- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] vsock/virtio: free queued packets when closing socket
by Ziyang Xuan 05 Mar '24

05 Mar '24

From: Stefano Garzarella <sgarzare(a)redhat.com> mainline inclusion from mainline-v5.13-rc1 commit 8432b8114957235f42e070a16118a7f750de9d39 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94J63 CVE: CVE-2021-47024 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As reported by syzbot [1], there is a memory leak while closing the socket. We partially solved this issue with commit ac03046ece2b ("vsock/virtio: free packets during the socket release"), but we forgot to drain the RX queue when the socket is definitely closed by the scheduled work. To avoid future issues, let's use the new virtio_transport_remove_sock() to drain the RX queue before removing the socket from the af_vsock lists calling vsock_remove_sock(). [1] https://syzkaller.appspot.com/bug?extid=24452624fc4c571eedd9 Fixes: ac03046ece2b ("vsock/virtio: free packets during the socket release") Reported-and-tested-by: syzbot+24452624fc4c571eedd9(a)syzkaller.appspotmail.com Signed-off-by: Stefano Garzarella <sgarzare(a)redhat.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/vmw_vsock/virtio_transport_common.c Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- net/vmw_vsock/virtio_transport_common.c | 27 +++++++++++++++++-------- 1 file changed, 19 insertions(+), 8 deletions(-) diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c index 52242a148c70..f3f0a5714835 100644 --- a/net/vmw_vsock/virtio_transport_common.c +++ b/net/vmw_vsock/virtio_transport_common.c @@ -700,6 +700,23 @@ static int virtio_transport_reset_no_sock(struct virtio_vsock_pkt *pkt) return t->send_pkt(reply); } +/* This function should be called with sk_lock held and SOCK_DONE set */ +static void virtio_transport_remove_sock(struct vsock_sock *vsk) +{ + struct virtio_vsock_sock *vvs = vsk->trans; + struct virtio_vsock_pkt *pkt, *tmp; + + /* We don't need to take rx_lock, as the socket is closing and we are + * removing it. + */ + list_for_each_entry_safe(pkt, tmp, &vvs->rx_queue, list) { + list_del(&pkt->list); + virtio_transport_free_pkt(pkt); + } + + vsock_remove_sock(vsk); +} + static void virtio_transport_wait_close(struct sock *sk, long timeout) { if (timeout) { @@ -732,7 +749,7 @@ static void virtio_transport_do_close(struct vsock_sock *vsk, (!cancel_timeout || cancel_delayed_work(&vsk->close_work))) { vsk->close_work_scheduled = false; - vsock_remove_sock(vsk); + virtio_transport_remove_sock(vsk); /* Release refcnt obtained when we scheduled the timeout */ sock_put(sk); @@ -795,8 +812,6 @@ static bool virtio_transport_close(struct vsock_sock *vsk) void virtio_transport_release(struct vsock_sock *vsk) { - struct virtio_vsock_sock *vvs = vsk->trans; - struct virtio_vsock_pkt *pkt, *tmp; struct sock *sk = &vsk->sk; bool remove_sock = true; @@ -804,14 +819,10 @@ void virtio_transport_release(struct vsock_sock *vsk) if (sk->sk_type == SOCK_STREAM) remove_sock = virtio_transport_close(vsk); - list_for_each_entry_safe(pkt, tmp, &vvs->rx_queue, list) { - list_del(&pkt->list); - virtio_transport_free_pkt(pkt); - } release_sock(sk); if (remove_sock) - vsock_remove_sock(vsk); + virtio_transport_remove_sock(vsk); } EXPORT_SYMBOL_GPL(virtio_transport_release); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/1] i2c: validate user data in compat ioctl
by Hongbo Li 05 Mar '24

05 Mar '24

Fix CVE-2021-46934 Pavel Skripkin (1): i2c: validate user data in compat ioctl drivers/i2c/i2c-dev.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP2] arm64: head.S: always initialize PSTATE
by Li Zetao 05 Mar '24

05 Mar '24

From: Mark Rutland <mark.rutland(a)arm.com> mainline inclusion from mainline-v5.11-rc1 commit d87a8e65b5101123a24cddeb7a8a2c7b45f7b60c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I95U8R Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As with SCTLR_ELx and other control registers, some PSTATE bits are UNKNOWN out-of-reset, and we may not be able to rely on hardware or firmware to initialize them to our liking prior to entry to the kernel, e.g. in the primary/secondary boot paths and return from idle/suspend. It would be more robust (and easier to reason about) if we consistently initialized PSTATE to a default value, as we do with control registers. This will ensure that the kernel is not adversely affected by bits it is not aware of, e.g. when support for a feature such as PAN/UAO is disabled. This patch ensures that PSTATE is consistently initialized at boot time via an ERET. This is not intended to relax the existing requirements (e.g. DAIF bits must still be set prior to entering the kernel). For features detected dynamically (which may require system-wide support), it is still necessary to subsequently modify PSTATE. As ERET is not always a Context Synchronization Event, an ISB is placed before each exception return to ensure updates to control registers have taken effect. This handles the kernel being entered with SCTLR_ELx.EOS clear (or any future control bits being in an UNKNOWN state). Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Cc: Christoph Hellwig <hch(a)lst.de> Cc: James Morse <james.morse(a)arm.com> Cc: Will Deacon <will(a)kernel.org> Link: https://lore.kernel.org/r/20201113124937.20574-6-mark.rutland@arm.com Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Conflicts: arch/arm64/kernel/head.S Signed-off-by: Li Zetao <lizetao1(a)huawei.com> --- arch/arm64/include/asm/ptrace.h | 5 +++++ arch/arm64/kernel/head.S | 32 +++++++++++++++++++++----------- 2 files changed, 26 insertions(+), 11 deletions(-) diff --git a/arch/arm64/include/asm/ptrace.h b/arch/arm64/include/asm/ptrace.h index 27fee85c3c2b..e58568f94b5e 100644 --- a/arch/arm64/include/asm/ptrace.h +++ b/arch/arm64/include/asm/ptrace.h @@ -16,6 +16,11 @@ #define CurrentEL_EL1 (1 << 2) #define CurrentEL_EL2 (2 << 2) +#define INIT_PSTATE_EL1 \ + (PSR_D_BIT | PSR_A_BIT | PSR_I_BIT | PSR_F_BIT | PSR_MODE_EL1h) +#define INIT_PSTATE_EL2 \ + (PSR_D_BIT | PSR_A_BIT | PSR_I_BIT | PSR_F_BIT | PSR_MODE_EL2h) + /* * PMR values used to mask/unmask interrupts. * diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S index b7a9f403ad2d..5fb9255fd5dd 100644 --- a/arch/arm64/kernel/head.S +++ b/arch/arm64/kernel/head.S @@ -486,21 +486,29 @@ EXPORT_SYMBOL(kimage_vaddr) * If we're fortunate enough to boot at EL2, ensure that the world is * sane before dropping to EL1. * + * Since we cannot always rely on ERET synchronizing writes to sysregs (e.g. if + * SCTLR_ELx.EOS is clear), we place an ISB prior to ERET. + * * Returns either BOOT_CPU_MODE_EL1 or BOOT_CPU_MODE_EL2 in w0 if * booted in EL1 or EL2 respectively. */ SYM_FUNC_START(el2_setup) - msr SPsel, #1 // We want to use SP_EL{1,2} mrs x0, CurrentEL cmp x0, #CurrentEL_EL2 - b.eq 1f + b.eq init_el2 + +SYM_INNER_LABEL(init_el1, SYM_L_LOCAL) mov_q x0, INIT_SCTLR_EL1_MMU_OFF msr sctlr_el1, x0 - mov w0, #BOOT_CPU_MODE_EL1 // This cpu booted in EL1 isb - ret + mov_q x0, INIT_PSTATE_EL1 + msr spsr_el1, x0 + msr elr_el1, lr + mov w0, #BOOT_CPU_MODE_EL1 + eret -1: mov_q x0, INIT_SCTLR_EL2_MMU_OFF +SYM_INNER_LABEL(init_el2, SYM_L_LOCAL) + mov_q x0, INIT_SCTLR_EL2_MMU_OFF msr sctlr_el2, x0 #ifdef CONFIG_ARM64_VHE @@ -609,9 +617,12 @@ set_hcr: cbz x2, install_el2_stub - mov w0, #BOOT_CPU_MODE_EL2 // This CPU booted in EL2 isb - ret + mov_q x0, INIT_PSTATE_EL2 + msr spsr_el2, x0 + msr elr_el2, lr + mov w0, #BOOT_CPU_MODE_EL2 + eret SYM_INNER_LABEL(install_el2_stub, SYM_L_LOCAL) /* @@ -643,12 +654,11 @@ SYM_INNER_LABEL(install_el2_stub, SYM_L_LOCAL) 7: adr_l x0, __hyp_stub_vectors msr vbar_el2, x0 - /* spsr */ - mov x0, #(PSR_F_BIT | PSR_I_BIT | PSR_A_BIT | PSR_D_BIT |\ - PSR_MODE_EL1h) + isb + mov x0, #INIT_PSTATE_EL1 msr spsr_el2, x0 msr elr_el2, lr - mov w0, #BOOT_CPU_MODE_EL2 // This CPU booted in EL2 + mov w0, #BOOT_CPU_MODE_EL2 eret SYM_FUNC_END(el2_setup) -- 2.34.1

2 1

[PATCH OLK-5.10] scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command
by Li Lingfeng 05 Mar '24

05 Mar '24

From: Michal Grzedzicki <mge(a)meta.com> mainline inclusion from mainline-v6.6-rc2 commit c13e7331745852d0dd7c35eabbe181cbd5b01172 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B2S CVE: CVE-2023-52500 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Tags allocated for OPC_INB_SET_CONTROLLER_CONFIG command need to be freed when we receive the response. Signed-off-by: Michal Grzedzicki <mge(a)meta.com> Link: https://lore.kernel.org/r/20230911170340.699533-2-mge@meta.com Acked-by: Jack Wang <jinpu.wang(a)ionos.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/scsi/pm8001/pm80xx_hwi.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c index 51345f02383d..bb9cab064375 100644 --- a/drivers/scsi/pm8001/pm80xx_hwi.c +++ b/drivers/scsi/pm8001/pm80xx_hwi.c @@ -3731,10 +3731,12 @@ static int mpi_set_controller_config_resp(struct pm8001_hba_info *pm8001_ha, (struct set_ctrl_cfg_resp *)(piomb + 4); u32 status = le32_to_cpu(pPayload->status); u32 err_qlfr_pgcd = le32_to_cpu(pPayload->err_qlfr_pgcd); + u32 tag = le32_to_cpu(pPayload->tag); pm8001_dbg(pm8001_ha, MSG, "SET CONTROLLER RESP: status 0x%x qlfr_pgcd 0x%x\n", status, err_qlfr_pgcd); + pm8001_tag_free(pm8001_ha, tag); return 0; } -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
by Dong Chenchen 05 Mar '24

05 Mar '24

From: Tony Lindgren <tony(a)atomide.com> stable inclusion from stable-v4.19.306 commit 486218c11e8d1c8f515a3bdd70d62203609d4b6b category: bugfix bugzilla: 189592, https://gitee.com/src-openeuler/kernel/issues/I93HCX CVE: CVE-2024-26600 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7104ba0f1958adb250319e68a15eff89ec4fd36d ] If the external phy working together with phy-omap-usb2 does not implement send_srp(), we may still attempt to call it. This can happen on an idle Ethernet gadget triggering a wakeup for example: configfs-gadget.g1 gadget.0: ECM Suspend configfs-gadget.g1 gadget.0: Port suspended. Triggering wakeup ... Unable to handle kernel NULL pointer dereference at virtual address 00000000 when execute ... PC is at 0x0 LR is at musb_gadget_wakeup+0x1d4/0x254 [musb_hdrc] ... musb_gadget_wakeup [musb_hdrc] from usb_gadget_wakeup+0x1c/0x3c [udc_core] usb_gadget_wakeup [udc_core] from eth_start_xmit+0x3b0/0x3d4 [u_ether] eth_start_xmit [u_ether] from dev_hard_start_xmit+0x94/0x24c dev_hard_start_xmit from sch_direct_xmit+0x104/0x2e4 sch_direct_xmit from __dev_queue_xmit+0x334/0xd88 __dev_queue_xmit from arp_solicit+0xf0/0x268 arp_solicit from neigh_probe+0x54/0x7c neigh_probe from __neigh_event_send+0x22c/0x47c __neigh_event_send from neigh_resolve_output+0x14c/0x1c0 neigh_resolve_output from ip_finish_output2+0x1c8/0x628 ip_finish_output2 from ip_send_skb+0x40/0xd8 ip_send_skb from udp_send_skb+0x124/0x340 udp_send_skb from udp_sendmsg+0x780/0x984 udp_sendmsg from __sys_sendto+0xd8/0x158 __sys_sendto from ret_fast_syscall+0x0/0x58 Let's fix the issue by checking for send_srp() and set_vbus() before calling them. For USB peripheral only cases these both could be NULL. Fixes: 657b306a7bdf ("usb: phy: add a new driver for omap usb2 phy") Signed-off-by: Tony Lindgren <tony(a)atomide.com> Link: https://lore.kernel.org/r/20240128120556.8848-1-tony@atomide.com Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/phy/ti/phy-omap-usb2.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/phy/ti/phy-omap-usb2.c b/drivers/phy/ti/phy-omap-usb2.c index fe909fd8144f..ae94e1e66bcc 100644 --- a/drivers/phy/ti/phy-omap-usb2.c +++ b/drivers/phy/ti/phy-omap-usb2.c @@ -64,7 +64,7 @@ static int omap_usb_set_vbus(struct usb_otg *otg, bool enabled) { struct omap_usb *phy = phy_to_omapusb(otg->usb_phy); - if (!phy->comparator) + if (!phy->comparator || !phy->comparator->set_vbus) return -ENODEV; return phy->comparator->set_vbus(phy->comparator, enabled); @@ -74,7 +74,7 @@ static int omap_usb_start_srp(struct usb_otg *otg) { struct omap_usb *phy = phy_to_omapusb(otg->usb_phy); - if (!phy->comparator) + if (!phy->comparator || !phy->comparator->start_srp) return -ENODEV; return phy->comparator->start_srp(phy->comparator); -- 2.25.1

2 1

[PATCH OLK-5.10] phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
by Dong Chenchen 05 Mar '24

05 Mar '24

From: Tony Lindgren <tony(a)atomide.com> stable inclusion from stable-v5.10.209 commit be3b82e4871ba00e9b5d0ede92d396d579d7b3b3 category: bugfix bugzilla: 189592, https://gitee.com/src-openeuler/kernel/issues/I93HCX CVE: CVE-2024-26600 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7104ba0f1958adb250319e68a15eff89ec4fd36d ] If the external phy working together with phy-omap-usb2 does not implement send_srp(), we may still attempt to call it. This can happen on an idle Ethernet gadget triggering a wakeup for example: configfs-gadget.g1 gadget.0: ECM Suspend configfs-gadget.g1 gadget.0: Port suspended. Triggering wakeup ... Unable to handle kernel NULL pointer dereference at virtual address 00000000 when execute ... PC is at 0x0 LR is at musb_gadget_wakeup+0x1d4/0x254 [musb_hdrc] ... musb_gadget_wakeup [musb_hdrc] from usb_gadget_wakeup+0x1c/0x3c [udc_core] usb_gadget_wakeup [udc_core] from eth_start_xmit+0x3b0/0x3d4 [u_ether] eth_start_xmit [u_ether] from dev_hard_start_xmit+0x94/0x24c dev_hard_start_xmit from sch_direct_xmit+0x104/0x2e4 sch_direct_xmit from __dev_queue_xmit+0x334/0xd88 __dev_queue_xmit from arp_solicit+0xf0/0x268 arp_solicit from neigh_probe+0x54/0x7c neigh_probe from __neigh_event_send+0x22c/0x47c __neigh_event_send from neigh_resolve_output+0x14c/0x1c0 neigh_resolve_output from ip_finish_output2+0x1c8/0x628 ip_finish_output2 from ip_send_skb+0x40/0xd8 ip_send_skb from udp_send_skb+0x124/0x340 udp_send_skb from udp_sendmsg+0x780/0x984 udp_sendmsg from __sys_sendto+0xd8/0x158 __sys_sendto from ret_fast_syscall+0x0/0x58 Let's fix the issue by checking for send_srp() and set_vbus() before calling them. For USB peripheral only cases these both could be NULL. Fixes: 657b306a7bdf ("usb: phy: add a new driver for omap usb2 phy") Signed-off-by: Tony Lindgren <tony(a)atomide.com> Link: https://lore.kernel.org/r/20240128120556.8848-1-tony@atomide.com Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/phy/ti/phy-omap-usb2.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/phy/ti/phy-omap-usb2.c b/drivers/phy/ti/phy-omap-usb2.c index f77ac041d836..95e72f7a3199 100644 --- a/drivers/phy/ti/phy-omap-usb2.c +++ b/drivers/phy/ti/phy-omap-usb2.c @@ -116,7 +116,7 @@ static int omap_usb_set_vbus(struct usb_otg *otg, bool enabled) { struct omap_usb *phy = phy_to_omapusb(otg->usb_phy); - if (!phy->comparator) + if (!phy->comparator || !phy->comparator->set_vbus) return -ENODEV; return phy->comparator->set_vbus(phy->comparator, enabled); @@ -126,7 +126,7 @@ static int omap_usb_start_srp(struct usb_otg *otg) { struct omap_usb *phy = phy_to_omapusb(otg->usb_phy); - if (!phy->comparator) + if (!phy->comparator || !phy->comparator->start_srp) return -ENODEV; return phy->comparator->start_srp(phy->comparator); -- 2.25.1

2 1

[PATCH OLK-6.6] erofs: fix lz4 inplace decompression
by Zizhi Wo 05 Mar '24

05 Mar '24

From: Gao Xiang <hsiangkao(a)linux.alibaba.com> stable inclusion from stable-v6.6.15 commit f36d200a80a3ca025532ed60dd1ac21b620e14ae category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I956BV CVE: CVE-2023-52497 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3c12466b6b7bf1e56f9b32c366a3d83d87afb4de upstream. Currently EROFS can map another compressed buffer for inplace decompression, that was used to handle the cases that some pages of compressed data are actually not in-place I/O. However, like most simple LZ77 algorithms, LZ4 expects the compressed data is arranged at the end of the decompressed buffer and it explicitly uses memmove() to handle overlapping: __________________________________________________________ |_ direction of decompression --> ____ |_ compressed data _| Although EROFS arranges compressed data like this, it typically maps two individual virtual buffers so the relative order is uncertain. Previously, it was hardly observed since LZ4 only uses memmove() for short overlapped literals and x86/arm64 memmove implementations seem to completely cover it up and they don't have this issue. Juhyung reported that EROFS data corruption can be found on a new Intel x86 processor. After some analysis, it seems that recent x86 processors with the new FSRM feature expose this issue with "rep movsb". Let's strictly use the decompressed buffer for lz4 inplace decompression for now. Later, as an useful improvement, we could try to tie up these two buffers together in the correct order. Reported-and-tested-by: Juhyung Park <qkrwngud825(a)gmail.com> Closes: https://lore.kernel.org/r/CAD14+f2AVKf8Fa2OO1aAUdDNTDsVzzR6ctU_oJSmTyd6zSYR… Fixes: 0ffd71bcc3a0 ("staging: erofs: introduce LZ4 decompression inplace") Fixes: 598162d05080 ("erofs: support decompress big pcluster for lz4 backend") Cc: stable <stable(a)vger.kernel.org> # 5.4+ Tested-by: Yifan Zhao <zhaoyifan(a)sjtu.edu.cn> Signed-off-by: Gao Xiang <hsiangkao(a)linux.alibaba.com> Link: https://lore.kernel.org/r/20231206045534.3920847-1-hsiangkao@linux.alibaba.… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/erofs/decompressor.c | 31 ++++++++++++++++--------------- 1 file changed, 16 insertions(+), 15 deletions(-) diff --git a/fs/erofs/decompressor.c b/fs/erofs/decompressor.c index 8d1f86487d6e..d36b3963c0bf 100644 --- a/fs/erofs/decompressor.c +++ b/fs/erofs/decompressor.c @@ -122,11 +122,11 @@ static int z_erofs_lz4_prepare_dstpages(struct z_erofs_lz4_decompress_ctx *ctx, } static void *z_erofs_lz4_handle_overlap(struct z_erofs_lz4_decompress_ctx *ctx, - void *inpage, unsigned int *inputmargin, int *maptype, - bool may_inplace) + void *inpage, void *out, unsigned int *inputmargin, + int *maptype, bool may_inplace) { struct z_erofs_decompress_req *rq = ctx->rq; - unsigned int omargin, total, i, j; + unsigned int omargin, total, i; struct page **in; void *src, *tmp; @@ -136,12 +136,13 @@ static void *z_erofs_lz4_handle_overlap(struct z_erofs_lz4_decompress_ctx *ctx, omargin < LZ4_DECOMPRESS_INPLACE_MARGIN(rq->inputsize)) goto docopy; - for (i = 0; i < ctx->inpages; ++i) { - DBG_BUGON(rq->in[i] == NULL); - for (j = 0; j < ctx->outpages - ctx->inpages + i; ++j) - if (rq->out[j] == rq->in[i]) - goto docopy; - } + for (i = 0; i < ctx->inpages; ++i) + if (rq->out[ctx->outpages - ctx->inpages + i] != + rq->in[i]) + goto docopy; + kunmap_local(inpage); + *maptype = 3; + return out + ((ctx->outpages - ctx->inpages) << PAGE_SHIFT); } if (ctx->inpages <= 1) { @@ -149,7 +150,6 @@ static void *z_erofs_lz4_handle_overlap(struct z_erofs_lz4_decompress_ctx *ctx, return inpage; } kunmap_local(inpage); - might_sleep(); src = erofs_vm_map_ram(rq->in, ctx->inpages); if (!src) return ERR_PTR(-ENOMEM); @@ -205,12 +205,12 @@ int z_erofs_fixup_insize(struct z_erofs_decompress_req *rq, const char *padbuf, } static int z_erofs_lz4_decompress_mem(struct z_erofs_lz4_decompress_ctx *ctx, - u8 *out) + u8 *dst) { struct z_erofs_decompress_req *rq = ctx->rq; bool support_0padding = false, may_inplace = false; unsigned int inputmargin; - u8 *headpage, *src; + u8 *out, *headpage, *src; int ret, maptype; DBG_BUGON(*rq->in == NULL); @@ -231,11 +231,12 @@ static int z_erofs_lz4_decompress_mem(struct z_erofs_lz4_decompress_ctx *ctx, } inputmargin = rq->pageofs_in; - src = z_erofs_lz4_handle_overlap(ctx, headpage, &inputmargin, + src = z_erofs_lz4_handle_overlap(ctx, headpage, dst, &inputmargin, &maptype, may_inplace); if (IS_ERR(src)) return PTR_ERR(src); + out = dst + rq->pageofs_out; /* legacy format could compress extra data in a pcluster. */ if (rq->partial_decoding || !support_0padding) ret = LZ4_decompress_safe_partial(src + inputmargin, out, @@ -266,7 +267,7 @@ static int z_erofs_lz4_decompress_mem(struct z_erofs_lz4_decompress_ctx *ctx, vm_unmap_ram(src, ctx->inpages); } else if (maptype == 2) { erofs_put_pcpubuf(src); - } else { + } else if (maptype != 3) { DBG_BUGON(1); return -EFAULT; } @@ -309,7 +310,7 @@ static int z_erofs_lz4_decompress(struct z_erofs_decompress_req *rq, } dstmap_out: - ret = z_erofs_lz4_decompress_mem(&ctx, dst + rq->pageofs_out); + ret = z_erofs_lz4_decompress_mem(&ctx, dst); if (!dst_maptype) kunmap_local(dst); else if (dst_maptype == 2) -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command
by Li Lingfeng 05 Mar '24

05 Mar '24

From: Michal Grzedzicki <mge(a)meta.com> mainline inclusion from mainline-v6.6-rc2 commit c13e7331745852d0dd7c35eabbe181cbd5b01172 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B2S CVE: CVE-2023-52500 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Tags allocated for OPC_INB_SET_CONTROLLER_CONFIG command need to be freed when we receive the response. Signed-off-by: Michal Grzedzicki <mge(a)meta.com> Link: https://lore.kernel.org/r/20230911170340.699533-2-mge@meta.com Acked-by: Jack Wang <jinpu.wang(a)ionos.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/scsi/pm8001/pm80xx_hwi.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c index 8627feb80261..327992fbb553 100644 --- a/drivers/scsi/pm8001/pm80xx_hwi.c +++ b/drivers/scsi/pm8001/pm80xx_hwi.c @@ -3418,10 +3418,12 @@ static int mpi_set_controller_config_resp(struct pm8001_hba_info *pm8001_ha, (struct set_ctrl_cfg_resp *)(piomb + 4); u32 status = le32_to_cpu(pPayload->status); u32 err_qlfr_pgcd = le32_to_cpu(pPayload->err_qlfr_pgcd); + u32 tag = le32_to_cpu(pPayload->tag); PM8001_MSG_DBG(pm8001_ha, pm8001_printk( "SET CONTROLLER RESP: status 0x%x qlfr_pgcd 0x%x\n", status, err_qlfr_pgcd)); + pm8001_tag_free(pm8001_ha, tag); return 0; } -- 2.31.1

2 1

[PATCH OLK-5.10] drm/bridge: sii902x: Fix probing race issue
by Ye Bin 05 Mar '24

05 Mar '24

From: Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com> mainline inclusion from mainline-v6.8-rc2 commit 08ac6f132dd77e40f786d8af51140c96c6d739c9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94UOT Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A null pointer dereference crash has been observed rarely on TI platforms using sii9022 bridge: [ 53.271356] sii902x_get_edid+0x34/0x70 [sii902x] [ 53.276066] sii902x_bridge_get_edid+0x14/0x20 [sii902x] [ 53.281381] drm_bridge_get_edid+0x20/0x34 [drm] [ 53.286305] drm_bridge_connector_get_modes+0x8c/0xcc [drm_kms_helper] [ 53.292955] drm_helper_probe_single_connector_modes+0x190/0x538 [drm_kms_helper] [ 53.300510] drm_client_modeset_probe+0x1f0/0xbd4 [drm] [ 53.305958] __drm_fb_helper_initial_config_and_unlock+0x50/0x510 [drm_kms_helper] [ 53.313611] drm_fb_helper_initial_config+0x48/0x58 [drm_kms_helper] [ 53.320039] drm_fbdev_dma_client_hotplug+0x84/0xd4 [drm_dma_helper] [ 53.326401] drm_client_register+0x5c/0xa0 [drm] [ 53.331216] drm_fbdev_dma_setup+0xc8/0x13c [drm_dma_helper] [ 53.336881] tidss_probe+0x128/0x264 [tidss] [ 53.341174] platform_probe+0x68/0xc4 [ 53.344841] really_probe+0x188/0x3c4 [ 53.348501] __driver_probe_device+0x7c/0x16c [ 53.352854] driver_probe_device+0x3c/0x10c [ 53.357033] __device_attach_driver+0xbc/0x158 [ 53.361472] bus_for_each_drv+0x88/0xe8 [ 53.365303] __device_attach+0xa0/0x1b4 [ 53.369135] device_initial_probe+0x14/0x20 [ 53.373314] bus_probe_device+0xb0/0xb4 [ 53.377145] deferred_probe_work_func+0xcc/0x124 [ 53.381757] process_one_work+0x1f0/0x518 [ 53.385770] worker_thread+0x1e8/0x3dc [ 53.389519] kthread+0x11c/0x120 [ 53.392750] ret_from_fork+0x10/0x20 The issue here is as follows: - tidss probes, but is deferred as sii902x is still missing. - sii902x starts probing and enters sii902x_init(). - sii902x calls drm_bridge_add(). Now the sii902x bridge is ready from DRM's perspective. - sii902x calls sii902x_audio_codec_init() and platform_device_register_data() - The registration of the audio platform device causes probing of the deferred devices. - tidss probes, which eventually causes sii902x_bridge_get_edid() to be called. - sii902x_bridge_get_edid() tries to use the i2c to read the edid. However, the sii902x driver has not set up the i2c part yet, leading to the crash. Fix this by moving the drm_bridge_add() to the end of the sii902x_init(), which is also at the very end of sii902x_probe(). Signed-off-by: Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com> Fixes: 21d808405fe4 ("drm/bridge/sii902x: Fix EDID readback") Acked-by: Linus Walleij <linus.walleij(a)linaro.org> Link: https://lore.kernel.org/r/20240103-si902x-fixes-v1-1-b9fd3e448411@ideasonbo… Signed-off-by: Neil Armstrong <neil.armstrong(a)linaro.org> Link: https://patchwork.freedesktop.org/patch/msgid/20240103-si902x-fixes-v1-1-b9… Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/gpu/drm/bridge/sii902x.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/bridge/sii902x.c b/drivers/gpu/drm/bridge/sii902x.c index 89558e581530..a3e7b7edb555 100644 --- a/drivers/gpu/drm/bridge/sii902x.c +++ b/drivers/gpu/drm/bridge/sii902x.c @@ -998,11 +998,6 @@ static int sii902x_init(struct sii902x *sii902x) return ret; } - sii902x->bridge.funcs = &sii902x_bridge_funcs; - sii902x->bridge.of_node = dev->of_node; - sii902x->bridge.timings = &default_sii902x_timings; - drm_bridge_add(&sii902x->bridge); - sii902x_audio_codec_init(sii902x, dev); i2c_set_clientdata(sii902x->i2c, sii902x); @@ -1015,7 +1010,16 @@ static int sii902x_init(struct sii902x *sii902x) return -ENOMEM; sii902x->i2cmux->priv = sii902x; - return i2c_mux_add_adapter(sii902x->i2cmux, 0, 0, 0); + ret = i2c_mux_add_adapter(sii902x->i2cmux, 0, 0, 0); + if (ret) + return ret; + + sii902x->bridge.funcs = &sii902x_bridge_funcs; + sii902x->bridge.of_node = dev->of_node; + sii902x->bridge.timings = &default_sii902x_timings; + drm_bridge_add(&sii902x->bridge); + + return 0; } static int sii902x_probe(struct i2c_client *client, @@ -1079,8 +1083,8 @@ static int sii902x_remove(struct i2c_client *client) { struct sii902x *sii902x = i2c_get_clientdata(client); - i2c_mux_del_adapters(sii902x->i2cmux); drm_bridge_remove(&sii902x->bridge); + i2c_mux_del_adapters(sii902x->i2cmux); regulator_bulk_disable(ARRAY_SIZE(sii902x->supplies), sii902x->supplies); -- 2.31.1

2 1

[PATCH v2 openEuler-1.0-LTS] bpf: Annotate bpf_long_memcpy with data_race
by Pu Lehui 04 Mar '24

04 Mar '24

From: Daniel Borkmann <daniel(a)iogearbox.net> mainline inclusion from mainline-v6.6-rc1 commit 6a86b5b5cd76d2734304a0173f5f01aa8aa2025e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AWP CVE: CVE-2023-52521 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot reported a data race splat between two processes trying to update the same BPF map value via syscall on different CPUs: BUG: KCSAN: data-race in bpf_percpu_array_update / bpf_percpu_array_update write to 0xffffe8fffe7425d8 of 8 bytes by task 8257 on cpu 1: bpf_long_memcpy include/linux/bpf.h:428 [inline] bpf_obj_memcpy include/linux/bpf.h:441 [inline] copy_map_value_long include/linux/bpf.h:464 [inline] bpf_percpu_array_update+0x3bb/0x500 kernel/bpf/arraymap.c:380 bpf_map_update_value+0x190/0x370 kernel/bpf/syscall.c:175 generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1749 bpf_map_do_batch+0x2df/0x3d0 kernel/bpf/syscall.c:4648 __sys_bpf+0x28a/0x780 __do_sys_bpf kernel/bpf/syscall.c:5241 [inline] __se_sys_bpf kernel/bpf/syscall.c:5239 [inline] __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5239 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd write to 0xffffe8fffe7425d8 of 8 bytes by task 8268 on cpu 0: bpf_long_memcpy include/linux/bpf.h:428 [inline] bpf_obj_memcpy include/linux/bpf.h:441 [inline] copy_map_value_long include/linux/bpf.h:464 [inline] bpf_percpu_array_update+0x3bb/0x500 kernel/bpf/arraymap.c:380 bpf_map_update_value+0x190/0x370 kernel/bpf/syscall.c:175 generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1749 bpf_map_do_batch+0x2df/0x3d0 kernel/bpf/syscall.c:4648 __sys_bpf+0x28a/0x780 __do_sys_bpf kernel/bpf/syscall.c:5241 [inline] __se_sys_bpf kernel/bpf/syscall.c:5239 [inline] __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5239 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x0000000000000000 -> 0xfffffff000002788 The bpf_long_memcpy is used with 8-byte aligned pointers, power-of-8 size and forced to use long read/writes to try to atomically copy long counters. It is best-effort only and no barriers are here since it _will_ race with concurrent updates from BPF programs. The bpf_long_memcpy() is called from bpf(2) syscall. Marco suggested that the best way to make this known to KCSAN would be to use data_race() annotation. Reported-by: syzbot+97522333291430dd277f(a)syzkaller.appspotmail.com Suggested-by: Marco Elver <elver(a)google.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Marco Elver <elver(a)google.com> Link: https://lore.kernel.org/bpf/000000000000d87a7f06040c970c@google.com Link: https://lore.kernel.org/bpf/57628f7a15e20d502247c3b55fceb1cb2b31f266.169334… Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- include/linux/bpf.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 30fcf812df9d..cb0b31f5857d 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -511,7 +511,7 @@ static inline void bpf_long_memcpy(void *dst, const void *src, u32 size) size /= sizeof(long); while (size--) - *ldst++ = *lsrc++; + data_race(*ldst++ = *lsrc++); } /* verify correctness of eBPF program */ -- 2.34.1

2 1

[PATCH OLK-5.10 v2 0/2] btrfs: do not ASSERT() if the newly created subvolume already got read
by Long Li 04 Mar '24

04 Mar '24

This patch set fix CVE-2024-23850. Filipe Manana (1): btrfs: fix double free of anonymous device after snapshot creation failure Qu Wenruo (1): btrfs: do not ASSERT() if the newly created subvolume already got read fs/btrfs/disk-io.c | 29 +++++++++++++++++++---------- fs/btrfs/disk-io.h | 2 +- fs/btrfs/ioctl.c | 2 +- fs/btrfs/transaction.c | 2 +- 4 files changed, 22 insertions(+), 13 deletions(-) -- 2.31.1

2 3

[PATCH openEuler-1.0-LTS] bpf: Annotate bpf_long_memcpy with data_race
by Pu Lehui 04 Mar '24

04 Mar '24

From: Daniel Borkmann <daniel(a)iogearbox.net> mainline inclusion from mainline-v6.6-rc1 commit 6a86b5b5cd76d2734304a0173f5f01aa8aa2025e category: bugfix bugzilla: 189600 CVE: CVE-2023-52521 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot reported a data race splat between two processes trying to update the same BPF map value via syscall on different CPUs: BUG: KCSAN: data-race in bpf_percpu_array_update / bpf_percpu_array_update write to 0xffffe8fffe7425d8 of 8 bytes by task 8257 on cpu 1: bpf_long_memcpy include/linux/bpf.h:428 [inline] bpf_obj_memcpy include/linux/bpf.h:441 [inline] copy_map_value_long include/linux/bpf.h:464 [inline] bpf_percpu_array_update+0x3bb/0x500 kernel/bpf/arraymap.c:380 bpf_map_update_value+0x190/0x370 kernel/bpf/syscall.c:175 generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1749 bpf_map_do_batch+0x2df/0x3d0 kernel/bpf/syscall.c:4648 __sys_bpf+0x28a/0x780 __do_sys_bpf kernel/bpf/syscall.c:5241 [inline] __se_sys_bpf kernel/bpf/syscall.c:5239 [inline] __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5239 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd write to 0xffffe8fffe7425d8 of 8 bytes by task 8268 on cpu 0: bpf_long_memcpy include/linux/bpf.h:428 [inline] bpf_obj_memcpy include/linux/bpf.h:441 [inline] copy_map_value_long include/linux/bpf.h:464 [inline] bpf_percpu_array_update+0x3bb/0x500 kernel/bpf/arraymap.c:380 bpf_map_update_value+0x190/0x370 kernel/bpf/syscall.c:175 generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1749 bpf_map_do_batch+0x2df/0x3d0 kernel/bpf/syscall.c:4648 __sys_bpf+0x28a/0x780 __do_sys_bpf kernel/bpf/syscall.c:5241 [inline] __se_sys_bpf kernel/bpf/syscall.c:5239 [inline] __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5239 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x0000000000000000 -> 0xfffffff000002788 The bpf_long_memcpy is used with 8-byte aligned pointers, power-of-8 size and forced to use long read/writes to try to atomically copy long counters. It is best-effort only and no barriers are here since it _will_ race with concurrent updates from BPF programs. The bpf_long_memcpy() is called from bpf(2) syscall. Marco suggested that the best way to make this known to KCSAN would be to use data_race() annotation. Reported-by: syzbot+97522333291430dd277f(a)syzkaller.appspotmail.com Suggested-by: Marco Elver <elver(a)google.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Marco Elver <elver(a)google.com> Link: https://lore.kernel.org/bpf/000000000000d87a7f06040c970c@google.com Link: https://lore.kernel.org/bpf/57628f7a15e20d502247c3b55fceb1cb2b31f266.169334… Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- include/linux/bpf.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 30fcf812df9d..cb0b31f5857d 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -511,7 +511,7 @@ static inline void bpf_long_memcpy(void *dst, const void *src, u32 size) size /= sizeof(long); while (size--) - *ldst++ = *lsrc++; + data_race(*ldst++ = *lsrc++); } /* verify correctness of eBPF program */ -- 2.34.1

2 1

[PATCH OLK-5.10] mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions()
by Ze Zuo 04 Mar '24

04 Mar '24

From: Jinjie Ruan <ruanjinjie(a)huawei.com> mainline inclusion from mainline-v6.6-rc4 commit 45120b15743fa7c0aa53d5db6dfb4c8f87be4abd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95ATG CVE: CVE-2023-52560 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When CONFIG_DAMON_VADDR_KUNIT_TEST=y and making CONFIG_DEBUG_KMEMLEAK=y and CONFIG_DEBUG_KMEMLEAK_AUTO_SCAN=y, the below memory leak is detected. Since commit 9f86d624292c ("mm/damon/vaddr-test: remove unnecessary variables"), the damon_destroy_ctx() is removed, but still call damon_new_target() and damon_new_region(), the damon_region which is allocated by kmem_cache_alloc() in damon_new_region() and the damon_target which is allocated by kmalloc in damon_new_target() are not freed. And the damon_region which is allocated in damon_new_region() in damon_set_regions() is also not freed. So use damon_destroy_target to free all the damon_regions and damon_target. unreferenced object 0xffff888107c9a940 (size 64): comm "kunit_try_catch", pid 1069, jiffies 4294670592 (age 732.761s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 06 00 00 00 6b 6b 6b 6b ............kkkk 60 c7 9c 07 81 88 ff ff f8 cb 9c 07 81 88 ff ff `............... backtrace: [<ffffffff817e0167>] kmalloc_trace+0x27/0xa0 [<ffffffff819c11cf>] damon_new_target+0x3f/0x1b0 [<ffffffff819c7d55>] damon_do_test_apply_three_regions.constprop.0+0x95/0x3e0 [<ffffffff819c82be>] damon_test_apply_three_regions1+0x21e/0x260 [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90 [<ffffffff81237cf6>] kthread+0x2b6/0x380 [<ffffffff81097add>] ret_from_fork+0x2d/0x70 [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20 unreferenced object 0xffff8881079cc740 (size 56): comm "kunit_try_catch", pid 1069, jiffies 4294670592 (age 732.761s) hex dump (first 32 bytes): 05 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 ................ 6b 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 6b 6b 6b 6b kkkkkkkk....kkkk backtrace: [<ffffffff819bc492>] damon_new_region+0x22/0x1c0 [<ffffffff819c7d91>] damon_do_test_apply_three_regions.constprop.0+0xd1/0x3e0 [<ffffffff819c82be>] damon_test_apply_three_regions1+0x21e/0x260 [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90 [<ffffffff81237cf6>] kthread+0x2b6/0x380 [<ffffffff81097add>] ret_from_fork+0x2d/0x70 [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20 unreferenced object 0xffff888107c9ac40 (size 64): comm "kunit_try_catch", pid 1071, jiffies 4294670595 (age 732.843s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 06 00 00 00 6b 6b 6b 6b ............kkkk a0 cc 9c 07 81 88 ff ff 78 a1 76 07 81 88 ff ff ........x.v..... backtrace: [<ffffffff817e0167>] kmalloc_trace+0x27/0xa0 [<ffffffff819c11cf>] damon_new_target+0x3f/0x1b0 [<ffffffff819c7d55>] damon_do_test_apply_three_regions.constprop.0+0x95/0x3e0 [<ffffffff819c851e>] damon_test_apply_three_regions2+0x21e/0x260 [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90 [<ffffffff81237cf6>] kthread+0x2b6/0x380 [<ffffffff81097add>] ret_from_fork+0x2d/0x70 [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20 unreferenced object 0xffff8881079ccc80 (size 56): comm "kunit_try_catch", pid 1071, jiffies 4294670595 (age 732.843s) hex dump (first 32 bytes): 05 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 ................ 6b 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 6b 6b 6b 6b kkkkkkkk....kkkk backtrace: [<ffffffff819bc492>] damon_new_region+0x22/0x1c0 [<ffffffff819c7d91>] damon_do_test_apply_three_regions.constprop.0+0xd1/0x3e0 [<ffffffff819c851e>] damon_test_apply_three_regions2+0x21e/0x260 [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90 [<ffffffff81237cf6>] kthread+0x2b6/0x380 [<ffffffff81097add>] ret_from_fork+0x2d/0x70 [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20 unreferenced object 0xffff888107c9af40 (size 64): comm "kunit_try_catch", pid 1073, jiffies 4294670597 (age 733.011s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 06 00 00 00 6b 6b 6b 6b ............kkkk 20 a2 76 07 81 88 ff ff b8 a6 76 07 81 88 ff ff .v.......v..... backtrace: [<ffffffff817e0167>] kmalloc_trace+0x27/0xa0 [<ffffffff819c11cf>] damon_new_target+0x3f/0x1b0 [<ffffffff819c7d55>] damon_do_test_apply_three_regions.constprop.0+0x95/0x3e0 [<ffffffff819c877e>] damon_test_apply_three_regions3+0x21e/0x260 [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90 [<ffffffff81237cf6>] kthread+0x2b6/0x380 [<ffffffff81097add>] ret_from_fork+0x2d/0x70 [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20 unreferenced object 0xffff88810776a200 (size 56): comm "kunit_try_catch", pid 1073, jiffies 4294670597 (age 733.011s) hex dump (first 32 bytes): 05 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 ................ 6b 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 6b 6b 6b 6b kkkkkkkk....kkkk backtrace: [<ffffffff819bc492>] damon_new_region+0x22/0x1c0 [<ffffffff819c7d91>] damon_do_test_apply_three_regions.constprop.0+0xd1/0x3e0 [<ffffffff819c877e>] damon_test_apply_three_regions3+0x21e/0x260 [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90 [<ffffffff81237cf6>] kthread+0x2b6/0x380 [<ffffffff81097add>] ret_from_fork+0x2d/0x70 [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20 unreferenced object 0xffff88810776a740 (size 56): comm "kunit_try_catch", pid 1073, jiffies 4294670597 (age 733.025s) hex dump (first 32 bytes): 3d 00 00 00 00 00 00 00 3f 00 00 00 00 00 00 00 =.......?....... 6b 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 6b 6b 6b 6b kkkkkkkk....kkkk backtrace: [<ffffffff819bc492>] damon_new_region+0x22/0x1c0 [<ffffffff819bfcc2>] damon_set_regions+0x4c2/0x8e0 [<ffffffff819c7dbb>] damon_do_test_apply_three_regions.constprop.0+0xfb/0x3e0 [<ffffffff819c877e>] damon_test_apply_three_regions3+0x21e/0x260 [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90 [<ffffffff81237cf6>] kthread+0x2b6/0x380 [<ffffffff81097add>] ret_from_fork+0x2d/0x70 [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20 unreferenced object 0xffff888108038240 (size 64): comm "kunit_try_catch", pid 1075, jiffies 4294670600 (age 733.022s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 03 00 00 00 6b 6b 6b 6b ............kkkk 48 ad 76 07 81 88 ff ff 98 ae 76 07 81 88 ff ff H.v.......v..... backtrace: [<ffffffff817e0167>] kmalloc_trace+0x27/0xa0 [<ffffffff819c11cf>] damon_new_target+0x3f/0x1b0 [<ffffffff819c7d55>] damon_do_test_apply_three_regions.constprop.0+0x95/0x3e0 [<ffffffff819c898d>] damon_test_apply_three_regions4+0x1cd/0x210 [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90 [<ffffffff81237cf6>] kthread+0x2b6/0x380 [<ffffffff81097add>] ret_from_fork+0x2d/0x70 [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20 unreferenced object 0xffff88810776ad28 (size 56): comm "kunit_try_catch", pid 1075, jiffies 4294670600 (age 733.022s) hex dump (first 32 bytes): 05 00 00 00 00 00 00 00 07 00 00 00 00 00 00 00 ................ 6b 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 6b 6b 6b 6b kkkkkkkk....kkkk backtrace: [<ffffffff819bc492>] damon_new_region+0x22/0x1c0 [<ffffffff819bfcc2>] damon_set_regions+0x4c2/0x8e0 [<ffffffff819c7dbb>] damon_do_test_apply_three_regions.constprop.0+0xfb/0x3e0 [<ffffffff819c898d>] damon_test_apply_three_regions4+0x1cd/0x210 [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90 [<ffffffff81237cf6>] kthread+0x2b6/0x380 [<ffffffff81097add>] ret_from_fork+0x2d/0x70 [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20 Link: https://lkml.kernel.org/r/20230925072100.3725620-1-ruanjinjie@huawei.com Fixes: 9f86d624292c ("mm/damon/vaddr-test: remove unnecessary variables") Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> Reviewed-by: SeongJae Park <sj(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- mm/damon/vaddr-test.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mm/damon/vaddr-test.h b/mm/damon/vaddr-test.h index d4f55f349100..a2a1e182929f 100644 --- a/mm/damon/vaddr-test.h +++ b/mm/damon/vaddr-test.h @@ -152,6 +152,8 @@ static void damon_do_test_apply_three_regions(struct kunit *test, KUNIT_EXPECT_EQ(test, r->ar.start, expected[i * 2]); KUNIT_EXPECT_EQ(test, r->ar.end, expected[i * 2 + 1]); } + + damon_destroy_target(t); } /* -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] btrfs: do not ASSERT() if the newly created subvolume already got read
by Long Li 04 Mar '24

04 Mar '24

This patch set fix cve-2024-23850. Filipe Manana (1): btrfs: fix double free of anonymous device after snapshot creation failure Qu Wenruo (1): btrfs: do not ASSERT() if the newly created subvolume already got read fs/btrfs/disk-io.c | 29 +++++++++++++++++++---------- fs/btrfs/disk-io.h | 2 +- fs/btrfs/ioctl.c | 2 +- fs/btrfs/transaction.c | 2 +- 4 files changed, 22 insertions(+), 13 deletions(-) -- 2.31.1

2 3

[PATCH v1 OLK-6.6 0/4] kworker: Fix the problem of ipsan performance degradation
by jiangdongxu 04 Mar '24

04 Mar '24

From: shaodenghui <shaodenghui(a)huawei.com> When the current downstream FS tests IPSAN, it is found that the performance on ARM is much worse than that on X86, and the test data of IPSAN fluctuates greatly. After analysis, the reason is that when iscsi issues IO, the task is sent to kworker for processing by iscsi_xmitworker. The workqueue created by iscsi can automatically identify the CPU of the soft interrupt currently processed by iscsi, and automatically schedule the workqueue to the corresponding NUMA node. shaodenghui (3): iscsi: add member for NUMA aware order workqueue workqueue: implement NUMA affinity for single thread workqueue iscsi: use dynamic single thread workqueue to improve performance drivers/scsi/iscsi_tcp.c | 9 +++++++++ drivers/scsi/libiscsi.c | 17 ++++++++++++----- include/linux/workqueue.h | 1 + include/scsi/libiscsi.h | 1 + kernel/workqueue.c | 15 ++++++++++----- 5 files changed, 33 insertions(+), 10 deletions(-) -- 2.33.0

2 5

[PATCH openEuler-1.0-LTS 0/1] ARM: footbridge: remove personal server platform
by Huang Xiaojia 04 Mar '24

04 Mar '24

Russell King (1): ARM: footbridge: fix PCI interrupt mapping arch/arm/mach-footbridge/cats-pci.c | 4 ++-- arch/arm/mach-footbridge/ebsa285-pci.c | 4 ++-- arch/arm/mach-footbridge/netwinder-pci.c | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) -- 2.34.1

2 2

[PATCH v2 openEuler-1.0-LTS] HID: usbhid: fix info leak in hid_submit_ctrl
by Yu Liao 04 Mar '24

04 Mar '24

From: Anirudh Rayabharam <mail(a)anirudhrb.com> stable inclusion from stable-v4.19.196 commit 0e280502be1b003c3483ae03fc60dea554fcfa82 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93XA7 CVE: CVE-2021-46906 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6be388f4a35d2ce5ef7dbf635a8964a5da7f799f ] In hid_submit_ctrl(), the way of calculating the report length doesn't take into account that report->size can be zero. When running the syzkaller reproducer, a report of size 0 causes hid_submit_ctrl) to calculate transfer_buffer_length as 16384. When this urb is passed to the usb core layer, KMSAN reports an info leak of 16384 bytes. To fix this, first modify hid_report_len() to account for the zero report size case by using DIV_ROUND_UP for the division. Then, call it from hid_submit_ctrl(). Reported-by: syzbot+7c2bb71996f95a82524c(a)syzkaller.appspotmail.com Signed-off-by: Anirudh Rayabharam <mail(a)anirudhrb.com> Acked-by: Benjamin Tissoires <benjamin.tissoires(a)redhat.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.cz> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- drivers/hid/usbhid/hid-core.c | 2 +- include/linux/hid.h | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c index 11103efebbaa..2376740ce4d5 100644 --- a/drivers/hid/usbhid/hid-core.c +++ b/drivers/hid/usbhid/hid-core.c @@ -377,7 +377,7 @@ static int hid_submit_ctrl(struct hid_device *hid) raw_report = usbhid->ctrl[usbhid->ctrltail].raw_report; dir = usbhid->ctrl[usbhid->ctrltail].dir; - len = ((report->size - 1) >> 3) + 1 + (report->id > 0); + len = hid_report_len(report); if (dir == USB_DIR_OUT) { usbhid->urbctrl->pipe = usb_sndctrlpipe(hid_to_usb_dev(hid), 0); usbhid->urbctrl->transfer_buffer_length = len; diff --git a/include/linux/hid.h b/include/linux/hid.h index 7f321909ec58..2053f3ee4395 100644 --- a/include/linux/hid.h +++ b/include/linux/hid.h @@ -1154,8 +1154,7 @@ static inline void hid_hw_wait(struct hid_device *hdev) */ static inline u32 hid_report_len(struct hid_report *report) { - /* equivalent to DIV_ROUND_UP(report->size, 8) + !!(report->id > 0) */ - return ((report->size - 1) >> 3) + 1 + (report->id > 0); + return DIV_ROUND_UP(report->size, 8) + (report->id > 0); } int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size, -- 2.25.1

2 1

[PATCH v3 openEuler-1.0-LTS] usb: hub: Guard against accesses to uninitialized BOS descriptors
by Jinjiang Tu 04 Mar '24

04 Mar '24

From: Ricardo Cañuelo <ricardo.canuelo(a)collabora.com> stable inclusion from stable-v4.19.297 commit 8e7346bfea56453e31b7421c1c17ca2fb9ed613d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94P5J Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f74a7afc224acd5e922c7a2e52244d891bbe44ee upstream. Many functions in drivers/usb/core/hub.c and drivers/usb/core/hub.h access fields inside udev->bos without checking if it was allocated and initialized. If usb_get_bos_descriptor() fails for whatever reason, udev->bos will be NULL and those accesses will result in a crash: BUG: kernel NULL pointer dereference, address: 0000000000000018 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 5 PID: 17818 Comm: kworker/5:1 Tainted: G W 5.15.108-18910-gab0e1cb584e1 #1 <HASH:1f9e 1> Hardware name: Google Kindred/Kindred, BIOS Google_Kindred.12672.413.0 02/03/2021 Workqueue: usb_hub_wq hub_event RIP: 0010:hub_port_reset+0x193/0x788 Code: 89 f7 e8 20 f7 15 00 48 8b 43 08 80 b8 96 03 00 00 03 75 36 0f b7 88 92 03 00 00 81 f9 10 03 00 00 72 27 48 8b 80 a8 03 00 00 <48> 83 78 18 00 74 19 48 89 df 48 8b 75 b0 ba 02 00 00 00 4c 89 e9 RSP: 0018:ffffab740c53fcf8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffa1bc5f678000 RCX: 0000000000000310 RDX: fffffffffffffdff RSI: 0000000000000286 RDI: ffffa1be9655b840 RBP: ffffab740c53fd70 R08: 00001b7d5edaa20c R09: ffffffffb005e060 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: ffffab740c53fd3e R14: 0000000000000032 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffffa1be96540000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000018 CR3: 000000022e80c005 CR4: 00000000003706e0 Call Trace: hub_event+0x73f/0x156e ? hub_activate+0x5b7/0x68f process_one_work+0x1a2/0x487 worker_thread+0x11a/0x288 kthread+0x13a/0x152 ? process_one_work+0x487/0x487 ? kthread_associate_blkcg+0x70/0x70 ret_from_fork+0x1f/0x30 Fall back to a default behavior if the BOS descriptor isn't accessible and skip all the functionalities that depend on it: LPM support checks, Super Speed capabilitiy checks, U1/U2 states setup. Signed-off-by: Ricardo Cañuelo <ricardo.canuelo(a)collabora.com> Cc: stable <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20230830100418.1952143-1-ricardo.canuelo@collabor… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/usb/core/hub.c | 28 ++++++++++++++++++++++++---- drivers/usb/core/hub.h | 2 +- 2 files changed, 25 insertions(+), 5 deletions(-) diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c index c6b16194f3cf..7750a304d7b4 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -138,6 +138,10 @@ int usb_device_supports_lpm(struct usb_device *udev) if (udev->quirks & USB_QUIRK_NO_LPM) return 0; + /* Skip if the device BOS descriptor couldn't be read */ + if (!udev->bos) + return 0; + /* USB 2.1 (and greater) devices indicate LPM support through * their USB 2.0 Extended Capabilities BOS descriptor. */ @@ -311,6 +315,10 @@ static void usb_set_lpm_parameters(struct usb_device *udev) if (!udev->lpm_capable || udev->speed < USB_SPEED_SUPER) return; + /* Skip if the device BOS descriptor couldn't be read */ + if (!udev->bos) + return; + hub = usb_hub_to_struct_hub(udev->parent); /* It doesn't take time to transition the roothub into U0, since it * doesn't have an upstream link. @@ -2616,7 +2624,8 @@ int usb_authorize_device(struct usb_device *usb_dev) } /* - * Return 1 if port speed is SuperSpeedPlus, 0 otherwise + * Return 1 if port speed is SuperSpeedPlus, 0 otherwise or if the + * capability couldn't be checked. * check it from the link protocol field of the current speed ID attribute. * current speed ID is got from ext port status request. Sublink speed attribute * table is returned with the hub BOS SSP device capability descriptor @@ -2626,8 +2635,12 @@ static int port_speed_is_ssp(struct usb_device *hdev, int speed_id) int ssa_count; u32 ss_attr; int i; - struct usb_ssp_cap_descriptor *ssp_cap = hdev->bos->ssp_cap; + struct usb_ssp_cap_descriptor *ssp_cap; + if (!hdev->bos) + return 0; + + ssp_cap = hdev->bos->ssp_cap; if (!ssp_cap) return 0; @@ -3979,8 +3992,15 @@ static void usb_enable_link_state(struct usb_hcd *hcd, struct usb_device *udev, enum usb3_link_state state) { int timeout, ret; - __u8 u1_mel = udev->bos->ss_cap->bU1devExitLat; - __le16 u2_mel = udev->bos->ss_cap->bU2DevExitLat; + __u8 u1_mel; + __le16 u2_mel; + + /* Skip if the device BOS descriptor couldn't be read */ + if (!udev->bos) + return; + + u1_mel = udev->bos->ss_cap->bU1devExitLat; + u2_mel = udev->bos->ss_cap->bU2DevExitLat; /* If the device says it doesn't have *any* exit latency to come out of * U1 or U2, it's probably lying. Assume it doesn't implement that link diff --git a/drivers/usb/core/hub.h b/drivers/usb/core/hub.h index 4accfb63f7dc..2ee899501220 100644 --- a/drivers/usb/core/hub.h +++ b/drivers/usb/core/hub.h @@ -138,7 +138,7 @@ static inline int hub_is_superspeedplus(struct usb_device *hdev) { return (hdev->descriptor.bDeviceProtocol == USB_HUB_PR_SS && le16_to_cpu(hdev->descriptor.bcdUSB) >= 0x0310 && - hdev->bos->ssp_cap); + hdev->bos && hdev->bos->ssp_cap); } static inline unsigned hub_power_on_good_delay(struct usb_hub *hub) -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP2] arm64: head.S: always initialize PSTATE
by Li Zetao 04 Mar '24

04 Mar '24

From: Mark Rutland <mark.rutland(a)arm.com> mainline inclusion from mainline-v5.11-rc1 commit d87a8e65b5101123a24cddeb7a8a2c7b45f7b60c category: bugfix bugzilla: 189556 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As with SCTLR_ELx and other control registers, some PSTATE bits are UNKNOWN out-of-reset, and we may not be able to rely on hardware or firmware to initialize them to our liking prior to entry to the kernel, e.g. in the primary/secondary boot paths and return from idle/suspend. It would be more robust (and easier to reason about) if we consistently initialized PSTATE to a default value, as we do with control registers. This will ensure that the kernel is not adversely affected by bits it is not aware of, e.g. when support for a feature such as PAN/UAO is disabled. This patch ensures that PSTATE is consistently initialized at boot time via an ERET. This is not intended to relax the existing requirements (e.g. DAIF bits must still be set prior to entering the kernel). For features detected dynamically (which may require system-wide support), it is still necessary to subsequently modify PSTATE. As ERET is not always a Context Synchronization Event, an ISB is placed before each exception return to ensure updates to control registers have taken effect. This handles the kernel being entered with SCTLR_ELx.EOS clear (or any future control bits being in an UNKNOWN state). Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Cc: Christoph Hellwig <hch(a)lst.de> Cc: James Morse <james.morse(a)arm.com> Cc: Will Deacon <will(a)kernel.org> Link: https://lore.kernel.org/r/20201113124937.20574-6-mark.rutland@arm.com Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Conflicts: arch/arm64/kernel/head.S Signed-off-by: Li Zetao <lizetao1(a)huawei.com> --- arch/arm64/include/asm/ptrace.h | 5 +++++ arch/arm64/kernel/head.S | 32 +++++++++++++++++++++----------- 2 files changed, 26 insertions(+), 11 deletions(-) diff --git a/arch/arm64/include/asm/ptrace.h b/arch/arm64/include/asm/ptrace.h index 27fee85c3c2b..e58568f94b5e 100644 --- a/arch/arm64/include/asm/ptrace.h +++ b/arch/arm64/include/asm/ptrace.h @@ -16,6 +16,11 @@ #define CurrentEL_EL1 (1 << 2) #define CurrentEL_EL2 (2 << 2) +#define INIT_PSTATE_EL1 \ + (PSR_D_BIT | PSR_A_BIT | PSR_I_BIT | PSR_F_BIT | PSR_MODE_EL1h) +#define INIT_PSTATE_EL2 \ + (PSR_D_BIT | PSR_A_BIT | PSR_I_BIT | PSR_F_BIT | PSR_MODE_EL2h) + /* * PMR values used to mask/unmask interrupts. * diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S index b7a9f403ad2d..5fb9255fd5dd 100644 --- a/arch/arm64/kernel/head.S +++ b/arch/arm64/kernel/head.S @@ -486,21 +486,29 @@ EXPORT_SYMBOL(kimage_vaddr) * If we're fortunate enough to boot at EL2, ensure that the world is * sane before dropping to EL1. * + * Since we cannot always rely on ERET synchronizing writes to sysregs (e.g. if + * SCTLR_ELx.EOS is clear), we place an ISB prior to ERET. + * * Returns either BOOT_CPU_MODE_EL1 or BOOT_CPU_MODE_EL2 in w0 if * booted in EL1 or EL2 respectively. */ SYM_FUNC_START(el2_setup) - msr SPsel, #1 // We want to use SP_EL{1,2} mrs x0, CurrentEL cmp x0, #CurrentEL_EL2 - b.eq 1f + b.eq init_el2 + +SYM_INNER_LABEL(init_el1, SYM_L_LOCAL) mov_q x0, INIT_SCTLR_EL1_MMU_OFF msr sctlr_el1, x0 - mov w0, #BOOT_CPU_MODE_EL1 // This cpu booted in EL1 isb - ret + mov_q x0, INIT_PSTATE_EL1 + msr spsr_el1, x0 + msr elr_el1, lr + mov w0, #BOOT_CPU_MODE_EL1 + eret -1: mov_q x0, INIT_SCTLR_EL2_MMU_OFF +SYM_INNER_LABEL(init_el2, SYM_L_LOCAL) + mov_q x0, INIT_SCTLR_EL2_MMU_OFF msr sctlr_el2, x0 #ifdef CONFIG_ARM64_VHE @@ -609,9 +617,12 @@ set_hcr: cbz x2, install_el2_stub - mov w0, #BOOT_CPU_MODE_EL2 // This CPU booted in EL2 isb - ret + mov_q x0, INIT_PSTATE_EL2 + msr spsr_el2, x0 + msr elr_el2, lr + mov w0, #BOOT_CPU_MODE_EL2 + eret SYM_INNER_LABEL(install_el2_stub, SYM_L_LOCAL) /* @@ -643,12 +654,11 @@ SYM_INNER_LABEL(install_el2_stub, SYM_L_LOCAL) 7: adr_l x0, __hyp_stub_vectors msr vbar_el2, x0 - /* spsr */ - mov x0, #(PSR_F_BIT | PSR_I_BIT | PSR_A_BIT | PSR_D_BIT |\ - PSR_MODE_EL1h) + isb + mov x0, #INIT_PSTATE_EL1 msr spsr_el2, x0 msr elr_el2, lr - mov w0, #BOOT_CPU_MODE_EL2 // This CPU booted in EL2 + mov w0, #BOOT_CPU_MODE_EL2 eret SYM_FUNC_END(el2_setup) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] HID: usbhid: fix info leak in hid_submit_ctrl
by Yu Liao 04 Mar '24

04 Mar '24

From: Anirudh Rayabharam <mail(a)anirudhrb.com> stable inclusion from stable-v5.15.128 commit 0e280502be1b003c3483ae03fc60dea554fcfa82 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93XA7 CVE: CVE-2021-46906 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6be388f4a35d2ce5ef7dbf635a8964a5da7f799f ] In hid_submit_ctrl(), the way of calculating the report length doesn't take into account that report->size can be zero. When running the syzkaller reproducer, a report of size 0 causes hid_submit_ctrl) to calculate transfer_buffer_length as 16384. When this urb is passed to the usb core layer, KMSAN reports an info leak of 16384 bytes. To fix this, first modify hid_report_len() to account for the zero report size case by using DIV_ROUND_UP for the division. Then, call it from hid_submit_ctrl(). Reported-by: syzbot+7c2bb71996f95a82524c(a)syzkaller.appspotmail.com Signed-off-by: Anirudh Rayabharam <mail(a)anirudhrb.com> Acked-by: Benjamin Tissoires <benjamin.tissoires(a)redhat.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.cz> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- drivers/hid/usbhid/hid-core.c | 2 +- include/linux/hid.h | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c index 11103efebbaa..2376740ce4d5 100644 --- a/drivers/hid/usbhid/hid-core.c +++ b/drivers/hid/usbhid/hid-core.c @@ -377,7 +377,7 @@ static int hid_submit_ctrl(struct hid_device *hid) raw_report = usbhid->ctrl[usbhid->ctrltail].raw_report; dir = usbhid->ctrl[usbhid->ctrltail].dir; - len = ((report->size - 1) >> 3) + 1 + (report->id > 0); + len = hid_report_len(report); if (dir == USB_DIR_OUT) { usbhid->urbctrl->pipe = usb_sndctrlpipe(hid_to_usb_dev(hid), 0); usbhid->urbctrl->transfer_buffer_length = len; diff --git a/include/linux/hid.h b/include/linux/hid.h index 7f321909ec58..2053f3ee4395 100644 --- a/include/linux/hid.h +++ b/include/linux/hid.h @@ -1154,8 +1154,7 @@ static inline void hid_hw_wait(struct hid_device *hdev) */ static inline u32 hid_report_len(struct hid_report *report) { - /* equivalent to DIV_ROUND_UP(report->size, 8) + !!(report->id > 0) */ - return ((report->size - 1) >> 3) + 1 + (report->id > 0); + return DIV_ROUND_UP(report->size, 8) + (report->id > 0); } int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size, -- 2.25.1

2 1

[PATCH v1 OLK-6.6 0/4] kworker: Fix the problem of ipsan performance degradation
by jiangdongxu 04 Mar '24

04 Mar '24

From: shaodenghui <shaodenghui(a)huawei.com> When the current downstream FS tests IPSAN, it is found that the performance on ARM is much worse than that on X86, and the test data of IPSAN fluctuates greatly. After analysis, the reason is that when iscsi issues IO, the task is sent to kworker for processing by iscsi_xmitworker. The workqueue created by iscsi can automatically identify the CPU of the soft interrupt currently processed by iscsi, and automatically schedule the workqueue to the corresponding NUMA node. shaodenghui (3): iscsi: add member for NUMA aware order workqueue workqueue: implement NUMA affinity for single thread workqueue iscsi: use dynamic single thread workqueue to improve performance drivers/scsi/iscsi_tcp.c | 9 +++++++++ drivers/scsi/libiscsi.c | 17 ++++++++++++----- include/linux/workqueue.h | 1 + include/scsi/libiscsi.h | 1 + kernel/workqueue.c | 15 ++++++++++----- 5 files changed, 33 insertions(+), 10 deletions(-) -- 2.33.0

2 5

[PATCH v1 OLK-6.6 1/4] iscsi: add member for NUMA aware order workqueue
by jiangdongxu 04 Mar '24

04 Mar '24

From: shaodenghui <shaodenghui(a)huawei.com> euleros inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I94XYA CVE: NA ------------------------------------------------- Add member to struct iscsi_conn. Signed-off-by: shaodenghui <shaodenghui(a)huawei.com> --- include/linux/workqueue.h | 1 + include/scsi/libiscsi.h | 1 + 2 files changed, 2 insertions(+) diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h index 961909875..485c0f5b2 100644 --- a/include/linux/workqueue.h +++ b/include/linux/workqueue.h @@ -415,6 +415,7 @@ enum { __WQ_ORDERED = 1 << 17, /* internal: workqueue is ordered */ __WQ_LEGACY = 1 << 18, /* internal: create*_workqueue() */ __WQ_ORDERED_EXPLICIT = 1 << 19, /* internal: alloc_ordered_workqueue() */ + __WQ_DYNAMIC = 1 << 25, /* internal: only support single work order WQ */ WQ_MAX_ACTIVE = 512, /* I like 512, better ideas? */ WQ_UNBOUND_MAX_ACTIVE = WQ_MAX_ACTIVE, diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h index d253b82e9..ead17d222 100644 --- a/include/scsi/libiscsi.h +++ b/include/scsi/libiscsi.h @@ -266,6 +266,7 @@ struct iscsi_conn { /* custom statistics */ uint32_t eh_abort_cnt; uint32_t fmr_unalign_cnt; + int intimate_cpu; KABI_RESERVE(1) KABI_RESERVE(2) -- 2.33.0

2 4

[PATCH OLK-6.6] LoongArch: enable CONFIG_DEBUG_INFO_BTF by default
by Hongchen Zhang 04 Mar '24

04 Mar '24

CONFIG_DEBUG_INFO_BTF is required by bpftool,so enable it. LoongArch inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I95P5Y -------------------------------- Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> Signed-off-by: Tiezhu Yang <yangtiezhu(a)loongson.cn> --- arch/loongarch/configs/loongson3_defconfig | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/loongarch/configs/loongson3_defconfig b/arch/loongarch/configs/loongson3_defconfig index a60d281bb525..0a1a3e68cdb2 100644 --- a/arch/loongarch/configs/loongson3_defconfig +++ b/arch/loongarch/configs/loongson3_defconfig @@ -2185,6 +2185,8 @@ CONFIG_PRINTK_TIME=y CONFIG_PRINTK_CALLER=y CONFIG_BOOT_PRINTK_DELAY=y CONFIG_DYNAMIC_DEBUG=y +CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y +CONFIG_DEBUG_INFO_BTF=y CONFIG_FRAME_WARN=4096 CONFIG_STRIP_ASM_SYMS=y CONFIG_DEBUG_SECTION_MISMATCH=y -- 2.33.0

2 1

[PATCH OLK-5.10] arm64: head.S: always initialize PSTATE
by Li Zetao 04 Mar '24

04 Mar '24

From: Mark Rutland <mark.rutland(a)arm.com> mainline inclusion from mainline-v5.11-rc1 commit d87a8e65b5101123a24cddeb7a8a2c7b45f7b60c category: bugfix bugzilla: 189556 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As with SCTLR_ELx and other control registers, some PSTATE bits are UNKNOWN out-of-reset, and we may not be able to rely on hardware or firmware to initialize them to our liking prior to entry to the kernel, e.g. in the primary/secondary boot paths and return from idle/suspend. It would be more robust (and easier to reason about) if we consistently initialized PSTATE to a default value, as we do with control registers. This will ensure that the kernel is not adversely affected by bits it is not aware of, e.g. when support for a feature such as PAN/UAO is disabled. This patch ensures that PSTATE is consistently initialized at boot time via an ERET. This is not intended to relax the existing requirements (e.g. DAIF bits must still be set prior to entering the kernel). For features detected dynamically (which may require system-wide support), it is still necessary to subsequently modify PSTATE. As ERET is not always a Context Synchronization Event, an ISB is placed before each exception return to ensure updates to control registers have taken effect. This handles the kernel being entered with SCTLR_ELx.EOS clear (or any future control bits being in an UNKNOWN state). Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Cc: Christoph Hellwig <hch(a)lst.de> Cc: James Morse <james.morse(a)arm.com> Cc: Will Deacon <will(a)kernel.org> Link: https://lore.kernel.org/r/20201113124937.20574-6-mark.rutland@arm.com Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Conflicts: arch/arm64/kernel/head.S Signed-off-by: Li Zetao <lizetao1(a)huawei.com> --- arch/arm64/include/asm/ptrace.h | 5 +++++ arch/arm64/kernel/head.S | 32 +++++++++++++++++++++----------- 2 files changed, 26 insertions(+), 11 deletions(-) diff --git a/arch/arm64/include/asm/ptrace.h b/arch/arm64/include/asm/ptrace.h index 27fee85c3c2b..e58568f94b5e 100644 --- a/arch/arm64/include/asm/ptrace.h +++ b/arch/arm64/include/asm/ptrace.h @@ -16,6 +16,11 @@ #define CurrentEL_EL1 (1 << 2) #define CurrentEL_EL2 (2 << 2) +#define INIT_PSTATE_EL1 \ + (PSR_D_BIT | PSR_A_BIT | PSR_I_BIT | PSR_F_BIT | PSR_MODE_EL1h) +#define INIT_PSTATE_EL2 \ + (PSR_D_BIT | PSR_A_BIT | PSR_I_BIT | PSR_F_BIT | PSR_MODE_EL2h) + /* * PMR values used to mask/unmask interrupts. * diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S index ad1e45abfe6c..91890de6cefa 100644 --- a/arch/arm64/kernel/head.S +++ b/arch/arm64/kernel/head.S @@ -531,21 +531,29 @@ EXPORT_SYMBOL(kimage_vaddr) * If we're fortunate enough to boot at EL2, ensure that the world is * sane before dropping to EL1. * + * Since we cannot always rely on ERET synchronizing writes to sysregs (e.g. if + * SCTLR_ELx.EOS is clear), we place an ISB prior to ERET. + * * Returns either BOOT_CPU_MODE_EL1 or BOOT_CPU_MODE_EL2 in w0 if * booted in EL1 or EL2 respectively. */ SYM_FUNC_START(el2_setup) - msr SPsel, #1 // We want to use SP_EL{1,2} mrs x0, CurrentEL cmp x0, #CurrentEL_EL2 - b.eq 1f + b.eq init_el2 + +SYM_INNER_LABEL(init_el1, SYM_L_LOCAL) mov_q x0, INIT_SCTLR_EL1_MMU_OFF msr sctlr_el1, x0 - mov w0, #BOOT_CPU_MODE_EL1 // This cpu booted in EL1 isb - ret + mov_q x0, INIT_PSTATE_EL1 + msr spsr_el1, x0 + msr elr_el1, lr + mov w0, #BOOT_CPU_MODE_EL1 + eret -1: mov_q x0, INIT_SCTLR_EL2_MMU_OFF +SYM_INNER_LABEL(init_el2, SYM_L_LOCAL) + mov_q x0, INIT_SCTLR_EL2_MMU_OFF msr sctlr_el2, x0 #ifdef CONFIG_ARM64_VHE @@ -657,9 +665,12 @@ set_hcr: cbz x2, install_el2_stub - mov w0, #BOOT_CPU_MODE_EL2 // This CPU booted in EL2 isb - ret + mov_q x0, INIT_PSTATE_EL2 + msr spsr_el2, x0 + msr elr_el2, lr + mov w0, #BOOT_CPU_MODE_EL2 + eret /* Disable any fine grained traps */ .macro __init_el2_fgt @@ -778,12 +789,11 @@ SYM_INNER_LABEL(install_el2_stub, SYM_L_LOCAL) 7: adr_l x0, __hyp_stub_vectors msr vbar_el2, x0 - /* spsr */ - mov x0, #(PSR_F_BIT | PSR_I_BIT | PSR_A_BIT | PSR_D_BIT |\ - PSR_MODE_EL1h) + isb + mov x0, #INIT_PSTATE_EL1 msr spsr_el2, x0 msr elr_el2, lr - mov w0, #BOOT_CPU_MODE_EL2 // This CPU booted in EL2 + mov w0, #BOOT_CPU_MODE_EL2 eret SYM_FUNC_END(el2_setup) -- 2.34.1

2 1

[PATCH v3 openEuler-1.0-LTS] usb: hub: Guard against accesses to uninitialized BOS descriptors
by Jinjiang Tu 04 Mar '24

04 Mar '24

From: Ricardo Cañuelo <ricardo.canuelo(a)collabora.com> stable inclusion from stable-v4.19.297 commit 8e7346bfea56453e31b7421c1c17ca2fb9ed613d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94P5J Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f74a7afc224acd5e922c7a2e52244d891bbe44ee upstream. Many functions in drivers/usb/core/hub.c and drivers/usb/core/hub.h access fields inside udev->bos without checking if it was allocated and initialized. If usb_get_bos_descriptor() fails for whatever reason, udev->bos will be NULL and those accesses will result in a crash: BUG: kernel NULL pointer dereference, address: 0000000000000018 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 5 PID: 17818 Comm: kworker/5:1 Tainted: G W 5.15.108-18910-gab0e1cb584e1 #1 <HASH:1f9e 1> Hardware name: Google Kindred/Kindred, BIOS Google_Kindred.12672.413.0 02/03/2021 Workqueue: usb_hub_wq hub_event RIP: 0010:hub_port_reset+0x193/0x788 Code: 89 f7 e8 20 f7 15 00 48 8b 43 08 80 b8 96 03 00 00 03 75 36 0f b7 88 92 03 00 00 81 f9 10 03 00 00 72 27 48 8b 80 a8 03 00 00 <48> 83 78 18 00 74 19 48 89 df 48 8b 75 b0 ba 02 00 00 00 4c 89 e9 RSP: 0018:ffffab740c53fcf8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffa1bc5f678000 RCX: 0000000000000310 RDX: fffffffffffffdff RSI: 0000000000000286 RDI: ffffa1be9655b840 RBP: ffffab740c53fd70 R08: 00001b7d5edaa20c R09: ffffffffb005e060 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: ffffab740c53fd3e R14: 0000000000000032 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffffa1be96540000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000018 CR3: 000000022e80c005 CR4: 00000000003706e0 Call Trace: hub_event+0x73f/0x156e ? hub_activate+0x5b7/0x68f process_one_work+0x1a2/0x487 worker_thread+0x11a/0x288 kthread+0x13a/0x152 ? process_one_work+0x487/0x487 ? kthread_associate_blkcg+0x70/0x70 ret_from_fork+0x1f/0x30 Fall back to a default behavior if the BOS descriptor isn't accessible and skip all the functionalities that depend on it: LPM support checks, Super Speed capabilitiy checks, U1/U2 states setup. Signed-off-by: Ricardo Cañuelo <ricardo.canuelo(a)collabora.com> Cc: stable <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20230830100418.1952143-1-ricardo.canuelo@collabor… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/usb/core/hub.c | 28 ++++++++++++++++++++++++---- drivers/usb/core/hub.h | 2 +- 2 files changed, 25 insertions(+), 5 deletions(-) diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c index c6b16194f3cf..7750a304d7b4 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -138,6 +138,10 @@ int usb_device_supports_lpm(struct usb_device *udev) if (udev->quirks & USB_QUIRK_NO_LPM) return 0; + /* Skip if the device BOS descriptor couldn't be read */ + if (!udev->bos) + return 0; + /* USB 2.1 (and greater) devices indicate LPM support through * their USB 2.0 Extended Capabilities BOS descriptor. */ @@ -311,6 +315,10 @@ static void usb_set_lpm_parameters(struct usb_device *udev) if (!udev->lpm_capable || udev->speed < USB_SPEED_SUPER) return; + /* Skip if the device BOS descriptor couldn't be read */ + if (!udev->bos) + return; + hub = usb_hub_to_struct_hub(udev->parent); /* It doesn't take time to transition the roothub into U0, since it * doesn't have an upstream link. @@ -2616,7 +2624,8 @@ int usb_authorize_device(struct usb_device *usb_dev) } /* - * Return 1 if port speed is SuperSpeedPlus, 0 otherwise + * Return 1 if port speed is SuperSpeedPlus, 0 otherwise or if the + * capability couldn't be checked. * check it from the link protocol field of the current speed ID attribute. * current speed ID is got from ext port status request. Sublink speed attribute * table is returned with the hub BOS SSP device capability descriptor @@ -2626,8 +2635,12 @@ static int port_speed_is_ssp(struct usb_device *hdev, int speed_id) int ssa_count; u32 ss_attr; int i; - struct usb_ssp_cap_descriptor *ssp_cap = hdev->bos->ssp_cap; + struct usb_ssp_cap_descriptor *ssp_cap; + if (!hdev->bos) + return 0; + + ssp_cap = hdev->bos->ssp_cap; if (!ssp_cap) return 0; @@ -3979,8 +3992,15 @@ static void usb_enable_link_state(struct usb_hcd *hcd, struct usb_device *udev, enum usb3_link_state state) { int timeout, ret; - __u8 u1_mel = udev->bos->ss_cap->bU1devExitLat; - __le16 u2_mel = udev->bos->ss_cap->bU2DevExitLat; + __u8 u1_mel; + __le16 u2_mel; + + /* Skip if the device BOS descriptor couldn't be read */ + if (!udev->bos) + return; + + u1_mel = udev->bos->ss_cap->bU1devExitLat; + u2_mel = udev->bos->ss_cap->bU2DevExitLat; /* If the device says it doesn't have *any* exit latency to come out of * U1 or U2, it's probably lying. Assume it doesn't implement that link diff --git a/drivers/usb/core/hub.h b/drivers/usb/core/hub.h index 4accfb63f7dc..2ee899501220 100644 --- a/drivers/usb/core/hub.h +++ b/drivers/usb/core/hub.h @@ -138,7 +138,7 @@ static inline int hub_is_superspeedplus(struct usb_device *hdev) { return (hdev->descriptor.bDeviceProtocol == USB_HUB_PR_SS && le16_to_cpu(hdev->descriptor.bcdUSB) >= 0x0310 && - hdev->bos->ssp_cap); + hdev->bos && hdev->bos->ssp_cap); } static inline unsigned hub_power_on_good_delay(struct usb_hub *hub) -- 2.25.1

2 1

[PATCH v2 openEuler-1.0-LTS] usb: hub: Guard against accesses to uninitialized BOS descriptors
by Jinjiang Tu 04 Mar '24

04 Mar '24

From: Ricardo Cañuelo <ricardo.canuelo(a)collabora.com> stable inclusion from stable-v4.19.297 commit 8e7346bfea56453e31b7421c1c17ca2fb9ed613d category: bugfix bugzilla: 189597 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f74a7afc224acd5e922c7a2e52244d891bbe44ee upstream. Many functions in drivers/usb/core/hub.c and drivers/usb/core/hub.h access fields inside udev->bos without checking if it was allocated and initialized. If usb_get_bos_descriptor() fails for whatever reason, udev->bos will be NULL and those accesses will result in a crash: BUG: kernel NULL pointer dereference, address: 0000000000000018 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 5 PID: 17818 Comm: kworker/5:1 Tainted: G W 5.15.108-18910-gab0e1cb584e1 #1 <HASH:1f9e 1> Hardware name: Google Kindred/Kindred, BIOS Google_Kindred.12672.413.0 02/03/2021 Workqueue: usb_hub_wq hub_event RIP: 0010:hub_port_reset+0x193/0x788 Code: 89 f7 e8 20 f7 15 00 48 8b 43 08 80 b8 96 03 00 00 03 75 36 0f b7 88 92 03 00 00 81 f9 10 03 00 00 72 27 48 8b 80 a8 03 00 00 <48> 83 78 18 00 74 19 48 89 df 48 8b 75 b0 ba 02 00 00 00 4c 89 e9 RSP: 0018:ffffab740c53fcf8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffa1bc5f678000 RCX: 0000000000000310 RDX: fffffffffffffdff RSI: 0000000000000286 RDI: ffffa1be9655b840 RBP: ffffab740c53fd70 R08: 00001b7d5edaa20c R09: ffffffffb005e060 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: ffffab740c53fd3e R14: 0000000000000032 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffffa1be96540000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000018 CR3: 000000022e80c005 CR4: 00000000003706e0 Call Trace: hub_event+0x73f/0x156e ? hub_activate+0x5b7/0x68f process_one_work+0x1a2/0x487 worker_thread+0x11a/0x288 kthread+0x13a/0x152 ? process_one_work+0x487/0x487 ? kthread_associate_blkcg+0x70/0x70 ret_from_fork+0x1f/0x30 Fall back to a default behavior if the BOS descriptor isn't accessible and skip all the functionalities that depend on it: LPM support checks, Super Speed capabilitiy checks, U1/U2 states setup. Signed-off-by: Ricardo Cañuelo <ricardo.canuelo(a)collabora.com> Cc: stable <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20230830100418.1952143-1-ricardo.canuelo@collabor… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/usb/core/hub.c | 28 ++++++++++++++++++++++++---- drivers/usb/core/hub.h | 2 +- 2 files changed, 25 insertions(+), 5 deletions(-) diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c index c6b16194f3cf..7750a304d7b4 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -138,6 +138,10 @@ int usb_device_supports_lpm(struct usb_device *udev) if (udev->quirks & USB_QUIRK_NO_LPM) return 0; + /* Skip if the device BOS descriptor couldn't be read */ + if (!udev->bos) + return 0; + /* USB 2.1 (and greater) devices indicate LPM support through * their USB 2.0 Extended Capabilities BOS descriptor. */ @@ -311,6 +315,10 @@ static void usb_set_lpm_parameters(struct usb_device *udev) if (!udev->lpm_capable || udev->speed < USB_SPEED_SUPER) return; + /* Skip if the device BOS descriptor couldn't be read */ + if (!udev->bos) + return; + hub = usb_hub_to_struct_hub(udev->parent); /* It doesn't take time to transition the roothub into U0, since it * doesn't have an upstream link. @@ -2616,7 +2624,8 @@ int usb_authorize_device(struct usb_device *usb_dev) } /* - * Return 1 if port speed is SuperSpeedPlus, 0 otherwise + * Return 1 if port speed is SuperSpeedPlus, 0 otherwise or if the + * capability couldn't be checked. * check it from the link protocol field of the current speed ID attribute. * current speed ID is got from ext port status request. Sublink speed attribute * table is returned with the hub BOS SSP device capability descriptor @@ -2626,8 +2635,12 @@ static int port_speed_is_ssp(struct usb_device *hdev, int speed_id) int ssa_count; u32 ss_attr; int i; - struct usb_ssp_cap_descriptor *ssp_cap = hdev->bos->ssp_cap; + struct usb_ssp_cap_descriptor *ssp_cap; + if (!hdev->bos) + return 0; + + ssp_cap = hdev->bos->ssp_cap; if (!ssp_cap) return 0; @@ -3979,8 +3992,15 @@ static void usb_enable_link_state(struct usb_hcd *hcd, struct usb_device *udev, enum usb3_link_state state) { int timeout, ret; - __u8 u1_mel = udev->bos->ss_cap->bU1devExitLat; - __le16 u2_mel = udev->bos->ss_cap->bU2DevExitLat; + __u8 u1_mel; + __le16 u2_mel; + + /* Skip if the device BOS descriptor couldn't be read */ + if (!udev->bos) + return; + + u1_mel = udev->bos->ss_cap->bU1devExitLat; + u2_mel = udev->bos->ss_cap->bU2DevExitLat; /* If the device says it doesn't have *any* exit latency to come out of * U1 or U2, it's probably lying. Assume it doesn't implement that link diff --git a/drivers/usb/core/hub.h b/drivers/usb/core/hub.h index 4accfb63f7dc..2ee899501220 100644 --- a/drivers/usb/core/hub.h +++ b/drivers/usb/core/hub.h @@ -138,7 +138,7 @@ static inline int hub_is_superspeedplus(struct usb_device *hdev) { return (hdev->descriptor.bDeviceProtocol == USB_HUB_PR_SS && le16_to_cpu(hdev->descriptor.bcdUSB) >= 0x0310 && - hdev->bos->ssp_cap); + hdev->bos && hdev->bos->ssp_cap); } static inline unsigned hub_power_on_good_delay(struct usb_hub *hub) -- 2.25.1

2 1

[PATCH] usb: hub: Guard against accesses to uninitialized BOS descriptors
by Jinjiang Tu 04 Mar '24

04 Mar '24

From: Ricardo Cañuelo <ricardo.canuelo(a)collabora.com> mainline inclusion from mainline-v6.6-rc6 commit f74a7afc224acd5e922c7a2e52244d891bbe44ee category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94P5J CVE: CVE-2023-52477 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- Many functions in drivers/usb/core/hub.c and drivers/usb/core/hub.h access fields inside udev->bos without checking if it was allocated and initialized. If usb_get_bos_descriptor() fails for whatever reason, udev->bos will be NULL and those accesses will result in a crash: BUG: kernel NULL pointer dereference, address: 0000000000000018 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 5 PID: 17818 Comm: kworker/5:1 Tainted: G W 5.15.108-18910-gab0e1cb584e1 #1 <HASH:1f9e 1> Hardware name: Google Kindred/Kindred, BIOS Google_Kindred.12672.413.0 02/03/2021 Workqueue: usb_hub_wq hub_event RIP: 0010:hub_port_reset+0x193/0x788 Code: 89 f7 e8 20 f7 15 00 48 8b 43 08 80 b8 96 03 00 00 03 75 36 0f b7 88 92 03 00 00 81 f9 10 03 00 00 72 27 48 8b 80 a8 03 00 00 <48> 83 78 18 00 74 19 48 89 df 48 8b 75 b0 ba 02 00 00 00 4c 89 e9 RSP: 0018:ffffab740c53fcf8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffa1bc5f678000 RCX: 0000000000000310 RDX: fffffffffffffdff RSI: 0000000000000286 RDI: ffffa1be9655b840 RBP: ffffab740c53fd70 R08: 00001b7d5edaa20c R09: ffffffffb005e060 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: ffffab740c53fd3e R14: 0000000000000032 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffffa1be96540000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000018 CR3: 000000022e80c005 CR4: 00000000003706e0 Call Trace: hub_event+0x73f/0x156e ? hub_activate+0x5b7/0x68f process_one_work+0x1a2/0x487 worker_thread+0x11a/0x288 kthread+0x13a/0x152 ? process_one_work+0x487/0x487 ? kthread_associate_blkcg+0x70/0x70 ret_from_fork+0x1f/0x30 Fall back to a default behavior if the BOS descriptor isn't accessible and skip all the functionalities that depend on it: LPM support checks, Super Speed capabilitiy checks, U1/U2 states setup. Signed-off-by: Ricardo Cañuelo <ricardo.canuelo(a)collabora.com> Cc: stable <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20230830100418.1952143-1-ricardo.canuelo@collabor… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/usb/core/hub.c Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/usb/core/hub.c | 19 +++++++++++++++++-- drivers/usb/core/hub.h | 2 +- 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c index c6b16194f3cf..a0cf795ebda2 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -138,6 +138,10 @@ int usb_device_supports_lpm(struct usb_device *udev) if (udev->quirks & USB_QUIRK_NO_LPM) return 0; + /* Skip if the device BOS descriptor couldn't be read */ + if (!udev->bos) + return 0; + /* USB 2.1 (and greater) devices indicate LPM support through * their USB 2.0 Extended Capabilities BOS descriptor. */ @@ -311,6 +315,10 @@ static void usb_set_lpm_parameters(struct usb_device *udev) if (!udev->lpm_capable || udev->speed < USB_SPEED_SUPER) return; + /* Skip if the device BOS descriptor couldn't be read */ + if (!udev->bos) + return; + hub = usb_hub_to_struct_hub(udev->parent); /* It doesn't take time to transition the roothub into U0, since it * doesn't have an upstream link. @@ -3979,8 +3987,15 @@ static void usb_enable_link_state(struct usb_hcd *hcd, struct usb_device *udev, enum usb3_link_state state) { int timeout, ret; - __u8 u1_mel = udev->bos->ss_cap->bU1devExitLat; - __le16 u2_mel = udev->bos->ss_cap->bU2DevExitLat; + __u8 u1_mel; + __le16 u2_mel; + + /* Skip if the device BOS descriptor couldn't be read */ + if (!udev->bos) + return; + + u1_mel = udev->bos->ss_cap->bU1devExitLat; + u2_mel = udev->bos->ss_cap->bU2DevExitLat; /* If the device says it doesn't have *any* exit latency to come out of * U1 or U2, it's probably lying. Assume it doesn't implement that link diff --git a/drivers/usb/core/hub.h b/drivers/usb/core/hub.h index 4accfb63f7dc..2ee899501220 100644 --- a/drivers/usb/core/hub.h +++ b/drivers/usb/core/hub.h @@ -138,7 +138,7 @@ static inline int hub_is_superspeedplus(struct usb_device *hdev) { return (hdev->descriptor.bDeviceProtocol == USB_HUB_PR_SS && le16_to_cpu(hdev->descriptor.bcdUSB) >= 0x0310 && - hdev->bos->ssp_cap); + hdev->bos && hdev->bos->ssp_cap); } static inline unsigned hub_power_on_good_delay(struct usb_hub *hub) -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 0/1] i2c: sprd: fix reference leak when pm_runtime_get_sync fails
by Liao Chen 04 Mar '24

04 Mar '24

Fix CVE-2020-36780 conflict: drivers/i2c/busses/i2c-sprd.c Qinglang Miao (1): i2c: sprd: fix reference leak when pm_runtime_get_sync fails drivers/i2c/busses/i2c-sprd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] usb: hub: Guard against accesses to uninitialized BOS descriptors
by Jinjiang Tu 04 Mar '24

04 Mar '24

From: Ricardo Cañuelo <ricardo.canuelo(a)collabora.com> mainline inclusion from mainline-v6.6-rc6 commit f74a7afc224acd5e922c7a2e52244d891bbe44ee category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94P5J CVE: CVE-2023-52477 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- Many functions in drivers/usb/core/hub.c and drivers/usb/core/hub.h access fields inside udev->bos without checking if it was allocated and initialized. If usb_get_bos_descriptor() fails for whatever reason, udev->bos will be NULL and those accesses will result in a crash: BUG: kernel NULL pointer dereference, address: 0000000000000018 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 5 PID: 17818 Comm: kworker/5:1 Tainted: G W 5.15.108-18910-gab0e1cb584e1 #1 <HASH:1f9e 1> Hardware name: Google Kindred/Kindred, BIOS Google_Kindred.12672.413.0 02/03/2021 Workqueue: usb_hub_wq hub_event RIP: 0010:hub_port_reset+0x193/0x788 Code: 89 f7 e8 20 f7 15 00 48 8b 43 08 80 b8 96 03 00 00 03 75 36 0f b7 88 92 03 00 00 81 f9 10 03 00 00 72 27 48 8b 80 a8 03 00 00 <48> 83 78 18 00 74 19 48 89 df 48 8b 75 b0 ba 02 00 00 00 4c 89 e9 RSP: 0018:ffffab740c53fcf8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffa1bc5f678000 RCX: 0000000000000310 RDX: fffffffffffffdff RSI: 0000000000000286 RDI: ffffa1be9655b840 RBP: ffffab740c53fd70 R08: 00001b7d5edaa20c R09: ffffffffb005e060 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: ffffab740c53fd3e R14: 0000000000000032 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffffa1be96540000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000018 CR3: 000000022e80c005 CR4: 00000000003706e0 Call Trace: hub_event+0x73f/0x156e ? hub_activate+0x5b7/0x68f process_one_work+0x1a2/0x487 worker_thread+0x11a/0x288 kthread+0x13a/0x152 ? process_one_work+0x487/0x487 ? kthread_associate_blkcg+0x70/0x70 ret_from_fork+0x1f/0x30 Fall back to a default behavior if the BOS descriptor isn't accessible and skip all the functionalities that depend on it: LPM support checks, Super Speed capabilitiy checks, U1/U2 states setup. Signed-off-by: Ricardo Cañuelo <ricardo.canuelo(a)collabora.com> Cc: stable <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20230830100418.1952143-1-ricardo.canuelo@collabor… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/usb/core/hub.c Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/usb/core/hub.c | 19 +++++++++++++++++-- drivers/usb/core/hub.h | 2 +- 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c index c6b16194f3cf..a0cf795ebda2 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -138,6 +138,10 @@ int usb_device_supports_lpm(struct usb_device *udev) if (udev->quirks & USB_QUIRK_NO_LPM) return 0; + /* Skip if the device BOS descriptor couldn't be read */ + if (!udev->bos) + return 0; + /* USB 2.1 (and greater) devices indicate LPM support through * their USB 2.0 Extended Capabilities BOS descriptor. */ @@ -311,6 +315,10 @@ static void usb_set_lpm_parameters(struct usb_device *udev) if (!udev->lpm_capable || udev->speed < USB_SPEED_SUPER) return; + /* Skip if the device BOS descriptor couldn't be read */ + if (!udev->bos) + return; + hub = usb_hub_to_struct_hub(udev->parent); /* It doesn't take time to transition the roothub into U0, since it * doesn't have an upstream link. @@ -3979,8 +3987,15 @@ static void usb_enable_link_state(struct usb_hcd *hcd, struct usb_device *udev, enum usb3_link_state state) { int timeout, ret; - __u8 u1_mel = udev->bos->ss_cap->bU1devExitLat; - __le16 u2_mel = udev->bos->ss_cap->bU2DevExitLat; + __u8 u1_mel; + __le16 u2_mel; + + /* Skip if the device BOS descriptor couldn't be read */ + if (!udev->bos) + return; + + u1_mel = udev->bos->ss_cap->bU1devExitLat; + u2_mel = udev->bos->ss_cap->bU2DevExitLat; /* If the device says it doesn't have *any* exit latency to come out of * U1 or U2, it's probably lying. Assume it doesn't implement that link diff --git a/drivers/usb/core/hub.h b/drivers/usb/core/hub.h index 4accfb63f7dc..2ee899501220 100644 --- a/drivers/usb/core/hub.h +++ b/drivers/usb/core/hub.h @@ -138,7 +138,7 @@ static inline int hub_is_superspeedplus(struct usb_device *hdev) { return (hdev->descriptor.bDeviceProtocol == USB_HUB_PR_SS && le16_to_cpu(hdev->descriptor.bcdUSB) >= 0x0310 && - hdev->bos->ssp_cap); + hdev->bos && hdev->bos->ssp_cap); } static inline unsigned hub_power_on_good_delay(struct usb_hub *hub) -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] fix CVE-2021-47036
by Zhengchao Shao 04 Mar '24

04 Mar '24

Fix CVE-2021-47036. Paolo Abeni (2): udp: skip L4 aggregation for UDP tunnel packets udp: properly flush normal packet at GRO time net/ipv4/udp_offload.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) -- 2.34.1

2 5

[PATCH openEuler-1.0-LTS] usb: dwc3: gadget: Free gadget structure only after freeing endpoints
by Zheng Zucheng 04 Mar '24

04 Mar '24

From: Jack Pham <jackp(a)codeaurora.org> mainline inclusion from mainline-v5.13-rc2 commit bb9c74a5bd1462499fe5ccb1e3c5ac40dcfa9139 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94JH6 CVE: CVE-2021-46986 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As part of commit e81a7018d93a ("usb: dwc3: allocate gadget structure dynamically") the dwc3_gadget_release() was added which will free the dwc->gadget structure upon the device's removal when usb_del_gadget_udc() is called in dwc3_gadget_exit(). However, simply freeing the gadget results a dangling pointer situation: the endpoints created in dwc3_gadget_init_endpoints() have their dep->endpoint.ep_list members chained off the list_head anchored at dwc->gadget->ep_list. Thus when dwc->gadget is freed, the first dwc3_ep in the list now has a dangling prev pointer and likewise for the next pointer of the dwc3_ep at the tail of the list. The dwc3_gadget_free_endpoints() that follows will result in a use-after-free when it calls list_del(). This was caught by enabling KASAN and performing a driver unbind. The recent commit 568262bf5492 ("usb: dwc3: core: Add shutdown callback for dwc3") also exposes this as a panic during shutdown. There are a few possibilities to fix this. One could be to perform a list_del() of the gadget->ep_list itself which removes it from the rest of the dwc3_ep chain. Another approach is what this patch does, by splitting up the usb_del_gadget_udc() call into its separate "del" and "put" components. This allows dwc3_gadget_free_endpoints() to be called before the gadget is finally freed with usb_put_gadget(). Fixes: e81a7018d93a ("usb: dwc3: allocate gadget structure dynamically") Reviewed-by: Peter Chen <peter.chen(a)kernel.org> Signed-off-by: Jack Pham <jackp(a)codeaurora.org> Link: https://lore.kernel.org/r/20210501093558.7375-1-jackp@codeaurora.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- drivers/usb/dwc3/gadget.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index a6e682a000fc..c733f71d1506 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -3224,8 +3224,9 @@ int dwc3_gadget_init(struct dwc3 *dwc) void dwc3_gadget_exit(struct dwc3 *dwc) { - usb_del_gadget_udc(&dwc->gadget); + usb_del_gadget(dwc->gadget); dwc3_gadget_free_endpoints(dwc); + usb_put_gadget(dwc->gadget); dma_free_coherent(dwc->sysdev, DWC3_BOUNCE_SIZE, dwc->bounce, dwc->bounce_addr); kfree(dwc->setup_buf); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] net: qualcomm: rmnet: fix global oob in rmnet_policy
by Xia Fukun 04 Mar '24

04 Mar '24

From: Lin Ma <linma(a)zju.edu.cn> mainline inclusion from mainline-v6.8-rc6 commit b33fb5b801c6db408b774a68e7c8722796b59ecc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EDF CVE: CVE-2024-26597 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The variable rmnet_link_ops assign a *bigger* maxtype which leads to a global out-of-bounds read when parsing the netlink attributes. See bug trace below: ================================================================== BUG: KASAN: global-out-of-bounds in validate_nla lib/nlattr.c:386 [inline] BUG: KASAN: global-out-of-bounds in __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 Read of size 1 at addr ffffffff92c438d0 by task syz-executor.6/84207 CPU: 0 PID: 84207 Comm: syz-executor.6 Tainted: G N 6.1.0 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x172/0x475 mm/kasan/report.c:395 kasan_report+0xbb/0x1c0 mm/kasan/report.c:495 validate_nla lib/nlattr.c:386 [inline] __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 __nla_parse+0x3e/0x50 lib/nlattr.c:697 nla_parse_nested_deprecated include/net/netlink.h:1248 [inline] __rtnl_newlink+0x50a/0x1880 net/core/rtnetlink.c:3485 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3594 rtnetlink_rcv_msg+0x43c/0xd70 net/core/rtnetlink.c:6091 netlink_rcv_skb+0x14f/0x410 net/netlink/af_netlink.c:2540 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x54e/0x800 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x930/0xe50 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0x154/0x190 net/socket.c:734 ____sys_sendmsg+0x6df/0x840 net/socket.c:2482 ___sys_sendmsg+0x110/0x1b0 net/socket.c:2536 __sys_sendmsg+0xf3/0x1c0 net/socket.c:2565 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fdcf2072359 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fdcf13e3168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fdcf219ff80 RCX: 00007fdcf2072359 RDX: 0000000000000000 RSI: 0000000020000200 RDI: 0000000000000003 RBP: 00007fdcf20bd493 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fffbb8d7bdf R14: 00007fdcf13e3300 R15: 0000000000022000 </TASK> The buggy address belongs to the variable: rmnet_policy+0x30/0xe0 The buggy address belongs to the physical page: page:0000000065bdeb3c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x155243 flags: 0x200000000001000(reserved|node=0|zone=2) raw: 0200000000001000 ffffea00055490c8 ffffea00055490c8 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffffffff92c43780: f9 f9 f9 f9 00 00 00 02 f9 f9 f9 f9 00 00 00 07 ffffffff92c43800: f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 06 f9 f9 f9 >ffffffff92c43880: f9 f9 f9 f9 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 ^ ffffffff92c43900: 00 00 00 00 00 00 00 00 07 f9 f9 f9 f9 f9 f9 f9 ffffffff92c43980: 00 00 00 07 f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 According to the comment of `nla_parse_nested_deprecated`, the maxtype should be len(destination array) - 1. Hence use `IFLA_RMNET_MAX` here. Fixes: 14452ca3b5ce ("net: qualcomm: rmnet: Export mux_id and flags to netlink") Signed-off-by: Lin Ma <linma(a)zju.edu.cn> Reviewed-by: Subash Abhinov Kasiviswanathan <quic_subashab(a)quicinc.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Reviewed-by: Jiri Pirko <jiri(a)nvidia.com> Link: https://lore.kernel.org/r/20240110061400.3356108-1-linma@zju.edu.cn Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c index 4c476fac7835..a7360fb3e45c 100644 --- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c +++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c @@ -376,7 +376,7 @@ static int rmnet_fill_info(struct sk_buff *skb, const struct net_device *dev) struct rtnl_link_ops rmnet_link_ops __read_mostly = { .kind = "rmnet", - .maxtype = __IFLA_RMNET_MAX, + .maxtype = IFLA_RMNET_MAX, .priv_size = sizeof(struct rmnet_priv), .setup = rmnet_vnd_setup, .validate = rmnet_rtnl_validate, -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios
by Zheng Yejian 04 Mar '24

04 Mar '24

From: Hans de Goede <hdegoede(a)redhat.com> mainline inclusion from mainline-v5.13-rc3 commit 3a53587423d25c87af4b4126a806a0575104b45e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I956GN CVE: CVE-2021-47073 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- init_dell_smbios_wmi() only registers the dell_smbios_wmi_driver on systems where the Dell WMI interface is supported. While exit_dell_smbios_wmi() unregisters it unconditionally, this leads to the following oops: [ 175.722921] ------------[ cut here ]------------ [ 175.722925] Unexpected driver unregister! [ 175.722939] WARNING: CPU: 1 PID: 3630 at drivers/base/driver.c:194 driver_unregister+0x38/0x40 ... [ 175.723089] Call Trace: [ 175.723094] cleanup_module+0x5/0xedd [dell_smbios] ... [ 175.723148] ---[ end trace 064c34e1ad49509d ]--- Make the unregister happen on the same condition the register happens to fix this. Cc: Mario Limonciello <mario.limonciello(a)outlook.com> Fixes: 1a258e670434 ("platform/x86: dell-smbios-wmi: Add new WMI dispatcher driver") Signed-off-by: Hans de Goede <hdegoede(a)redhat.com> Reviewed-by: Mario Limonciello <mario.limonciello(a)outlook.com> Reviewed-by: Mark Gross <mgross(a)linux.intel.com> Link: https://lore.kernel.org/r/20210518125027.21824-1-hdegoede@redhat.com Conflict: drivers/platform/x86/dell-smbios-wmi.c Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- drivers/platform/x86/dell-smbios-wmi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/platform/x86/dell-smbios-wmi.c b/drivers/platform/x86/dell-smbios-wmi.c index cf2229ece9ff..ccccce9b67ef 100644 --- a/drivers/platform/x86/dell-smbios-wmi.c +++ b/drivers/platform/x86/dell-smbios-wmi.c @@ -274,7 +274,8 @@ int init_dell_smbios_wmi(void) void exit_dell_smbios_wmi(void) { - wmi_driver_unregister(&dell_smbios_wmi_driver); + if (wmi_supported) + wmi_driver_unregister(&dell_smbios_wmi_driver); } MODULE_ALIAS("wmi:" DELL_WMI_SMBIOS_GUID); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/1] i2c: validate user data in compat ioctl
by Hongbo Li 04 Mar '24

04 Mar '24

Fix CVE-2021-46934 Pavel Skripkin (1): i2c: validate user data in compat ioctl drivers/i2c/i2c-dev.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios
by Zheng Yejian 04 Mar '24

04 Mar '24

From: Hans de Goede <hdegoede(a)redhat.com> init_dell_smbios_wmi() only registers the dell_smbios_wmi_driver on systems where the Dell WMI interface is supported. While exit_dell_smbios_wmi() unregisters it unconditionally, this leads to the following oops: [ 175.722921] ------------[ cut here ]------------ [ 175.722925] Unexpected driver unregister! [ 175.722939] WARNING: CPU: 1 PID: 3630 at drivers/base/driver.c:194 driver_unregister+0x38/0x40 ... [ 175.723089] Call Trace: [ 175.723094] cleanup_module+0x5/0xedd [dell_smbios] ... [ 175.723148] ---[ end trace 064c34e1ad49509d ]--- Make the unregister happen on the same condition the register happens to fix this. Cc: Mario Limonciello <mario.limonciello(a)outlook.com> Fixes: 1a258e670434 ("platform/x86: dell-smbios-wmi: Add new WMI dispatcher driver") Signed-off-by: Hans de Goede <hdegoede(a)redhat.com> Reviewed-by: Mario Limonciello <mario.limonciello(a)outlook.com> Reviewed-by: Mark Gross <mgross(a)linux.intel.com> Link: https://lore.kernel.org/r/20210518125027.21824-1-hdegoede@redhat.com Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> Conflict: drivers/platform/x86/dell-smbios-wmi.c Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- drivers/platform/x86/dell-smbios-wmi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/platform/x86/dell-smbios-wmi.c b/drivers/platform/x86/dell-smbios-wmi.c index cf2229ece9ff..ccccce9b67ef 100644 --- a/drivers/platform/x86/dell-smbios-wmi.c +++ b/drivers/platform/x86/dell-smbios-wmi.c @@ -274,7 +274,8 @@ int init_dell_smbios_wmi(void) void exit_dell_smbios_wmi(void) { - wmi_driver_unregister(&dell_smbios_wmi_driver); + if (wmi_supported) + wmi_driver_unregister(&dell_smbios_wmi_driver); } MODULE_ALIAS("wmi:" DELL_WMI_SMBIOS_GUID); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] arm64/mpam: Skip updates of unrelated ctrl type
by Zeng Heng 04 Mar '24

04 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I95IFB CVE: NA ---------------------------------------- Add ctrl_updated variable and only when ctrl_updated is true, the new control configuration needs to deliver. Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/include/asm/resctrl.h | 1 + arch/arm64/kernel/mpam/mpam_ctrlmon.c | 24 +++++++++++++++++------- arch/arm64/kernel/mpam/mpam_resctrl.c | 2 ++ 3 files changed, 20 insertions(+), 7 deletions(-) diff --git a/arch/arm64/include/asm/resctrl.h b/arch/arm64/include/asm/resctrl.h index 2865397740b4..d46b9ffe6c88 100644 --- a/arch/arm64/include/asm/resctrl.h +++ b/arch/arm64/include/asm/resctrl.h @@ -295,6 +295,7 @@ do { \ struct resctrl_staged_config { hw_closid_t hw_closid; u32 new_ctrl[SCHEMA_NUM_CTRL_TYPE]; + bool ctrl_updated[SCHEMA_NUM_CTRL_TYPE]; bool have_new_ctrl; enum resctrl_conf_type conf_type; enum resctrl_ctrl_type ctrl_type; diff --git a/arch/arm64/kernel/mpam/mpam_ctrlmon.c b/arch/arm64/kernel/mpam/mpam_ctrlmon.c index 9bf4f68fb2f5..7659b29e6fe3 100644 --- a/arch/arm64/kernel/mpam/mpam_ctrlmon.c +++ b/arch/arm64/kernel/mpam/mpam_ctrlmon.c @@ -265,7 +265,8 @@ static void resctrl_group_update_domain_ctrls(struct rdtgroup *rdtgrp, closid.intpartid = hw_closid_val(cfg[i].hw_closid); for_each_ctrl_type(type) { /* if ctrl group's config has changed, refresh it first. */ - if (dom->ctrl_val[closid.intpartid] != cfg[i].new_ctrl) { + if (dom->ctrl_val[type][closid.intpartid] != cfg[i].new_ctrl[type] && + cfg[i].ctrl_updated[type] == true) { /* * duplicate ctrl group's configuration indexed * by intpartid from domain ctrl_val array. @@ -400,6 +401,7 @@ ssize_t resctrl_group_schemata_write(struct kernfs_open_file *of, struct mpam_resctrl_res *res; enum resctrl_conf_type conf_type; struct resctrl_staged_config *cfg; + enum resctrl_ctrl_type t; char *tok, *resname; u32 closid; int ret = 0; @@ -422,13 +424,17 @@ ssize_t resctrl_group_schemata_write(struct kernfs_open_file *of, for_each_supported_resctrl_exports(res) { r = &res->resctrl_res; - if (r->alloc_enabled) { - list_for_each_entry(dom, &r->domains, list) { - dom->have_new_ctrl = false; - for_each_conf_type(conf_type) { - cfg = &dom->staged_cfg[conf_type]; - cfg->have_new_ctrl = false; + if (!r->alloc_enabled) + continue; + + list_for_each_entry(dom, &r->domains, list) { + dom->have_new_ctrl = false; + for_each_conf_type(conf_type) { + cfg = &dom->staged_cfg[conf_type]; + for_each_ctrl_type(t) { + cfg->ctrl_updated[t] = false; } + cfg->have_new_ctrl = false; } } } @@ -908,11 +914,13 @@ static void rdtgroup_init_mba(struct resctrl_schema *s, u32 closid) cfg = &d->staged_cfg[CDP_BOTH]; cfg->cdp_both_ctrl = s->cdp_mc_both; cfg->new_ctrl[SCHEMA_COMM] = rr->ctrl_features[SCHEMA_COMM].default_ctrl; + cfg->ctrl_updated[SCHEMA_COMM] = true; resctrl_cdp_mpamid_map(closid, CDP_BOTH, cfg->hw_closid); cfg->have_new_ctrl = true; /* Set extension ctrl default value, e.g. priority/hardlimit */ for_each_extend_ctrl_type(t) { cfg->new_ctrl[t] = rr->ctrl_features[t].default_ctrl; + cfg->ctrl_updated[t] = true; } } } @@ -965,6 +973,7 @@ static int rdtgroup_init_cat(struct resctrl_schema *s, u32 closid) } resctrl_cdp_mpamid_map(closid, conf_type, cfg->hw_closid); + cfg->ctrl_updated[SCHEMA_COMM] = true; cfg->have_new_ctrl = true; /* @@ -974,6 +983,7 @@ static int rdtgroup_init_cat(struct resctrl_schema *s, u32 closid) for_each_extend_ctrl_type(ctrl_type) { cfg->new_ctrl[ctrl_type] = rr->ctrl_features[ctrl_type].default_ctrl; + cfg->ctrl_updated[ctrl_type] = true; } } diff --git a/arch/arm64/kernel/mpam/mpam_resctrl.c b/arch/arm64/kernel/mpam/mpam_resctrl.c index 5901261d17fc..7dcb75accf86 100644 --- a/arch/arm64/kernel/mpam/mpam_resctrl.c +++ b/arch/arm64/kernel/mpam/mpam_resctrl.c @@ -322,6 +322,7 @@ parse_cache(char *buf, struct resctrl_resource *r, return -EINVAL; cfg->new_ctrl[type] = data; + cfg->ctrl_updated[type] = true; cfg->have_new_ctrl = true; return 0; @@ -364,6 +365,7 @@ parse_bw(char *buf, struct resctrl_resource *r, return -EINVAL; cfg->new_ctrl[type] = data; + cfg->ctrl_updated[type] = true; cfg->have_new_ctrl = true; return 0; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] arm64/mpam: set default feedback of last_cmd_status interface as null string
by Zeng Heng 04 Mar '24

04 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I95IFO CVE: NA ---------------------------------------- Set default feedback of last_cmd_status interface as null string, in case misunderstanding the execution result of the previous command. Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_resctrl.c | 2 +- arch/x86/kernel/cpu/intel_rdt_rdtgroup.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kernel/mpam/mpam_resctrl.c b/arch/arm64/kernel/mpam/mpam_resctrl.c index 60d3d8706a38..5901261d17fc 100644 --- a/arch/arm64/kernel/mpam/mpam_resctrl.c +++ b/arch/arm64/kernel/mpam/mpam_resctrl.c @@ -1749,7 +1749,7 @@ static int resctrl_last_cmd_status_show(struct kernfs_open_file *of, if (len) seq_printf(seq, "%.*s", len, last_cmd_status_buf); else - seq_puts(seq, "ok\n"); + seq_puts(seq, ""); mutex_unlock(&resctrl_group_mutex); return 0; } diff --git a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c index a2d7e6646cce..686f685c8c7e 100644 --- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c +++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c @@ -743,7 +743,7 @@ static int rdt_last_cmd_status_show(struct kernfs_open_file *of, if (len) seq_printf(seq, "%.*s", len, last_cmd_status_buf); else - seq_puts(seq, "ok\n"); + seq_puts(seq, ""); mutex_unlock(&rdtgroup_mutex); return 0; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] arm64/mpam: support resctrl fs to show mounting option
by Zeng Heng 04 Mar '24

04 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I95IFL CVE: NA ---------------------------------------- Support to display MPAM mounting options: # mount -t resctrl resctrl /sys/fs/resctrl/ -o cdpl3,mbMin,mbMax,mbHdl,caPbm # mount | grep resctrl resctrl on /sys/fs/resctrl type resctrl (rw,relatime,cdpl3,caPbm,mbMax,mbMin,mbHdl) Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/include/asm/resctrl.h | 5 +--- arch/arm64/kernel/mpam/mpam_ctrlmon.c | 34 +++++++++++++++++++++++++++ 2 files changed, 35 insertions(+), 4 deletions(-) diff --git a/arch/arm64/include/asm/resctrl.h b/arch/arm64/include/asm/resctrl.h index 3fceaa482e5a..2865397740b4 100644 --- a/arch/arm64/include/asm/resctrl.h +++ b/arch/arm64/include/asm/resctrl.h @@ -415,10 +415,7 @@ void resctrl_resource_reset(void); int resctrl_group_init_alloc(struct rdtgroup *rdtgrp); -static inline int __resctrl_group_show_options(struct seq_file *seq) -{ - return 0; -} +int __resctrl_group_show_options(struct seq_file *seq); int resctrl_update_groups_config(struct rdtgroup *rdtgrp); diff --git a/arch/arm64/kernel/mpam/mpam_ctrlmon.c b/arch/arm64/kernel/mpam/mpam_ctrlmon.c index 4b8429ceddb6..9bf4f68fb2f5 100644 --- a/arch/arm64/kernel/mpam/mpam_ctrlmon.c +++ b/arch/arm64/kernel/mpam/mpam_ctrlmon.c @@ -1027,3 +1027,37 @@ int resctrl_update_groups_config(struct rdtgroup *rdtgrp) return ret; } + +int __resctrl_group_show_options(struct seq_file *seq) +{ + struct resctrl_resource *res; + struct raw_resctrl_resource *r; + + res = mpam_resctrl_get_resource(RDT_RESOURCE_L3); + if (res && res->cdp_enable) + seq_puts(seq, ",cdpl3"); + + res = mpam_resctrl_get_resource(RDT_RESOURCE_L2); + if (res && res->cdp_enable) + seq_puts(seq, ",cdpl2"); + + r = mpam_get_raw_resctrl_resource(RDT_RESOURCE_L3); + if (r && r->ctrl_features[SCHEMA_PBM].enabled) + seq_puts(seq, ",caPbm"); + if (r && r->ctrl_features[SCHEMA_MAX].enabled) + seq_puts(seq, ",caMax"); + if (r && r->ctrl_features[SCHEMA_PRI].enabled) + seq_puts(seq, ",caPrio"); + + r = mpam_get_raw_resctrl_resource(RDT_RESOURCE_MC); + if (r && r->ctrl_features[SCHEMA_MAX].enabled) + seq_puts(seq, ",mbMax"); + if (r && r->ctrl_features[SCHEMA_MIN].enabled) + seq_puts(seq, ",mbMin"); + if (r && r->ctrl_features[SCHEMA_HDL].enabled) + seq_puts(seq, ",mbHdl"); + if (r && r->ctrl_features[SCHEMA_PRI].enabled) + seq_puts(seq, ",mbPrio"); + + return 0; +} -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
by Zhengchao Shao 04 Mar '24

04 Mar '24

From: Yuxuan Hu <20373622(a)buaa.edu.cn> mainline inclusion from mainline-v6.8-rc7 commit 2535b848fa0f42ddff3e5255cf5e742c9b77bb26 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8YV3O CVE: CVE-2024-22099 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- During our fuzz testing of the connection and disconnection process at the RFCOMM layer, we discovered this bug. By comparing the packets from a normal connection and disconnection process with the testcase that triggered a KASAN report. We analyzed the cause of this bug as follows: 1. In the packets captured during a normal connection, the host sends a `Read Encryption Key Size` type of `HCI_CMD` packet (Command Opcode: 0x1408) to the controller to inquire the length of encryption key.After receiving this packet, the controller immediately replies with a Command Completepacket (Event Code: 0x0e) to return the Encryption Key Size. 2. In our fuzz test case, the timing of the controller's response to this packet was delayed to an unexpected point: after the RFCOMM and L2CAP layers had disconnected but before the HCI layer had disconnected. 3. After receiving the Encryption Key Size Response at the time described in point 2, the host still called the rfcomm_check_security function. However, by this time `struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;` had already been released, and when the function executed `return hci_conn_security(conn->hcon, d->sec_level, auth_type, d->out);`, specifically when accessing `conn->hcon`, a null-ptr-deref error occurred. To fix this bug, check if `sk->sk_state` is BT_CLOSED before calling rfcomm_recv_frame in rfcomm_process_rx. Signed-off-by: Yuxuan Hu <20373622(a)buaa.edu.cn> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/bluetooth/rfcomm/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c index 8d6fce9005bd..4f54c7df3a94 100644 --- a/net/bluetooth/rfcomm/core.c +++ b/net/bluetooth/rfcomm/core.c @@ -1937,7 +1937,7 @@ static struct rfcomm_session *rfcomm_process_rx(struct rfcomm_session *s) /* Get data directly from socket receive queue without copying it. */ while ((skb = skb_dequeue(&sk->sk_receive_queue))) { skb_orphan(skb); - if (!skb_linearize(skb)) { + if (!skb_linearize(skb) && sk->sk_state != BT_CLOSED) { s = rfcomm_recv_frame(s, skb); if (!s) break; -- 2.34.1

2 1

[PATCH OLK-5.10] Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
by Zhengchao Shao 04 Mar '24

04 Mar '24

From: Yuxuan Hu <20373622(a)buaa.edu.cn> mainline inclusion from mainline-v6.8-rc7 commit 2535b848fa0f42ddff3e5255cf5e742c9b77bb26 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8YV3O CVE: CVE-2024-22099 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- During our fuzz testing of the connection and disconnection process at the RFCOMM layer, we discovered this bug. By comparing the packets from a normal connection and disconnection process with the testcase that triggered a KASAN report. We analyzed the cause of this bug as follows: 1. In the packets captured during a normal connection, the host sends a `Read Encryption Key Size` type of `HCI_CMD` packet (Command Opcode: 0x1408) to the controller to inquire the length of encryption key.After receiving this packet, the controller immediately replies with a Command Completepacket (Event Code: 0x0e) to return the Encryption Key Size. 2. In our fuzz test case, the timing of the controller's response to this packet was delayed to an unexpected point: after the RFCOMM and L2CAP layers had disconnected but before the HCI layer had disconnected. 3. After receiving the Encryption Key Size Response at the time described in point 2, the host still called the rfcomm_check_security function. However, by this time `struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;` had already been released, and when the function executed `return hci_conn_security(conn->hcon, d->sec_level, auth_type, d->out);`, specifically when accessing `conn->hcon`, a null-ptr-deref error occurred. To fix this bug, check if `sk->sk_state` is BT_CLOSED before calling rfcomm_recv_frame in rfcomm_process_rx. Signed-off-by: Yuxuan Hu <20373622(a)buaa.edu.cn> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/bluetooth/rfcomm/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c index 8d6fce9005bd..4f54c7df3a94 100644 --- a/net/bluetooth/rfcomm/core.c +++ b/net/bluetooth/rfcomm/core.c @@ -1937,7 +1937,7 @@ static struct rfcomm_session *rfcomm_process_rx(struct rfcomm_session *s) /* Get data directly from socket receive queue without copying it. */ while ((skb = skb_dequeue(&sk->sk_receive_queue))) { skb_orphan(skb); - if (!skb_linearize(skb)) { + if (!skb_linearize(skb) && sk->sk_state != BT_CLOSED) { s = rfcomm_recv_frame(s, skb); if (!s) break; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/1] i2c: validate user data in compat ioctl
by Hongbo Li 04 Mar '24

04 Mar '24

Fix CVE-2021-46934 Pavel Skripkin (1): i2c: validate user data in compat ioctl drivers/i2c/i2c-dev.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

2 2

[openeuler:OLK-5.10 25831/30000] drivers/gpu/drm/phytium/phytium_dp.c:300:17: warning: 'strncpy' output may be truncated copying 32 bytes from a string of length 439
by kernel test robot 04 Mar '24

04 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 6adee00913b51cd59245584085cdaca64f74465c commit: b2a83bcdafcaaaa60199147d04798d431cc800cc [25831/30000] DRM: Phytium display DRM driver config: arm64-randconfig-002-20240302 (https://download.01.org/0day-ci/archive/20240304/202403041133.ZJq3J9Jk-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240304/202403041133.ZJq3J9Jk-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403041133.ZJq3J9Jk-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/gpu/drm/phytium/phytium_dp.c:503:6: warning: no previous prototype for 'phytium_dp_coding_8b10b_need_enable' [-Wmissing-prototypes] 503 | bool phytium_dp_coding_8b10b_need_enable(unsigned char test_pattern) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:520:6: warning: no previous prototype for 'phytium_dp_scrambled_need_enable' [-Wmissing-prototypes] 520 | bool phytium_dp_scrambled_need_enable(unsigned char test_pattern) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:653:6: warning: no previous prototype for 'phytium_dp_hw_enable_audio' [-Wmissing-prototypes] 653 | void phytium_dp_hw_enable_audio(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:822:6: warning: no previous prototype for 'phytium_dp_hw_disable_video' [-Wmissing-prototypes] 822 | void phytium_dp_hw_disable_video(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:833:6: warning: no previous prototype for 'phytium_dp_hw_video_is_enable' [-Wmissing-prototypes] 833 | bool phytium_dp_hw_video_is_enable(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:844:6: warning: no previous prototype for 'phytium_dp_hw_enable_video' [-Wmissing-prototypes] 844 | void phytium_dp_hw_enable_video(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:856:6: warning: no previous prototype for 'phytium_dp_hw_config_video' [-Wmissing-prototypes] 856 | void phytium_dp_hw_config_video(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:945:6: warning: no previous prototype for 'phytium_dp_hw_disable_output' [-Wmissing-prototypes] 945 | void phytium_dp_hw_disable_output(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:957:6: warning: no previous prototype for 'phytium_dp_hw_enable_output' [-Wmissing-prototypes] 957 | void phytium_dp_hw_enable_output(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:969:6: warning: no previous prototype for 'phytium_dp_hw_enable_input_source' [-Wmissing-prototypes] 969 | void phytium_dp_hw_enable_input_source(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:980:6: warning: no previous prototype for 'phytium_dp_hw_disable_input_source' [-Wmissing-prototypes] 980 | void phytium_dp_hw_disable_input_source(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:990:6: warning: no previous prototype for 'phytium_dp_hw_output_is_enable' [-Wmissing-prototypes] 990 | bool phytium_dp_hw_output_is_enable(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:1027:6: warning: no previous prototype for 'phytium_dp_hw_hpd_irq_setup' [-Wmissing-prototypes] 1027 | void phytium_dp_hw_hpd_irq_setup(struct phytium_dp_device *phytium_dp, bool enable) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:1042:5: warning: no previous prototype for 'phytium_dp_hw_init' [-Wmissing-prototypes] 1042 | int phytium_dp_hw_init(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:1220:6: warning: no previous prototype for 'phytium_dp_dpcd_sink_dpms' [-Wmissing-prototypes] 1220 | void phytium_dp_dpcd_sink_dpms(struct phytium_dp_device *phytium_dp, int mode) | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:1445:5: warning: no previous prototype for 'phytium_dp_get_link_train_fallback_values' [-Wmissing-prototypes] 1445 | int phytium_dp_get_link_train_fallback_values(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:1494:5: warning: no previous prototype for 'phytium_dp_start_link_train' [-Wmissing-prototypes] 1494 | int phytium_dp_start_link_train(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:1799:6: warning: no previous prototype for 'phytium_dp_hpd_poll_handler' [-Wmissing-prototypes] 1799 | void phytium_dp_hpd_poll_handler(struct phytium_display_private *priv) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:1946:6: warning: no previous prototype for 'phytium_dp_fast_link_train' [-Wmissing-prototypes] 1946 | bool phytium_dp_fast_link_train(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:2137:6: warning: no previous prototype for 'phytium_dp_adjust_link_train_parameter' [-Wmissing-prototypes] 2137 | void phytium_dp_adjust_link_train_parameter(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:2197:1: warning: no previous prototype for 'phytium_encoder_mode_valid' [-Wmissing-prototypes] 2197 | phytium_encoder_mode_valid(struct drm_encoder *encoder, const struct drm_display_mode *mode) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:2447:5: warning: no previous prototype for 'phytium_get_encoder_crtc_mask' [-Wmissing-prototypes] 2447 | int phytium_get_encoder_crtc_mask(struct phytium_dp_device *phytium_dp, int port) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c: In function 'phytium_connector_add_common_modes': >> drivers/gpu/drm/phytium/phytium_dp.c:300:17: warning: 'strncpy' output may be truncated copying 32 bytes from a string of length 439 [-Wstringop-truncation] 300 | strncpy(mode->name, common_mode[i].name, DRM_DISPLAY_MODE_LEN); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/strncpy +300 drivers/gpu/drm/phytium/phytium_dp.c 244 245 static int phytium_connector_add_common_modes(struct phytium_dp_device *phytium_dp) 246 { 247 int i = 0, ret = 0; 248 struct drm_device *dev = phytium_dp->dev; 249 struct drm_display_mode *mode = NULL, *current_mode = NULL; 250 struct drm_display_mode *native_mode = &phytium_dp->native_mode; 251 bool mode_existed = false; 252 struct mode_size { 253 char name[DRM_DISPLAY_MODE_LEN]; 254 int w; 255 int h; 256 } common_mode[] = { 257 { "640x480", 640, 480}, 258 { "800x600", 800, 600}, 259 { "1024x768", 1024, 768}, 260 { "1280x720", 1280, 720}, 261 { "1280x800", 1280, 800}, 262 {"1280x1024", 1280, 1024}, 263 { "1440x900", 1440, 900}, 264 {"1680x1050", 1680, 1050}, 265 {"1600x1200", 1600, 1200}, 266 {"1920x1080", 1920, 1080}, 267 {"1920x1200", 1920, 1200} 268 }; 269 270 if (native_mode->clock == 0) 271 return ret; 272 273 for (i = 0; i < ARRAY_SIZE(common_mode); i++) { 274 mode_existed = false; 275 276 if (common_mode[i].w > native_mode->hdisplay || 277 common_mode[i].h > native_mode->vdisplay || 278 (common_mode[i].w == native_mode->hdisplay && 279 common_mode[i].h == native_mode->vdisplay)) 280 continue; 281 282 list_for_each_entry(current_mode, &phytium_dp->connector.probed_modes, head) { 283 if (common_mode[i].w == current_mode->hdisplay && 284 common_mode[i].h == current_mode->vdisplay) { 285 mode_existed = true; 286 break; 287 } 288 } 289 290 if (mode_existed) 291 continue; 292 293 mode = drm_mode_duplicate(dev, native_mode); 294 if (mode == NULL) 295 continue; 296 297 mode->hdisplay = common_mode[i].w; 298 mode->vdisplay = common_mode[i].h; 299 mode->type &= ~DRM_MODE_TYPE_PREFERRED; > 300 strncpy(mode->name, common_mode[i].name, DRM_DISPLAY_MODE_LEN); 301 drm_mode_probed_add(&phytium_dp->connector, mode); 302 ret++; 303 } 304 305 return ret; 306 } 307 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/1] i2c: validate user data in compat ioctl
by Hongbo Li 04 Mar '24

04 Mar '24

Fix CVE-2021-46934 Pavel Skripkin (1): i2c: validate user data in compat ioctl drivers/i2c/i2c-dev.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

2 2

[PATCH v3 openEuler-1.0-LTS] media: dvbdev: Fix memory leak in dvb_media_device_free()
by Wenyu Huang 04 Mar '24

04 Mar '24

From: Peilin Ye <yepeilin.cs(a)gmail.com> stable inclusion from stable-v4.19.308 commit cd89f79be5d553c78202f686e8e4caa5fbe94e98 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I949D9 CVE: CVE-2020-36777 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit bf9a40ae8d722f281a2721779595d6df1c33a0bf upstream. dvb_media_device_free() is leaking memory. Free `dvbdev->adapter->conn` before setting it to NULL, as documented in include/media/media-device.h: "The media_entity instance itself must be freed explicitly by the driver if required." Link: https://syzkaller.appspot.com/bug?id=9bbe4b842c98f0ed05c5eed77a226e9de33bf2… Link: https://lore.kernel.org/linux-media/20201211083039.521617-1-yepeilin.cs@gma… Cc: stable(a)vger.kernel.org Fixes: 0230d60e4661 ("[media] dvbdev: Add RF connector if needed") Reported-by: syzbot+7f09440acc069a0d38ac(a)syzkaller.appspotmail.com Signed-off-by: Peilin Ye <yepeilin.cs(a)gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/media/dvb-core/dvbdev.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c index a7d57ff7c88b..4b562238749d 100644 --- a/drivers/media/dvb-core/dvbdev.c +++ b/drivers/media/dvb-core/dvbdev.c @@ -242,6 +242,7 @@ static void dvb_media_device_free(struct dvb_device *dvbdev) if (dvbdev->adapter->conn) { media_device_unregister_entity(dvbdev->adapter->conn); + kfree(dvbdev->adapter->conn); dvbdev->adapter->conn = NULL; kfree(dvbdev->adapter->conn_pads); dvbdev->adapter->conn_pads = NULL; -- 2.34.1

2 1

[openeuler:OLK-6.6 2180/3769] kernel/sched/fair.c:8988:1: sparse: sparse: symbol 'qos_smt_expell_switch' was not declared. Should it be static?
by kernel test robot 04 Mar '24

04 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: fbcd4a3032a53350f6d182c9daeaa4c46e65d964 commit: a62d532da0b51fe39f726c4c08f3debc8b3bc5d7 [2180/3769] sched/fair: Add cmdline nosmtexpell config: arm64-randconfig-r111-20240227 (https://download.01.org/0day-ci/archive/20240304/202403041146.O9ZSxlLC-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240304/202403041146.O9ZSxlLC-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403041146.O9ZSxlLC-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) kernel/sched/fair.c:151:14: sparse: sparse: symbol 'sysctl_overload_detect_period' was not declared. Should it be static? kernel/sched/fair.c:152:14: sparse: sparse: symbol 'sysctl_offline_wait_interval' was not declared. Should it be static? kernel/sched/fair.c:1284:34: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct sched_entity const *se @@ got struct sched_entity [noderef] __rcu * @@ kernel/sched/fair.c:1284:34: sparse: expected struct sched_entity const *se kernel/sched/fair.c:1284:34: sparse: got struct sched_entity [noderef] __rcu * kernel/sched/fair.c:13325:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:13325:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:13325:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:6038:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:6038:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:6038:22: sparse: struct task_struct * kernel/sched/fair.c:6780:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:6780:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:6780:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:8163:20: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:8163:20: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:8163:20: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:8478:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] tmp @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:8478:9: sparse: expected struct sched_domain *[assigned] tmp kernel/sched/fair.c:8478:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:8590:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:8590:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:8590:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:8936:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:8936:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:8936:22: sparse: struct task_struct * >> kernel/sched/fair.c:8988:1: sparse: sparse: symbol 'qos_smt_expell_switch' was not declared. Should it be static? kernel/sched/fair.c:9122:51: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct task_struct *sibling_p @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:9122:51: sparse: expected struct task_struct *sibling_p kernel/sched/fair.c:9122:51: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:9127:30: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:9127:30: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:9127:30: sparse: struct task_struct * kernel/sched/fair.c:9205:48: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct task_struct *p @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:9454:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:10525:40: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain *child @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/fair.c:11162:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:11162:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:11162:22: sparse: struct task_struct * kernel/sched/fair.c:12603:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12603:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12603:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:12260:44: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain *sd_parent @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12260:44: sparse: expected struct sched_domain *sd_parent kernel/sched/fair.c:12260:44: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:12699:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12699:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12699:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c: note: in included file (through include/linux/rculist.h, include/linux/pid.h, include/linux/sched.h, ...): include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true kernel/sched/fair.c: note: in included file: kernel/sched/sched.h:2182:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2182:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2182:25: sparse: struct task_struct * kernel/sched/sched.h:2346:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2346:9: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2346:9: sparse: struct task_struct * kernel/sched/sched.h:2346:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2346:9: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2346:9: sparse: struct task_struct * kernel/sched/sched.h:2182:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2182:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2182:25: sparse: struct task_struct * kernel/sched/sched.h:2182:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2182:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2182:25: sparse: struct task_struct * vim +/qos_smt_expell_switch +8988 kernel/sched/fair.c 8986 8987 #ifdef CONFIG_QOS_SCHED_SMT_EXPELLER > 8988 DEFINE_STATIC_KEY_TRUE(qos_smt_expell_switch); 8989 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] KVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU
by Liu Shixin 04 Mar '24

04 Mar '24

From: Sean Christopherson <seanjc(a)google.com> mainline inclusion from mainline-v5.13-rc1 commit 2ee3757424be7c1cd1d0bbfa6db29a7edd82a250 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94VO4 CVE: CVE-2021-47061 -------------------------------- If allocating a new instance of an I/O bus fails when unregistering a device, wait to destroy the device until after all readers are guaranteed to see the new null bus. Destroying devices before the bus is nullified could lead to use-after-free since readers expect the devices on their reference of the bus to remain valid. Fixes: f65886606c2d ("KVM: fix memory leak in kvm_io_bus_unregister_dev()") Cc: stable(a)vger.kernel.org Signed-off-by: Sean Christopherson <seanjc(a)google.com> Message-Id: <20210412222050.876100-2-seanjc(a)google.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Conflicts: virt/kvm/kvm_main.c Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- virt/kvm/kvm_main.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index 5f4f222c991f..b65bff740c24 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -3878,7 +3878,13 @@ void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx, new_bus->dev_count--; memcpy(new_bus->range + i, bus->range + i + 1, (new_bus->dev_count - i) * sizeof(struct kvm_io_range)); - } else { + } + + rcu_assign_pointer(kvm->buses[bus_idx], new_bus); + synchronize_srcu_expedited(&kvm->srcu); + + /* Destroy the old bus _after_ installing the (null) bus. */ + if (!new_bus) { pr_err("kvm: failed to shrink bus, removing it completely\n"); for (j = 0; j < bus->dev_count; j++) { if (j == i) @@ -3887,8 +3893,6 @@ void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx, } } - rcu_assign_pointer(kvm->buses[bus_idx], new_bus); - synchronize_srcu_expedited(&kvm->srcu); kfree(bus); return; } -- 2.25.1

2 1

[PATCH v1 OLK-6.6 0/4] kworker: Fix the problem of ipsan performance degradation
by jiangdongxu 04 Mar '24

04 Mar '24

From: shaodenghui <shaodenghui(a)huawei.com> When the current downstream FS tests IPSAN, it is found that the performance on ARM is much worse than that on X86, and the test data of IPSAN fluctuates greatly. After analysis, the reason is that when iscsi issues IO, the task is sent to kworker for processing by iscsi_xmitworker. The workqueue created by iscsi can automatically identify the CPU of the soft interrupt currently processed by iscsi, and automatically schedule the workqueue to the corresponding NUMA node. shaodenghui (3): iscsi: add member for NUMA aware order workqueue workqueue: implement NUMA affinity for single thread workqueue iscsi: use dynamic single thread workqueue to improve performance drivers/scsi/iscsi_tcp.c | 9 +++++++++ drivers/scsi/libiscsi.c | 17 ++++++++++++----- include/linux/workqueue.h | 1 + include/scsi/libiscsi.h | 1 + kernel/workqueue.c | 15 ++++++++++----- 5 files changed, 33 insertions(+), 10 deletions(-) -- 2.33.0

2 5

[PATCH v2 openEuler-1.0-LTS] media: dvbdev: Fix memory leak in dvb_media_device_free()
by Wenyu Huang 04 Mar '24

04 Mar '24

From: Peilin Ye <yepeilin.cs(a)gmail.com> stable inclusion from stable-4.19.308 commit cd89f79be5d553c78202f686e8e4caa5fbe94e98 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I949D9 CVE: CVE-2020-36777 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit bf9a40ae8d722f281a2721779595d6df1c33a0bf upstream. dvb_media_device_free() is leaking memory. Free `dvbdev->adapter->conn` before setting it to NULL, as documented in include/media/media-device.h: "The media_entity instance itself must be freed explicitly by the driver if required." Link: https://syzkaller.appspot.com/bug?id=9bbe4b842c98f0ed05c5eed77a226e9de33bf2… Link: https://lore.kernel.org/linux-media/20201211083039.521617-1-yepeilin.cs@gma… Cc: stable(a)vger.kernel.org Fixes: 0230d60e4661 ("[media] dvbdev: Add RF connector if needed") Reported-by: syzbot+7f09440acc069a0d38ac(a)syzkaller.appspotmail.com Signed-off-by: Peilin Ye <yepeilin.cs(a)gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/media/dvb-core/dvbdev.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c index a7d57ff7c88b..4b562238749d 100644 --- a/drivers/media/dvb-core/dvbdev.c +++ b/drivers/media/dvb-core/dvbdev.c @@ -242,6 +242,7 @@ static void dvb_media_device_free(struct dvb_device *dvbdev) if (dvbdev->adapter->conn) { media_device_unregister_entity(dvbdev->adapter->conn); + kfree(dvbdev->adapter->conn); dvbdev->adapter->conn = NULL; kfree(dvbdev->adapter->conn_pads); dvbdev->adapter->conn_pads = NULL; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/1] i2c: sprd: fix reference leak when pm_runtime_get_sync fails
by Liao Chen 04 Mar '24

04 Mar '24

Fix CVE-2020-36780 conflict: drivers/i2c/busses/i2c-sprd.c Qinglang Miao (1): i2c: sprd: fix reference leak when pm_runtime_get_sync fails drivers/i2c/busses/i2c-sprd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH v1 OLK-6.6 0/4] kworker: Fix the problem of ipsan performance degradation on ARM architecture
by jiangdongxu 04 Mar '24

04 Mar '24

From: shaodenghui <shaodenghui(a)huawei.com> When the current downstream FS tests IPSAN, it is found that the performance on ARM is much worse than that on X86, and the test data of IPSAN fluctuates greatly. After analysis, the reason is that when iscsi issues IO, the task is sent to kworker for processing by iscsi_xmitworker. The workqueue created by iscsi can automatically identify the CPU of the soft interrupt currently processed by iscsi, and automatically schedule the workqueue to the corresponding NUMA node. shaodenghui (3): iscsi: add member for NUMA aware order workqueue workqueue: implement NUMA affinity for single thread workqueue iscsi: use dynamic single thread workqueue to improve performance drivers/scsi/iscsi_tcp.c | 9 +++++++++ drivers/scsi/libiscsi.c | 17 ++++++++++++----- include/linux/workqueue.h | 1 + include/scsi/libiscsi.h | 1 + kernel/workqueue.c | 15 ++++++++++----- 5 files changed, 33 insertions(+), 10 deletions(-) -- 2.33.0

2 5

[PATCH openEuler-1.0-LTS] Input: appletouch - initialize work before device registration
by Jinjiang Tu 04 Mar '24

04 Mar '24

From: Pavel Skripkin <paskripkin(a)gmail.com> mainline inclusion from mainline-v5.16-rc8 commit 9f3ccdc3f6ef10084ceb3a47df0961bec6196fd0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I947RI CVE: CVE-2021-46932 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Syzbot has reported warning in __flush_work(). This warning is caused by work->func == NULL, which means missing work initialization. This may happen, since input_dev->close() calls cancel_work_sync(&dev->work), but dev->work initalization happens _after_ input_register_device() call. So this patch moves dev->work initialization before registering input device Fixes: 5a6eb676d3bc ("Input: appletouch - improve powersaving for Geyser3 devices") Reported-and-tested-by: syzbot+b88c5eae27386b252bbd(a)syzkaller.appspotmail.com Signed-off-by: Pavel Skripkin <paskripkin(a)gmail.com> Link: https://lore.kernel.org/r/20211230141151.17300-1-paskripkin@gmail.com Cc: stable(a)vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/input/mouse/appletouch.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/input/mouse/appletouch.c b/drivers/input/mouse/appletouch.c index f1e66e257cff..e305a4f2b0f0 100644 --- a/drivers/input/mouse/appletouch.c +++ b/drivers/input/mouse/appletouch.c @@ -930,6 +930,8 @@ static int atp_probe(struct usb_interface *iface, set_bit(BTN_TOOL_TRIPLETAP, input_dev->keybit); set_bit(BTN_LEFT, input_dev->keybit); + INIT_WORK(&dev->work, atp_reinit); + error = input_register_device(dev->input); if (error) goto err_free_buffer; @@ -937,8 +939,6 @@ static int atp_probe(struct usb_interface *iface, /* save our data pointer in this interface device */ usb_set_intfdata(iface, dev); - INIT_WORK(&dev->work, atp_reinit); - return 0; err_free_buffer: -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] i2c: cadence: fix reference leak when pm_runtime_get_sync fails
by Jinjiang Tu 04 Mar '24

04 Mar '24

From: Qinglang Miao <miaoqinglang(a)huawei.com> mainline inclusion from mainline-v5.13-rc1 commit 23ceb8462dc6f4b4decdb5536a7e5fc477cdf0b6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94JHY CVE: CVE-2020-36784 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- The PM reference count is not expected to be incremented on return in functions cdns_i2c_master_xfer and cdns_reg_slave. However, pm_runtime_get_sync will increment pm usage counter even failed. Forgetting to putting operation will result in a reference leak here. Replace it with pm_runtime_resume_and_get to keep usage counter balanced. Fixes: 7fa32329ca03 ("i2c: cadence: Move to sensible power management") Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Qinglang Miao <miaoqinglang(a)huawei.com> Signed-off-by: Wolfram Sang <wsa(a)kernel.org> Conflicts: drivers/i2c/busses/i2c-cadence.c Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/i2c/busses/i2c-cadence.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c index d917cefc5a19..f64c7f8b924e 100644 --- a/drivers/i2c/busses/i2c-cadence.c +++ b/drivers/i2c/busses/i2c-cadence.c @@ -578,7 +578,7 @@ static int cdns_i2c_master_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, struct cdns_i2c *id = adap->algo_data; bool hold_quirk; - ret = pm_runtime_get_sync(id->dev); + ret = pm_runtime_resume_and_get(id->dev); if (ret < 0) return ret; /* Check if the bus is free */ -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/1] i2c: sprd: fix reference leak when pm_runtime_get_sync fails
by Liao Chen 04 Mar '24

04 Mar '24

Fix CVE-2020-36780 conflict: drivers/i2c/busses/i2c-sprd.c Qinglang Miao (1): i2c: sprd: fix reference leak when pm_runtime_get_sync fails drivers/i2c/busses/i2c-sprd.c | 4 ++-- drivers/i2c/busses/i2c-sprd.c.rej | 10 ++++++++++ 2 files changed, 12 insertions(+), 2 deletions(-) create mode 100644 drivers/i2c/busses/i2c-sprd.c.rej -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] KVM: Stop looking for coalesced MMIO zones if the bus is destroyed
by Zheng Yejian 04 Mar '24

04 Mar '24

From: Sean Christopherson <seanjc(a)google.com> mainline inclusion from mainline-v5.13-rc1 commit 5d3c4c79384af06e3c8e25b7770b6247496b4417 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94VOT CVE: CVE-2021-47060 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- Abort the walk of coalesced MMIO zones if kvm_io_bus_unregister_dev() fails to allocate memory for the new instance of the bus. If it can't instantiate a new bus, unregister_dev() destroys all devices _except_ the target device. But, it doesn't tell the caller that it obliterated the bus and invoked the destructor for all devices that were on the bus. In the coalesced MMIO case, this can result in a deleted list entry dereference due to attempting to continue iterating on coalesced_zones after future entries (in the walk) have been deleted. Opportunistically add curly braces to the for-loop, which encompasses many lines but sneaks by without braces due to the guts being a single if statement. Fixes: f65886606c2d ("KVM: fix memory leak in kvm_io_bus_unregister_dev()") Cc: stable(a)vger.kernel.org Reported-by: Hao Sun <sunhao.th(a)gmail.com> Signed-off-by: Sean Christopherson <seanjc(a)google.com> Message-Id: <20210412222050.876100-3-seanjc(a)google.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- include/linux/kvm_host.h | 4 ++-- virt/kvm/coalesced_mmio.c | 19 +++++++++++++++++-- virt/kvm/kvm_main.c | 10 +++++----- 3 files changed, 24 insertions(+), 9 deletions(-) diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h index cac0fad2695f..6346d0123077 100644 --- a/include/linux/kvm_host.h +++ b/include/linux/kvm_host.h @@ -195,8 +195,8 @@ int kvm_io_bus_read(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, gpa_t addr, int len, void *val); int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr, int len, struct kvm_io_device *dev); -void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx, - struct kvm_io_device *dev); +int kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx, + struct kvm_io_device *dev); struct kvm_io_device *kvm_io_bus_get_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr); diff --git a/virt/kvm/coalesced_mmio.c b/virt/kvm/coalesced_mmio.c index b9336693c87e..70bd2dbdfffe 100644 --- a/virt/kvm/coalesced_mmio.c +++ b/virt/kvm/coalesced_mmio.c @@ -172,16 +172,31 @@ int kvm_vm_ioctl_unregister_coalesced_mmio(struct kvm *kvm, struct kvm_coalesced_mmio_zone *zone) { struct kvm_coalesced_mmio_dev *dev, *tmp; + int r; mutex_lock(&kvm->slots_lock); - list_for_each_entry_safe(dev, tmp, &kvm->coalesced_zones, list) + list_for_each_entry_safe(dev, tmp, &kvm->coalesced_zones, list) { if (coalesced_mmio_in_range(dev, zone->addr, zone->size)) { - kvm_io_bus_unregister_dev(kvm, KVM_MMIO_BUS, &dev->dev); + r = kvm_io_bus_unregister_dev(kvm, KVM_MMIO_BUS, &dev->dev); kvm_iodevice_destructor(&dev->dev); + + /* + * On failure, unregister destroys all devices on the + * bus _except_ the target device, i.e. coalesced_zones + * has been modified. No need to restart the walk as + * there aren't any zones left. + */ + if (r) + break; } + } mutex_unlock(&kvm->slots_lock); + /* + * Ignore the result of kvm_io_bus_unregister_dev(), from userspace's + * perspective, the coalesced MMIO is most definitely unregistered. + */ return 0; } diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index 5f4f222c991f..62cd5624b715 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -3853,15 +3853,15 @@ int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr, } /* Caller must hold slots_lock. */ -void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx, - struct kvm_io_device *dev) +int kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx, + struct kvm_io_device *dev) { int i, j; struct kvm_io_bus *new_bus, *bus; bus = kvm_get_bus(kvm, bus_idx); if (!bus) - return; + return 0; for (i = 0; i < bus->dev_count; i++) if (bus->range[i].dev == dev) { @@ -3869,7 +3869,7 @@ void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx, } if (i == bus->dev_count) - return; + return 0; new_bus = kmalloc(sizeof(*bus) + ((bus->dev_count - 1) * sizeof(struct kvm_io_range)), GFP_KERNEL); @@ -3890,7 +3890,7 @@ void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx, rcu_assign_pointer(kvm->buses[bus_idx], new_bus); synchronize_srcu_expedited(&kvm->srcu); kfree(bus); - return; + return new_bus ? 0 : -ENOMEM; } struct kvm_io_device *kvm_io_bus_get_dev(struct kvm *kvm, enum kvm_bus bus_idx, -- 2.25.1

2 1

[PATCH v1 OLK-6.6 0/4] kworker: Fix the problem of ipsan performance degradation on ARM architecture
by jiangdongxu 04 Mar '24

04 Mar '24

From: shaodenghui <shaodenghui(a)huawei.com> When the current downstream FS tests IPSAN, it is found that the performance on ARM is much worse than that on X86, and the test data of IPSAN fluctuates greatly. After analysis, the reason is that when iscsi issues IO, the task is sent to kworker for processing by iscsi_xmitworker. The workqueue created by iscsi can automatically identify the CPU of the soft interrupt currently processed by iscsi, and automatically schedule the workqueue to the corresponding NUMA node. shaodenghui (3): iscsi: add member for NUMA aware order workqueue workqueue: implement NUMA affinity for single thread workqueue iscsi: use dynamic single thread workqueue to improve performance drivers/scsi/iscsi_tcp.c | 9 +++++++++ drivers/scsi/libiscsi.c | 17 ++++++++++++----- include/linux/workqueue.h | 1 + include/scsi/libiscsi.h | 1 + kernel/workqueue.c | 15 ++++++++++----- 5 files changed, 33 insertions(+), 10 deletions(-) -- 2.33.0

2 5

[PATCH openEuler-1.0-LTS] i2c: Fix a potential use after free
by Liu Chuang 04 Mar '24

04 Mar '24

From: Xu Wang <vulab(a)iscas.ac.cn> stable inclusion from stable-v4.19.307 commit 23a191b132cd87f746c62f3dc27da33683d85829 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I946KM CVE: CVE-2019-25162 Reference: https://git.kernel.org/stable/c/23a191b132cd87f746c62f3dc27da33683d85829 --------------------------------------------------------------- [ Upstream commit e4c72c06c367758a14f227c847f9d623f1994ecf ] Free the adap structure only after we are done using it. This patch just moves the put_device() down a bit to avoid the use after free. Fixes: 611e12ea0f12 ("i2c: core: manage i2c bus device refcount in i2c_[get|put]_adapter") Signed-off-by: Xu Wang <vulab(a)iscas.ac.cn> [wsa: added comment to the code, added Fixes tag] Signed-off-by: Wolfram Sang <wsa(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/i2c/i2c-core-base.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index 2a43f4e46af0..9079be0d51d1 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -2273,8 +2273,9 @@ void i2c_put_adapter(struct i2c_adapter *adap) if (!adap) return; - put_device(&adap->dev); module_put(adap->owner); + /* Should be last, otherwise we risk use-after-free with 'adap' */ + put_device(&adap->dev); } EXPORT_SYMBOL(i2c_put_adapter); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/1] backport patch to fix CVE-2021-47077
by Yuntao Liu 04 Mar '24

04 Mar '24

backport patch to fix CVE-2021-47077 Zhen Lei (1): [Backport] ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook arch/arm/kernel/hw_breakpoint.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 2

[openeuler:openEuler-1.0-LTS 16561/21676] mm/pin_mem.c:844:63: error: lvalue required as unary '&' operand
by kernel test robot 04 Mar '24

04 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 415aa2f13fd4c4766b3b6deb471c6b909d39ac51 commit: 1a378b87531ea80e7847bf0105adedff28a73080 [16561/21676] mm: add pin memory method for checkpoint add restore config: arm64-randconfig-001-20240302 (https://download.01.org/0day-ci/archive/20240304/202403040641.1SwwRMg7-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240304/202403040641.1SwwRMg7-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403040641.1SwwRMg7-lkp@intel.com/ All errors (new ones prefixed by >>): mm/pin_mem.c:171:6: warning: no previous prototype for 'reserve_page_from_buddy' [-Wmissing-prototypes] 171 | void reserve_page_from_buddy(unsigned long nr_pages, struct page *page) | ^~~~~~~~~~~~~~~~~~~~~~~ mm/pin_mem.c:254:6: warning: no previous prototype for 'free_user_map_pages' [-Wmissing-prototypes] 254 | void free_user_map_pages(unsigned int pid_index, unsigned int entry_index, unsigned int page_index) | ^~~~~~~~~~~~~~~~~~~ mm/pin_mem.c:311:6: warning: no previous prototype for 'check_redirect_end_valid' [-Wmissing-prototypes] 311 | bool check_redirect_end_valid(struct redirect_info *redirect_start, | ^~~~~~~~~~~~~~~~~~~~~~~~ mm/pin_mem.c:392:5: warning: no previous prototype for 'calculate_pin_mem_digest' [-Wmissing-prototypes] 392 | int calculate_pin_mem_digest(struct pin_mem_dump_info *pmdi, char *digest) | ^~~~~~~~~~~~~~~~~~~~~~~~ mm/pin_mem.c:481:5: warning: no previous prototype for 'collect_pmd_huge_pages' [-Wmissing-prototypes] 481 | int collect_pmd_huge_pages(struct task_struct *task, | ^~~~~~~~~~~~~~~~~~~~~~ mm/pin_mem.c:544:5: warning: no previous prototype for 'collect_normal_pages' [-Wmissing-prototypes] 544 | int collect_normal_pages(struct task_struct *task, | ^~~~~~~~~~~~~~~~~~~~ mm/pin_mem.c: In function 'collect_normal_pages': mm/pin_mem.c:549:26: warning: variable 'nr_pages' set but not used [-Wunused-but-set-variable] 549 | unsigned long i, nr_pages; | ^~~~~~~~ mm/pin_mem.c: At top level: mm/pin_mem.c:610:6: warning: no previous prototype for 'free_pin_pages' [-Wmissing-prototypes] 610 | void free_pin_pages(struct page_map_entry *pme) | ^~~~~~~~~~~~~~ mm/pin_mem.c:770:12: warning: no previous prototype for 'remap_normal_pages' [-Wmissing-prototypes] 770 | vm_fault_t remap_normal_pages(struct mm_struct *mm, struct vm_area_struct *vma, | ^~~~~~~~~~~~~~~~~~ mm/pin_mem.c: In function 'get_hugepage_gfpmask': >> mm/pin_mem.c:844:63: error: lvalue required as unary '&' operand 844 | if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags)) | ^ mm/pin_mem.c:846:63: error: lvalue required as unary '&' operand 846 | if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags)) | ^ mm/pin_mem.c:848:71: error: lvalue required as unary '&' operand 848 | if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags)) | ^ mm/pin_mem.c:851:65: error: lvalue required as unary '&' operand 851 | if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags)) | ^ mm/pin_mem.c: At top level: mm/pin_mem.c:857:12: warning: no previous prototype for 'remap_huge_pmd_pages' [-Wmissing-prototypes] 857 | vm_fault_t remap_huge_pmd_pages(struct mm_struct *mm, struct vm_area_struct *vma, | ^~~~~~~~~~~~~~~~~~~~ vim +844 mm/pin_mem.c 839 840 static inline gfp_t get_hugepage_gfpmask(struct vm_area_struct *vma) 841 { 842 const bool vma_madvised = !!(vma->vm_flags & VM_HUGEPAGE); 843 > 844 if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags)) 845 return GFP_TRANSHUGE | (vma_madvised ? 0 : __GFP_NORETRY); 846 if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags)) 847 return GFP_TRANSHUGE_LIGHT | __GFP_KSWAPD_RECLAIM; 848 if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags)) 849 return GFP_TRANSHUGE_LIGHT | (vma_madvised ? __GFP_DIRECT_RECLAIM : 850 __GFP_KSWAPD_RECLAIM); 851 if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags)) 852 return GFP_TRANSHUGE_LIGHT | (vma_madvised ? __GFP_DIRECT_RECLAIM : 853 0); 854 return GFP_TRANSHUGE_LIGHT; 855 } 856 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2176/3769] kernel/sched/fair.c:9005:51: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 04 Mar '24

04 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: fbcd4a3032a53350f6d182c9daeaa4c46e65d964 commit: c52c17a85f1fa9cde2bcb15359096634cfd9eb7c [2176/3769] sched: Add tracepoint for qos smt expeller config: arm64-randconfig-r111-20240227 (https://download.01.org/0day-ci/archive/20240304/202403040353.ycQkLqqd-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240304/202403040353.ycQkLqqd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403040353.ycQkLqqd-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) kernel/sched/fair.c:151:14: sparse: sparse: symbol 'sysctl_overload_detect_period' was not declared. Should it be static? kernel/sched/fair.c:152:14: sparse: sparse: symbol 'sysctl_offline_wait_interval' was not declared. Should it be static? kernel/sched/fair.c:1283:34: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct sched_entity const *se @@ got struct sched_entity [noderef] __rcu * @@ kernel/sched/fair.c:1283:34: sparse: expected struct sched_entity const *se kernel/sched/fair.c:1283:34: sparse: got struct sched_entity [noderef] __rcu * kernel/sched/fair.c:13203:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:13203:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:13203:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:6012:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:6012:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:6012:22: sparse: struct task_struct * kernel/sched/fair.c:6754:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:6754:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:6754:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:8121:20: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:8121:20: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:8121:20: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:8436:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] tmp @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:8436:9: sparse: expected struct sched_domain *[assigned] tmp kernel/sched/fair.c:8436:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:8548:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:8548:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:8548:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:8774:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:8774:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:8774:22: sparse: struct task_struct * >> kernel/sched/fair.c:9005:51: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct task_struct *sibling_p @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:9005:51: sparse: expected struct task_struct *sibling_p kernel/sched/fair.c:9005:51: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:9010:30: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:9010:30: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:9010:30: sparse: struct task_struct * kernel/sched/fair.c:9084:48: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct task_struct *p @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:9332:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:10403:40: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain *child @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/fair.c:11040:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:11040:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:11040:22: sparse: struct task_struct * kernel/sched/fair.c:12481:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12481:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12481:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:12138:44: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain *sd_parent @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12138:44: sparse: expected struct sched_domain *sd_parent kernel/sched/fair.c:12138:44: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:12577:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12577:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12577:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c: note: in included file (through include/linux/rculist.h, include/linux/pid.h, include/linux/sched.h, ...): include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true kernel/sched/fair.c: note: in included file: kernel/sched/sched.h:2174:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2174:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2174:25: sparse: struct task_struct * kernel/sched/sched.h:2338:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2338:9: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2338:9: sparse: struct task_struct * kernel/sched/sched.h:2338:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2338:9: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2338:9: sparse: struct task_struct * kernel/sched/sched.h:2174:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2174:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2174:25: sparse: struct task_struct * kernel/sched/sched.h:2174:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2174:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2174:25: sparse: struct task_struct * vim +9005 kernel/sched/fair.c 8984 8985 static bool _qos_smt_check_need_resched(int this_cpu, struct rq *rq) 8986 { 8987 int cpu; 8988 8989 if (!sched_smt_active()) 8990 return false; 8991 8992 for_each_cpu(cpu, cpu_smt_mask(this_cpu)) { 8993 if (cpu == this_cpu) 8994 continue; 8995 8996 /* 8997 * There are two cases rely on the set need_resched to drive away 8998 * offline task： 8999 * a) The qos_smt_status of siblings cpu is online, the task of curr cpu is offline; 9000 * b) The qos_smt_status of siblings cpu is offline, the task of curr cpu is idle, 9001 * and current cpu only has SCHED_IDLE tasks enqueued. 9002 */ 9003 if (per_cpu(qos_smt_status, cpu) == QOS_LEVEL_ONLINE && 9004 task_group(current)->qos_level < QOS_LEVEL_ONLINE) { > 9005 trace_sched_qos_smt_expel(cpu_curr(cpu), per_cpu(qos_smt_status, cpu)); 9006 return true; 9007 } 9008 9009 if (per_cpu(qos_smt_status, cpu) == QOS_LEVEL_OFFLINE && 9010 rq->curr == rq->idle && sched_idle_cpu(this_cpu)) { 9011 trace_sched_qos_smt_expel(cpu_curr(cpu), per_cpu(qos_smt_status, cpu)); 9012 return true; 9013 } 9014 } 9015 9016 return false; 9017 } 9018 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1683/3769] mm/memcontrol.c:3147:6: sparse: sparse: symbol 'hisi_oom_recover' was not declared. Should it be static?
by kernel test robot 03 Mar '24

03 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: fbcd4a3032a53350f6d182c9daeaa4c46e65d964 commit: b498d9f1bacd40d583c0970cab02ad522127a7e7 [1683/3769] arm64/ascend: Add new enable_oom_killer interface for oom contrl config: arm64-randconfig-r111-20240227 (https://download.01.org/0day-ci/archive/20240303/202403032008.Rzqq5udk-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240303/202403032008.Rzqq5udk-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403032008.Rzqq5udk-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/memcontrol.c:3147:6: sparse: sparse: symbol 'hisi_oom_recover' was not declared. Should it be static? mm/memcontrol.c:4228:21: sparse: sparse: incompatible types in comparison expression (different address spaces): mm/memcontrol.c:4228:21: sparse: struct mem_cgroup_threshold_ary [noderef] __rcu * mm/memcontrol.c:4228:21: sparse: struct mem_cgroup_threshold_ary * mm/memcontrol.c:4230:21: sparse: sparse: incompatible types in comparison expression (different address spaces): mm/memcontrol.c:4230:21: sparse: struct mem_cgroup_threshold_ary [noderef] __rcu * mm/memcontrol.c:4230:21: sparse: struct mem_cgroup_threshold_ary * mm/memcontrol.c:4386:9: sparse: sparse: incompatible types in comparison expression (different address spaces): mm/memcontrol.c:4386:9: sparse: struct mem_cgroup_threshold_ary [noderef] __rcu * mm/memcontrol.c:4386:9: sparse: struct mem_cgroup_threshold_ary * mm/memcontrol.c:4480:9: sparse: sparse: incompatible types in comparison expression (different address spaces): mm/memcontrol.c:4480:9: sparse: struct mem_cgroup_threshold_ary [noderef] __rcu * mm/memcontrol.c:4480:9: sparse: struct mem_cgroup_threshold_ary * mm/memcontrol.c:6198:23: sparse: sparse: incompatible types in comparison expression (different address spaces): mm/memcontrol.c:6198:23: sparse: struct task_struct [noderef] __rcu * mm/memcontrol.c:6198:23: sparse: struct task_struct * mm/memcontrol.c: note: in included file (through include/linux/rculist.h, include/linux/pid.h, include/linux/sched.h, ...): include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true mm/memcontrol.c: note: in included file: include/linux/memcontrol.h:751:9: sparse: sparse: context imbalance in 'folio_lruvec_lock' - wrong count at exit include/linux/memcontrol.h:751:9: sparse: sparse: context imbalance in 'folio_lruvec_lock_irq' - wrong count at exit include/linux/memcontrol.h:751:9: sparse: sparse: context imbalance in 'folio_lruvec_lock_irqsave' - wrong count at exit mm/memcontrol.c:2111:6: sparse: sparse: context imbalance in 'folio_memcg_lock' - wrong count at exit mm/memcontrol.c:2158:17: sparse: sparse: context imbalance in '__folio_memcg_unlock' - unexpected unlock mm/memcontrol.c: note: in included file (through include/linux/rculist.h, include/linux/pid.h, include/linux/sched.h, ...): include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true mm/memcontrol.c: note: in included file (through include/linux/rculist.h, include/linux/pid.h, include/linux/sched.h, ...): include/linux/rcupdate.h:780:9: sparse: sparse: context imbalance in 'mem_cgroup_count_precharge_pte_range' - unexpected unlock include/linux/rcupdate.h:780:9: sparse: sparse: context imbalance in 'mem_cgroup_move_charge_pte_range' - unexpected unlock vim +/hisi_oom_recover +3147 mm/memcontrol.c 3145 3146 #ifdef CONFIG_ASCEND_OOM > 3147 void hisi_oom_recover(struct obj_cgroup *objcg) 3148 { 3149 struct mem_cgroup *memcg; 3150 3151 memcg = get_mem_cgroup_from_objcg(objcg); 3152 if (!mem_cgroup_is_root(memcg)) 3153 memcg_oom_recover(memcg); 3154 css_put(&memcg->css); 3155 } 3156 #else 3157 static inline void hisi_oom_recover(struct obj_cgroup *objcg) { } 3158 #endif 3159 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1624/3769] loongson3-acpi-cpufreq.c:undefined reference to `acpi_processor_unregister_performance'
by kernel test robot 03 Mar '24

03 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: fbcd4a3032a53350f6d182c9daeaa4c46e65d964 commit: 47a0b6f372d7f05822d021f86b21a34fd2142225 [1624/3769] cpufreq: Add cpufreq driver for LoongArch config: loongarch-allmodconfig (https://download.01.org/0day-ci/archive/20240303/202403032032.n9rHviOs-lkp@…) compiler: loongarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240303/202403032032.n9rHviOs-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403032032.n9rHviOs-lkp@intel.com/ All errors (new ones prefixed by >>): loongarch64-linux-ld: drivers/cpufreq/loongson3-acpi-cpufreq.o: in function `loongson3_cpufreq_cpu_exit': >> loongson3-acpi-cpufreq.c:(.text+0x668): undefined reference to `acpi_processor_unregister_performance' loongarch64-linux-ld: drivers/cpufreq/loongson3-acpi-cpufreq.o: in function `.L342': >> loongson3-acpi-cpufreq.c:(.text+0x255c): undefined reference to `acpi_processor_register_performance' loongarch64-linux-ld: drivers/cpufreq/loongson3-acpi-cpufreq.o: in function `.L359': loongson3-acpi-cpufreq.c:(.text+0x2e80): undefined reference to `acpi_processor_unregister_performance' -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1373/3769] ld: vgettimeofday.c:undefined reference to `__tsan_read2'
by kernel test robot 03 Mar '24

03 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: fbcd4a3032a53350f6d182c9daeaa4c46e65d964 commit: 371d3f569b16c38afcf6abb24d620f9d768c95f9 [1373/3769] vdso: do cntvct workaround in the VDSO config: arm64-randconfig-r051-20240303 (https://download.01.org/0day-ci/archive/20240303/202403031930.ji3wANIx-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240303/202403031930.ji3wANIx-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403031930.ji3wANIx-lkp@intel.com/ All errors (new ones prefixed by >>): scripts/genksyms/parse.y: warning: 9 shift/reduce conflicts [-Wconflicts-sr] scripts/genksyms/parse.y: warning: 5 reduce/reduce conflicts [-Wconflicts-rr] scripts/genksyms/parse.y: note: rerun with option '-Wcounterexamples' to generate conflict counterexamples arch/arm64/kernel/vdso-ilp32/Makefile:87: FORCE prerequisite is missing arch/arm64/kernel/vdso-ilp32/Makefile:90: FORCE prerequisite is missing arch/arm64/kernel/vdso-ilp32/Makefile:93: FORCE prerequisite is missing arch/arm64/kernel/vdso-ilp32/Makefile:71: FORCE prerequisite is missing ld: arch/arm64/kernel/vdso-ilp32/vgettimeofday-ilp32.o: in function `__cvdso_gettimeofday_data.constprop.0': vgettimeofday.c:(.text+0x28): undefined reference to `__tsan_volatile_read4' ld: vgettimeofday.c:(.text+0x40): undefined reference to `__tsan_read4' >> ld: vgettimeofday.c:(.text+0x60): undefined reference to `__tsan_read2' ld: vgettimeofday.c:(.text+0x80): undefined reference to `__tsan_read8' ld: vgettimeofday.c:(.text+0x90): undefined reference to `__tsan_read8' ld: vgettimeofday.c:(.text+0x9c): undefined reference to `__tsan_read8' ld: vgettimeofday.c:(.text+0xa8): undefined reference to `__tsan_read4' ld: vgettimeofday.c:(.text+0xb4): undefined reference to `__tsan_read4' ld: vgettimeofday.c:(.text+0xc4): undefined reference to `__tsan_read8' ld: vgettimeofday.c:(.text+0xd4): undefined reference to `__tsan_volatile_read4' ld: vgettimeofday.c:(.text+0x130): undefined reference to `__tsan_write4' ld: vgettimeofday.c:(.text+0x13c): undefined reference to `__tsan_write4' ld: vgettimeofday.c:(.text+0x194): undefined reference to `__tsan_read2' ld: vgettimeofday.c:(.text+0x1b8): undefined reference to `__tsan_read2' ld: vgettimeofday.c:(.text+0x1e4): undefined reference to `__tsan_read4' ld: vgettimeofday.c:(.text+0x1f0): undefined reference to `__tsan_write4' ld: vgettimeofday.c:(.text+0x1fc): undefined reference to `__tsan_read4' ld: vgettimeofday.c:(.text+0x208): undefined reference to `__tsan_write4' ld: arch/arm64/kernel/vdso-ilp32/vgettimeofday-ilp32.o: in function `__cvdso_clock_gettime_data.constprop.0': vgettimeofday.c:(.text+0x28c): undefined reference to `__tsan_volatile_read4' ld: vgettimeofday.c:(.text+0x2a4): undefined reference to `__tsan_read4' ld: vgettimeofday.c:(.text+0x2c0): undefined reference to `__tsan_read2' ld: vgettimeofday.c:(.text+0x2ec): undefined reference to `__tsan_read8' ld: vgettimeofday.c:(.text+0x2fc): undefined reference to `__tsan_read8' ld: vgettimeofday.c:(.text+0x308): undefined reference to `__tsan_read8' ld: vgettimeofday.c:(.text+0x318): undefined reference to `__tsan_read4' ld: vgettimeofday.c:(.text+0x324): undefined reference to `__tsan_read4' ld: vgettimeofday.c:(.text+0x334): undefined reference to `__tsan_read8' ld: vgettimeofday.c:(.text+0x344): undefined reference to `__tsan_volatile_read4' ld: vgettimeofday.c:(.text+0x3a0): undefined reference to `__tsan_write8' ld: vgettimeofday.c:(.text+0x3ac): undefined reference to `__tsan_write8' ld: vgettimeofday.c:(.text+0x3f4): undefined reference to `__tsan_read2' ld: vgettimeofday.c:(.text+0x41c): undefined reference to `__tsan_read2' ld: vgettimeofday.c:(.text+0x4dc): undefined reference to `__tsan_volatile_read4' ld: vgettimeofday.c:(.text+0x4f0): undefined reference to `__tsan_read8' ld: vgettimeofday.c:(.text+0x4fc): undefined reference to `__tsan_write8' ld: vgettimeofday.c:(.text+0x508): undefined reference to `__tsan_read8' ld: vgettimeofday.c:(.text+0x514): undefined reference to `__tsan_write8' ld: vgettimeofday.c:(.text+0x524): undefined reference to `__tsan_volatile_read4' ld: arch/arm64/kernel/vdso-ilp32/vgettimeofday-ilp32.o: in function `__kernel_clock_getres': vgettimeofday.c:(.text+0x604): undefined reference to `__tsan_write8' ld: vgettimeofday.c:(.text+0x610): undefined reference to `__tsan_write8' ld: vgettimeofday.c:(.text+0x640): undefined reference to `__tsan_volatile_read4' ld: arch/arm64/kernel/vdso-ilp32/vgettimeofday-ilp32.o: in function `_sub_I_00099_0': vgettimeofday.c:(.text.startup+0x8): undefined reference to `__tsan_init' collect2: error: ld returned 1 exit status make[3]: *** [arch/arm64/kernel/vdso-ilp32/Makefile:71: arch/arm64/kernel/vdso-ilp32/vdso-ilp32.so.dbg] Error 1 make[3]: Target 'include/generated/vdso-ilp32-offsets.h' not remade because of errors. make[2]: *** [arch/arm64/Makefile:201: vdso_prepare] Error 2 make[2]: Target 'prepare' not remade because of errors. make[1]: *** [Makefile:234: __sub-make] Error 2 make[1]: Target 'prepare' not remade because of errors. make: *** [Makefile:234: __sub-make] Error 2 make: Target 'prepare' not remade because of errors. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for ARM64_ERRATUM_845719 Depends on [n]: AARCH32_EL0 [=n] Selected by [y]: - ARCH_MXC [=y] && ARCH_NXP [=y] && COMPAT [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2688/3769] drivers/acpi/pptt.c:309:5: sparse: sparse: symbol 'acpi_pptt_for_each_container' was not declared. Should it be static?
by kernel test robot 03 Mar '24

03 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: fbcd4a3032a53350f6d182c9daeaa4c46e65d964 commit: 1ab6383ee94e788fe424d7eac10dc8ec3bfa6828 [2688/3769] ACPI / PPTT: Provide a helper to walk processor containers config: loongarch-randconfig-r112-20240302 (https://download.01.org/0day-ci/archive/20240303/202403031641.WjM6vjTf-lkp@…) compiler: loongarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240303/202403031641.WjM6vjTf-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403031641.WjM6vjTf-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/acpi/pptt.c:309:5: sparse: sparse: symbol 'acpi_pptt_for_each_container' was not declared. Should it be static? vim +/acpi_pptt_for_each_container +309 drivers/acpi/pptt.c 297 298 /** 299 * acpi_pptt_for_each_container() - Iterate over all processor containers 300 * 301 * Not all 'Processor' entries in the PPTT are either a CPU or a Processor 302 * Container, they may exist purely to describe a Private resource. CPUs 303 * have to be leaves, so a Processor Container is a non-leaf that has the 304 * 'ACPI Processor ID valid' flag set. 305 * 306 * Return: 0 for a complete walk, or the first non-zero value from the callback 307 * that stopped the walk. 308 */ > 309 int acpi_pptt_for_each_container(acpi_pptt_cpu_callback_t callback, void *arg) 310 { 311 struct acpi_pptt_processor *cpu_node; 312 struct acpi_table_header *table_hdr; 313 struct acpi_subtable_header *entry; 314 bool leaf_flag, has_leaf_flag = false; 315 unsigned long table_end; 316 acpi_status status; 317 u32 proc_sz; 318 int ret = 0; 319 320 status = acpi_get_table(ACPI_SIG_PPTT, 0, &table_hdr); 321 if (ACPI_FAILURE(status)) 322 return 0; 323 324 if (table_hdr->revision > 1) 325 has_leaf_flag = true; 326 327 table_end = (unsigned long)table_hdr + table_hdr->length; 328 entry = ACPI_ADD_PTR(struct acpi_subtable_header, table_hdr, 329 sizeof(struct acpi_table_pptt)); 330 proc_sz = sizeof(struct acpi_pptt_processor); 331 while ((unsigned long)entry + proc_sz < table_end) { 332 cpu_node = (struct acpi_pptt_processor *)entry; 333 if (entry->type == ACPI_PPTT_TYPE_PROCESSOR && 334 cpu_node->flags & ACPI_PPTT_ACPI_PROCESSOR_ID_VALID) 335 { 336 leaf_flag = cpu_node->flags & ACPI_PPTT_ACPI_LEAF_NODE; 337 if ((has_leaf_flag && !leaf_flag) || 338 (!has_leaf_flag && !acpi_pptt_leaf_node(table_hdr, cpu_node))) 339 { 340 ret = callback(cpu_node, arg); 341 if (ret) 342 break; 343 } 344 } 345 entry = ACPI_ADD_PTR(struct acpi_subtable_header, entry, 346 entry->length); 347 } 348 349 acpi_put_table(table_hdr); 350 351 return ret; 352 } 353 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 701/3769] vgettimeofday.c:undefined reference to `__tsan_volatile_read4'
by kernel test robot 03 Mar '24

03 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: fbcd4a3032a53350f6d182c9daeaa4c46e65d964 commit: f9b54a6714445cde83aeff0318cf767b3b81229d [701/3769] arm64:ilp32: add ARM64_ILP32 to Kconfig config: arm64-randconfig-r051-20240303 (https://download.01.org/0day-ci/archive/20240303/202403031506.b9MRia3z-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240303/202403031506.b9MRia3z-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403031506.b9MRia3z-lkp@intel.com/ All errors (new ones prefixed by >>): scripts/genksyms/parse.y: warning: 9 shift/reduce conflicts [-Wconflicts-sr] scripts/genksyms/parse.y: warning: 5 reduce/reduce conflicts [-Wconflicts-rr] scripts/genksyms/parse.y: note: rerun with option '-Wcounterexamples' to generate conflict counterexamples arch/arm64/kernel/vdso-ilp32/Makefile:84: FORCE prerequisite is missing arch/arm64/kernel/vdso-ilp32/Makefile:87: FORCE prerequisite is missing arch/arm64/kernel/vdso-ilp32/Makefile:90: FORCE prerequisite is missing arch/arm64/kernel/vdso-ilp32/Makefile:68: FORCE prerequisite is missing ld: arch/arm64/kernel/vdso-ilp32/vgettimeofday-ilp32.o: in function `__cvdso_gettimeofday_data.constprop.0': >> vgettimeofday.c:(.text+0x28): undefined reference to `__tsan_volatile_read4' >> ld: vgettimeofday.c:(.text+0x40): undefined reference to `__tsan_read4' >> ld: vgettimeofday.c:(.text+0x6c): undefined reference to `__tsan_read8' ld: vgettimeofday.c:(.text+0x7c): undefined reference to `__tsan_read8' ld: vgettimeofday.c:(.text+0x88): undefined reference to `__tsan_read8' ld: vgettimeofday.c:(.text+0x94): undefined reference to `__tsan_read4' ld: vgettimeofday.c:(.text+0xa0): undefined reference to `__tsan_read4' ld: vgettimeofday.c:(.text+0xb0): undefined reference to `__tsan_read8' >> ld: vgettimeofday.c:(.text+0xc0): undefined reference to `__tsan_volatile_read4' >> ld: vgettimeofday.c:(.text+0x120): undefined reference to `__tsan_write4' ld: vgettimeofday.c:(.text+0x12c): undefined reference to `__tsan_write4' ld: vgettimeofday.c:(.text+0x184): undefined reference to `__tsan_read4' ld: vgettimeofday.c:(.text+0x190): undefined reference to `__tsan_write4' ld: vgettimeofday.c:(.text+0x19c): undefined reference to `__tsan_read4' ld: vgettimeofday.c:(.text+0x1a8): undefined reference to `__tsan_write4' ld: arch/arm64/kernel/vdso-ilp32/vgettimeofday-ilp32.o: in function `__cvdso_clock_gettime_data.constprop.0': vgettimeofday.c:(.text+0x24c): undefined reference to `__tsan_volatile_read4' ld: vgettimeofday.c:(.text+0x264): undefined reference to `__tsan_read4' ld: vgettimeofday.c:(.text+0x298): undefined reference to `__tsan_read8' ld: vgettimeofday.c:(.text+0x2a8): undefined reference to `__tsan_read8' ld: vgettimeofday.c:(.text+0x2b4): undefined reference to `__tsan_read8' ld: vgettimeofday.c:(.text+0x2c4): undefined reference to `__tsan_read4' ld: vgettimeofday.c:(.text+0x2d0): undefined reference to `__tsan_read4' ld: vgettimeofday.c:(.text+0x2e0): undefined reference to `__tsan_read8' ld: vgettimeofday.c:(.text+0x2f0): undefined reference to `__tsan_volatile_read4' >> ld: vgettimeofday.c:(.text+0x350): undefined reference to `__tsan_write8' ld: vgettimeofday.c:(.text+0x35c): undefined reference to `__tsan_write8' ld: vgettimeofday.c:(.text+0x438): undefined reference to `__tsan_volatile_read4' ld: vgettimeofday.c:(.text+0x44c): undefined reference to `__tsan_read8' ld: vgettimeofday.c:(.text+0x458): undefined reference to `__tsan_write8' ld: vgettimeofday.c:(.text+0x464): undefined reference to `__tsan_read8' ld: vgettimeofday.c:(.text+0x470): undefined reference to `__tsan_write8' ld: vgettimeofday.c:(.text+0x480): undefined reference to `__tsan_volatile_read4' ld: arch/arm64/kernel/vdso-ilp32/vgettimeofday-ilp32.o: in function `__kernel_clock_getres': >> vgettimeofday.c:(.text+0x584): undefined reference to `__tsan_write8' ld: vgettimeofday.c:(.text+0x590): undefined reference to `__tsan_write8' ld: vgettimeofday.c:(.text+0x5c0): undefined reference to `__tsan_volatile_read4' ld: arch/arm64/kernel/vdso-ilp32/vgettimeofday-ilp32.o: in function `_sub_I_00099_0': >> vgettimeofday.c:(.text.startup+0x8): undefined reference to `__tsan_init' >> collect2: error: ld returned 1 exit status make[3]: *** [arch/arm64/kernel/vdso-ilp32/Makefile:68: arch/arm64/kernel/vdso-ilp32/vdso-ilp32.so.dbg] Error 1 make[3]: Target 'include/generated/vdso-ilp32-offsets.h' not remade because of errors. make[2]: *** [arch/arm64/Makefile:201: vdso_prepare] Error 2 make[2]: Target 'prepare' not remade because of errors. make[1]: *** [Makefile:234: __sub-make] Error 2 make[1]: Target 'prepare' not remade because of errors. make: *** [Makefile:234: __sub-make] Error 2 make: Target 'prepare' not remade because of errors. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for ARM64_ERRATUM_845719 Depends on [n]: AARCH32_EL0 [=n] Selected by [y]: - ARCH_MXC [=y] && ARCH_NXP [=y] && COMPAT [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 14455/30000] drivers/scsi/qedf/qedf_main.o: warning: objtool: __qedf_probe() falls through to next function qedf_handle_link_update()
by kernel test robot 03 Mar '24

03 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 6adee00913b51cd59245584085cdaca64f74465c commit: 3e393ad0efe336af9da4abd7ce7b5b858e9b9b0c [14455/30000] ubsan: remove CONFIG_UBSAN_OBJECT_SIZE config: x86_64-randconfig-073-20240302 (https://download.01.org/0day-ci/archive/20240303/202403031342.0NFibsyL-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240303/202403031342.0NFibsyL-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403031342.0NFibsyL-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/scsi/qedf/qedf_main.o: warning: objtool: __qedf_probe() falls through to next function qedf_handle_link_update() -- >> drivers/scsi/qedi/qedi_main.o: warning: objtool: __qedi_probe() falls through to next function qedi_setup_int() -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 830/30000] arch/arm64/kernel/watchdog_sdei.c:28:5: warning: no previous prototype for 'watchdog_sdei_enable'
by kernel test robot 03 Mar '24

03 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 6adee00913b51cd59245584085cdaca64f74465c commit: c7e03fb97fd2cfc439080387ea755846bc138a7f [830/30000] arm64: watchdog: add switch to select sdei_watchdog/pmu_watchdog config: arm64-randconfig-002-20240302 (https://download.01.org/0day-ci/archive/20240303/202403031229.ycxCdpan-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240303/202403031229.ycxCdpan-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403031229.ycxCdpan-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/arm64/kernel/watchdog_sdei.c:28:5: warning: no previous prototype for 'watchdog_sdei_enable' [-Wmissing-prototypes] 28 | int watchdog_sdei_enable(unsigned int cpu) | ^~~~~~~~~~~~~~~~~~~~ >> arch/arm64/kernel/watchdog_sdei.c:52:6: warning: no previous prototype for 'watchdog_sdei_disable' [-Wmissing-prototypes] 52 | void watchdog_sdei_disable(unsigned int cpu) | ^~~~~~~~~~~~~~~~~~~~~ >> arch/arm64/kernel/watchdog_sdei.c:114:12: warning: no previous prototype for 'watchdog_sdei_probe' [-Wmissing-prototypes] 114 | int __init watchdog_sdei_probe(void) | ^~~~~~~~~~~~~~~~~~~ vim +/watchdog_sdei_enable +28 arch/arm64/kernel/watchdog_sdei.c 27 > 28 int watchdog_sdei_enable(unsigned int cpu) 29 { 30 int ret; 31 32 if (!sdei_watchdog_registered) 33 return -EINVAL; 34 35 #ifdef CONFIG_HARDLOCKUP_CHECK_TIMESTAMP 36 refresh_hld_last_timestamp(); 37 #endif 38 39 __this_cpu_write(last_check_time, ktime_get_mono_fast_ns()); 40 sdei_api_set_secure_timer_period(watchdog_thresh); 41 42 ret = sdei_api_event_enable(sdei_watchdog_event_num); 43 if (ret) { 44 pr_err("Enable NMI Watchdog failed on cpu%d\n", 45 smp_processor_id()); 46 return ret; 47 } 48 49 return 0; 50 } 51 > 52 void watchdog_sdei_disable(unsigned int cpu) 53 { 54 int ret; 55 56 if (!sdei_watchdog_registered) 57 return; 58 59 ret = sdei_api_event_disable(sdei_watchdog_event_num); 60 if (ret) 61 pr_err("Disable NMI Watchdog failed on cpu%d\n", 62 smp_processor_id()); 63 } 64 65 static int sdei_watchdog_callback(u32 event, 66 struct pt_regs *regs, void *arg) 67 { 68 ktime_t delta, now = ktime_get_mono_fast_ns(); 69 70 delta = now - __this_cpu_read(last_check_time); 71 __this_cpu_write(last_check_time, now); 72 73 /* 74 * Set delta to 4/5 of the actual watchdog threshold period so the 75 * hrtimer is guaranteed to fire at least once within the real 76 * watchdog threshold. 77 */ 78 if (delta < watchdog_thresh * (u64)NSEC_PER_SEC * 4 / 5) { 79 pr_err(FW_BUG "SDEI Watchdog event triggered too soon, " 80 "time to last check:%lld ns\n", delta); 81 WARN_ON(1); 82 return 0; 83 } 84 85 watchdog_hardlockup_check(regs); 86 87 return 0; 88 } 89 NOKPROBE_SYMBOL(sdei_watchdog_callback); 90 91 static void sdei_nmi_watchdog_bind(void *data) 92 { 93 int ret; 94 95 ret = sdei_api_event_interrupt_bind(SDEI_NMI_WATCHDOG_HWIRQ); 96 if (ret < 0) 97 pr_err("SDEI bind failed on cpu%d, return %d\n", 98 smp_processor_id(), ret); 99 } 100 101 static int __init disable_sdei_nmi_watchdog_setup(char *str) 102 { 103 disable_sdei_nmi_watchdog = true; 104 return 1; 105 } 106 __setup("disable_sdei_nmi_watchdog", disable_sdei_nmi_watchdog_setup); 107 108 void sdei_watchdog_clear_eoi(void) 109 { 110 if (sdei_watchdog_registered) 111 sdei_api_clear_eoi(SDEI_NMI_WATCHDOG_HWIRQ); 112 } 113 > 114 int __init watchdog_sdei_probe(void) 115 { 116 int ret; 117 118 if (!is_hyp_mode_available()) { 119 pr_err("Disable SDEI NMI Watchdog in VM\n"); 120 return -EINVAL; 121 } 122 123 sdei_watchdog_event_num = sdei_api_event_interrupt_bind(SDEI_NMI_WATCHDOG_HWIRQ); 124 if (sdei_watchdog_event_num < 0) { 125 pr_err("Bind interrupt failed. Firmware may not support SDEI !\n"); 126 return sdei_watchdog_event_num; 127 } 128 129 /* 130 * After we introduced 'sdei_api_set_secure_timer_period', we disselect 131 * 'CONFIG_HARDLOCKUP_CHECK_TIMESTAMP'. So we need to make sure that 132 * firmware can set the period of the secure timer and the timer 133 * interrupt doesn't trigger too soon. 134 */ 135 if (sdei_api_set_secure_timer_period(watchdog_thresh)) { 136 pr_err("Firmware doesn't support setting the secure timer period, please update your BIOS !\n"); 137 return -EINVAL; 138 } 139 140 on_each_cpu(sdei_nmi_watchdog_bind, NULL, true); 141 142 ret = sdei_event_register(sdei_watchdog_event_num, 143 sdei_watchdog_callback, NULL); 144 if (ret) { 145 pr_err("SDEI Watchdog register callback failed\n"); 146 return ret; 147 } 148 149 sdei_watchdog_registered = true; 150 pr_info("SDEI Watchdog registered successfully\n"); 151 152 return 0; 153 } 154 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1693/3769] drivers/pci/controller/pci-loongson.c:183:22: sparse: sparse: incorrect type in argument 2 (different address spaces)
by kernel test robot 03 Mar '24

03 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: fbcd4a3032a53350f6d182c9daeaa4c46e65d964 commit: 668ae8b1a55a96a60303d36b81b112a709a324bb [1693/3769] PCI: LS7A2000: fix GPU card error config: loongarch-randconfig-r112-20240302 (https://download.01.org/0day-ci/archive/20240303/202403030850.TjIcnZbF-lkp@…) compiler: loongarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240303/202403030850.TjIcnZbF-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403030850.TjIcnZbF-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/pci/controller/pci-loongson.c:183:22: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void volatile * @@ drivers/pci/controller/pci-loongson.c:183:22: sparse: expected void volatile [noderef] __iomem *addr drivers/pci/controller/pci-loongson.c:183:22: sparse: got void volatile * drivers/pci/controller/pci-loongson.c:184:29: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void volatile * @@ drivers/pci/controller/pci-loongson.c:184:29: sparse: expected void volatile [noderef] __iomem *addr drivers/pci/controller/pci-loongson.c:184:29: sparse: got void volatile * vim +183 drivers/pci/controller/pci-loongson.c 151 152 static void loongson_display_quirk(struct pci_dev *dev) 153 { 154 u32 val; 155 u64 mask, size; 156 u64 max_size = 0; 157 int i, num; 158 struct pci_bus *bus = dev->bus; 159 160 if (!dev->bus->number) { 161 if (!(dev->vendor == PCI_VENDOR_ID_LOONGSON && dev->device == 0x7a25)) 162 return; 163 } else { 164 while (!pci_is_root_bus(bus->parent)) 165 bus = bus->parent; 166 167 /* ensure slot is 7a2000 */ 168 if (bus->self->vendor != PCI_VENDOR_ID_LOONGSON || bus->self->device < 0x7a39) 169 return; 170 } 171 max_size = 0; 172 for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) { 173 if (dev->resource[i].flags & IORESOURCE_MEM) { 174 size = dev->resource[i].end - dev->resource[i].start; 175 if (size > max_size) { 176 max_size = size; 177 num = i; 178 } 179 } 180 } 181 mask = ~(dev->resource[num].end - dev->resource[num].start); 182 val = (dev->resource[num].start >> (24 - 16)) | ((mask >> 24) & 0xffff); > 183 writel(val, (volatile void *)0x80000efdfb000174UL); 184 writel(0x80000000, (volatile void *)0x80000efdfb000170UL); 185 } 186 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_LOONGSON, 0x7a25, loongson_display_quirk); 187 DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_ANY_ID, PCI_ANY_ID, 188 PCI_BASE_CLASS_DISPLAY, 16, loongson_display_quirk); 189 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 23439/30000] mm/hugetlb.c:6315:14: warning: no previous prototype for 'hugetlb_alloc_hugepage_nodemask'
by kernel test robot 03 Mar '24

03 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 6adee00913b51cd59245584085cdaca64f74465c commit: 8deff3a60ce1a9dffb552210f065fc9ed6a55f84 [23439/30000] mm/sharepool: Add mg_sp_alloc_nodemask config: arm64-randconfig-001-20240302 (https://download.01.org/0day-ci/archive/20240303/202403030519.VqzwjhSV-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240303/202403030519.VqzwjhSV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403030519.VqzwjhSV-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/hugetlb.c:6315:14: warning: no previous prototype for 'hugetlb_alloc_hugepage_nodemask' [-Wmissing-prototypes] 6315 | struct page *hugetlb_alloc_hugepage_nodemask(int nid, int flag, nodemask_t *nodemask) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/hugetlb_alloc_hugepage_nodemask +6315 mm/hugetlb.c 6311 6312 /* 6313 * Allocate hugepage without reserve 6314 */ > 6315 struct page *hugetlb_alloc_hugepage_nodemask(int nid, int flag, nodemask_t *nodemask) 6316 { 6317 struct hstate *h = &default_hstate; 6318 gfp_t gfp_mask = htlb_alloc_mask(h); 6319 struct page *page = NULL; 6320 6321 if (nid == NUMA_NO_NODE) 6322 nid = numa_mem_id(); 6323 6324 if (nid < 0 || nid >= MAX_NUMNODES) 6325 return NULL; 6326 6327 if (flag & ~HUGETLB_ALLOC_MASK) 6328 return NULL; 6329 6330 if (enable_charge_mighp) 6331 gfp_mask |= __GFP_ACCOUNT; 6332 6333 if (flag & HUGETLB_ALLOC_NORECLAIM) 6334 gfp_mask &= ~__GFP_RECLAIM; 6335 6336 if (flag & HUGETLB_ALLOC_NORMAL) 6337 page = hugetlb_alloc_hugepage_normal(h, gfp_mask, nid); 6338 else if (flag & HUGETLB_ALLOC_BUDDY) 6339 page = alloc_migrate_huge_page(h, gfp_mask, nid, nodemask); 6340 else 6341 page = alloc_huge_page_nodemask(h, nid, nodemask, gfp_mask); 6342 6343 return page; 6344 } 6345 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 415aa2f13fd4c4766b3b6deb471c6b909d39ac51
by kernel test robot 03 Mar '24

03 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 415aa2f13fd4c4766b3b6deb471c6b909d39ac51 !4856 bus: qcom: Put child node before return Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-randconfig-001-20240302 | |-- drivers-iommu-arm-smmu-v3.c:error:CONFIG_CMA_ALIGNMENT-undeclared-(first-use-in-this-function) | `-- include-linux-kernel.h:error:first-argument-to-__builtin_choose_expr-not-a-constant |-- arm64-randconfig-002-20240302 | |-- drivers-gpio-gpio-phytium-platform.c:warning:phytium_gpio_acpi_match-defined-but-not-used | |-- drivers-mailbox-phytium_mailbox.c:warning:phytium_mbox_acpi_match-defined-but-not-used | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_sriov.c:warning:sss_deinit_vf_hw-defined-but-not-used | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_sriov.c:warning:sss_init_vf_hw-defined-but-not-used | |-- drivers-net-ethernet-netswift-ngbe-ngbe_main.c:warning:unused-variable-adapter | `-- mm-mem_reliable.c:warning:zero-defined-but-not-used |-- arm64-randconfig-003-20240302 | `-- arch-arm64-mm-init.c:error:pmu_nmi_enable-undeclared-(first-use-in-this-function) |-- arm64-randconfig-004-20240302 | |-- arch-arm64-mm-init.c:error:pmu_nmi_enable-undeclared-(first-use-in-this-function) | |-- include-linux-uaccess.h:warning:bind-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ciov-may-be-used-uninitialized | `-- mm-mem_reliable.c:warning:zero-defined-but-not-used |-- x86_64-buildonly-randconfig-003-20240302 | |-- drivers-gpu-drm-nouveau-include-nvkm-core-os.h:warning:reg-may-be-used-uninitialized-in-this-function | `-- drivers-gpu-drm-nouveau-nvkm-engine-fifo-dmanv40.c:warning:ctx-may-be-used-uninitialized-in-this-function `-- x86_64-buildonly-randconfig-005-20240302 |-- drivers-gpu-drm-nouveau-include-nvkm-core-os.h:warning:reg-may-be-used-uninitialized-in-this-function `-- drivers-gpu-drm-nouveau-nvkm-engine-fifo-dmanv40.c:warning:ctx-may-be-used-uninitialized-in-this-function elapsed time: 721m configs tested: 20 configs skipped: 131 tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240302 gcc arm64 randconfig-002-20240302 gcc arm64 randconfig-003-20240302 gcc arm64 randconfig-004-20240302 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240302 clang x86_64 buildonly-randconfig-002-20240302 clang x86_64 buildonly-randconfig-003-20240302 gcc x86_64 buildonly-randconfig-004-20240302 gcc x86_64 buildonly-randconfig-005-20240302 gcc x86_64 buildonly-randconfig-006-20240302 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240302 clang x86_64 randconfig-002-20240302 gcc x86_64 randconfig-003-20240302 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION fbcd4a3032a53350f6d182c9daeaa4c46e65d964
by kernel test robot 03 Mar '24

03 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: fbcd4a3032a53350f6d182c9daeaa4c46e65d964 !4845 PCI: Avoid potential out-of-bounds read in pci_dev_for_each_resource() Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202403021652.crccT6al-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202403030238.Vu4FjlZ9-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) arch/loongarch/kernel/dma.c:37:42: sparse: sparse: incorrect type in argument 1 (different address spaces) Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-randconfig-001-20240302 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | `-- drivers-iommu-arm-arm-smmu-v3-arm-smmu-v3.c:error:pci_bus_type-undeclared-(first-use-in-this-function) |-- arm64-randconfig-002-20240302 | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-phytium_dp_encoder_destroy | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-phytium_gem_prime_vmap | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-phytium_gem_prime_vunmap | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:phytium_pci_pm_resume-defined-but-not-used | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:phytium_pci_pm_suspend-defined-but-not-used | |-- drivers-gpu-drm-phytium-phytium_platform.c:warning:phytium_platform_pm_resume-defined-but-not-used | |-- drivers-gpu-drm-phytium-phytium_platform.c:warning:phytium_platform_pm_suspend-defined-but-not-used | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- mm-mem_reliable.c:error:implicit-declaration-of-function-mem_reliable_ctrl_bit_disable | `-- mm-mem_reliable.c:warning:mem_reliable_ctrl_bit_disabled-defined-but-not-used |-- arm64-randconfig-004-20240302 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-phytium_dp_encoder_destroy | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-phytium_gem_prime_vmap | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-phytium_gem_prime_vunmap | |-- drivers-gpu-drm-phytium-phytium_pci.c:error:implicit-declaration-of-function-pci_disable_msi | |-- drivers-gpu-drm-phytium-phytium_pci.c:error:implicit-declaration-of-function-pci_enable_msi | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:phytium_pci_pm_resume-defined-but-not-used | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:phytium_pci_pm_suspend-defined-but-not-used | |-- drivers-gpu-drm-phytium-phytium_platform.c:warning:phytium_platform_pm_resume-defined-but-not-used | |-- drivers-gpu-drm-phytium-phytium_platform.c:warning:phytium_platform_pm_suspend-defined-but-not-used | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- kernel-sched-core.c:warning:format-llu-expects-argument-of-type-long-long-unsigned-int-but-argument-has-type-int | |-- kernel-sched-fair.c:warning:hundred_thousand-defined-but-not-used | |-- kernel-sched-fair.c:warning:one_thousand-defined-but-not-used | |-- mm-mem_reliable.c:error:implicit-declaration-of-function-mem_reliable_ctrl_bit_disable | `-- mm-mem_reliable.c:warning:mem_reliable_ctrl_bit_disabled-defined-but-not-used |-- arm64-randconfig-r111-20240227 | |-- kernel-sched-fair.c:sparse:sparse:symbol-sysctl_offline_wait_interval-was-not-declared.-Should-it-be-static | `-- kernel-sched-fair.c:sparse:sparse:symbol-sysctl_overload_detect_period-was-not-declared.-Should-it-be-static |-- loongarch-allmodconfig | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-infiniband-hw-hns-hns_roce_hw_v2.c:warning:no-previous-prototype-for-hns_roce_hw_v2_get_dscp | `-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-ima_get_hash_algo |-- loongarch-randconfig-001-20240302 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- kernel-sched-fair.c:warning:hundred_thousand-defined-but-not-used | `-- kernel-sched-fair.c:warning:one_thousand-defined-but-not-used |-- loongarch-randconfig-002-20240302 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- loongarch-randconfig-r112-20240302 | `-- arch-loongarch-kernel-dma.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-void-volatile |-- x86_64-buildonly-randconfig-003-20240302 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-buildonly-randconfig-005-20240302 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-buildonly-randconfig-006-20240302 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- x86_64-defconfig | |-- include-linux-ras.h:error:return-type-defaults-to-int | |-- include-linux-ras.h:warning:no-previous-prototype-for-log_arm_hw_error | `-- include-linux-ras.h:warning:return-with-no-value-in-function-returning-non-void |-- x86_64-randconfig-002-20240302 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-013-20240302 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-014-20240302 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-016-20240302 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device `-- x86_64-randconfig-074-20240302 `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device clang_recent_errors |-- arm64-allmodconfig | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_config_pix_clock | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_fb_format_check | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_plane_get_cursor_format | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_plane_get_primary_format | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_reset | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_update_cursor_hi_addr | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_update_primary_hi_addr | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_vram_init | |-- drivers-gpu-drm-phytium-pe22_dp.c:warning:no-previous-prototype-for-function-pe22_dp_hw_get_source_lane_count | |-- drivers-gpu-drm-phytium-pe22_dp.c:warning:no-previous-prototype-for-function-pe22_dp_hw_reset | |-- drivers-gpu-drm-phytium-pe22_dp.c:warning:no-previous-prototype-for-function-pe22_dp_hw_spread_is_enable | |-- drivers-gpu-drm-phytium-phytium_crtc.c:warning:no-previous-prototype-for-function-phytium_crtc_atomic_destroy_state | |-- drivers-gpu-drm-phytium-phytium_crtc.c:warning:no-previous-prototype-for-function-phytium_crtc_atomic_duplicate_state | |-- drivers-gpu-drm-phytium-phytium_debugfs.c:warning:no-previous-prototype-for-function-phytium_debugfs_connector_add | |-- drivers-gpu-drm-phytium-phytium_debugfs.c:warning:no-previous-prototype-for-function-phytium_debugfs_display_register | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_adjust_link_train_parameter | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_coding_8b10b_need_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_dpcd_sink_dpms | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_encoder_destroy | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_fast_link_train | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_get_link_train_fallback_values | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hpd_poll_handler | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_config_video | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_disable_input_source | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_disable_output | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_disable_video | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_audio | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_input_source | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_output | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_video | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_hpd_irq_setup | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_init | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_output_is_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_video_is_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_scrambled_need_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_start_link_train | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_encoder_mode_valid | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_get_encoder_crtc_mask | |-- drivers-gpu-drm-phytium-phytium_fbdev.c:warning:no-previous-prototype-for-function-phytium_drm_fbdev_fini | |-- drivers-gpu-drm-phytium-phytium_fbdev.c:warning:no-previous-prototype-for-function-phytium_drm_fbdev_init | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_dma_transfer | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_gem_prime_vmap | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_gem_prime_vunmap | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_memory_pool_alloc | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_memory_pool_free | |-- drivers-gpu-drm-phytium-phytium_panel.c:warning:no-previous-prototype-for-function-phytium_dp_panel_release_backlight_funcs | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_dma_fini | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_dma_init | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_vram_fini | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_vram_hw_init | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_vram_init | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_atomic_destroy_state | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_atomic_duplicate_state | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_atomic_set_property | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_destroy | |-- drivers-gpu-drm-phytium-phytium_platform.c:warning:no-previous-prototype-for-function-phytium_platform_carveout_mem_fini | |-- drivers-gpu-drm-phytium-phytium_platform.c:warning:no-previous-prototype-for-function-phytium_platform_carveout_mem_init | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_clear_msi_irq | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_config_pix_clock | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_disable | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_fb_format_check | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_plane_get_cursor_format | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_plane_get_primary_format | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_update_dcreq | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_update_primary_hi_addr | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_vram_init | |-- drivers-gpu-drm-phytium-px210_dp.c:warning:no-previous-prototype-for-function-px210_dp_hw_get_source_lane_count | |-- drivers-gpu-drm-phytium-px210_dp.c:warning:no-previous-prototype-for-function-px210_dp_hw_reset | |-- drivers-gpu-drm-phytium-px210_dp.c:warning:no-previous-prototype-for-function-px210_dp_hw_spread_is_enable | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-iommu-arm-arm-smmu-v3-arm-smmu-v3.c:warning:variable-pre_addr-is-uninitialized-when-used-here | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- x86_64-allyesconfig | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-sm3_generic_block_fn | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-zx_sm3_finup | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-zx_sm3_update | |-- arch-x86-crypto-sm4-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-gmi_sm4_set_key | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:no-previous-prototype-for-function-tsse_stop_dev | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:variable-ptr-is-used-uninitialized-whenever-for-loop-exits-because-its-condition-is-false | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_free | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-get_msginf | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_hw_init | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_init_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_recieve_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-msg_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:no-previous-prototype-for-function-service_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:variable-ret-set-but-not-used | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-base_offset-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-pin-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-value_back-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-value_read-set-but-not-used | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- x86_64-buildonly-randconfig-001-20240302 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-buildonly-randconfig-002-20240302 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-004-20240302 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-006-20240302 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-011-20240302 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-012-20240302 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-015-20240302 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-071-20240302 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-072-20240302 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- include-linux-ras.h:error:type-specifier-missing-defaults-to-int-ISO-C99-and-later-do-not-support-implicit-int | |-- include-linux-ras.h:warning:no-previous-prototype-for-function-log_arm_hw_error | `-- include-linux-ras.h:warning:non-void-function-log_arm_hw_error-should-return-a-value |-- x86_64-randconfig-073-20240302 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | `-- ld.lld:error:undefined-symbol:lockdep_is_cpus_held |-- x86_64-randconfig-075-20240302 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-076-20240302 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device `-- x86_64-rhel-8.3-rust `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device elapsed time: 721m configs tested: 40 configs skipped: 126 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240302 gcc arm64 randconfig-002-20240302 gcc arm64 randconfig-003-20240302 clang arm64 randconfig-004-20240302 gcc loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240302 gcc loongarch randconfig-002-20240302 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240302 clang x86_64 buildonly-randconfig-002-20240302 clang x86_64 buildonly-randconfig-003-20240302 gcc x86_64 buildonly-randconfig-004-20240302 gcc x86_64 buildonly-randconfig-005-20240302 gcc x86_64 buildonly-randconfig-006-20240302 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240302 clang x86_64 randconfig-002-20240302 gcc x86_64 randconfig-003-20240302 gcc x86_64 randconfig-004-20240302 clang x86_64 randconfig-005-20240302 gcc x86_64 randconfig-006-20240302 clang x86_64 randconfig-011-20240302 clang x86_64 randconfig-012-20240302 clang x86_64 randconfig-013-20240302 gcc x86_64 randconfig-014-20240302 gcc x86_64 randconfig-015-20240302 clang x86_64 randconfig-016-20240302 gcc x86_64 randconfig-071-20240302 clang x86_64 randconfig-072-20240302 clang x86_64 randconfig-073-20240302 clang x86_64 randconfig-074-20240302 gcc x86_64 randconfig-075-20240302 clang x86_64 randconfig-076-20240302 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 780/3769] arch/loongarch/kernel/dma.c:37:42: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 03 Mar '24

03 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: fbcd4a3032a53350f6d182c9daeaa4c46e65d964 commit: 90d2bbc1ade2216bda17fb582a1aaabf7567478f [780/3769] LoongArch: use arch specific phys_to_dma config: loongarch-randconfig-r112-20240302 (https://download.01.org/0day-ci/archive/20240303/202403030238.Vu4FjlZ9-lkp@…) compiler: loongarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240303/202403030238.Vu4FjlZ9-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403030238.Vu4FjlZ9-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> arch/loongarch/kernel/dma.c:37:42: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void volatile * @@ arch/loongarch/kernel/dma.c:37:42: sparse: expected void const volatile [noderef] __iomem *addr arch/loongarch/kernel/dma.c:37:42: sparse: got void volatile * vim +37 arch/loongarch/kernel/dma.c 29 30 void acpi_arch_dma_setup(struct device *dev) 31 { 32 int ret; 33 u64 mask, end = 0; 34 const struct bus_dma_region *map = NULL; 35 36 if (node_id_offset == 0) { > 37 node_id_offset = ((readl(LS7A_DMA_CFG) & LS7A_DMA_NODE_MASK) >> LS7A_DMA_NODE_SHF); 38 node_id_offset += 36; 39 } 40 41 ret = acpi_dma_get_range(dev, &map); 42 if (!ret && map) { 43 const struct bus_dma_region *r = map; 44 45 for (end = 0; r->size; r++) { 46 if (r->dma_start + r->size - 1 > end) 47 end = r->dma_start + r->size - 1; 48 } 49 50 mask = DMA_BIT_MASK(ilog2(end) + 1); 51 dev->bus_dma_limit = end; 52 dev->dma_range_map = map; 53 dev->coherent_dma_mask = min(dev->coherent_dma_mask, mask); 54 *dev->dma_mask = min(*dev->dma_mask, mask); 55 } 56 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openEuler-1.0-LTS] KVM: Stop looking for coalesced MMIO zones if the bus is destroyed
by Zheng Yejian 02 Mar '24

02 Mar '24

From: Sean Christopherson <seanjc(a)google.com> mainline inclusion from mainline-v5.13-rc1 commit 5d3c4c79384af06e3c8e25b7770b6247496b4417 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94VOT CVE: CVE-2021-47060 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- Abort the walk of coalesced MMIO zones if kvm_io_bus_unregister_dev() fails to allocate memory for the new instance of the bus. If it can't instantiate a new bus, unregister_dev() destroys all devices _except_ the target device. But, it doesn't tell the caller that it obliterated the bus and invoked the destructor for all devices that were on the bus. In the coalesced MMIO case, this can result in a deleted list entry dereference due to attempting to continue iterating on coalesced_zones after future entries (in the walk) have been deleted. Opportunistically add curly braces to the for-loop, which encompasses many lines but sneaks by without braces due to the guts being a single if statement. Fixes: f65886606c2d ("KVM: fix memory leak in kvm_io_bus_unregister_dev()") Cc: stable(a)vger.kernel.org Reported-by: Hao Sun <sunhao.th(a)gmail.com> Signed-off-by: Sean Christopherson <seanjc(a)google.com> Message-Id: <20210412222050.876100-3-seanjc(a)google.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- include/linux/kvm_host.h | 4 ++-- virt/kvm/coalesced_mmio.c | 19 +++++++++++++++++-- virt/kvm/kvm_main.c | 10 +++++----- 3 files changed, 24 insertions(+), 9 deletions(-) diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h index cac0fad2695f..6346d0123077 100644 --- a/include/linux/kvm_host.h +++ b/include/linux/kvm_host.h @@ -195,8 +195,8 @@ int kvm_io_bus_read(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, gpa_t addr, int len, void *val); int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr, int len, struct kvm_io_device *dev); -void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx, - struct kvm_io_device *dev); +int kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx, + struct kvm_io_device *dev); struct kvm_io_device *kvm_io_bus_get_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr); diff --git a/virt/kvm/coalesced_mmio.c b/virt/kvm/coalesced_mmio.c index b9336693c87e..70bd2dbdfffe 100644 --- a/virt/kvm/coalesced_mmio.c +++ b/virt/kvm/coalesced_mmio.c @@ -172,16 +172,31 @@ int kvm_vm_ioctl_unregister_coalesced_mmio(struct kvm *kvm, struct kvm_coalesced_mmio_zone *zone) { struct kvm_coalesced_mmio_dev *dev, *tmp; + int r; mutex_lock(&kvm->slots_lock); - list_for_each_entry_safe(dev, tmp, &kvm->coalesced_zones, list) + list_for_each_entry_safe(dev, tmp, &kvm->coalesced_zones, list) { if (coalesced_mmio_in_range(dev, zone->addr, zone->size)) { - kvm_io_bus_unregister_dev(kvm, KVM_MMIO_BUS, &dev->dev); + r = kvm_io_bus_unregister_dev(kvm, KVM_MMIO_BUS, &dev->dev); kvm_iodevice_destructor(&dev->dev); + + /* + * On failure, unregister destroys all devices on the + * bus _except_ the target device, i.e. coalesced_zones + * has been modified. No need to restart the walk as + * there aren't any zones left. + */ + if (r) + break; } + } mutex_unlock(&kvm->slots_lock); + /* + * Ignore the result of kvm_io_bus_unregister_dev(), from userspace's + * perspective, the coalesced MMIO is most definitely unregistered. + */ return 0; } diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index 5f4f222c991f..62cd5624b715 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -3853,15 +3853,15 @@ int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr, } /* Caller must hold slots_lock. */ -void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx, - struct kvm_io_device *dev) +int kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx, + struct kvm_io_device *dev) { int i, j; struct kvm_io_bus *new_bus, *bus; bus = kvm_get_bus(kvm, bus_idx); if (!bus) - return; + return 0; for (i = 0; i < bus->dev_count; i++) if (bus->range[i].dev == dev) { @@ -3869,7 +3869,7 @@ void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx, } if (i == bus->dev_count) - return; + return 0; new_bus = kmalloc(sizeof(*bus) + ((bus->dev_count - 1) * sizeof(struct kvm_io_range)), GFP_KERNEL); @@ -3890,7 +3890,7 @@ void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx, rcu_assign_pointer(kvm->buses[bus_idx], new_bus); synchronize_srcu_expedited(&kvm->srcu); kfree(bus); - return; + return new_bus ? 0 : -ENOMEM; } struct kvm_io_device *kvm_io_bus_get_dev(struct kvm *kvm, enum kvm_bus bus_idx, -- 2.25.1

1 0

[openeuler:OLK-5.10] BUILD SUCCESS 6adee00913b51cd59245584085cdaca64f74465c
by kernel test robot 02 Mar '24

02 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 6adee00913b51cd59245584085cdaca64f74465c !4847 btrfs: mainline backport Warning ids grouped by kconfigs: clang_recent_errors `-- x86_64-allyesconfig |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_find_tpf_device_legacy |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:no-previous-prototype-for-function-ubcore_modify_tp_state |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_dev_accessible_by_ns |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_dev_ns `-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_ns_mode elapsed time: 730m configs tested: 33 configs skipped: 133 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240302 gcc arm64 randconfig-002-20240302 gcc arm64 randconfig-003-20240302 clang arm64 randconfig-004-20240302 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240302 clang x86_64 buildonly-randconfig-002-20240302 clang x86_64 buildonly-randconfig-003-20240302 gcc x86_64 buildonly-randconfig-004-20240302 gcc x86_64 buildonly-randconfig-005-20240302 gcc x86_64 buildonly-randconfig-006-20240302 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240302 clang x86_64 randconfig-002-20240302 gcc x86_64 randconfig-003-20240302 gcc x86_64 randconfig-004-20240302 clang x86_64 randconfig-005-20240302 gcc x86_64 randconfig-006-20240302 clang x86_64 randconfig-011-20240302 clang x86_64 randconfig-012-20240302 clang x86_64 randconfig-013-20240302 gcc x86_64 randconfig-014-20240302 gcc x86_64 randconfig-015-20240302 clang x86_64 randconfig-016-20240302 gcc x86_64 randconfig-071-20240302 clang x86_64 randconfig-072-20240302 clang x86_64 randconfig-073-20240302 clang x86_64 randconfig-075-20240302 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS v2] net: openvswitch: limit the number of recursions from action sets
by Dong Chenchen 02 Mar '24

02 Mar '24

From: Aaron Conole <aconole(a)redhat.com> mainline inclusion from mainline-v6.8-rc3 commit 6e2f90d31fe09f2b852de25125ca875aabd81367 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I91L17 CVE: CVE-2024-1151 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The ovs module allows for some actions to recursively contain an action list for complex scenarios, such as sampling, checking lengths, etc. When these actions are copied into the internal flow table, they are evaluated to validate that such actions make sense, and these calls happen recursively. The ovs-vswitchd userspace won't emit more than 16 recursion levels deep. However, the module has no such limit and will happily accept limits larger than 16 levels nested. Prevent this by tracking the number of recursions happening and manually limiting it to 16 levels nested. The initial implementation of the sample action would track this depth and prevent more than 3 levels of recursion, but this was removed to support the clone use case, rather than limited at the current userspace limit. Fixes: 798c166173ff ("openvswitch: Optimize sample action for the clone use cases") Signed-off-by: Aaron Conole <aconole(a)redhat.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://lore.kernel.org/r/20240207132416.1488485-2-aconole@redhat.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/openvswitch/flow_netlink.c Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/openvswitch/flow_netlink.c | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-) diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c index 5af7254bd749..45acc612c73b 100644 --- a/net/openvswitch/flow_netlink.c +++ b/net/openvswitch/flow_netlink.c @@ -60,6 +60,7 @@ struct ovs_len_tbl { #define OVS_ATTR_NESTED -1 #define OVS_ATTR_VARIABLE -2 +#define OVS_COPY_ACTIONS_MAX_DEPTH 16 static bool actions_may_change_flow(const struct nlattr *actions) { @@ -2393,13 +2394,14 @@ static inline void add_nested_action_end(struct sw_flow_actions *sfa, static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, const struct sw_flow_key *key, struct sw_flow_actions **sfa, - __be16 eth_type, __be16 vlan_tci, bool log); + __be16 eth_type, __be16 vlan_tci, bool log, + u32 depth); static int validate_and_copy_sample(struct net *net, const struct nlattr *attr, const struct sw_flow_key *key, struct sw_flow_actions **sfa, __be16 eth_type, __be16 vlan_tci, - bool log, bool last) + bool log, bool last, u32 depth) { const struct nlattr *attrs[OVS_SAMPLE_ATTR_MAX + 1]; const struct nlattr *probability, *actions; @@ -2450,7 +2452,8 @@ static int validate_and_copy_sample(struct net *net, const struct nlattr *attr, return err; err = __ovs_nla_copy_actions(net, actions, key, sfa, - eth_type, vlan_tci, log); + eth_type, vlan_tci, log, + depth + 1); if (err) return err; @@ -2465,7 +2468,7 @@ static int validate_and_copy_clone(struct net *net, const struct sw_flow_key *key, struct sw_flow_actions **sfa, __be16 eth_type, __be16 vlan_tci, - bool log, bool last) + bool log, bool last, u32 depth) { int start, err; u32 exec; @@ -2485,7 +2488,8 @@ static int validate_and_copy_clone(struct net *net, return err; err = __ovs_nla_copy_actions(net, attr, key, sfa, - eth_type, vlan_tci, log); + eth_type, vlan_tci, log, + depth + 1); if (err) return err; @@ -2855,12 +2859,16 @@ static int copy_action(const struct nlattr *from, static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, const struct sw_flow_key *key, struct sw_flow_actions **sfa, - __be16 eth_type, __be16 vlan_tci, bool log) + __be16 eth_type, __be16 vlan_tci, + bool log, u32 depth) { u8 mac_proto = ovs_key_mac_proto(key); const struct nlattr *a; int rem, err; + if (depth > OVS_COPY_ACTIONS_MAX_DEPTH) + return -EOVERFLOW; + nla_for_each_nested(a, attr, rem) { /* Expected argument lengths, (u32)-1 for variable length. */ static const u32 action_lens[OVS_ACTION_ATTR_MAX + 1] = { @@ -3008,7 +3016,7 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, err = validate_and_copy_sample(net, a, key, sfa, eth_type, vlan_tci, - log, last); + log, last, depth); if (err) return err; skip_copy = true; @@ -3078,7 +3086,7 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, err = validate_and_copy_clone(net, a, key, sfa, eth_type, vlan_tci, - log, last); + log, last, depth); if (err) return err; skip_copy = true; @@ -3115,7 +3123,7 @@ int ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, (*sfa)->orig_len = nla_len(attr); err = __ovs_nla_copy_actions(net, attr, key, sfa, key->eth.type, - key->eth.vlan.tci, log); + key->eth.vlan.tci, log, 0); if (err) ovs_nla_free_flow_actions(*sfa); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] net: openvswitch: limit the number of recursions from action sets
by Dong Chenchen 02 Mar '24

02 Mar '24

From: Aaron Conole <aconole(a)redhat.com> mainline inclusion from mainline-v6.8-rc3 commit 6e2f90d31fe09f2b852de25125ca875aabd81367 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I91L17 CVE: CVE-2024-1151 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The ovs module allows for some actions to recursively contain an action list for complex scenarios, such as sampling, checking lengths, etc. When these actions are copied into the internal flow table, they are evaluated to validate that such actions make sense, and these calls happen recursively. The ovs-vswitchd userspace won't emit more than 16 recursion levels deep. However, the module has no such limit and will happily accept limits larger than 16 levels nested. Prevent this by tracking the number of recursions happening and manually limiting it to 16 levels nested. The initial implementation of the sample action would track this depth and prevent more than 3 levels of recursion, but this was removed to support the clone use case, rather than limited at the current userspace limit. Fixes: 798c166173ff ("openvswitch: Optimize sample action for the clone use cases") Signed-off-by: Aaron Conole <aconole(a)redhat.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://lore.kernel.org/r/20240207132416.1488485-2-aconole@redhat.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/openvswitch/flow_netlink.c Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/openvswitch/flow_netlink.c | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c index 5af7254bd749..0c2848facef3 100644 --- a/net/openvswitch/flow_netlink.c +++ b/net/openvswitch/flow_netlink.c @@ -60,6 +60,7 @@ struct ovs_len_tbl { #define OVS_ATTR_NESTED -1 #define OVS_ATTR_VARIABLE -2 +#define OVS_COPY_ACTIONS_MAX_DEPTH 16 static bool actions_may_change_flow(const struct nlattr *actions) { @@ -2393,13 +2394,14 @@ static inline void add_nested_action_end(struct sw_flow_actions *sfa, static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, const struct sw_flow_key *key, struct sw_flow_actions **sfa, - __be16 eth_type, __be16 vlan_tci, bool log); + __be16 eth_type, __be16 vlan_tci, bool log, + u32 depth); static int validate_and_copy_sample(struct net *net, const struct nlattr *attr, const struct sw_flow_key *key, struct sw_flow_actions **sfa, __be16 eth_type, __be16 vlan_tci, - bool log, bool last) + bool log, bool last, u32 depth) { const struct nlattr *attrs[OVS_SAMPLE_ATTR_MAX + 1]; const struct nlattr *probability, *actions; @@ -2450,7 +2452,8 @@ static int validate_and_copy_sample(struct net *net, const struct nlattr *attr, return err; err = __ovs_nla_copy_actions(net, actions, key, sfa, - eth_type, vlan_tci, log); + eth_type, vlan_tci, log, + depth + 1); if (err) return err; @@ -2465,7 +2468,7 @@ static int validate_and_copy_clone(struct net *net, const struct sw_flow_key *key, struct sw_flow_actions **sfa, __be16 eth_type, __be16 vlan_tci, - bool log, bool last) + bool log, bool last, u32 depth) { int start, err; u32 exec; @@ -2485,7 +2488,8 @@ static int validate_and_copy_clone(struct net *net, return err; err = __ovs_nla_copy_actions(net, attr, key, sfa, - eth_type, vlan_tci, log); + eth_type, vlan_tci, log, + depth + 1); if (err) return err; @@ -2855,12 +2859,16 @@ static int copy_action(const struct nlattr *from, static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, const struct sw_flow_key *key, struct sw_flow_actions **sfa, - __be16 eth_type, __be16 vlan_tci, bool log) + __be16 eth_type, __be16 vlan_tci, + bool log, u32 depth) { u8 mac_proto = ovs_key_mac_proto(key); const struct nlattr *a; int rem, err; + if (depth > OVS_COPY_ACTIONS_MAX_DEPTH) + return -EOVERFLOW; + nla_for_each_nested(a, attr, rem) { /* Expected argument lengths, (u32)-1 for variable length. */ static const u32 action_lens[OVS_ACTION_ATTR_MAX + 1] = { @@ -3008,7 +3016,7 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, err = validate_and_copy_sample(net, a, key, sfa, eth_type, vlan_tci, - log, last); + log, last, depth); if (err) return err; skip_copy = true; @@ -3078,7 +3086,7 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, err = validate_and_copy_clone(net, a, key, sfa, eth_type, vlan_tci, - log, last); + log, last, depth); if (err) return err; skip_copy = true; @@ -3105,7 +3113,8 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, /* 'key' must be the masked key. */ int ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, const struct sw_flow_key *key, - struct sw_flow_actions **sfa, bool log) + struct sw_flow_actions **sfa, bool log + u32 depth) { int err; @@ -3115,7 +3124,7 @@ int ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, (*sfa)->orig_len = nla_len(attr); err = __ovs_nla_copy_actions(net, attr, key, sfa, key->eth.type, - key->eth.vlan.tci, log); + key->eth.vlan.tci, log, 0); if (err) ovs_nla_free_flow_actions(*sfa); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] Revert "blk-mq: Fix memory leak in blk_mq_init_allocated_queue error handling"
by Li Lingfeng 02 Mar '24

02 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I959FN CVE: NA -------------------------------- This reverts commit 961e2d0bd3b537aa39b58b074aec4a6c6a9fea47. When blk_mq_init_allocated_queue() fail, blk_mq_init_queue() will catch the error code and call blk_cleanup_queue() to release resource. So it's not necessary to call blk_mq_del_queue_tag_set() in blk_mq_init_allocated_queue(). What's more, hctx can't be released since commit 73d9c8d4c001 ("blk-mq: Fix memory leak in blk_mq_init_allocated_queue error handling") set q->nr_hw_queues as zero. Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- block/blk-mq.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/block/blk-mq.c b/block/blk-mq.c index 96debbe63ad2..41a3f6b89319 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -2874,8 +2874,6 @@ static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set, struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set, struct request_queue *q) { - int ret = -ENOMEM; - /* mark the queue as mq asap */ q->mq_ops = set->ops; @@ -2942,18 +2940,17 @@ struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set, blk_mq_map_swqueue(q); if (!(set->flags & BLK_MQ_F_NO_SCHED)) { + int ret; + ret = elevator_init_mq(q); if (ret) - goto err_tag_set; + return ERR_PTR(ret); } return q; -err_tag_set: - blk_mq_del_queue_tag_set(q); err_hctxs: kfree(q->queue_hw_ctx); - q->nr_hw_queues = 0; err_sys_init: blk_mq_sysfs_deinit(q); err_exit: -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] net: openvswitch: limit the number of recursions from action sets
by Dong Chenchen 02 Mar '24

02 Mar '24

From: Aaron Conole <aconole(a)redhat.com> mainline inclusion from mainline-v6.8-rc3 commit 6e2f90d31fe09f2b852de25125ca875aabd81367 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I91L17 CVE: CVE-2024-1151 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The ovs module allows for some actions to recursively contain an action list for complex scenarios, such as sampling, checking lengths, etc. When these actions are copied into the internal flow table, they are evaluated to validate that such actions make sense, and these calls happen recursively. The ovs-vswitchd userspace won't emit more than 16 recursion levels deep. However, the module has no such limit and will happily accept limits larger than 16 levels nested. Prevent this by tracking the number of recursions happening and manually limiting it to 16 levels nested. The initial implementation of the sample action would track this depth and prevent more than 3 levels of recursion, but this was removed to support the clone use case, rather than limited at the current userspace limit. Fixes: 798c166173ff ("openvswitch: Optimize sample action for the clone use cases") Signed-off-by: Aaron Conole <aconole(a)redhat.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://lore.kernel.org/r/20240207132416.1488485-2-aconole@redhat.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/openvswitch/flow_netlink.c Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/openvswitch/flow_netlink.c | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c index 5af7254bd749..9acd7f45e988 100644 --- a/net/openvswitch/flow_netlink.c +++ b/net/openvswitch/flow_netlink.c @@ -60,6 +60,7 @@ struct ovs_len_tbl { #define OVS_ATTR_NESTED -1 #define OVS_ATTR_VARIABLE -2 +#define OVS_COPY_ACTIONS_MAX_DEPTH 16 static bool actions_may_change_flow(const struct nlattr *actions) { @@ -2393,13 +2394,14 @@ static inline void add_nested_action_end(struct sw_flow_actions *sfa, static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, const struct sw_flow_key *key, struct sw_flow_actions **sfa, - __be16 eth_type, __be16 vlan_tci, bool log); + __be16 eth_type, __be16 vlan_tci, bool log, + u32 depth); static int validate_and_copy_sample(struct net *net, const struct nlattr *attr, const struct sw_flow_key *key, struct sw_flow_actions **sfa, __be16 eth_type, __be16 vlan_tci, - bool log, bool last) + bool log, bool last, u32 depth) { const struct nlattr *attrs[OVS_SAMPLE_ATTR_MAX + 1]; const struct nlattr *probability, *actions; @@ -2450,7 +2452,8 @@ static int validate_and_copy_sample(struct net *net, const struct nlattr *attr, return err; err = __ovs_nla_copy_actions(net, actions, key, sfa, - eth_type, vlan_tci, log); + eth_type, vlan_tci, log, + depth + 1); if (err) return err; @@ -2465,7 +2468,7 @@ static int validate_and_copy_clone(struct net *net, const struct sw_flow_key *key, struct sw_flow_actions **sfa, __be16 eth_type, __be16 vlan_tci, - bool log, bool last) + bool log, bool last, u32 depth) { int start, err; u32 exec; @@ -2485,7 +2488,8 @@ static int validate_and_copy_clone(struct net *net, return err; err = __ovs_nla_copy_actions(net, attr, key, sfa, - eth_type, vlan_tci, log); + eth_type, vlan_tci, log + depth + 1); if (err) return err; @@ -2855,12 +2859,16 @@ static int copy_action(const struct nlattr *from, static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, const struct sw_flow_key *key, struct sw_flow_actions **sfa, - __be16 eth_type, __be16 vlan_tci, bool log) + __be16 eth_type, __be16 vlan_tci, + bool log, u32 depth) { u8 mac_proto = ovs_key_mac_proto(key); const struct nlattr *a; int rem, err; + if (depth > OVS_COPY_ACTIONS_MAX_DEPTH) + return -EOVERFLOW; + nla_for_each_nested(a, attr, rem) { /* Expected argument lengths, (u32)-1 for variable length. */ static const u32 action_lens[OVS_ACTION_ATTR_MAX + 1] = { @@ -3008,7 +3016,7 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, err = validate_and_copy_sample(net, a, key, sfa, eth_type, vlan_tci, - log, last); + log, last, depth); if (err) return err; skip_copy = true; @@ -3078,7 +3086,7 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, err = validate_and_copy_clone(net, a, key, sfa, eth_type, vlan_tci, - log, last); + log, last, depth); if (err) return err; skip_copy = true; @@ -3105,7 +3113,8 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, /* 'key' must be the masked key. */ int ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, const struct sw_flow_key *key, - struct sw_flow_actions **sfa, bool log) + struct sw_flow_actions **sfa, bool log + u32 depth) { int err; @@ -3115,7 +3124,7 @@ int ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, (*sfa)->orig_len = nla_len(attr); err = __ovs_nla_copy_actions(net, attr, key, sfa, key->eth.type, - key->eth.vlan.tci, log); + key->eth.vlan.tci, log, 0); if (err) ovs_nla_free_flow_actions(*sfa); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/1] i2c: validate user data in compat ioctl
by Hongbo Li 02 Mar '24

02 Mar '24

Wrong user data may cause warning in i2c_transfer(), ex: zero msgs. Userspace should not be able to trigger warnings, so this patch adds validation checks for user data in compact ioctl to prevent reported warnings Pavel Skripkin (1): i2c: validate user data in compat ioctl drivers/i2c/i2c-dev.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS 0/3] Fix CVE-2021-46941
by Zhang Xiaoxu 02 Mar '24

02 Mar '24

*** BLURB HERE *** Li Jun (1): usb: dwc3: core: balance phy init and exit Rohith Kollalsi (1): usb: dwc3: core: Do not perform GCTL_CORE_SOFTRESET during bootup Yu Chen (1): usb: dwc3: core: Do core softreset when switch mode drivers/usb/dwc3/core.c | 71 +++++++++++++++++++++++++++++------------ drivers/usb/dwc3/core.h | 5 +++ 2 files changed, 55 insertions(+), 21 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10] net: openvswitch: limit the number of recursions from action sets
by Dong Chenchen 02 Mar '24

02 Mar '24

From: Aaron Conole <aconole(a)redhat.com> stable inclusion from stable-v5.10.209 commit 55cfccb658fc142d7fbfeae2d0496b7841d128c3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I91L17 CVE: CVE-2024-1151 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6e2f90d31fe09f2b852de25125ca875aabd81367 ] The ovs module allows for some actions to recursively contain an action list for complex scenarios, such as sampling, checking lengths, etc. When these actions are copied into the internal flow table, they are evaluated to validate that such actions make sense, and these calls happen recursively. The ovs-vswitchd userspace won't emit more than 16 recursion levels deep. However, the module has no such limit and will happily accept limits larger than 16 levels nested. Prevent this by tracking the number of recursions happening and manually limiting it to 16 levels nested. The initial implementation of the sample action would track this depth and prevent more than 3 levels of recursion, but this was removed to support the clone use case, rather than limited at the current userspace limit. Fixes: 798c166173ff ("openvswitch: Optimize sample action for the clone use cases") Signed-off-by: Aaron Conole <aconole(a)redhat.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://lore.kernel.org/r/20240207132416.1488485-2-aconole@redhat.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/openvswitch/flow_netlink.c | 49 +++++++++++++++++++++++----------- 1 file changed, 33 insertions(+), 16 deletions(-) diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c index 293a798e89f4..cff18a5bbf38 100644 --- a/net/openvswitch/flow_netlink.c +++ b/net/openvswitch/flow_netlink.c @@ -47,6 +47,7 @@ struct ovs_len_tbl { #define OVS_ATTR_NESTED -1 #define OVS_ATTR_VARIABLE -2 +#define OVS_COPY_ACTIONS_MAX_DEPTH 16 static bool actions_may_change_flow(const struct nlattr *actions) { @@ -2514,13 +2515,15 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, const struct sw_flow_key *key, struct sw_flow_actions **sfa, __be16 eth_type, __be16 vlan_tci, - u32 mpls_label_count, bool log); + u32 mpls_label_count, bool log, + u32 depth); static int validate_and_copy_sample(struct net *net, const struct nlattr *attr, const struct sw_flow_key *key, struct sw_flow_actions **sfa, __be16 eth_type, __be16 vlan_tci, - u32 mpls_label_count, bool log, bool last) + u32 mpls_label_count, bool log, bool last, + u32 depth) { const struct nlattr *attrs[OVS_SAMPLE_ATTR_MAX + 1]; const struct nlattr *probability, *actions; @@ -2571,7 +2574,8 @@ static int validate_and_copy_sample(struct net *net, const struct nlattr *attr, return err; err = __ovs_nla_copy_actions(net, actions, key, sfa, - eth_type, vlan_tci, mpls_label_count, log); + eth_type, vlan_tci, mpls_label_count, log, + depth + 1); if (err) return err; @@ -2586,7 +2590,8 @@ static int validate_and_copy_dec_ttl(struct net *net, const struct sw_flow_key *key, struct sw_flow_actions **sfa, __be16 eth_type, __be16 vlan_tci, - u32 mpls_label_count, bool log) + u32 mpls_label_count, bool log, + u32 depth) { const struct nlattr *attrs[OVS_DEC_TTL_ATTR_MAX + 1]; int start, action_start, err, rem; @@ -2619,7 +2624,8 @@ static int validate_and_copy_dec_ttl(struct net *net, return action_start; err = __ovs_nla_copy_actions(net, actions, key, sfa, eth_type, - vlan_tci, mpls_label_count, log); + vlan_tci, mpls_label_count, log, + depth + 1); if (err) return err; @@ -2633,7 +2639,8 @@ static int validate_and_copy_clone(struct net *net, const struct sw_flow_key *key, struct sw_flow_actions **sfa, __be16 eth_type, __be16 vlan_tci, - u32 mpls_label_count, bool log, bool last) + u32 mpls_label_count, bool log, bool last, + u32 depth) { int start, err; u32 exec; @@ -2653,7 +2660,8 @@ static int validate_and_copy_clone(struct net *net, return err; err = __ovs_nla_copy_actions(net, attr, key, sfa, - eth_type, vlan_tci, mpls_label_count, log); + eth_type, vlan_tci, mpls_label_count, log, + depth + 1); if (err) return err; @@ -3022,7 +3030,7 @@ static int validate_and_copy_check_pkt_len(struct net *net, struct sw_flow_actions **sfa, __be16 eth_type, __be16 vlan_tci, u32 mpls_label_count, - bool log, bool last) + bool log, bool last, u32 depth) { const struct nlattr *acts_if_greater, *acts_if_lesser_eq; struct nlattr *a[OVS_CHECK_PKT_LEN_ATTR_MAX + 1]; @@ -3070,7 +3078,8 @@ static int validate_and_copy_check_pkt_len(struct net *net, return nested_acts_start; err = __ovs_nla_copy_actions(net, acts_if_lesser_eq, key, sfa, - eth_type, vlan_tci, mpls_label_count, log); + eth_type, vlan_tci, mpls_label_count, log, + depth + 1); if (err) return err; @@ -3083,7 +3092,8 @@ static int validate_and_copy_check_pkt_len(struct net *net, return nested_acts_start; err = __ovs_nla_copy_actions(net, acts_if_greater, key, sfa, - eth_type, vlan_tci, mpls_label_count, log); + eth_type, vlan_tci, mpls_label_count, log, + depth + 1); if (err) return err; @@ -3111,12 +3121,16 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, const struct sw_flow_key *key, struct sw_flow_actions **sfa, __be16 eth_type, __be16 vlan_tci, - u32 mpls_label_count, bool log) + u32 mpls_label_count, bool log, + u32 depth) { u8 mac_proto = ovs_key_mac_proto(key); const struct nlattr *a; int rem, err; + if (depth > OVS_COPY_ACTIONS_MAX_DEPTH) + return -EOVERFLOW; + nla_for_each_nested(a, attr, rem) { /* Expected argument lengths, (u32)-1 for variable length. */ static const u32 action_lens[OVS_ACTION_ATTR_MAX + 1] = { @@ -3311,7 +3325,7 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, err = validate_and_copy_sample(net, a, key, sfa, eth_type, vlan_tci, mpls_label_count, - log, last); + log, last, depth); if (err) return err; skip_copy = true; @@ -3382,7 +3396,7 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, err = validate_and_copy_clone(net, a, key, sfa, eth_type, vlan_tci, mpls_label_count, - log, last); + log, last, depth); if (err) return err; skip_copy = true; @@ -3396,7 +3410,8 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, eth_type, vlan_tci, mpls_label_count, - log, last); + log, last, + depth); if (err) return err; skip_copy = true; @@ -3406,7 +3421,8 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, case OVS_ACTION_ATTR_DEC_TTL: err = validate_and_copy_dec_ttl(net, a, key, sfa, eth_type, vlan_tci, - mpls_label_count, log); + mpls_label_count, log, + depth); if (err) return err; skip_copy = true; @@ -3446,7 +3462,8 @@ int ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, (*sfa)->orig_len = nla_len(attr); err = __ovs_nla_copy_actions(net, attr, key, sfa, key->eth.type, - key->eth.vlan.tci, mpls_label_count, log); + key->eth.vlan.tci, mpls_label_count, log, + 0); if (err) ovs_nla_free_flow_actions(*sfa); -- 2.25.1

2 1

[PATCH OLK-6.6] ext4: regenerate buddy after block freeing failed if under fc replay
by Baokun Li 02 Mar '24

02 Mar '24

mainline inclusion from mainline-v6.8-rc3 commit c9b528c35795b711331ed36dc3dbee90d5812d4e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93HD9 CVE: CVE-2024-26601 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This mostly reverts commit 6bd97bf273bd ("ext4: remove redundant mb_regenerate_buddy()") and reintroduces mb_regenerate_buddy(). Based on code in mb_free_blocks(), fast commit replay can end up marking as free blocks that are already marked as such. This causes corruption of the buddy bitmap so we need to regenerate it in that case. Reported-by: Jan Kara <jack(a)suse.cz> Fixes: 6bd97bf273bd ("ext4: remove redundant mb_regenerate_buddy()") Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20240104142040.2835097-4-libaokun1@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/ext4/mballoc.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index a7b8558c0d09..bbb2410a0724 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -1232,6 +1232,24 @@ void ext4_mb_generate_buddy(struct super_block *sb, atomic64_add(period, &sbi->s_mb_generation_time); } +static void mb_regenerate_buddy(struct ext4_buddy *e4b) +{ + int count; + int order = 1; + void *buddy; + + while ((buddy = mb_find_buddy(e4b, order++, &count))) + mb_set_bits(buddy, 0, count); + + e4b->bd_info->bb_fragments = 0; + memset(e4b->bd_info->bb_counters, 0, + sizeof(*e4b->bd_info->bb_counters) * + (e4b->bd_sb->s_blocksize_bits + 2)); + + ext4_mb_generate_buddy(e4b->bd_sb, e4b->bd_buddy, + e4b->bd_bitmap, e4b->bd_group, e4b->bd_info); +} + /* The buddy information is attached the buddy cache inode * for convenience. The information regarding each group * is loaded via ext4_mb_load_buddy. The information involve @@ -1920,6 +1938,8 @@ static void mb_free_blocks(struct inode *inode, struct ext4_buddy *e4b, ext4_mark_group_bitmap_corrupted( sb, e4b->bd_group, EXT4_GROUP_INFO_BBITMAP_CORRUPT); + } else { + mb_regenerate_buddy(e4b); } goto done; } -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] Input: appletouch - initialize work before device registration
by Jinjiang Tu 02 Mar '24

02 Mar '24

From: Pavel Skripkin <paskripkin(a)gmail.com> mainline inclusion from mainline-v5.16-rc8 commit 9f3ccdc3f6ef10084ceb3a47df0961bec6196fd0 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I947RI CVE: CVE-2021-46932 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Syzbot has reported warning in __flush_work(). This warning is caused by work->func == NULL, which means missing work initialization. This may happen, since input_dev->close() calls cancel_work_sync(&dev->work), but dev->work initalization happens _after_ input_register_device() call. So this patch moves dev->work initialization before registering input device Fixes: 5a6eb676d3bc ("Input: appletouch - improve powersaving for Geyser3 devices") Reported-and-tested-by: syzbot+b88c5eae27386b252bbd(a)syzkaller.appspotmail.com Signed-off-by: Pavel Skripkin <paskripkin(a)gmail.com> Link: https://lore.kernel.org/r/20211230141151.17300-1-paskripkin@gmail.com Cc: stable(a)vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/input/mouse/appletouch.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/input/mouse/appletouch.c b/drivers/input/mouse/appletouch.c index f1e66e257cff..e305a4f2b0f0 100644 --- a/drivers/input/mouse/appletouch.c +++ b/drivers/input/mouse/appletouch.c @@ -930,6 +930,8 @@ static int atp_probe(struct usb_interface *iface, set_bit(BTN_TOOL_TRIPLETAP, input_dev->keybit); set_bit(BTN_LEFT, input_dev->keybit); + INIT_WORK(&dev->work, atp_reinit); + error = input_register_device(dev->input); if (error) goto err_free_buffer; @@ -937,8 +939,6 @@ static int atp_probe(struct usb_interface *iface, /* save our data pointer in this interface device */ usb_set_intfdata(iface, dev); - INIT_WORK(&dev->work, atp_reinit); - return 0; err_free_buffer: -- 2.25.1

2 1

[openeuler:OLK-6.6 2676/3767] rdtgroup.c:undefined reference to `lockdep_is_cpus_held'
by kernel test robot 02 Mar '24

02 Mar '24

Hi James, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 236cb940335e3542c9d5ac16b5d8546a0cbbdfc1 commit: c054efea286659a6504fdeafc0a611c6a3b124cc [2676/3767] x86/resctrl: Claim get_domain_from_cpu() for resctrl config: x86_64-buildonly-randconfig-004-20240301 (https://download.01.org/0day-ci/archive/20240302/202403021655.4zz3RhBO-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240302/202403021655.4zz3RhBO-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403021655.4zz3RhBO-lkp@intel.com/ All errors (new ones prefixed by >>): ld: arch/x86/kernel/cpu/resctrl/core.o: in function `rdt_ctrl_update': core.c:(.text+0x2561): undefined reference to `lockdep_is_cpus_held' ld: arch/x86/kernel/cpu/resctrl/rdtgroup.o: in function `resctrl_offline_cpu': >> rdtgroup.c:(.text+0x12301): undefined reference to `lockdep_is_cpus_held' ld: arch/x86/kernel/cpu/resctrl/monitor.o: in function `update_mba_bw': monitor.c:(.text+0x31e): undefined reference to `lockdep_is_cpus_held' -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] Input: powermate - fix use-after-free in powermate_config_complete
by Xiang Yang 02 Mar '24

02 Mar '24

From: Javier Carrasco <javier.carrasco.cruz(a)gmail.com> stable inclusion from stable-v4.19.297 commit 67cace72606baf1758fd60feb358f4c6be92e1cc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94PA7 CVE: CVE-2023-52475 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ----------------------------------------------------- commit 5c15c60e7be615f05a45cd905093a54b11f461bc upstream. syzbot has found a use-after-free bug [1] in the powermate driver. This happens when the device is disconnected, which leads to a memory free from the powermate_device struct. When an asynchronous control message completes after the kfree and its callback is invoked, the lock does not exist anymore and hence the bug. Use usb_kill_urb() on pm->config to cancel any in-progress requests upon device disconnection. [1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e Signed-off-by: Javier Carrasco <javier.carrasco.cruz(a)gmail.com> Reported-by: syzbot+0434ac83f907a1dbdd1e(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20230916-topic-powermate_use_after_free-v3-1-6441… Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- drivers/input/misc/powermate.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/input/misc/powermate.c b/drivers/input/misc/powermate.c index e8de3aaf9f63..14f48e10f589 100644 --- a/drivers/input/misc/powermate.c +++ b/drivers/input/misc/powermate.c @@ -424,6 +424,7 @@ static void powermate_disconnect(struct usb_interface *intf) pm->requires_update = 0; usb_kill_urb(pm->irq); input_unregister_device(pm->input); + usb_kill_urb(pm->config); usb_free_urb(pm->irq); usb_free_urb(pm->config); powermate_free_buffers(interface_to_usbdev(intf), pm); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP2] ext4: regenerate buddy after block freeing failed if under fc replay
by Baokun Li 02 Mar '24

02 Mar '24

mainline inclusion from mainline-v6.8-rc3 commit c9b528c35795b711331ed36dc3dbee90d5812d4e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93HD9 CVE: CVE-2024-26601 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This mostly reverts commit 6bd97bf273bd ("ext4: remove redundant mb_regenerate_buddy()") and reintroduces mb_regenerate_buddy(). Based on code in mb_free_blocks(), fast commit replay can end up marking as free blocks that are already marked as such. This causes corruption of the buddy bitmap so we need to regenerate it in that case. Reported-by: Jan Kara <jack(a)suse.cz> Fixes: 6bd97bf273bd ("ext4: remove redundant mb_regenerate_buddy()") Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20240104142040.2835097-4-libaokun1@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Conflicts: fs/ext4/mballoc.c Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/ext4/mballoc.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index 929fc424d68a..cdb443932e3b 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -822,6 +822,24 @@ void ext4_mb_generate_buddy(struct super_block *sb, atomic64_add(period, &sbi->s_mb_generation_time); } +static void mb_regenerate_buddy(struct ext4_buddy *e4b) +{ + int count; + int order = 1; + void *buddy; + + while ((buddy = mb_find_buddy(e4b, order++, &count))) + ext4_set_bits(buddy, 0, count); + + e4b->bd_info->bb_fragments = 0; + memset(e4b->bd_info->bb_counters, 0, + sizeof(*e4b->bd_info->bb_counters) * + (e4b->bd_sb->s_blocksize_bits + 2)); + + ext4_mb_generate_buddy(e4b->bd_sb, e4b->bd_buddy, + e4b->bd_bitmap, e4b->bd_group, e4b->bd_info); +} + /* The buddy information is attached the buddy cache inode * for convenience. The information regarding each group * is loaded via ext4_mb_load_buddy. The information involve @@ -1504,6 +1522,8 @@ static void mb_free_blocks(struct inode *inode, struct ext4_buddy *e4b, ext4_mark_group_bitmap_corrupted( sb, e4b->bd_group, EXT4_GROUP_INFO_BBITMAP_CORRUPT); + } else { + mb_regenerate_buddy(e4b); } goto done; } -- 2.31.1

2 1

[openeuler:OLK-6.6 780/3767] arch/loongarch/kernel/dma.c:37:42: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 02 Mar '24

02 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: fbcd4a3032a53350f6d182c9daeaa4c46e65d964 commit: 90d2bbc1ade2216bda17fb582a1aaabf7567478f [780/3767] LoongArch: use arch specific phys_to_dma config: loongarch-randconfig-r112-20240302 (https://download.01.org/0day-ci/archive/20240302/202403021652.crccT6al-lkp@…) compiler: loongarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240302/202403021652.crccT6al-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403021652.crccT6al-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> arch/loongarch/kernel/dma.c:37:42: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void volatile * @@ arch/loongarch/kernel/dma.c:37:42: sparse: expected void const volatile [noderef] __iomem *addr arch/loongarch/kernel/dma.c:37:42: sparse: got void volatile * vim +37 arch/loongarch/kernel/dma.c 29 30 void acpi_arch_dma_setup(struct device *dev) 31 { 32 int ret; 33 u64 mask, end = 0; 34 const struct bus_dma_region *map = NULL; 35 36 if (node_id_offset == 0) { > 37 node_id_offset = ((readl(LS7A_DMA_CFG) & LS7A_DMA_NODE_MASK) >> LS7A_DMA_NODE_SHF); 38 node_id_offset += 36; 39 } 40 41 ret = acpi_dma_get_range(dev, &map); 42 if (!ret && map) { 43 const struct bus_dma_region *r = map; 44 45 for (end = 0; r->size; r++) { 46 if (r->dma_start + r->size - 1 > end) 47 end = r->dma_start + r->size - 1; 48 } 49 50 mask = DMA_BIT_MASK(ilog2(end) + 1); 51 dev->bus_dma_limit = end; 52 dev->dma_range_map = map; 53 dev->coherent_dma_mask = min(dev->coherent_dma_mask, mask); 54 *dev->dma_mask = min(*dev->dma_mask, mask); 55 } 56 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] i2c: cadence: fix reference leak when pm_runtime_get_sync fails
by Jinjiang Tu 02 Mar '24

02 Mar '24

From: Qinglang Miao <miaoqinglang(a)huawei.com> mainline inclusion from mainline-v5.13-rc1 commit 23ceb8462dc6f4b4decdb5536a7e5fc477cdf0b6 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I94JHY CVE: CVE-2020-36784 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- The PM reference count is not expected to be incremented on return in functions cdns_i2c_master_xfer and cdns_reg_slave. However, pm_runtime_get_sync will increment pm usage counter even failed. Forgetting to putting operation will result in a reference leak here. Replace it with pm_runtime_resume_and_get to keep usage counter balanced. Fixes: 7fa32329ca03 ("i2c: cadence: Move to sensible power management") Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Qinglang Miao <miaoqinglang(a)huawei.com> Signed-off-by: Wolfram Sang <wsa(a)kernel.org> Conflicts: drivers/i2c/busses/i2c-cadence.c Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/i2c/busses/i2c-cadence.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c index d917cefc5a19..f64c7f8b924e 100644 --- a/drivers/i2c/busses/i2c-cadence.c +++ b/drivers/i2c/busses/i2c-cadence.c @@ -578,7 +578,7 @@ static int cdns_i2c_master_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, struct cdns_i2c *id = adap->algo_data; bool hold_quirk; - ret = pm_runtime_get_sync(id->dev); + ret = pm_runtime_resume_and_get(id->dev); if (ret < 0) return ret; /* Check if the bus is free */ -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] usb: dwc3: core: Do core softreset when switch mode
by Zhang Xiaoxu 02 Mar '24

02 Mar '24

From: Yu Chen <chenyu56(a)huawei.com> mainline inclusion from mainline-v5.13-rc1 commit f88359e1588b85cf0e8209ab7d6620085f3441d9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I949BN CVE: CVE-2021-46941 --------------------------- From: John Stultz <john.stultz(a)linaro.org> According to the programming guide, to switch mode for DRD controller, the driver needs to do the following. To switch from device to host: 1. Reset controller with GCTL.CoreSoftReset 2. Set GCTL.PrtCapDir(host mode) 3. Reset the host with USBCMD.HCRESET 4. Then follow up with the initializing host registers sequence To switch from host to device: 1. Reset controller with GCTL.CoreSoftReset 2. Set GCTL.PrtCapDir(device mode) 3. Reset the device with DCTL.CSftRst 4. Then follow up with the initializing registers sequence Currently we're missing step 1) to do GCTL.CoreSoftReset and step 3) of switching from host to device. John Stult reported a lockup issue seen with HiKey960 platform without these steps[1]. Similar issue is observed with Ferry's testing platform[2]. So, apply the required steps along with some fixes to Yu Chen's and John Stultz's version. The main fixes to their versions are the missing wait for clocks synchronization before clearing GCTL.CoreSoftReset and only apply DCTL.CSftRst when switching from host to device. [1] https://lore.kernel.org/linux-usb/20210108015115.27920-1-john.stultz@linaro… [2] https://lore.kernel.org/linux-usb/0ba7a6ba-e6a7-9cd4-0695-64fc927e01f1@gmai… Fixes: 41ce1456e1db ("usb: dwc3: core: make dwc3_set_mode() work properly") Cc: Andy Shevchenko <andy.shevchenko(a)gmail.com> Cc: Ferry Toth <fntoth(a)gmail.com> Cc: Wesley Cheng <wcheng(a)codeaurora.org> Cc: <stable(a)vger.kernel.org> Tested-by: John Stultz <john.stultz(a)linaro.org> Tested-by: Wesley Cheng <wcheng(a)codeaurora.org> Signed-off-by: Yu Chen <chenyu56(a)huawei.com> Signed-off-by: John Stultz <john.stultz(a)linaro.org> Signed-off-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Link: https://lore.kernel.org/r/374440f8dcd4f06c02c2caf4b1efde86774e02d9.16185216… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Conflicts: drivers/usb/dwc3/core.c --- drivers/usb/dwc3/core.c | 37 +++++++++++++++++++++++++++++++++---- drivers/usb/dwc3/core.h | 5 +++++ 2 files changed, 38 insertions(+), 4 deletions(-) diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c index f52fcbc5c971..3f605ca8a8c3 100644 --- a/drivers/usb/dwc3/core.c +++ b/drivers/usb/dwc3/core.c @@ -111,26 +111,31 @@ void dwc3_set_prtcap(struct dwc3 *dwc, u32 mode) dwc->current_dr_role = mode; } +static int dwc3_core_soft_reset(struct dwc3 *dwc); + static void __dwc3_set_mode(struct work_struct *work) { struct dwc3 *dwc = work_to_dwc(work); unsigned long flags; int ret; + u32 reg; + + mutex_lock(&dwc->mutex); if (dwc->dr_mode != USB_DR_MODE_OTG) - return; + goto out; if (dwc->current_dr_role == DWC3_GCTL_PRTCAP_OTG) dwc3_otg_update(dwc, 0); if (!dwc->desired_dr_role) - return; + goto out; if (dwc->desired_dr_role == dwc->current_dr_role) - return; + goto out; if (dwc->desired_dr_role == DWC3_GCTL_PRTCAP_OTG && dwc->edev) - return; + goto out; switch (dwc->current_dr_role) { case DWC3_GCTL_PRTCAP_HOST: @@ -151,6 +156,25 @@ static void __dwc3_set_mode(struct work_struct *work) break; } + /* For DRD host or device mode only */ + if (dwc->desired_dr_role != DWC3_GCTL_PRTCAP_OTG) { + reg = dwc3_readl(dwc->regs, DWC3_GCTL); + reg |= DWC3_GCTL_CORESOFTRESET; + dwc3_writel(dwc->regs, DWC3_GCTL, reg); + + /* + * Wait for internal clocks to synchronized. DWC_usb31 and + * DWC_usb32 may need at least 50ms (less for DWC_usb3). To + * keep it consistent across different IPs, let's wait up to + * 100ms before clearing GCTL.CORESOFTRESET. + */ + msleep(100); + + reg = dwc3_readl(dwc->regs, DWC3_GCTL); + reg &= ~DWC3_GCTL_CORESOFTRESET; + dwc3_writel(dwc->regs, DWC3_GCTL, reg); + } + spin_lock_irqsave(&dwc->lock, flags); dwc3_set_prtcap(dwc, dwc->desired_dr_role); @@ -171,6 +195,8 @@ static void __dwc3_set_mode(struct work_struct *work) } break; case DWC3_GCTL_PRTCAP_DEVICE: + dwc3_core_soft_reset(dwc); + dwc3_event_buffers_setup(dwc); if (dwc->usb2_phy) @@ -190,6 +216,8 @@ static void __dwc3_set_mode(struct work_struct *work) break; } +out: + mutex_unlock(&dwc->mutex); } void dwc3_set_mode(struct dwc3 *dwc, u32 mode) @@ -1453,6 +1481,7 @@ static int dwc3_probe(struct platform_device *pdev) dwc3_cache_hwparams(dwc); spin_lock_init(&dwc->lock); + mutex_init(&dwc->mutex); pm_runtime_set_active(dev); pm_runtime_use_autosuspend(dev); diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h index 131028501752..a5d3004ae388 100644 --- a/drivers/usb/dwc3/core.h +++ b/drivers/usb/dwc3/core.h @@ -13,6 +13,7 @@ #include <linux/device.h> #include <linux/spinlock.h> +#include <linux/mutex.h> #include <linux/ioport.h> #include <linux/list.h> #include <linux/bitops.h> @@ -896,6 +897,7 @@ struct dwc3_scratchpad_array { * @scratch_addr: dma address of scratchbuf * @ep0_in_setup: one control transfer is completed and enter setup phase * @lock: for synchronizing + * @mutex: for mode switching * @dev: pointer to our struct device * @sysdev: pointer to the DMA-capable device * @xhci: pointer to our xHCI child @@ -1017,6 +1019,9 @@ struct dwc3 { /* device lock */ spinlock_t lock; + /* mode switching lock */ + struct mutex mutex; + struct device *dev; struct device *sysdev; -- 2.34.1

2 1

[PATCH OLK-5.10] ext4: regenerate buddy after block freeing failed if under fc replay
by Baokun Li 02 Mar '24

02 Mar '24

mainline inclusion from mainline-v6.8-rc3 commit c9b528c35795b711331ed36dc3dbee90d5812d4e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93HD9 CVE: CVE-2024-26601 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This mostly reverts commit 6bd97bf273bd ("ext4: remove redundant mb_regenerate_buddy()") and reintroduces mb_regenerate_buddy(). Based on code in mb_free_blocks(), fast commit replay can end up marking as free blocks that are already marked as such. This causes corruption of the buddy bitmap so we need to regenerate it in that case. Reported-by: Jan Kara <jack(a)suse.cz> Fixes: 6bd97bf273bd ("ext4: remove redundant mb_regenerate_buddy()") Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20240104142040.2835097-4-libaokun1@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Conflicts: fs/ext4/mballoc.c Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/ext4/mballoc.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index bc25bdbcb01e..5d68204070e4 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -822,6 +822,24 @@ void ext4_mb_generate_buddy(struct super_block *sb, atomic64_add(period, &sbi->s_mb_generation_time); } +static void mb_regenerate_buddy(struct ext4_buddy *e4b) +{ + int count; + int order = 1; + void *buddy; + + while ((buddy = mb_find_buddy(e4b, order++, &count))) + ext4_set_bits(buddy, 0, count); + + e4b->bd_info->bb_fragments = 0; + memset(e4b->bd_info->bb_counters, 0, + sizeof(*e4b->bd_info->bb_counters) * + (e4b->bd_sb->s_blocksize_bits + 2)); + + ext4_mb_generate_buddy(e4b->bd_sb, e4b->bd_buddy, + e4b->bd_bitmap, e4b->bd_group, e4b->bd_info); +} + /* The buddy information is attached the buddy cache inode * for convenience. The information regarding each group * is loaded via ext4_mb_load_buddy. The information involve @@ -1504,6 +1522,8 @@ static void mb_free_blocks(struct inode *inode, struct ext4_buddy *e4b, ext4_mark_group_bitmap_corrupted( sb, e4b->bd_group, EXT4_GROUP_INFO_BBITMAP_CORRUPT); + } else { + mb_regenerate_buddy(e4b); } goto done; } -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] apparmor: avoid crash when parsed profile name is empty
by Xiang Yang 02 Mar '24

02 Mar '24

From: Fedor Pchelkin <pchelkin(a)ispras.ru> stable inclusion from stable-v4.19.306 commit 9286ee97aa4803d99185768735011d0d65827c9e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932W7 CVE: CVE-2023-52443 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ----------------------------------------------------- [ Upstream commit 55a8210c9e7d21ff2644809699765796d4bfb200 ] When processing a packed profile in unpack_profile() described like "profile :ns::samba-dcerpcd /usr/lib*/samba/{,samba/}samba-dcerpcd {...}" a string ":samba-dcerpcd" is unpacked as a fully-qualified name and then passed to aa_splitn_fqname(). aa_splitn_fqname() treats ":samba-dcerpcd" as only containing a namespace. Thus it returns NULL for tmpname, meanwhile tmpns is non-NULL. Later aa_alloc_profile() crashes as the new profile name is NULL now. general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 6 PID: 1657 Comm: apparmor_parser Not tainted 6.7.0-rc2-dirty #16 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 RIP: 0010:strlen+0x1e/0xa0 Call Trace: <TASK> ? strlen+0x1e/0xa0 aa_policy_init+0x1bb/0x230 aa_alloc_profile+0xb1/0x480 unpack_profile+0x3bc/0x4960 aa_unpack+0x309/0x15e0 aa_replace_profiles+0x213/0x33c0 policy_update+0x261/0x370 profile_replace+0x20e/0x2a0 vfs_write+0x2af/0xe00 ksys_write+0x126/0x250 do_syscall_64+0x46/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 </TASK> ---[ end trace 0000000000000000 ]--- RIP: 0010:strlen+0x1e/0xa0 It seems such behaviour of aa_splitn_fqname() is expected and checked in other places where it is called (e.g. aa_remove_profiles). Well, there is an explicit comment "a ns name without a following profile is allowed" inside. AFAICS, nothing can prevent unpacked "name" to be in form like ":samba-dcerpcd" - it is passed from userspace. Deny the whole profile set replacement in such case and inform user with EPROTO and an explaining message. Found by Linux Verification Center (linuxtesting.org) Fixes: 04dc715e24d0 ("apparmor: audit policy ns specified in policy load") Signed-off-by: Fedor Pchelkin <pchelkin(a)ispras.ru> Signed-off-by: John Johansen <john.johansen(a)canonical.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- security/apparmor/policy_unpack.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c index 612f737cee83..36bf9534acf0 100644 --- a/security/apparmor/policy_unpack.c +++ b/security/apparmor/policy_unpack.c @@ -635,6 +635,10 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name) tmpname = aa_splitn_fqname(name, strlen(name), &tmpns, &ns_len); if (tmpns) { + if (!tmpname) { + info = "empty profile name"; + goto fail; + } *ns_name = kstrndup(tmpns, ns_len, GFP_KERNEL); if (!*ns_name) { info = "out of memory"; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] hfsplus: prevent corruption in shrinking truncate
by Baokun Li 02 Mar '24

02 Mar '24

From: Jouni Roivas <jouni.roivas(a)tuxera.com> stable inclusion from stable-v4.19.191 commit 52dde855663e5db824af51db39b5757d2ef3e28a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94JCO CVE: CVE-2021-46989 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c3187cf32216313fb316084efac4dab3a8459b1d upstream. I believe there are some issues introduced by commit 31651c607151 ("hfsplus: avoid deadlock on file truncation") HFS+ has extent records which always contains 8 extents. In case the first extent record in catalog file gets full, new ones are allocated from extents overflow file. In case shrinking truncate happens to middle of an extent record which locates in extents overflow file, the logic in hfsplus_file_truncate() was changed so that call to hfs_brec_remove() is not guarded any more. Right action would be just freeing the extents that exceed the new size inside extent record by calling hfsplus_free_extents(), and then check if the whole extent record should be removed. However since the guard (blk_cnt > start) is now after the call to hfs_brec_remove(), this has unfortunate effect that the last matching extent record is removed unconditionally. To reproduce this issue, create a file which has at least 10 extents, and then perform shrinking truncate into middle of the last extent record, so that the number of remaining extents is not under or divisible by 8. This causes the last extent record (8 extents) to be removed totally instead of truncating into middle of it. Thus this causes corruption, and lost data. Fix for this is simply checking if the new truncated end is below the start of this extent record, making it safe to remove the full extent record. However call to hfs_brec_remove() can't be moved to it's previous place since we're dropping ->tree_lock and it can cause a race condition and the cached info being invalidated possibly corrupting the node data. Another issue is related to this one. When entering into the block (blk_cnt > start) we are not holding the ->tree_lock. We break out from the loop not holding the lock, but hfs_find_exit() does unlock it. Not sure if it's possible for someone else to take the lock under our feet, but it can cause hard to debug errors and premature unlocking. Even if there's no real risk of it, the locking should still always be kept in balance. Thus taking the lock now just before the check. Link: https://lkml.kernel.org/r/20210429165139.3082828-1-jouni.roivas@tuxera.com Fixes: 31651c607151f ("hfsplus: avoid deadlock on file truncation") Signed-off-by: Jouni Roivas <jouni.roivas(a)tuxera.com> Reviewed-by: Anton Altaparmakov <anton(a)tuxera.com> Cc: Anatoly Trosinenko <anatoly.trosinenko(a)gmail.com> Cc: Viacheslav Dubeyko <slava(a)dubeyko.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/hfsplus/extents.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c index a930ddd15681..7054a542689f 100644 --- a/fs/hfsplus/extents.c +++ b/fs/hfsplus/extents.c @@ -598,13 +598,15 @@ void hfsplus_file_truncate(struct inode *inode) res = __hfsplus_ext_cache_extent(&fd, inode, alloc_cnt); if (res) break; - hfs_brec_remove(&fd); - mutex_unlock(&fd.tree->tree_lock); start = hip->cached_start; + if (blk_cnt <= start) + hfs_brec_remove(&fd); + mutex_unlock(&fd.tree->tree_lock); hfsplus_free_extents(sb, hip->cached_extents, alloc_cnt - start, alloc_cnt - blk_cnt); hfsplus_dump_extent(hip->cached_extents); + mutex_lock(&fd.tree->tree_lock); if (blk_cnt > start) { hip->extent_state |= HFSPLUS_EXT_DIRTY; break; @@ -612,7 +614,6 @@ void hfsplus_file_truncate(struct inode *inode) alloc_cnt = start; hip->cached_start = hip->cached_blocks = 0; hip->extent_state &= ~(HFSPLUS_EXT_DIRTY | HFSPLUS_EXT_NEW); - mutex_lock(&fd.tree->tree_lock); } hfs_find_exit(&fd); -- 2.31.1

2 1

[openeuler:OLK-6.6 3630/3767] include/linux/ras.h:45:1: error: return type defaults to 'int'
by kernel test robot 02 Mar '24

02 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 236cb940335e3542c9d5ac16b5d8546a0cbbdfc1 commit: fa75636857993e25030c3db31444d2aa01d5d9de [3630/3767] RAS: Report ARM processor information to userspace config: x86_64-defconfig (https://download.01.org/0day-ci/archive/20240302/202403021440.BIb46Slr-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240302/202403021440.BIb46Slr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403021440.BIb46Slr-lkp@intel.com/ Note: the openeuler/OLK-6.6 HEAD 236cb940335e3542c9d5ac16b5d8546a0cbbdfc1 builds fine. It only hurts bisectability. All errors (new ones prefixed by >>): In file included from arch/x86/kernel/cpu/mce/core.c:36: >> include/linux/ras.h:45:1: error: return type defaults to 'int' [-Werror=implicit-int] 45 | log_arm_hw_error(struct cper_sec_proc_arm *err) { return; } | ^~~~~~~~~~~~~~~~ include/linux/ras.h:45:1: warning: no previous prototype for 'log_arm_hw_error' [-Wmissing-prototypes] include/linux/ras.h: In function 'log_arm_hw_error': include/linux/ras.h:45:51: warning: 'return' with no value, in function returning non-void [-Wreturn-type] 45 | log_arm_hw_error(struct cper_sec_proc_arm *err) { return; } | ^~~~~~ include/linux/ras.h:45:1: note: declared here 45 | log_arm_hw_error(struct cper_sec_proc_arm *err) { return; } | ^~~~~~~~~~~~~~~~ cc1: some warnings being treated as errors vim +/int +45 include/linux/ras.h fa75636857993e Shengwei Luo 2022-02-23 40 fa75636857993e Shengwei Luo 2022-02-23 41 #ifdef CONFIG_RAS_ARM_EVENT_INFO 0607512d0a8d7f Arnd Bergmann 2017-06-27 42 static inline void fa75636857993e Shengwei Luo 2022-02-23 43 log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev) { return; } fa75636857993e Shengwei Luo 2022-02-23 44 #else 0607512d0a8d7f Arnd Bergmann 2017-06-27 @45 log_arm_hw_error(struct cper_sec_proc_arm *err) { return; } 297b64c74385fc Tyler Baicar 2017-06-21 46 #endif 297b64c74385fc Tyler Baicar 2017-06-21 47 :::::: The code at line 45 was first introduced by commit :::::: 0607512d0a8d7fac86667466b884095e04b10a59 ras: mark stub functions as 'inline' :::::: TO: Arnd Bergmann <arnd(a)arndb.de> :::::: CC: Will Deacon <will.deacon(a)arm.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3630/3767] include/linux/ras.h:45:1: error: type specifier missing, defaults to 'int'; ISO C99 and later do not support implicit int
by kernel test robot 02 Mar '24

02 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 236cb940335e3542c9d5ac16b5d8546a0cbbdfc1 commit: fa75636857993e25030c3db31444d2aa01d5d9de [3630/3767] RAS: Report ARM processor information to userspace config: x86_64-randconfig-003-20240301 (https://download.01.org/0day-ci/archive/20240302/202403021409.FLAeOOj5-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240302/202403021409.FLAeOOj5-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403021409.FLAeOOj5-lkp@intel.com/ All error/warnings (new ones prefixed by >>): In file included from arch/x86/kernel/cpu/mce/core.c:36: >> include/linux/ras.h:45:1: error: type specifier missing, defaults to 'int'; ISO C99 and later do not support implicit int [-Wimplicit-int] 45 | log_arm_hw_error(struct cper_sec_proc_arm *err) { return; } | ^ | int >> include/linux/ras.h:45:51: warning: non-void function 'log_arm_hw_error' should return a value [-Wreturn-type] 45 | log_arm_hw_error(struct cper_sec_proc_arm *err) { return; } | ^ >> include/linux/ras.h:45:1: warning: no previous prototype for function 'log_arm_hw_error' [-Wmissing-prototypes] 45 | log_arm_hw_error(struct cper_sec_proc_arm *err) { return; } | ^ include/linux/ras.h:45:17: note: declare 'static' if the function is not intended to be used outside of this translation unit 45 | log_arm_hw_error(struct cper_sec_proc_arm *err) { return; } | ^ | static 2 warnings and 1 error generated. vim +/int +45 include/linux/ras.h fa75636857993e Shengwei Luo 2022-02-23 40 fa75636857993e Shengwei Luo 2022-02-23 41 #ifdef CONFIG_RAS_ARM_EVENT_INFO 0607512d0a8d7f Arnd Bergmann 2017-06-27 42 static inline void fa75636857993e Shengwei Luo 2022-02-23 43 log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev) { return; } fa75636857993e Shengwei Luo 2022-02-23 44 #else 0607512d0a8d7f Arnd Bergmann 2017-06-27 @45 log_arm_hw_error(struct cper_sec_proc_arm *err) { return; } 297b64c74385fc Tyler Baicar 2017-06-21 46 #endif 297b64c74385fc Tyler Baicar 2017-06-21 47 :::::: The code at line 45 was first introduced by commit :::::: 0607512d0a8d7fac86667466b884095e04b10a59 ras: mark stub functions as 'inline' :::::: TO: Arnd Bergmann <arnd(a)arndb.de> :::::: CC: Will Deacon <will.deacon(a)arm.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2431/3767] drivers/net/dsa/sja1105/sja1105_main.o: warning: objtool: sja1105_fast_age() falls through to next function sja1105et_fdb_add.cold()
by kernel test robot 02 Mar '24

02 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 236cb940335e3542c9d5ac16b5d8546a0cbbdfc1 commit: f04c0f3eb9b49427c273cd3e4d5a2ff895855b4b [2431/3767] make OPTIMIZE_INLINING config editable config: x86_64-randconfig-073-20240301 (https://download.01.org/0day-ci/archive/20240302/202403021321.7y53Xl0J-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240302/202403021321.7y53Xl0J-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403021321.7y53Xl0J-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/dsa/sja1105/sja1105_main.o: warning: objtool: sja1105_fast_age() falls through to next function sja1105et_fdb_add.cold() -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 21121/21674] drivers/net/ethernet/3snic/sssnic/hw/sss_pci_sriov.c:40:13: warning: 'sss_deinit_vf_hw' defined but not used
by kernel test robot 02 Mar '24

02 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: c4c847f506337d954e047d8180cebae7d09d60e8 commit: a6a7981cbf66d4951425d33cdce6ef39206eba83 [21121/21674] Net: ethernet: Support 3snic 3s9xx network card config: arm64-randconfig-002-20240302 (https://download.01.org/0day-ci/archive/20240302/202403021253.DevBZWcC-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240302/202403021253.DevBZWcC-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403021253.DevBZWcC-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ethernet/3snic/sssnic/hw/sss_pci_sriov.c:40:13: warning: 'sss_deinit_vf_hw' defined but not used [-Wunused-function] 40 | static void sss_deinit_vf_hw(void *hwdev, u16 vf_num) | ^~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/hw/sss_pci_sriov.c:18:12: warning: 'sss_init_vf_hw' defined but not used [-Wunused-function] 18 | static int sss_init_vf_hw(void *hwdev, u16 vf_num) | ^~~~~~~~~~~~~~ vim +/sss_deinit_vf_hw +40 drivers/net/ethernet/3snic/sssnic/hw/sss_pci_sriov.c 17 > 18 static int sss_init_vf_hw(void *hwdev, u16 vf_num) 19 { 20 int ret; 21 u16 i; 22 u16 id; 23 24 /* mbx msg channel resources will be freed during remove process */ 25 ret = sss_init_func_mbx_msg(hwdev, sss_get_max_vf_num(hwdev)); 26 if (ret != 0) 27 return ret; 28 29 /* vf use 256K as default wq page size, and can't change it */ 30 for (i = 1; i <= vf_num; i++) { 31 id = sss_get_glb_pf_vf_offset(hwdev) + i; 32 ret = sss_chip_set_wq_page_size(hwdev, id, SSS_DEFAULT_WQ_PAGE_SIZE); 33 if (ret != 0) 34 return ret; 35 } 36 37 return 0; 38 } 39 > 40 static void sss_deinit_vf_hw(void *hwdev, u16 vf_num) 41 { 42 u16 i; 43 u16 id; 44 45 for (i = 1; i <= vf_num; i++) { 46 id = sss_get_glb_pf_vf_offset(hwdev) + i; 47 sss_chip_set_wq_page_size(hwdev, id, SSS_HW_WQ_PAGE_SIZE); 48 } 49 } 50 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 00/12] LoongArch: fix some known bug and update defconfig
by Hongchen Zhang 02 Mar '24

02 Mar '24

Chong Qiao (1): irqchip/loongson-pch-pic: 7a1000 int_clear reg must use 64bit write. Hongchen Zhang (2): usb: xhci: add XHCI_NO_SOFT_RETRY quirk for EJ188 net: stmmac: fix potential double free of dma descriptor resources Huacai Chen (1): drm/radeon: Workaround radeon driver bug for Loongson Jianmin Lv (1): LoongArch: Remove generic irq migration Tianli Xiong (1): irqchip/loongson-liointc: Set different isr for differnt core Yingkun Meng (1): LoongArch: defconfig: Enable a large number of configurations Youling Tang (4): LoongArch: kdump: Add memory reservation for old kernel LoongArch: kexec: Add compatibility with old interfaces LoongArch: Fix kdump failure on v40 interface specification LoongArch: kdump: Add high memory reservation zhangtianyang (1): LoongArch: Adapted SECTION_SIZE_BITS with page size arch/loongarch/Kconfig | 1 - arch/loongarch/configs/loongson3_defconfig | 1569 +++++++++++++++-- arch/loongarch/include/asm/irq.h | 1 + arch/loongarch/include/asm/sparsemem.h | 2 +- arch/loongarch/kernel/irq.c | 36 + arch/loongarch/kernel/machine_kexec.c | 45 +- arch/loongarch/kernel/setup.c | 94 +- arch/loongarch/kernel/smp.c | 3 +- drivers/gpu/drm/radeon/cik.c | 3 + drivers/gpu/drm/radeon/evergreen.c | 3 + drivers/gpu/drm/radeon/r600.c | 3 + drivers/gpu/drm/radeon/si.c | 3 + drivers/irqchip/irq-loongson-liointc.c | 4 +- drivers/irqchip/irq-loongson-pch-pic.c | 16 +- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 11 + drivers/usb/host/xhci-pci.c | 6 + kernel/irq/Kconfig | 4 +- 17 files changed, 1626 insertions(+), 178 deletions(-) -- 2.33.0

2 13

[PATCH OLK-5.10] x86/srso: Add SRSO mitigation for Hygon processors
by Wei Li 02 Mar '24

02 Mar '24

From: Pu Wen <puwen(a)hygon.cn> mainline inclusion from mainline-v6.6-rc4 commit a5ef7d68cea1344cf524f04981c2b3f80bedbb0d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94P0E CVE: CVE-2023-52482 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?i… -------------------------------- Add mitigation for the speculative return stack overflow vulnerability which exists on Hygon processors too. Signed-off-by: Pu Wen <puwen(a)hygon.cn> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Acked-by: Borislav Petkov (AMD) <bp(a)alien8.de> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/tencent_4A14812842F104E93AA722EC939483CEFF05@qq.c… Signed-off-by: Wei Li <liwei391(a)huawei.com> --- arch/x86/kernel/cpu/common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index 48bd58e3f5183..c69bc3917e307 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -1181,7 +1181,7 @@ static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = { VULNBL_AMD(0x15, RETBLEED), VULNBL_AMD(0x16, RETBLEED), VULNBL_AMD(0x17, RETBLEED | SMT_RSB | SRSO), - VULNBL_HYGON(0x18, RETBLEED | SMT_RSB), + VULNBL_HYGON(0x18, RETBLEED | SMT_RSB | SRSO), VULNBL_AMD(0x19, SRSO), {} }; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] bus: qcom: Put child node before return
by Zhang Xiaoxu 02 Mar '24

02 Mar '24

From: Pan Bian <bianpan2016(a)163.com> mainline inclusion from mainline-v5.13-rc1 commit ac6ad7c2a862d682bb584a4bc904d89fa7721af8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94VOR CVE: CVE-2021-47054 --------------------------- Put child node before return to fix potential reference count leak. Generally, the reference count of child is incremented and decremented automatically in the macro for_each_available_child_of_node() and should be decremented manually if the loop is broken in loop body. Reviewed-by: Linus Walleij <linus.walleij(a)linaro.org> Fixes: 335a12754808 ("bus: qcom: add EBI2 driver") Signed-off-by: Pan Bian <bianpan2016(a)163.com> Link: https://lore.kernel.org/r/20210121114907.109267-1-bianpan2016@163.com Signed-off-by: Bjorn Andersson <bjorn.andersson(a)linaro.org> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> --- drivers/bus/qcom-ebi2.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/bus/qcom-ebi2.c b/drivers/bus/qcom-ebi2.c index a6444244c411..bfb67aa00bec 100644 --- a/drivers/bus/qcom-ebi2.c +++ b/drivers/bus/qcom-ebi2.c @@ -357,8 +357,10 @@ static int qcom_ebi2_probe(struct platform_device *pdev) /* Figure out the chipselect */ ret = of_property_read_u32(child, "reg", &csindex); - if (ret) + if (ret) { + of_node_put(child); return ret; + } if (csindex > 5) { dev_err(dev, -- 2.34.1

2 1

[PATCH] bus: qcom: Put child node before return
by Zhang Xiaoxu 02 Mar '24

02 Mar '24

From: Pan Bian <bianpan2016(a)163.com> mainline inclusion from mainline-v5.13-rc1 commit ac6ad7c2a862d682bb584a4bc904d89fa7721af8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94VOR CVE: CVE-2021-47054 --------------------------- Put child node before return to fix potential reference count leak. Generally, the reference count of child is incremented and decremented automatically in the macro for_each_available_child_of_node() and should be decremented manually if the loop is broken in loop body. Reviewed-by: Linus Walleij <linus.walleij(a)linaro.org> Fixes: 335a12754808 ("bus: qcom: add EBI2 driver") Signed-off-by: Pan Bian <bianpan2016(a)163.com> Link: https://lore.kernel.org/r/20210121114907.109267-1-bianpan2016@163.com Signed-off-by: Bjorn Andersson <bjorn.andersson(a)linaro.org> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> --- drivers/bus/qcom-ebi2.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/bus/qcom-ebi2.c b/drivers/bus/qcom-ebi2.c index a6444244c411..bfb67aa00bec 100644 --- a/drivers/bus/qcom-ebi2.c +++ b/drivers/bus/qcom-ebi2.c @@ -357,8 +357,10 @@ static int qcom_ebi2_probe(struct platform_device *pdev) /* Figure out the chipselect */ ret = of_property_read_u32(child, "reg", &csindex); - if (ret) + if (ret) { + of_node_put(child); return ret; + } if (csindex > 5) { dev_err(dev, -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS 0/3] i2c: sprd: fix reference leak when pm_runtime_get_sync fails
by Liao Chen 02 Mar '24

02 Mar '24

This patch set fixes CVE-2020-36780, with i2c: sprd: fix reference leak when pm_runtime_get_sync fails as fix patch and the other two patches as its precedent. Qinglang Miao (1): i2c: sprd: fix reference leak when pm_runtime_get_sync fails Wolfram Sang (2): i2c: sprd: don't use pdev as variable name for struct device * i2c: sprd: use core helper to mark adapter suspended drivers/i2c/busses/i2c-sprd.c | 38 +++++++++++++---------------------- 1 file changed, 14 insertions(+), 24 deletions(-) -- 2.34.1

2 4