode *inode, struct file *filep) mutex_lock(&minor_lock); idev = idr_find(&uio_idr, iminor(inode)); - mutex_unlock(&minor_lock); if (!idev) { ret = -ENODEV; + mutex_unlock(&minor_lock); goto out; } - get_device(&idev->dev); + mutex_unlock(&minor_lock); if (!try_module_get(idev->owner)) { ret = -ENODEV; @@ -1062,9 +1062,8 @@ void uio_unregister_device(struct uio_info *info) wake_up_interruptible(&idev->wait); kill_fasync(&idev->async_queue, SIGIO, POLL_HUP); - device_unregister(&idev->dev); - uio_free_minor(minor); + device_unregister(&idev->dev); return; } -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS] uio: Fix use-after-free in uio_open
by Guo Mengqi 23 Feb '24

23 Feb '24

From: Guanghui Feng <guanghuifeng(a)linux.alibaba.com> stable inclusion from stable-v4.19.306 commit 3174e0f7de1ba392dc191625da83df02d695b60c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I92HXN CVE: CVE-2023-52439 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0c9ae0b8605078eafc3bea053cc78791e97ba2e2 upstream. core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev = idr_find() device_unregister(&idev->dev) put_device(&idev->dev) uio_device_release get_device(&idev->dev) kfree(idev) uio_free_minor(minor) uio_release put_device(&idev->dev) kfree(idev) ------------------------------------------------------- In the core-1 uio_unregister_device(), the device_unregister will kfree idev when the idev->dev kobject ref is 1. But after core-1 device_unregister, put_device and before doing kfree, the core-2 may get_device. Then: 1. After core-1 kfree idev, the core-2 will do use-after-free for idev. 2. When core-2 do uio_release and put_device, the idev will be double freed. To address this issue, we can get idev atomic & inc idev reference with minor_lock. Fixes: 57c5f4df0a5a ("uio: fix crash after the device is unregistered") Cc: stable <stable(a)kernel.org> Signed-off-by: Guanghui Feng <guanghuifeng(a)linux.alibaba.com> Reviewed-by: Baolin Wang <baolin.wang(a)linux.alibaba.com> Link: https://lore.kernel.org/r/1703152663-59949-1-git-send-email-guanghuifeng@li… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/uio/uio.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c index f43498e5cfb8..facccb36f692 100644 --- a/drivers/uio/uio.c +++ b/drivers/uio/uio.c @@ -464,13 +464,13 @@ static int uio_open(struct inode *inode, struct file *filep) mutex_lock(&minor_lock); idev = idr_find(&uio_idr, iminor(inode)); - mutex_unlock(&minor_lock); if (!idev) { ret = -ENODEV; + mutex_unlock(&minor_lock); goto out; } - get_device(&idev->dev); + mutex_unlock(&minor_lock); if (!try_module_get(idev->owner)) { ret = -ENODEV; @@ -1024,9 +1024,8 @@ void uio_unregister_device(struct uio_info *info) wake_up_interruptible(&idev->wait); kill_fasync(&idev->async_queue, SIGIO, POLL_HUP); - device_unregister(&idev->dev); - uio_free_minor(minor); + device_unregister(&idev->dev); return; } -- 2.17.1

2 1

[PATCH OLK-6.6 0/3] audit: Backport mainline patches
by GUO Zihua 23 Feb '24

23 Feb '24

This series backports mainline bugfixes for audit. Jan Kara (3): audit_tree: Remove mark->lock locking audit: Fix possible spurious -ENOSPC error audit: Fix possible tagging failures kernel/audit_tree.c | 61 ++++++++++++++++++++------------------------- 1 file changed, 27 insertions(+), 34 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6 0/1] keys: safe concurrent user->{session,uid}_keyring access
by GUO Zihua 23 Feb '24

23 Feb '24

This patch backports mainline bugfix commit 0b9dc6c9f01c ("keys: safe concurrent user->{session,uid}_keyring access") Jann Horn (1): keys: safe concurrent user->{session,uid}_keyring access include/linux/sched/user.h | 7 +++++++ security/keys/process_keys.c | 31 +++++++++++++++++-------------- security/keys/request_key.c | 5 +++-- 3 files changed, 27 insertions(+), 16 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] keys: safe concurrent user->{session,uid}_keyring access
by GUO Zihua 23 Feb '24

23 Feb '24

This patch backports mainline bugfix commit 0b9dc6c9f01c ("keys: safe concurrent user->{session,uid}_keyring access") Jann Horn (1): keys: safe concurrent user->{session,uid}_keyring access include/linux/sched/user.h | 7 +++++++ security/keys/process_keys.c | 31 +++++++++++++++++-------------- security/keys/request_key.c | 5 +++-- 3 files changed, 27 insertions(+), 16 deletions(-) -- 2.34.1

2 2