- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] selinux: ignore unknown extended permissions
by Gu Bowen 03 Jan '25

03 Jan '25

From: Thiébaud Weksteen <tweek(a)google.com> mainline inclusion from mainline-v6.13-rc4 commit 900f83cf376bdaf798b6f5dcb2eae0c822e908b6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEUBD Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When evaluating extended permissions, ignore unknown permissions instead of calling BUG(). This commit ensures that future permissions can be added without interfering with older kernels. Cc: stable(a)vger.kernel.org Fixes: fa1aa143ac4a ("selinux: extended permissions for ioctls") Signed-off-by: Thiébaud Weksteen <tweek(a)google.com> Signed-off-by: Paul Moore <paul(a)paul-moore.com> Conflicts: security/selinux/ss/services.c [Due to commit d1d991efaf346 ("selinux: Add netlink xperm support") add a new policy and refactored the function, there are context conflicts happened.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- security/selinux/ss/services.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index a1ea7d90ce4f..83b499980041 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -965,7 +965,10 @@ void services_compute_xperms_decision(struct extended_perms_decision *xpermd, xpermd->driver)) return; } else { - BUG(); + pr_warn_once( + "SELinux: unknown extended permission (%u) will be ignored\n", + node->datum.u.xperms->specified); + return; } if (node->key.specified == AVTAB_XPERMS_ALLOWED) { @@ -1002,7 +1005,8 @@ void services_compute_xperms_decision(struct extended_perms_decision *xpermd, node->datum.u.xperms->perms.p[i]; } } else { - BUG(); + pr_warn_once("SELinux: unknown specified key (%u)\n", + node->key.specified); } } -- 2.25.1

2 1

[PATCH OLK-6.6] net: usb: lan78xx: Fix double free issue with interrupt buffer allocation
by Zicheng Qu 03 Jan '25

03 Jan '25

From: Oleksij Rempel <o.rempel(a)pengutronix.de> stable inclusion from stable-v6.6.64 commit a422ebec863d99d5607fb41bb7af3347fcb436d3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAEY CVE: CVE-2024-53213 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 03819abbeb11117dcbba40bfe322b88c0c88a6b6 ] In lan78xx_probe(), the buffer `buf` was being freed twice: once implicitly through `usb_free_urb(dev->urb_intr)` with the `URB_FREE_BUFFER` flag and again explicitly by `kfree(buf)`. This caused a double free issue. To resolve this, reordered `kmalloc()` and `usb_alloc_urb()` calls to simplify the initialization sequence and removed the redundant `kfree(buf)`. Now, `buf` is allocated after `usb_alloc_urb()`, ensuring it is correctly managed by `usb_fill_int_urb()` and freed by `usb_free_urb()` as intended. Fixes: a6df95cae40b ("lan78xx: Fix memory allocation bug") Cc: John Efstathiades <john.efstathiades(a)pebblebay.com> Signed-off-by: Oleksij Rempel <o.rempel(a)pengutronix.de> Link: https://patch.msgid.link/20241116130558.1352230-1-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- drivers/net/usb/lan78xx.c | 29 ++++++++++++++--------------- 1 file changed, 14 insertions(+), 15 deletions(-) diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c index 921ae046f860..2ae33ecb6749 100644 --- a/drivers/net/usb/lan78xx.c +++ b/drivers/net/usb/lan78xx.c @@ -4414,29 +4414,30 @@ static int lan78xx_probe(struct usb_interface *intf, period = ep_intr->desc.bInterval; maxp = usb_maxpacket(dev->udev, dev->pipe_intr); - buf = kmalloc(maxp, GFP_KERNEL); - if (!buf) { + + dev->urb_intr = usb_alloc_urb(0, GFP_KERNEL); + if (!dev->urb_intr) { ret = -ENOMEM; goto out5; } - dev->urb_intr = usb_alloc_urb(0, GFP_KERNEL); - if (!dev->urb_intr) { + buf = kmalloc(maxp, GFP_KERNEL); + if (!buf) { ret = -ENOMEM; - goto out6; - } else { - usb_fill_int_urb(dev->urb_intr, dev->udev, - dev->pipe_intr, buf, maxp, - intr_complete, dev, period); - dev->urb_intr->transfer_flags |= URB_FREE_BUFFER; + goto free_urbs; } + usb_fill_int_urb(dev->urb_intr, dev->udev, + dev->pipe_intr, buf, maxp, + intr_complete, dev, period); + dev->urb_intr->transfer_flags |= URB_FREE_BUFFER; + dev->maxpacket = usb_maxpacket(dev->udev, dev->pipe_out); /* Reject broken descriptors. */ if (dev->maxpacket == 0) { ret = -ENODEV; - goto out6; + goto free_urbs; } /* driver requires remote-wakeup capability during autosuspend. */ @@ -4444,7 +4445,7 @@ static int lan78xx_probe(struct usb_interface *intf, ret = lan78xx_phy_init(dev); if (ret < 0) - goto out7; + goto free_urbs; ret = register_netdev(netdev); if (ret != 0) { @@ -4466,10 +4467,8 @@ static int lan78xx_probe(struct usb_interface *intf, out8: phy_disconnect(netdev->phydev); -out7: +free_urbs: usb_free_urb(dev->urb_intr); -out6: - kfree(buf); out5: lan78xx_unbind(dev, intf); out4: -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] media: wl128x: Fix atomicity violation in fmc_send_cmd()
by dinglongwei 03 Jan '25

03 Jan '25

From: Qiu-ji Chen <chenqiuji666(a)gmail.com> stable inclusion from stable-v4.19.325 commit d16109c9fdc1b8cea4fe63b42e06e926c3f68990 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDOW CVE: CVE-2024-56700 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit ca59f9956d4519ab18ab2270be47c6b8c6ced091 upstream. Atomicity violation occurs when the fmc_send_cmd() function is executed simultaneously with the modification of the fmdev->resp_skb value. Consider a scenario where, after passing the validity check within the function, a non-null fmdev->resp_skb variable is assigned a null value. This results in an invalid fmdev->resp_skb variable passing the validity check. As seen in the later part of the function, skb = fmdev->resp_skb; when the invalid fmdev->resp_skb passes the check, a null pointer dereference error may occur at line 478, evt_hdr = (void *)skb->data; To address this issue, it is recommended to include the validity check of fmdev->resp_skb within the locked section of the function. This modification ensures that the value of fmdev->resp_skb does not change during the validation process, thereby maintaining its validity. This possible bug is found by an experimental static analysis tool developed by our team. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations. Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common sources") Cc: stable(a)vger.kernel.org Signed-off-by: Qiu-ji Chen <chenqiuji666(a)gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- drivers/media/radio/wl128x/fmdrv_common.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c index 1cf4019689a5..8b8453dab660 100644 --- a/drivers/media/radio/wl128x/fmdrv_common.c +++ b/drivers/media/radio/wl128x/fmdrv_common.c @@ -472,11 +472,12 @@ int fmc_send_cmd(struct fmdev *fmdev, u8 fm_op, u16 type, void *payload, jiffies_to_msecs(FM_DRV_TX_TIMEOUT) / 1000); return -ETIMEDOUT; } + spin_lock_irqsave(&fmdev->resp_skb_lock, flags); if (!fmdev->resp_skb) { + spin_unlock_irqrestore(&fmdev->resp_skb_lock, flags); fmerr("Response SKB is missing\n"); return -EFAULT; } - spin_lock_irqsave(&fmdev->resp_skb_lock, flags); skb = fmdev->resp_skb; fmdev->resp_skb = NULL; spin_unlock_irqrestore(&fmdev->resp_skb_lock, flags); -- 2.22.0

2 2

[PATCH openEuler-22.03-LTS-SP1] media: wl128x: Fix atomicity violation in fmc_send_cmd()
by dinglongwei 03 Jan '25

03 Jan '25

From: Qiu-ji Chen <chenqiuji666(a)gmail.com> stable inclusion from stable-v5.10.231 commit d7408a052aa1b4f6fb6f1c7a8877b84017a07ac9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDOW CVE: CVE-2024-56700 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit ca59f9956d4519ab18ab2270be47c6b8c6ced091 upstream. Atomicity violation occurs when the fmc_send_cmd() function is executed simultaneously with the modification of the fmdev->resp_skb value. Consider a scenario where, after passing the validity check within the function, a non-null fmdev->resp_skb variable is assigned a null value. This results in an invalid fmdev->resp_skb variable passing the validity check. As seen in the later part of the function, skb = fmdev->resp_skb; when the invalid fmdev->resp_skb passes the check, a null pointer dereference error may occur at line 478, evt_hdr = (void *)skb->data; To address this issue, it is recommended to include the validity check of fmdev->resp_skb within the locked section of the function. This modification ensures that the value of fmdev->resp_skb does not change during the validation process, thereby maintaining its validity. This possible bug is found by an experimental static analysis tool developed by our team. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations. Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common sources") Cc: stable(a)vger.kernel.org Signed-off-by: Qiu-ji Chen <chenqiuji666(a)gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- drivers/media/radio/wl128x/fmdrv_common.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c index 6142484d5cb4..d9287a935a9e 100644 --- a/drivers/media/radio/wl128x/fmdrv_common.c +++ b/drivers/media/radio/wl128x/fmdrv_common.c @@ -465,11 +465,12 @@ int fmc_send_cmd(struct fmdev *fmdev, u8 fm_op, u16 type, void *payload, jiffies_to_msecs(FM_DRV_TX_TIMEOUT) / 1000); return -ETIMEDOUT; } + spin_lock_irqsave(&fmdev->resp_skb_lock, flags); if (!fmdev->resp_skb) { + spin_unlock_irqrestore(&fmdev->resp_skb_lock, flags); fmerr("Response SKB is missing\n"); return -EFAULT; } - spin_lock_irqsave(&fmdev->resp_skb_lock, flags); skb = fmdev->resp_skb; fmdev->resp_skb = NULL; spin_unlock_irqrestore(&fmdev->resp_skb_lock, flags); -- 2.22.0

2 2

[PATCH OLK-5.10] media: wl128x: Fix atomicity violation in fmc_send_cmd()
by dinglongwei 03 Jan '25

03 Jan '25

From: Qiu-ji Chen <chenqiuji666(a)gmail.com> stable inclusion from stable-v5.10.231 commit d7408a052aa1b4f6fb6f1c7a8877b84017a07ac9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDOW CVE: CVE-2024-56700 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit ca59f9956d4519ab18ab2270be47c6b8c6ced091 upstream. Atomicity violation occurs when the fmc_send_cmd() function is executed simultaneously with the modification of the fmdev->resp_skb value. Consider a scenario where, after passing the validity check within the function, a non-null fmdev->resp_skb variable is assigned a null value. This results in an invalid fmdev->resp_skb variable passing the validity check. As seen in the later part of the function, skb = fmdev->resp_skb; when the invalid fmdev->resp_skb passes the check, a null pointer dereference error may occur at line 478, evt_hdr = (void *)skb->data; To address this issue, it is recommended to include the validity check of fmdev->resp_skb within the locked section of the function. This modification ensures that the value of fmdev->resp_skb does not change during the validation process, thereby maintaining its validity. This possible bug is found by an experimental static analysis tool developed by our team. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations. Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common sources") Cc: stable(a)vger.kernel.org Signed-off-by: Qiu-ji Chen <chenqiuji666(a)gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- drivers/media/radio/wl128x/fmdrv_common.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c index 6142484d5cb4..d9287a935a9e 100644 --- a/drivers/media/radio/wl128x/fmdrv_common.c +++ b/drivers/media/radio/wl128x/fmdrv_common.c @@ -465,11 +465,12 @@ int fmc_send_cmd(struct fmdev *fmdev, u8 fm_op, u16 type, void *payload, jiffies_to_msecs(FM_DRV_TX_TIMEOUT) / 1000); return -ETIMEDOUT; } + spin_lock_irqsave(&fmdev->resp_skb_lock, flags); if (!fmdev->resp_skb) { + spin_unlock_irqrestore(&fmdev->resp_skb_lock, flags); fmerr("Response SKB is missing\n"); return -EFAULT; } - spin_lock_irqsave(&fmdev->resp_skb_lock, flags); skb = fmdev->resp_skb; fmdev->resp_skb = NULL; spin_unlock_irqrestore(&fmdev->resp_skb_lock, flags); -- 2.22.0

2 2

[PATCH OLK-6.6] media: wl128x: Fix atomicity violation in fmc_send_cmd()
by dinglongwei 03 Jan '25

03 Jan '25

From: Qiu-ji Chen <chenqiuji666(a)gmail.com> stable inclusion from stable-v6.6.64 commit 378ce4e08ca2b1ac7bbf1d57b68643ca4226c5f8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDOW CVE: CVE-2024-56700 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit ca59f9956d4519ab18ab2270be47c6b8c6ced091 upstream. Atomicity violation occurs when the fmc_send_cmd() function is executed simultaneously with the modification of the fmdev->resp_skb value. Consider a scenario where, after passing the validity check within the function, a non-null fmdev->resp_skb variable is assigned a null value. This results in an invalid fmdev->resp_skb variable passing the validity check. As seen in the later part of the function, skb = fmdev->resp_skb; when the invalid fmdev->resp_skb passes the check, a null pointer dereference error may occur at line 478, evt_hdr = (void *)skb->data; To address this issue, it is recommended to include the validity check of fmdev->resp_skb within the locked section of the function. This modification ensures that the value of fmdev->resp_skb does not change during the validation process, thereby maintaining its validity. This possible bug is found by an experimental static analysis tool developed by our team. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations. Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common sources") Cc: stable(a)vger.kernel.org Signed-off-by: Qiu-ji Chen <chenqiuji666(a)gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- drivers/media/radio/wl128x/fmdrv_common.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c index 3da8e5102bec..1225dab9fc7d 100644 --- a/drivers/media/radio/wl128x/fmdrv_common.c +++ b/drivers/media/radio/wl128x/fmdrv_common.c @@ -466,11 +466,12 @@ int fmc_send_cmd(struct fmdev *fmdev, u8 fm_op, u16 type, void *payload, jiffies_to_msecs(FM_DRV_TX_TIMEOUT) / 1000); return -ETIMEDOUT; } + spin_lock_irqsave(&fmdev->resp_skb_lock, flags); if (!fmdev->resp_skb) { + spin_unlock_irqrestore(&fmdev->resp_skb_lock, flags); fmerr("Response SKB is missing\n"); return -EFAULT; } - spin_lock_irqsave(&fmdev->resp_skb_lock, flags); skb = fmdev->resp_skb; fmdev->resp_skb = NULL; spin_unlock_irqrestore(&fmdev->resp_skb_lock, flags); -- 2.22.0

2 3

[openeuler:OLK-6.6 1673/1673] arch/x86/kvm/svm/csv.c:30:5: sparse: sparse: symbol 'csv_vm_attestation' was not declared. Should it be static?
by kernel test robot 03 Jan '25

03 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c2f1662c3fb301fe7ba127fe06c14538112982d4 commit: 0f13b8634792cff1f2fb18bf35e5a24d7a8cbf8e [1673/1673] KVM: x86: Support VM_ATTESTATION hypercall config: x86_64-randconfig-121-20241230 (https://download.01.org/0day-ci/archive/20250103/202501031119.BkQTUZGn-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250103/202501031119.BkQTUZGn-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501031119.BkQTUZGn-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> arch/x86/kvm/svm/csv.c:30:5: sparse: sparse: symbol 'csv_vm_attestation' was not declared. Should it be static? vim +/csv_vm_attestation +30 arch/x86/kvm/svm/csv.c 29 > 30 int csv_vm_attestation(struct kvm *kvm, unsigned long gpa, unsigned long len) 31 { 32 struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info; 33 struct sev_data_attestation_report *data = NULL; 34 struct page **pages; 35 unsigned long guest_uaddr, n; 36 int ret = 0, offset, error; 37 38 if (!sev_guest(kvm) || !hygon_kvm_hooks.sev_hooks_installed) 39 return -ENOTTY; 40 41 /* 42 * The physical address of guest must valid and page aligned, and 43 * the length of guest memory region must be page size aligned. 44 */ 45 if (!gpa || (gpa & ~PAGE_MASK) || (len & ~PAGE_MASK)) { 46 pr_err("invalid guest address or length\n"); 47 return -EFAULT; 48 } 49 50 guest_uaddr = gfn_to_hva(kvm, gpa_to_gfn(gpa)); 51 pages = hygon_kvm_hooks.sev_pin_memory(kvm, guest_uaddr, len, &n, 1); 52 if (IS_ERR(pages)) 53 return PTR_ERR(pages); 54 55 /* 56 * The attestation report must be copied into contiguous memory region, 57 * lets verify that userspace memory pages are contiguous before we 58 * issue commmand. 59 */ 60 if (hygon_kvm_hooks.get_num_contig_pages(0, pages, n) != n) { 61 ret = -EINVAL; 62 goto e_unpin_memory; 63 } 64 65 ret = -ENOMEM; 66 data = kzalloc(sizeof(*data), GFP_KERNEL); 67 if (!data) 68 goto e_unpin_memory; 69 70 /* csv_vm_mnonce indicates attestation request from guest */ 71 if (sizeof(csv_vm_mnonce) >= sizeof(data->mnonce)) { 72 ret = -EINVAL; 73 goto e_free; 74 } 75 76 memcpy(data->mnonce, csv_vm_mnonce, sizeof(csv_vm_mnonce)); 77 78 offset = guest_uaddr & (PAGE_SIZE - 1); 79 data->address = __sme_page_pa(pages[0]) + offset; 80 data->len = len; 81 82 data->handle = sev->handle; 83 ret = hygon_kvm_hooks.sev_issue_cmd(kvm, SEV_CMD_ATTESTATION_REPORT, 84 data, &error); 85 86 if (ret) 87 pr_err("vm attestation ret %#x, error %#x\n", ret, error); 88 89 e_free: 90 kfree(data); 91 e_unpin_memory: 92 hygon_kvm_hooks.sev_unpin_memory(kvm, pages, n); 93 return ret; 94 } 95 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] um: ubd: Do not use drvdata in release
by Yuan Can 03 Jan '25

03 Jan '25

From: Tiwei Bie <tiwei.btw(a)antgroup.com> stable inclusion from stable-v4.19.325 commit 23d742a3fcd4781eed015a3a93e6a0e3ab1ef2a8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAEN CVE: CVE-2024-53184 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5bee35e5389f450a7eea7318deb9073e9414d3b1 upstream. The drvdata is not available in release. Let's just use container_of() to get the ubd instance. Otherwise, removing a ubd device will result in a crash: RIP: 0033:blk_mq_free_tag_set+0x1f/0xba RSP: 00000000e2083bf0 EFLAGS: 00010246 RAX: 000000006021463a RBX: 0000000000000348 RCX: 0000000062604d00 RDX: 0000000004208060 RSI: 00000000605241a0 RDI: 0000000000000348 RBP: 00000000e2083c10 R08: 0000000062414010 R09: 00000000601603f7 R10: 000000000000133a R11: 000000006038c4bd R12: 0000000000000000 R13: 0000000060213a5c R14: 0000000062405d20 R15: 00000000604f7aa0 Kernel panic - not syncing: Segfault with no mm CPU: 0 PID: 17 Comm: kworker/0:1 Not tainted 6.8.0-rc3-00107-gba3f67c11638 #1 Workqueue: events mc_work_proc Stack: 00000000 604f7ef0 62c5d000 62405d20 e2083c30 6002c776 6002c755 600e47ff e2083c60 6025ffe3 04208060 603d36e0 Call Trace: [<6002c776>] ubd_device_release+0x21/0x55 [<6002c755>] ? ubd_device_release+0x0/0x55 [<600e47ff>] ? kfree+0x0/0x100 [<6025ffe3>] device_release+0x70/0xba [<60381d6a>] kobject_put+0xb5/0xe2 [<6026027b>] put_device+0x19/0x1c [<6026a036>] platform_device_put+0x26/0x29 [<6026ac5a>] platform_device_unregister+0x2c/0x2e [<6002c52e>] ubd_remove+0xb8/0xd6 [<6002bb74>] ? mconsole_reply+0x0/0x50 [<6002b926>] mconsole_remove+0x160/0x1cc [<6002bbbc>] ? mconsole_reply+0x48/0x50 [<6003379c>] ? um_set_signals+0x3b/0x43 [<60061c55>] ? update_min_vruntime+0x14/0x70 [<6006251f>] ? dequeue_task_fair+0x164/0x235 [<600620aa>] ? update_cfs_group+0x0/0x40 [<603a0e77>] ? __schedule+0x0/0x3ed [<60033761>] ? um_set_signals+0x0/0x43 [<6002af6a>] mc_work_proc+0x77/0x91 [<600520b4>] process_scheduled_works+0x1af/0x2c3 [<6004ede3>] ? assign_work+0x0/0x58 [<600527a1>] worker_thread+0x2f7/0x37a [<6004ee3b>] ? set_pf_worker+0x0/0x64 [<6005765d>] ? arch_local_irq_save+0x0/0x2d [<60058e07>] ? kthread_exit+0x0/0x3a [<600524aa>] ? worker_thread+0x0/0x37a [<60058f9f>] kthread+0x130/0x135 [<6002068e>] new_thread_handler+0x85/0xb6 Cc: stable(a)vger.kernel.org Signed-off-by: Tiwei Bie <tiwei.btw(a)antgroup.com> Acked-By: Anton Ivanov <anton.ivanov(a)cambridgegreys.com> Link: https://patch.msgid.link/20241104163203.435515-3-tiwei.btw@antgroup.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- arch/um/drivers/ubd_kern.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c index 83c470364dfb..709aa3e0af3f 100644 --- a/arch/um/drivers/ubd_kern.c +++ b/arch/um/drivers/ubd_kern.c @@ -854,7 +854,7 @@ static int ubd_open_dev(struct ubd *ubd_dev) static void ubd_device_release(struct device *dev) { - struct ubd *ubd_dev = dev_get_drvdata(dev); + struct ubd *ubd_dev = container_of(dev, struct ubd, pdev.dev); blk_cleanup_queue(ubd_dev->queue); *ubd_dev = ((struct ubd) DEFAULT_UBD); -- 2.22.0

2 5

[PATCH openEuler-1.0-LTS] media: wl128x: Fix atomicity violation in fmc_send_cmd()
by dinglongwei 03 Jan '25

03 Jan '25

From: Qiu-ji Chen <chenqiuji666(a)gmail.com> stable inclusion from stable-v4.19.325 commit d16109c9fdc1b8cea4fe63b42e06e926c3f68990 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDOW CVE: CVE-2024-56700 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit ca59f9956d4519ab18ab2270be47c6b8c6ced091 upstream. Atomicity violation occurs when the fmc_send_cmd() function is executed simultaneously with the modification of the fmdev->resp_skb value. Consider a scenario where, after passing the validity check within the function, a non-null fmdev->resp_skb variable is assigned a null value. This results in an invalid fmdev->resp_skb variable passing the validity check. As seen in the later part of the function, skb = fmdev->resp_skb; when the invalid fmdev->resp_skb passes the check, a null pointer dereference error may occur at line 478, evt_hdr = (void *)skb->data; To address this issue, it is recommended to include the validity check of fmdev->resp_skb within the locked section of the function. This modification ensures that the value of fmdev->resp_skb does not change during the validation process, thereby maintaining its validity. This possible bug is found by an experimental static analysis tool developed by our team. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations. Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common sources") Cc: stable(a)vger.kernel.org Signed-off-by: Qiu-ji Chen <chenqiuji666(a)gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- drivers/media/radio/wl128x/fmdrv_common.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c index 1cf4019689a5..8b8453dab660 100644 --- a/drivers/media/radio/wl128x/fmdrv_common.c +++ b/drivers/media/radio/wl128x/fmdrv_common.c @@ -472,11 +472,12 @@ int fmc_send_cmd(struct fmdev *fmdev, u8 fm_op, u16 type, void *payload, jiffies_to_msecs(FM_DRV_TX_TIMEOUT) / 1000); return -ETIMEDOUT; } + spin_lock_irqsave(&fmdev->resp_skb_lock, flags); if (!fmdev->resp_skb) { + spin_unlock_irqrestore(&fmdev->resp_skb_lock, flags); fmerr("Response SKB is missing\n"); return -EFAULT; } - spin_lock_irqsave(&fmdev->resp_skb_lock, flags); skb = fmdev->resp_skb; fmdev->resp_skb = NULL; spin_unlock_irqrestore(&fmdev->resp_skb_lock, flags); -- 2.22.0

2 5

[PATCH OLK-5.10] RDMA/mlx5: Move events notifier registration to be after device registration
by Pu Lehui 03 Jan '25

03 Jan '25

From: Patrisious Haddad <phaddad(a)nvidia.com> mainline inclusion from mainline-v6.13-rc1 commit ede132a5cf559f3ab35a4c28bac4f4a6c20334d8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEADY CVE: CVE-2024-53224 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Move pkey change work initialization and cleanup from device resources stage to notifier stage, since this is the stage which handles this work events. Fix a race between the device deregistration and pkey change work by moving MLX5_IB_STAGE_DEVICE_NOTIFIER to be after MLX5_IB_STAGE_IB_REG in order to ensure that the notifier is deregistered before the device during cleanup. Which ensures there are no works that are being executed after the device has already unregistered which can cause the panic below. BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 630071 Comm: kworker/1:2 Kdump: loaded Tainted: G W OE --------- --- 5.14.0-162.6.1.el9_1.x86_64 #1 Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS 090008 02/27/2023 Workqueue: events pkey_change_handler [mlx5_ib] RIP: 0010:setup_qp+0x38/0x1f0 [mlx5_ib] Code: ee 41 54 45 31 e4 55 89 f5 53 48 89 fb 48 83 ec 20 8b 77 08 65 48 8b 04 25 28 00 00 00 48 89 44 24 18 48 8b 07 48 8d 4c 24 16 <4c> 8b 38 49 8b 87 80 0b 00 00 4c 89 ff 48 8b 80 08 05 00 00 8b 40 RSP: 0018:ffffbcc54068be20 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff954054494128 RCX: ffffbcc54068be36 RDX: ffff954004934000 RSI: 0000000000000001 RDI: ffff954054494128 RBP: 0000000000000023 R08: ffff954001be2c20 R09: 0000000000000001 R10: ffff954001be2c20 R11: ffff9540260133c0 R12: 0000000000000000 R13: 0000000000000023 R14: 0000000000000000 R15: ffff9540ffcb0905 FS: 0000000000000000(0000) GS:ffff9540ffc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010625c001 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mlx5_ib_gsi_pkey_change+0x20/0x40 [mlx5_ib] process_one_work+0x1e8/0x3c0 worker_thread+0x50/0x3b0 ? rescuer_thread+0x380/0x380 kthread+0x149/0x170 ? set_kthread_struct+0x50/0x50 ret_from_fork+0x22/0x30 Modules linked in: rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) mlx5_fwctl(OE) fwctl(OE) ib_uverbs(OE) mlx5_core(OE) mlxdevm(OE) ib_core(OE) mlx_compat(OE) psample mlxfw(OE) tls knem(OE) netconsole nfsv3 nfs_acl nfs lockd grace fscache netfs qrtr rfkill sunrpc intel_rapl_msr intel_rapl_common rapl hv_balloon hv_utils i2c_piix4 pcspkr joydev fuse ext4 mbcache jbd2 sr_mod sd_mod cdrom t10_pi sg ata_generic pci_hyperv pci_hyperv_intf hyperv_drm drm_shmem_helper drm_kms_helper hv_storvsc syscopyarea hv_netvsc sysfillrect sysimgblt hid_hyperv fb_sys_fops scsi_transport_fc hyperv_keyboard drm ata_piix crct10dif_pclmul crc32_pclmul crc32c_intel libata ghash_clmulni_intel hv_vmbus serio_raw [last unloaded: ib_core] CR2: 0000000000000000 ---[ end trace f6f8be4eae12f7bc ]--- Fixes: 7722f47e71e5 ("IB/mlx5: Create GSI transmission QPs when P_Key table is changed") Signed-off-by: Patrisious Haddad <phaddad(a)nvidia.com> Reviewed-by: Michael Guralnik <michaelgur(a)nvidia.com> Link: https://patch.msgid.link/d271ceeff0c08431b3cbbbb3e2d416f09b6d1621.173149694… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Conflicts: drivers/infiniband/hw/mlx5/main.c drivers/infiniband/hw/mlx5/mlx5_ib.h [The conflicts were due to some minor issue] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/infiniband/hw/mlx5/main.c | 35 +++++++++++++++------------- drivers/infiniband/hw/mlx5/mlx5_ib.h | 2 +- 2 files changed, 20 insertions(+), 17 deletions(-) diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c index fc331dd9909b..982be8a8bba8 100644 --- a/drivers/infiniband/hw/mlx5/main.c +++ b/drivers/infiniband/hw/mlx5/main.c @@ -3045,7 +3045,6 @@ static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev) struct ib_srq_init_attr attr; struct ib_device *ibdev; struct ib_cq_init_attr cq_attr = {.cqe = 1}; - int port; int ret = 0; ibdev = &dev->ib_dev; @@ -3134,10 +3133,6 @@ static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev) atomic_inc(&devr->p0->usecnt); atomic_set(&devr->s1->usecnt, 0); - for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) - INIT_WORK(&devr->ports[port].pkey_change_work, - pkey_change_handler); - return 0; error6: @@ -3164,7 +3159,6 @@ static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev) static void mlx5_ib_dev_res_cleanup(struct mlx5_ib_dev *dev) { struct mlx5_ib_resources *devr = &dev->devr; - int port; mlx5_ib_destroy_srq(devr->s1, NULL); kfree(devr->s1); @@ -3176,10 +3170,6 @@ static void mlx5_ib_dev_res_cleanup(struct mlx5_ib_dev *dev) kfree(devr->c0); mlx5_ib_dealloc_pd(devr->p0, NULL); kfree(devr->p0); - - /* Make sure no change P_Key work items are still executing */ - for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) - cancel_work_sync(&devr->ports[port].pkey_change_work); } static u32 get_core_cap_flags(struct ib_device *ibdev, @@ -4578,6 +4568,13 @@ static void mlx5_ib_stage_delay_drop_cleanup(struct mlx5_ib_dev *dev) static int mlx5_ib_stage_dev_notifier_init(struct mlx5_ib_dev *dev) { + struct mlx5_ib_resources *devr = &dev->devr; + int port; + + for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) + INIT_WORK(&devr->ports[port].pkey_change_work, + pkey_change_handler); + dev->mdev_events.notifier_call = mlx5_ib_event; mlx5_notifier_register(dev->mdev, &dev->mdev_events); return 0; @@ -4585,7 +4582,13 @@ static int mlx5_ib_stage_dev_notifier_init(struct mlx5_ib_dev *dev) static void mlx5_ib_stage_dev_notifier_cleanup(struct mlx5_ib_dev *dev) { + struct mlx5_ib_resources *devr = &dev->devr; + int port; + mlx5_notifier_unregister(dev->mdev, &dev->mdev_events); + + for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) + cancel_work_sync(&devr->ports[port].pkey_change_work); } void __mlx5_ib_remove(struct mlx5_ib_dev *dev, @@ -4656,9 +4659,6 @@ static const struct mlx5_ib_profile pf_profile = { STAGE_CREATE(MLX5_IB_STAGE_DEVICE_RESOURCES, mlx5_ib_dev_res_init, mlx5_ib_dev_res_cleanup), - STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, - mlx5_ib_stage_dev_notifier_init, - mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_ODP, mlx5_ib_odp_init_one, mlx5_ib_odp_cleanup_one), @@ -4683,6 +4683,9 @@ static const struct mlx5_ib_profile pf_profile = { STAGE_CREATE(MLX5_IB_STAGE_IB_REG, mlx5_ib_stage_ib_reg_init, mlx5_ib_stage_ib_reg_cleanup), + STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, + mlx5_ib_stage_dev_notifier_init, + mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_POST_IB_REG_UMR, mlx5_ib_stage_post_ib_reg_umr_init, NULL), @@ -4719,9 +4722,6 @@ const struct mlx5_ib_profile raw_eth_profile = { STAGE_CREATE(MLX5_IB_STAGE_DEVICE_RESOURCES, mlx5_ib_dev_res_init, mlx5_ib_dev_res_cleanup), - STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, - mlx5_ib_stage_dev_notifier_init, - mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_COUNTERS, mlx5_ib_counters_init, mlx5_ib_counters_cleanup), @@ -4743,6 +4743,9 @@ const struct mlx5_ib_profile raw_eth_profile = { STAGE_CREATE(MLX5_IB_STAGE_IB_REG, mlx5_ib_stage_ib_reg_init, mlx5_ib_stage_ib_reg_cleanup), + STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, + mlx5_ib_stage_dev_notifier_init, + mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_POST_IB_REG_UMR, mlx5_ib_stage_post_ib_reg_umr_init, NULL), diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h index b1f2b34e5955..15afc11bdd6e 100644 --- a/drivers/infiniband/hw/mlx5/mlx5_ib.h +++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h @@ -826,7 +826,6 @@ enum mlx5_ib_stages { MLX5_IB_STAGE_QP, MLX5_IB_STAGE_SRQ, MLX5_IB_STAGE_DEVICE_RESOURCES, - MLX5_IB_STAGE_DEVICE_NOTIFIER, MLX5_IB_STAGE_ODP, MLX5_IB_STAGE_COUNTERS, MLX5_IB_STAGE_CONG_DEBUGFS, @@ -835,6 +834,7 @@ enum mlx5_ib_stages { MLX5_IB_STAGE_PRE_IB_REG_UMR, MLX5_IB_STAGE_WHITELIST_UID, MLX5_IB_STAGE_IB_REG, + MLX5_IB_STAGE_DEVICE_NOTIFIER, MLX5_IB_STAGE_POST_IB_REG_UMR, MLX5_IB_STAGE_DELAY_DROP, MLX5_IB_STAGE_RESTRACK, -- 2.34.1

2 5

[PATCH openEuler-22.03-LTS-SP1] RDMA/mlx5: Move events notifier registration to be after device registration
by Pu Lehui 03 Jan '25

03 Jan '25

From: Patrisious Haddad <phaddad(a)nvidia.com> mainline inclusion from mainline-v6.13-rc1 commit ede132a5cf559f3ab35a4c28bac4f4a6c20334d8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEADY CVE: CVE-2024-53224 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Move pkey change work initialization and cleanup from device resources stage to notifier stage, since this is the stage which handles this work events. Fix a race between the device deregistration and pkey change work by moving MLX5_IB_STAGE_DEVICE_NOTIFIER to be after MLX5_IB_STAGE_IB_REG in order to ensure that the notifier is deregistered before the device during cleanup. Which ensures there are no works that are being executed after the device has already unregistered which can cause the panic below. BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 630071 Comm: kworker/1:2 Kdump: loaded Tainted: G W OE --------- --- 5.14.0-162.6.1.el9_1.x86_64 #1 Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS 090008 02/27/2023 Workqueue: events pkey_change_handler [mlx5_ib] RIP: 0010:setup_qp+0x38/0x1f0 [mlx5_ib] Code: ee 41 54 45 31 e4 55 89 f5 53 48 89 fb 48 83 ec 20 8b 77 08 65 48 8b 04 25 28 00 00 00 48 89 44 24 18 48 8b 07 48 8d 4c 24 16 <4c> 8b 38 49 8b 87 80 0b 00 00 4c 89 ff 48 8b 80 08 05 00 00 8b 40 RSP: 0018:ffffbcc54068be20 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff954054494128 RCX: ffffbcc54068be36 RDX: ffff954004934000 RSI: 0000000000000001 RDI: ffff954054494128 RBP: 0000000000000023 R08: ffff954001be2c20 R09: 0000000000000001 R10: ffff954001be2c20 R11: ffff9540260133c0 R12: 0000000000000000 R13: 0000000000000023 R14: 0000000000000000 R15: ffff9540ffcb0905 FS: 0000000000000000(0000) GS:ffff9540ffc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010625c001 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mlx5_ib_gsi_pkey_change+0x20/0x40 [mlx5_ib] process_one_work+0x1e8/0x3c0 worker_thread+0x50/0x3b0 ? rescuer_thread+0x380/0x380 kthread+0x149/0x170 ? set_kthread_struct+0x50/0x50 ret_from_fork+0x22/0x30 Modules linked in: rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) mlx5_fwctl(OE) fwctl(OE) ib_uverbs(OE) mlx5_core(OE) mlxdevm(OE) ib_core(OE) mlx_compat(OE) psample mlxfw(OE) tls knem(OE) netconsole nfsv3 nfs_acl nfs lockd grace fscache netfs qrtr rfkill sunrpc intel_rapl_msr intel_rapl_common rapl hv_balloon hv_utils i2c_piix4 pcspkr joydev fuse ext4 mbcache jbd2 sr_mod sd_mod cdrom t10_pi sg ata_generic pci_hyperv pci_hyperv_intf hyperv_drm drm_shmem_helper drm_kms_helper hv_storvsc syscopyarea hv_netvsc sysfillrect sysimgblt hid_hyperv fb_sys_fops scsi_transport_fc hyperv_keyboard drm ata_piix crct10dif_pclmul crc32_pclmul crc32c_intel libata ghash_clmulni_intel hv_vmbus serio_raw [last unloaded: ib_core] CR2: 0000000000000000 ---[ end trace f6f8be4eae12f7bc ]--- Fixes: 7722f47e71e5 ("IB/mlx5: Create GSI transmission QPs when P_Key table is changed") Signed-off-by: Patrisious Haddad <phaddad(a)nvidia.com> Reviewed-by: Michael Guralnik <michaelgur(a)nvidia.com> Link: https://patch.msgid.link/d271ceeff0c08431b3cbbbb3e2d416f09b6d1621.173149694… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Conflicts: drivers/infiniband/hw/mlx5/main.c drivers/infiniband/hw/mlx5/mlx5_ib.h [The conflicts were due to some minor issue] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/infiniband/hw/mlx5/main.c | 35 +++++++++++++++------------- drivers/infiniband/hw/mlx5/mlx5_ib.h | 2 +- 2 files changed, 20 insertions(+), 17 deletions(-) diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c index eb69bec77e5d..afb65ab64a4e 100644 --- a/drivers/infiniband/hw/mlx5/main.c +++ b/drivers/infiniband/hw/mlx5/main.c @@ -3029,7 +3029,6 @@ static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev) struct ib_srq_init_attr attr; struct ib_device *ibdev; struct ib_cq_init_attr cq_attr = {.cqe = 1}; - int port; int ret = 0; ibdev = &dev->ib_dev; @@ -3118,10 +3117,6 @@ static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev) atomic_inc(&devr->p0->usecnt); atomic_set(&devr->s1->usecnt, 0); - for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) - INIT_WORK(&devr->ports[port].pkey_change_work, - pkey_change_handler); - return 0; error6: @@ -3148,7 +3143,6 @@ static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev) static void mlx5_ib_dev_res_cleanup(struct mlx5_ib_dev *dev) { struct mlx5_ib_resources *devr = &dev->devr; - int port; mlx5_ib_destroy_srq(devr->s1, NULL); kfree(devr->s1); @@ -3160,10 +3154,6 @@ static void mlx5_ib_dev_res_cleanup(struct mlx5_ib_dev *dev) kfree(devr->c0); mlx5_ib_dealloc_pd(devr->p0, NULL); kfree(devr->p0); - - /* Make sure no change P_Key work items are still executing */ - for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) - cancel_work_sync(&devr->ports[port].pkey_change_work); } static u32 get_core_cap_flags(struct ib_device *ibdev, @@ -4562,6 +4552,13 @@ static void mlx5_ib_stage_delay_drop_cleanup(struct mlx5_ib_dev *dev) static int mlx5_ib_stage_dev_notifier_init(struct mlx5_ib_dev *dev) { + struct mlx5_ib_resources *devr = &dev->devr; + int port; + + for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) + INIT_WORK(&devr->ports[port].pkey_change_work, + pkey_change_handler); + dev->mdev_events.notifier_call = mlx5_ib_event; mlx5_notifier_register(dev->mdev, &dev->mdev_events); return 0; @@ -4569,7 +4566,13 @@ static int mlx5_ib_stage_dev_notifier_init(struct mlx5_ib_dev *dev) static void mlx5_ib_stage_dev_notifier_cleanup(struct mlx5_ib_dev *dev) { + struct mlx5_ib_resources *devr = &dev->devr; + int port; + mlx5_notifier_unregister(dev->mdev, &dev->mdev_events); + + for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) + cancel_work_sync(&devr->ports[port].pkey_change_work); } void __mlx5_ib_remove(struct mlx5_ib_dev *dev, @@ -4640,9 +4643,6 @@ static const struct mlx5_ib_profile pf_profile = { STAGE_CREATE(MLX5_IB_STAGE_DEVICE_RESOURCES, mlx5_ib_dev_res_init, mlx5_ib_dev_res_cleanup), - STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, - mlx5_ib_stage_dev_notifier_init, - mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_ODP, mlx5_ib_odp_init_one, mlx5_ib_odp_cleanup_one), @@ -4667,6 +4667,9 @@ static const struct mlx5_ib_profile pf_profile = { STAGE_CREATE(MLX5_IB_STAGE_IB_REG, mlx5_ib_stage_ib_reg_init, mlx5_ib_stage_ib_reg_cleanup), + STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, + mlx5_ib_stage_dev_notifier_init, + mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_POST_IB_REG_UMR, mlx5_ib_stage_post_ib_reg_umr_init, NULL), @@ -4703,9 +4706,6 @@ const struct mlx5_ib_profile raw_eth_profile = { STAGE_CREATE(MLX5_IB_STAGE_DEVICE_RESOURCES, mlx5_ib_dev_res_init, mlx5_ib_dev_res_cleanup), - STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, - mlx5_ib_stage_dev_notifier_init, - mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_COUNTERS, mlx5_ib_counters_init, mlx5_ib_counters_cleanup), @@ -4727,6 +4727,9 @@ const struct mlx5_ib_profile raw_eth_profile = { STAGE_CREATE(MLX5_IB_STAGE_IB_REG, mlx5_ib_stage_ib_reg_init, mlx5_ib_stage_ib_reg_cleanup), + STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, + mlx5_ib_stage_dev_notifier_init, + mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_POST_IB_REG_UMR, mlx5_ib_stage_post_ib_reg_umr_init, NULL), diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h index b1f2b34e5955..15afc11bdd6e 100644 --- a/drivers/infiniband/hw/mlx5/mlx5_ib.h +++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h @@ -826,7 +826,6 @@ enum mlx5_ib_stages { MLX5_IB_STAGE_QP, MLX5_IB_STAGE_SRQ, MLX5_IB_STAGE_DEVICE_RESOURCES, - MLX5_IB_STAGE_DEVICE_NOTIFIER, MLX5_IB_STAGE_ODP, MLX5_IB_STAGE_COUNTERS, MLX5_IB_STAGE_CONG_DEBUGFS, @@ -835,6 +834,7 @@ enum mlx5_ib_stages { MLX5_IB_STAGE_PRE_IB_REG_UMR, MLX5_IB_STAGE_WHITELIST_UID, MLX5_IB_STAGE_IB_REG, + MLX5_IB_STAGE_DEVICE_NOTIFIER, MLX5_IB_STAGE_POST_IB_REG_UMR, MLX5_IB_STAGE_DELAY_DROP, MLX5_IB_STAGE_RESTRACK, -- 2.34.1

2 6

[openeuler:OLK-6.6 1693/1693] arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 03 Jan '25

03 Jan '25

Hi Tianrui, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c2f1662c3fb301fe7ba127fe06c14538112982d4 commit: 07db411edd838080fb7c42b9f56bc08dd60d9af6 [1693/1693] LoongArch: KVM: Enable kvm config and add the makefile config: loongarch-randconfig-r112-20250103 (https://download.01.org/0day-ci/archive/20250103/202501031054.kEd1r4Aw-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250103/202501031054.kEd1r4Aw-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501031054.kEd1r4Aw-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) arch/loongarch/kvm/../../../virt/kvm/kvm_main.c: note: in included file: include/linux/kvm_host.h:1946:54: sparse: sparse: array of flexible structures include/linux/kvm_host.h:1948:56: sparse: sparse: array of flexible structures >> arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: got unsigned int [noderef] __percpu * >> arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: got unsigned int [noderef] __percpu * >> arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: got unsigned int [noderef] __percpu * >> arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: got unsigned int [noderef] __percpu * >> arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: got int [noderef] __percpu * >> arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: got int [noderef] __percpu * >> arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: got int [noderef] __percpu * >> arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: got int [noderef] __percpu * arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: got unsigned int [noderef] __percpu * arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: got unsigned int [noderef] __percpu * arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: got unsigned int [noderef] __percpu * arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: got unsigned int [noderef] __percpu * arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: got int [noderef] __percpu * arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: got int [noderef] __percpu * arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: got int [noderef] __percpu * arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: got int [noderef] __percpu * arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:602:9: sparse: sparse: context imbalance in 'kvm_mmu_notifier_change_pte' - different lock contexts for basic block arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:602:9: sparse: sparse: context imbalance in 'kvm_mmu_notifier_invalidate_range_start' - different lock contexts for basic block arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:602:9: sparse: sparse: context imbalance in 'kvm_mmu_notifier_invalidate_range_end' - different lock contexts for basic block arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:602:9: sparse: sparse: context imbalance in 'kvm_mmu_notifier_clear_flush_young' - different lock contexts for basic block arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:602:9: sparse: sparse: context imbalance in 'kvm_mmu_notifier_clear_young' - different lock contexts for basic block arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:602:9: sparse: sparse: context imbalance in 'kvm_mmu_notifier_test_young' - different lock contexts for basic block arch/loongarch/kvm/../../../virt/kvm/kvm_main.c: note: in included file (through include/linux/mutex.h, include/linux/kvm_types.h, include/kvm/iodev.h): include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:1973:49: sparse: sparse: self-comparison always evaluates to false arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:1979:37: sparse: sparse: self-comparison always evaluates to false arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:2678:9: sparse: sparse: context imbalance in 'hva_to_pfn_remapped' - unexpected unlock include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true vim +5340 arch/loongarch/kvm/../../../virt/kvm/kvm_main.c 9a2b85c620b977 drivers/kvm/kvm_main.c Rusty Russell 2007-07-17 5328 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5329 static int kvm_suspend(void) 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5330 { 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5331 /* 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5332 * Secondary CPUs and CPU hotplug are disabled across the suspend/resume 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5333 * callbacks, i.e. no need to acquire kvm_lock to ensure the usage count 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5334 * is stable. Assert that kvm_lock is not held to ensure the system 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5335 * isn't suspended while KVM is enabling hardware. Hardware enabling 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5336 * can be preempted, but the task cannot be frozen until it has dropped 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5337 * all locks (userspace tasks are frozen via a fake signal). 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5338 */ 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5339 lockdep_assert_not_held(&kvm_lock); 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 @5340 lockdep_assert_irqs_disabled(); 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5341 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5342 if (kvm_usage_count) 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5343 hardware_disable_nolock(NULL); 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5344 return 0; 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5345 } 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5346 :::::: The code at line 5340 was first introduced by commit :::::: 35774a9f94db08df78e1c08d2b097666deec4e76 KVM: Register syscore (suspend/resume) ops early in kvm_init() :::::: TO: Sean Christopherson <seanjc(a)google.com> :::::: CC: Paolo Bonzini <pbonzini(a)redhat.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION 90884a336c06ff4d4124cd908b66433ea5a2346d
by kernel test robot 03 Jan '25

03 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 90884a336c06ff4d4124cd908b66433ea5a2346d !14371 [OLK-5.10] update AMD Zen5 Turin feature Error/Warning (recently discovered and may have been fixed): fs/btrfs/tree-log.o: warning: objtool: btrfs_log_holes()+0x28e: unreachable instruction Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x0-in-asm | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x1-in-asm | `-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x2-in-asm |-- arm64-allnoconfig | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-CPPC_CPUFREQ_SYSFS_INTERFACE-when-selected-by-CPU_FREQ_GOV_SEEP |-- arm64-randconfig-001-20250102 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r0-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r1-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-x16-in-asm | `-- arch-arm64-include-asm-stack_pointer.h:error:register-sp-unsuitable-for-global-register-variables-on-this-target |-- arm64-randconfig-003-20250102 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r0-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r1-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm | `-- arch-arm64-include-asm-stack_pointer.h:error:register-sp-unsuitable-for-global-register-variables-on-this-target |-- arm64-randconfig-004-20250102 | `-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit |-- x86_64-allnoconfig | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-allyesconfig | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-cpu-description-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_get_auto_sel | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_set_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_set_epp | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-auto_act_window-not-described-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-auto_act_window-not-described-in-cppc_set_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-cpunum-not-described-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-epp_val-not-described-in-cppc_set_epp | |-- drivers-gpu-drm-vmwgfx-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_rd32 | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_wr32 | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_send_clp_msg | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_in_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_out_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_copy_to_user | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_in_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_out_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_id | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_type | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_hw_driver_stats | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read_ack | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write_nack | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_destroy_adm_msg | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_func_id | |-- drivers-net-ethernet-hisilicon-hns3-hns3_unic.c:warning:Function-parameter-or-member-skb-not-described-in-hns3_unic_set_l3_type | |-- drivers-net-ethernet-hisilicon-hns3-hns3_unic.c:warning:Function-parameter-or-member-type_cs_vlan_tso-not-described-in-hns3_unic_set_l3_type | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_unic_guid.c:warning:no-previous-prototype-for-function-hclge_unic_del_mc_guid_common | |-- drivers-net-ethernet-huawei-hinic-hinic_hwdev.c:warning:address-of-array-chip_node-rt_cmd-will-always-evaluate-to-true | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-has_mac-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-has_trans-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-headroom-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-tailroom-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_debugfs.c:warning:Excess-function-parameter-pf-description-in-rnp_dbg_adapter_exit | |-- drivers-net-ethernet-mucse-rnp-rnp_debugfs.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_dbg_adapter_exit | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-cmd-description-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-cmd-description-in-rnp_set_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-ec-description-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_module_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_ts_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_set_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_set_rxnfc | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-coal-not-described-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-data-not-described-in-rnp_reg_test | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_module_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_ts_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_set_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_set_rxnfc | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_get_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_set_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_set_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-ker-not-described-in-rnp_get_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-ker-not-described-in-rnp_set_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnp_set_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-inner_vlan_tag-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-l4_hdr_len-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-mss_seg_len-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-rxr_count-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-rxr_idx-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-tunnel_hdr_len-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-txr_count-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-txr_idx-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-type_tucmd-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-v_count-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-crc_pad-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-eth_queue_idx-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-ignore_vlan-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-inner_vlan_tunnel_len-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-mss_len_vf_num-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-r_count-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-r_idx-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-step-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:no-previous-prototype-for-function-rnp_acquire_msix_vectors | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:no-previous-prototype-for-function-rnp_print_ring_info | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-data-description-in-rnp_service_timer | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-ent-description-in-rnp_probe | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-hw-description-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-link_speed-description-in-rnp_watchdog_update_link | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-maxrate-description-in-rnp_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-netdev-description-in-rnp_setup_tc | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-netdev-description-in-rnp_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-queue-description-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-skb-description-in-rnp_is_non_eop | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-subdev_id-description-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_rx_ring_reinit | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_setup_rx_resources | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_setup_tx_resources | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_setup_tc | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-id-not-described-in-rnp_probe | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-napi_budget-not-described-in-rnp_clean_tx_irq | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-rnp_msix_vector-not-described-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-rnp_queue-not-described-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-subdevice_id-not-described-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-t-not-described-in-rnp_service_timer | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-txqueue-not-described-in-rnp_tx_timeout | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_assign_netdev_ops | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_can_rpu_start | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_clear_udp_tunnel_port | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_config_knode | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_delete_knode | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_do_reset | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_rx_ring_reinit | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_service_task | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_service_timer | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_setup_tc_cls_u32 | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_unmap_and_free_tx_resource | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_vlan_stags_flag | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_write_eitr_rx | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_xmit_nop_frame_ring | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:variable-rxctrl-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:variable-xdp_xmit-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnp_check_for_ack_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnp_check_for_msg_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnp_read_mbx_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnp_check_for_ack_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnp_check_for_msg_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnp_read_mbx_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Excess-function-parameter-rnp_info-description-in-rnp_mbx_get_capability | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-adv-not-described-in-rnp_mbx_phy_link_set | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-info-not-described-in-rnp_mbx_get_capability | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-pfvfnum-not-described-in-rnp_fw_get_macaddr | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value-not-described-in-rnp_mbx_reg_writev | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value0-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value1-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value2-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value3-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_fw_reg_read | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:variable-err-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:variable-value-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Excess-function-parameter-hw-description-in-rnp_mac_fc_mode_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-hw-not-described-in-rnp_write_uc_addr_list_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-mac-not-described-in-rnp_mac_fc_mode_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-sriov_flag-not-described-in-rnp_eth_update_rss_key_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-sriov_flag-not-described-in-rnp_write_uc_addr_list_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:equality-comparison-with-extraneous-parentheses | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp10_get_link_ksettings | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp10_set_link_ksettings | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_addr_list_itr | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_check_mac_link_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_clean_link_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_device_supports_autoneg_fc | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clear_rar_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clear_vmdq_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_all_layer2_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_all_tuple5_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_layer2_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_mc_addr_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_tuple5_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_vfta_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_layer2_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_rar_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_tcp_sync_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_tuple5_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_vfta_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_vmdq_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_update_mc_addr_list_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_update_rss_key_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_update_rss_table_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_get_permtion_mac_addr_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_get_thermal_sensor_data_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_init_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_init_thermal_sensor_thresh_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_layer2_pritologic_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_mac_fc_mode_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_mac_set_mac_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_nway_reset | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_phy_read_reg_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_phy_write_reg_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_reset_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_set_ethtool_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_set_vf_vlan_mode_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_setup_mac_link_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_start_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_tuple5_pritologic_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_tuple5_pritologic_tcam_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-autoneg_changed-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-dma_ch-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-duplex_changed-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-idx-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_ptp.c:warning:no-previous-prototype-for-function-rnp_ptp_setup_ptp | |-- drivers-net-ethernet-mucse-rnp-rnp_ptp.c:warning:variable-ts_event_en-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_sriov.c:warning:no-previous-prototype-for-function-check_ari_mode | |-- drivers-net-ethernet-mucse-rnp-rnp_sriov.c:warning:no-previous-prototype-for-function-rnp_msg_post_status_signle_link | |-- drivers-net-ethernet-mucse-rnp-rnp_sysfs.c:warning:no-previous-prototype-for-function-rnp_mbx_get_pn_sn | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func | |-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr | |-- fs-eulerfs-euler_def.h:warning:redefinition-of-typedef-hashlen_t-is-a-C11-feature | |-- fs-eulerfs-euler_def.h:warning:redefinition-of-typedef-page_info_t-is-a-C11-feature | `-- fs-eulerfs-namei.c:warning:variable-de-is-uninitialized-when-used-here |-- x86_64-buildonly-randconfig-002-20250102 | |-- fs-cachefiles-ondemand.c:warning:implicit-conversion-from-enum-cachefiles_obj_ref_trace-to-enum-fscache_obj_ref_trace | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-cachefiles_readpages_work_func | |-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-cachefiles_check_old_object_xattr | |-- fs-fscache-main.c:warning:fscache_min_object_max_active-defined-but-not-used | `-- fs-fscache-main.c:warning:fscache_min_op_max_active-defined-but-not-used |-- x86_64-buildonly-randconfig-003-20250102 | `-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) |-- x86_64-buildonly-randconfig-004-20241230 | `-- fs-btrfs-tree-log.o:warning:objtool:btrfs_log_holes:unreachable-instruction |-- x86_64-buildonly-randconfig-004-20250102 | |-- drivers-net-ethernet-marvell-mv643xx_eth.o:warning:objtool:mv643xx_eth_xmit:unreachable-instruction | |-- drivers-net-ethernet-samsung-sxgbe-sxgbe_main.o:warning:objtool:sxgbe_xmit:unreachable-instruction | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func | |-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr | |-- fs-fscache-main.c:warning:unused-variable-fscache_min_object_max_active | |-- fs-fscache-main.c:warning:unused-variable-fscache_min_op_max_active | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-005-20250102 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) | |-- fs-cachefiles-ondemand.c:warning:implicit-conversion-from-enum-cachefiles_obj_ref_trace-to-enum-fscache_obj_ref_trace | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-cachefiles_readpages_work_func | `-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-cachefiles_check_old_object_xattr |-- x86_64-buildonly-randconfig-006-20250102 | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_OPCODE | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-defconfig | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-cpu-description-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_get_auto_sel | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_set_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_set_epp | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-auto_act_window-not-described-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-auto_act_window-not-described-in-cppc_set_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-cpunum-not-described-in-cppc_get_auto_act_window | `-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-epp_val-not-described-in-cppc_set_epp `-- x86_64-randconfig-161-20250103 |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory elapsed time: 726m configs tested: 15 configs skipped: 128 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250102 clang-20 arm64 randconfig-002-20250102 gcc-14.2.0 arm64 randconfig-003-20250102 clang-20 arm64 randconfig-004-20250102 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250102 gcc-12 x86_64 buildonly-randconfig-002-20250102 gcc-12 x86_64 buildonly-randconfig-003-20250102 gcc-12 x86_64 buildonly-randconfig-004-20250102 clang-19 x86_64 buildonly-randconfig-005-20250102 gcc-12 x86_64 buildonly-randconfig-006-20250102 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/1] CVE-2024-56546
by Lin Yujun 03 Jan '25

03 Jan '25

Gaosheng Cui (1): drivers: soc: xilinx: add the missing kfree in xlnx_add_cb_for_suspend() drivers/soc/xilinx/xlnx_event_manager.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[openeuler:openEuler-1.0-LTS 1365/1365] drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed.
by kernel test robot 03 Jan '25

03 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4c116febc8d53bc1f8f25a3d60db331f17ab8cd8 commit: b8815fbbe89b0d15fa3296c3e57d2197a92f5bc0 [1365/1365] ACPI: CPPC: Fix cppc_cpufreq_init failed in CPU Hotplug situation config: x86_64-randconfig-102-20250103 (https://download.01.org/0day-ci/archive/20250103/202501030955.epvYv0Bn-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501030955.epvYv0Bn-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed. vim +614 drivers/acpi/cppc_acpi.c 576 577 int acpi_get_psd_map(struct cppc_cpudata **all_cpu_data) 578 { 579 struct cpc_desc **cpc_pptr, *cpc_ptr; 580 int parsed_core_num = 0; 581 int i, ret; 582 583 cpc_pptr = kcalloc(num_possible_cpus(), sizeof(void *), GFP_KERNEL); 584 if (!cpc_pptr) 585 return -ENOMEM; 586 for_each_possible_cpu(i) { 587 cpc_pptr[i] = kzalloc(sizeof(struct cpc_desc), GFP_KERNEL); 588 if (!cpc_pptr[i]) { 589 ret = -ENOMEM; 590 goto out; 591 } 592 } 593 594 /* 595 * We can not use acpi_get_devices() to walk the processor devices 596 * because some processor device is not present. 597 */ 598 ret = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, 599 ACPI_UINT32_MAX, acpi_parse_cpc, NULL, 600 cpc_pptr, (void **)&parsed_core_num); 601 if (ret) 602 goto out; 603 if (parsed_core_num != num_possible_cpus()) { 604 ret = -EINVAL; 605 goto out; 606 } 607 608 ret = __acpi_get_psd_map(all_cpu_data, cpc_pptr); 609 610 out: 611 for_each_possible_cpu(i) { 612 cpc_ptr = cpc_pptr[i]; 613 if (cpc_ptr) > 614 kfree(cpc_ptr); 615 } 616 kfree(cpc_pptr); 617 618 return ret; 619 } 620 EXPORT_SYMBOL_GPL(acpi_get_psd_map); 621 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] drm/vc4: hdmi: Avoid hang with debug registers when suspended
by Liu Chuang 03 Jan '25

03 Jan '25

From: Dom Cobley <popcornmix(a)gmail.com> stable inclusion from stable-v6.6.64 commit c7d474974954d9af7e0092021223d58f2de128df category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDP5 CVE: CVE-2024-56683 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 223ee2567a55e4f80315c768d2969e6a3b9fb23d ] Trying to read /sys/kernel/debug/dri/1/hdmi1_regs when the hdmi is disconnected results in a fatal system hang. This is due to the pm suspend code disabling the dvp clock. That is just a gate of the 108MHz clock in DVP_HT_RPI_MISC_CONFIG, which results in accesses hanging AXI bus. Protect against this. Fixes: 25eb441d55d4 ("drm/vc4: hdmi: Add all the vc5 HDMI registers into the debugfs dumps") Signed-off-by: Dom Cobley <popcornmix(a)gmail.com> Reviewed-by: Maxime Ripard <mripard(a)kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-17-dav… Signed-off-by: Dave Stevenson <dave.stevenson(a)raspberrypi.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/vc4/vc4_hdmi.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c index c6e986f71a26..d4487f4cb303 100644 --- a/drivers/gpu/drm/vc4/vc4_hdmi.c +++ b/drivers/gpu/drm/vc4/vc4_hdmi.c @@ -179,6 +179,8 @@ static int vc4_hdmi_debugfs_regs(struct seq_file *m, void *unused) if (!drm_dev_enter(drm, &idx)) return -ENODEV; + WARN_ON(pm_runtime_resume_and_get(&vc4_hdmi->pdev->dev)); + drm_print_regset32(&p, &vc4_hdmi->hdmi_regset); drm_print_regset32(&p, &vc4_hdmi->hd_regset); drm_print_regset32(&p, &vc4_hdmi->cec_regset); @@ -188,6 +190,8 @@ static int vc4_hdmi_debugfs_regs(struct seq_file *m, void *unused) drm_print_regset32(&p, &vc4_hdmi->ram_regset); drm_print_regset32(&p, &vc4_hdmi->rm_regset); + pm_runtime_put(&vc4_hdmi->pdev->dev); + drm_dev_exit(idx); return 0; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] sched/deadline: Fix warning in migrate_enable for boosted tasks
by Zicheng Qu 03 Jan '25

03 Jan '25

From: Wander Lairson Costa <wander(a)redhat.com> stable inclusion from stable-v6.6.66 commit b600d30402854415aa57548a6b53dc6478f65517 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOS CVE: CVE-2024-56583 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0664e2c311b9fa43b33e3e81429cd0c2d7f9c638 ] When running the following command: while true; do stress-ng --cyclic 30 --timeout 30s --minimize --quiet done a warning is eventually triggered: WARNING: CPU: 43 PID: 2848 at kernel/sched/deadline.c:794 setup_new_dl_entity+0x13e/0x180 ... Call Trace: <TASK> ? show_trace_log_lvl+0x1c4/0x2df ? enqueue_dl_entity+0x631/0x6e0 ? setup_new_dl_entity+0x13e/0x180 ? __warn+0x7e/0xd0 ? report_bug+0x11a/0x1a0 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 enqueue_dl_entity+0x631/0x6e0 enqueue_task_dl+0x7d/0x120 __do_set_cpus_allowed+0xe3/0x280 __set_cpus_allowed_ptr_locked+0x140/0x1d0 __set_cpus_allowed_ptr+0x54/0xa0 migrate_enable+0x7e/0x150 rt_spin_unlock+0x1c/0x90 group_send_sig_info+0xf7/0x1a0 ? kill_pid_info+0x1f/0x1d0 kill_pid_info+0x78/0x1d0 kill_proc_info+0x5b/0x110 __x64_sys_kill+0x93/0xc0 do_syscall_64+0x5c/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 RIP: 0033:0x7f0dab31f92b This warning occurs because set_cpus_allowed dequeues and enqueues tasks with the ENQUEUE_RESTORE flag set. If the task is boosted, the warning is triggered. A boosted task already had its parameters set by rt_mutex_setprio, and a new call to setup_new_dl_entity is unnecessary, hence the WARN_ON call. Check if we are requeueing a boosted task and avoid calling setup_new_dl_entity if that's the case. Fixes: 295d6d5e3736 ("sched/deadline: Fix switching to -deadline") Signed-off-by: Wander Lairson Costa <wander(a)redhat.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Acked-by: Juri Lelli <juri.lelli(a)redhat.com> Link: https://lore.kernel.org/r/20240724142253.27145-2-wander@redhat.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- kernel/sched/deadline.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c index f2a636e7acc4..bac946da756c 100644 --- a/kernel/sched/deadline.c +++ b/kernel/sched/deadline.c @@ -1494,6 +1494,7 @@ enqueue_dl_entity(struct sched_dl_entity *dl_se, int flags) } else if (flags & ENQUEUE_REPLENISH) { replenish_dl_entity(dl_se); } else if ((flags & ENQUEUE_RESTORE) && + !is_dl_boosted(dl_se) && dl_time_before(dl_se->deadline, rq_clock(rq_of_dl_rq(dl_rq_of_se(dl_se))))) { setup_new_dl_entity(dl_se); -- 2.34.1

2 1

[PATCH OLK-6.6] sched/deadline: Fix warning in migrate_enable for boosted tasks
by Zicheng Qu 03 Jan '25

03 Jan '25

From: Wander Lairson Costa <wander(a)redhat.com> stable inclusion from stable-v6.6.66 commit b600d30402854415aa57548a6b53dc6478f65517 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOS CVE: CVE-2024-56583 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0664e2c311b9fa43b33e3e81429cd0c2d7f9c638 ] When running the following command: while true; do stress-ng --cyclic 30 --timeout 30s --minimize --quiet done a warning is eventually triggered: WARNING: CPU: 43 PID: 2848 at kernel/sched/deadline.c:794 setup_new_dl_entity+0x13e/0x180 ... Call Trace: <TASK> ? show_trace_log_lvl+0x1c4/0x2df ? enqueue_dl_entity+0x631/0x6e0 ? setup_new_dl_entity+0x13e/0x180 ? __warn+0x7e/0xd0 ? report_bug+0x11a/0x1a0 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 enqueue_dl_entity+0x631/0x6e0 enqueue_task_dl+0x7d/0x120 __do_set_cpus_allowed+0xe3/0x280 __set_cpus_allowed_ptr_locked+0x140/0x1d0 __set_cpus_allowed_ptr+0x54/0xa0 migrate_enable+0x7e/0x150 rt_spin_unlock+0x1c/0x90 group_send_sig_info+0xf7/0x1a0 ? kill_pid_info+0x1f/0x1d0 kill_pid_info+0x78/0x1d0 kill_proc_info+0x5b/0x110 __x64_sys_kill+0x93/0xc0 do_syscall_64+0x5c/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 RIP: 0033:0x7f0dab31f92b This warning occurs because set_cpus_allowed dequeues and enqueues tasks with the ENQUEUE_RESTORE flag set. If the task is boosted, the warning is triggered. A boosted task already had its parameters set by rt_mutex_setprio, and a new call to setup_new_dl_entity is unnecessary, hence the WARN_ON call. Check if we are requeueing a boosted task and avoid calling setup_new_dl_entity if that's the case. Fixes: 295d6d5e3736 ("sched/deadline: Fix switching to -deadline") Signed-off-by: Wander Lairson Costa <wander(a)redhat.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Acked-by: Juri Lelli <juri.lelli(a)redhat.com> Link: https://lore.kernel.org/r/20240724142253.27145-2-wander@redhat.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- kernel/sched/deadline.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c index 89131f4d0c43..dd13bbe8c0e4 100644 --- a/kernel/sched/deadline.c +++ b/kernel/sched/deadline.c @@ -1645,6 +1645,7 @@ enqueue_dl_entity(struct sched_dl_entity *dl_se, int flags) } else if (flags & ENQUEUE_REPLENISH) { replenish_dl_entity(dl_se); } else if ((flags & ENQUEUE_RESTORE) && + !is_dl_boosted(dl_se) && dl_time_before(dl_se->deadline, rq_clock(rq_of_dl_rq(dl_rq_of_se(dl_se))))) { setup_new_dl_entity(dl_se); -- 2.34.1

2 1

[PATCH OLK-5.10] sched/deadline: Fix warning in migrate_enable for boosted tasks
by Zicheng Qu 03 Jan '25

03 Jan '25

From: Wander Lairson Costa <wander(a)redhat.com> stable inclusion from stable-v6.6.66 commit b600d30402854415aa57548a6b53dc6478f65517 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOS CVE: CVE-2024-56583 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0664e2c311b9fa43b33e3e81429cd0c2d7f9c638 ] When running the following command: while true; do stress-ng --cyclic 30 --timeout 30s --minimize --quiet done a warning is eventually triggered: WARNING: CPU: 43 PID: 2848 at kernel/sched/deadline.c:794 setup_new_dl_entity+0x13e/0x180 ... Call Trace: <TASK> ? show_trace_log_lvl+0x1c4/0x2df ? enqueue_dl_entity+0x631/0x6e0 ? setup_new_dl_entity+0x13e/0x180 ? __warn+0x7e/0xd0 ? report_bug+0x11a/0x1a0 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 enqueue_dl_entity+0x631/0x6e0 enqueue_task_dl+0x7d/0x120 __do_set_cpus_allowed+0xe3/0x280 __set_cpus_allowed_ptr_locked+0x140/0x1d0 __set_cpus_allowed_ptr+0x54/0xa0 migrate_enable+0x7e/0x150 rt_spin_unlock+0x1c/0x90 group_send_sig_info+0xf7/0x1a0 ? kill_pid_info+0x1f/0x1d0 kill_pid_info+0x78/0x1d0 kill_proc_info+0x5b/0x110 __x64_sys_kill+0x93/0xc0 do_syscall_64+0x5c/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 RIP: 0033:0x7f0dab31f92b This warning occurs because set_cpus_allowed dequeues and enqueues tasks with the ENQUEUE_RESTORE flag set. If the task is boosted, the warning is triggered. A boosted task already had its parameters set by rt_mutex_setprio, and a new call to setup_new_dl_entity is unnecessary, hence the WARN_ON call. Check if we are requeueing a boosted task and avoid calling setup_new_dl_entity if that's the case. Fixes: 295d6d5e3736 ("sched/deadline: Fix switching to -deadline") Signed-off-by: Wander Lairson Costa <wander(a)redhat.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Acked-by: Juri Lelli <juri.lelli(a)redhat.com> Link: https://lore.kernel.org/r/20240724142253.27145-2-wander@redhat.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- kernel/sched/deadline.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c index cff58dba27ff..e765b88b0f7d 100644 --- a/kernel/sched/deadline.c +++ b/kernel/sched/deadline.c @@ -1495,6 +1495,7 @@ enqueue_dl_entity(struct sched_dl_entity *dl_se, int flags) } else if (flags & ENQUEUE_REPLENISH) { replenish_dl_entity(dl_se); } else if ((flags & ENQUEUE_RESTORE) && + !is_dl_boosted(dl_se) && dl_time_before(dl_se->deadline, rq_clock(rq_of_dl_rq(dl_rq_of_se(dl_se))))) { setup_new_dl_entity(dl_se); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amdgpu: set the right AMDGPU sg segment limitation
by Zicheng Qu 03 Jan '25

03 Jan '25

From: Prike Liang <Prike.Liang(a)amd.com> stable inclusion from stable-v5.10.231 commit 13c3a54f48a612a117dfd82a9dd91732261e869d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOA CVE: CVE-2024-56594 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e2e97435783979124ba92d6870415c57ecfef6a5 ] The driver needs to set the correct max_segment_size; otherwise debug_dma_map_sg() will complain about the over-mapping of the AMDGPU sg length as following: WARNING: CPU: 6 PID: 1964 at kernel/dma/debug.c:1178 debug_dma_map_sg+0x2dc/0x370 [ 364.049444] Modules linked in: veth amdgpu(OE) amdxcp drm_exec gpu_sched drm_buddy drm_ttm_helper ttm(OE) drm_suballoc_helper drm_display_helper drm_kms_helper i2c_algo_bit rpcsec_gss_krb5 auth_rpcgss nfsv4 nfs lockd grace netfs xt_conntrack xt_MASQUERADE nf_conntrack_netlink xfrm_user xfrm_algo iptable_nat xt_addrtype iptable_filter br_netfilter nvme_fabrics overlay nfnetlink_cttimeout nfnetlink openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c bridge stp llc amd_atl intel_rapl_msr intel_rapl_common sunrpc sch_fq_codel snd_hda_codec_realtek snd_hda_codec_generic snd_hda_scodec_component snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg edac_mce_amd binfmt_misc snd_hda_codec snd_pci_acp6x snd_hda_core snd_acp_config snd_hwdep snd_soc_acpi kvm_amd snd_pcm kvm snd_seq_midi snd_seq_midi_event crct10dif_pclmul ghash_clmulni_intel sha512_ssse3 snd_rawmidi sha256_ssse3 sha1_ssse3 aesni_intel snd_seq nls_iso8859_1 crypto_simd snd_seq_device cryptd snd_timer rapl input_leds snd [ 364.049532] ipmi_devintf wmi_bmof ccp serio_raw k10temp sp5100_tco soundcore ipmi_msghandler cm32181 industrialio mac_hid msr parport_pc ppdev lp parport drm efi_pstore ip_tables x_tables pci_stub crc32_pclmul nvme ahci libahci i2c_piix4 r8169 nvme_core i2c_designware_pci realtek i2c_ccgx_ucsi video wmi hid_generic cdc_ether usbnet usbhid hid r8152 mii [ 364.049576] CPU: 6 PID: 1964 Comm: rocminfo Tainted: G OE 6.10.0-custom #492 [ 364.049579] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS RMJ1009A 06/13/2021 [ 364.049582] RIP: 0010:debug_dma_map_sg+0x2dc/0x370 [ 364.049585] Code: 89 4d b8 e8 36 b1 86 00 8b 4d b8 48 8b 55 b0 44 8b 45 a8 4c 8b 4d a0 48 89 c6 48 c7 c7 00 4b 74 bc 4c 89 4d b8 e8 b4 73 f3 ff <0f> 0b 4c 8b 4d b8 8b 15 c8 2c b8 01 85 d2 0f 85 ee fd ff ff 8b 05 [ 364.049588] RSP: 0018:ffff9ca600b57ac0 EFLAGS: 00010286 [ 364.049590] RAX: 0000000000000000 RBX: ffff88b7c132b0c8 RCX: 0000000000000027 [ 364.049592] RDX: ffff88bb0f521688 RSI: 0000000000000001 RDI: ffff88bb0f521680 [ 364.049594] RBP: ffff9ca600b57b20 R08: 000000000000006f R09: ffff9ca600b57930 [ 364.049596] R10: ffff9ca600b57928 R11: ffffffffbcb46328 R12: 0000000000000000 [ 364.049597] R13: 0000000000000001 R14: ffff88b7c19c0700 R15: ffff88b7c9059800 [ 364.049599] FS: 00007fb2d3516e80(0000) GS:ffff88bb0f500000(0000) knlGS:0000000000000000 [ 364.049601] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 364.049603] CR2: 000055610bd03598 CR3: 00000001049f6000 CR4: 0000000000350ef0 [ 364.049605] Call Trace: [ 364.049607] <TASK> [ 364.049609] ? show_regs+0x6d/0x80 [ 364.049614] ? __warn+0x8c/0x140 [ 364.049618] ? debug_dma_map_sg+0x2dc/0x370 [ 364.049621] ? report_bug+0x193/0x1a0 [ 364.049627] ? handle_bug+0x46/0x80 [ 364.049631] ? exc_invalid_op+0x1d/0x80 [ 364.049635] ? asm_exc_invalid_op+0x1f/0x30 [ 364.049642] ? debug_dma_map_sg+0x2dc/0x370 [ 364.049647] __dma_map_sg_attrs+0x90/0xe0 [ 364.049651] dma_map_sgtable+0x25/0x40 [ 364.049654] amdgpu_bo_move+0x59a/0x850 [amdgpu] [ 364.049935] ? srso_return_thunk+0x5/0x5f [ 364.049939] ? amdgpu_ttm_tt_populate+0x5d/0xc0 [amdgpu] [ 364.050095] ttm_bo_handle_move_mem+0xc3/0x180 [ttm] [ 364.050103] ttm_bo_validate+0xc1/0x160 [ttm] [ 364.050108] ? amdgpu_ttm_tt_get_user_pages+0xe5/0x1b0 [amdgpu] [ 364.050263] amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0xa12/0xc90 [amdgpu] [ 364.050473] kfd_ioctl_alloc_memory_of_gpu+0x16b/0x3b0 [amdgpu] [ 364.050680] kfd_ioctl+0x3c2/0x530 [amdgpu] [ 364.050866] ? __pfx_kfd_ioctl_alloc_memory_of_gpu+0x10/0x10 [amdgpu] [ 364.051054] ? srso_return_thunk+0x5/0x5f [ 364.051057] ? tomoyo_file_ioctl+0x20/0x30 [ 364.051063] __x64_sys_ioctl+0x9c/0xd0 [ 364.051068] x64_sys_call+0x1219/0x20d0 [ 364.051073] do_syscall_64+0x51/0x120 [ 364.051077] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 364.051081] RIP: 0033:0x7fb2d2f1a94f Signed-off-by: Prike Liang <Prike.Liang(a)amd.com> Reviewed-by: Christian König <christian.koenig(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c index 7d4a54025e18..06a0cef24c6d 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c @@ -1885,6 +1885,7 @@ int amdgpu_ttm_init(struct amdgpu_device *adev) mutex_init(&adev->mman.gtt_window_lock); + dma_set_max_seg_size(adev->dev, UINT_MAX); /* No others user of address space so set it to 0 */ r = ttm_bo_device_init(&adev->mman.bdev, &amdgpu_bo_driver, -- 2.34.1

2 1

[PATCH OLK-6.6] drm/amdgpu: set the right AMDGPU sg segment limitation
by Zicheng Qu 03 Jan '25

03 Jan '25

From: Prike Liang <Prike.Liang(a)amd.com> stable inclusion from stable-v6.6.66 commit b9e52a96ec92245bf15dabba1d3d862d7a03efb8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOA CVE: CVE-2024-56594 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e2e97435783979124ba92d6870415c57ecfef6a5 ] The driver needs to set the correct max_segment_size; otherwise debug_dma_map_sg() will complain about the over-mapping of the AMDGPU sg length as following: WARNING: CPU: 6 PID: 1964 at kernel/dma/debug.c:1178 debug_dma_map_sg+0x2dc/0x370 [ 364.049444] Modules linked in: veth amdgpu(OE) amdxcp drm_exec gpu_sched drm_buddy drm_ttm_helper ttm(OE) drm_suballoc_helper drm_display_helper drm_kms_helper i2c_algo_bit rpcsec_gss_krb5 auth_rpcgss nfsv4 nfs lockd grace netfs xt_conntrack xt_MASQUERADE nf_conntrack_netlink xfrm_user xfrm_algo iptable_nat xt_addrtype iptable_filter br_netfilter nvme_fabrics overlay nfnetlink_cttimeout nfnetlink openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c bridge stp llc amd_atl intel_rapl_msr intel_rapl_common sunrpc sch_fq_codel snd_hda_codec_realtek snd_hda_codec_generic snd_hda_scodec_component snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg edac_mce_amd binfmt_misc snd_hda_codec snd_pci_acp6x snd_hda_core snd_acp_config snd_hwdep snd_soc_acpi kvm_amd snd_pcm kvm snd_seq_midi snd_seq_midi_event crct10dif_pclmul ghash_clmulni_intel sha512_ssse3 snd_rawmidi sha256_ssse3 sha1_ssse3 aesni_intel snd_seq nls_iso8859_1 crypto_simd snd_seq_device cryptd snd_timer rapl input_leds snd [ 364.049532] ipmi_devintf wmi_bmof ccp serio_raw k10temp sp5100_tco soundcore ipmi_msghandler cm32181 industrialio mac_hid msr parport_pc ppdev lp parport drm efi_pstore ip_tables x_tables pci_stub crc32_pclmul nvme ahci libahci i2c_piix4 r8169 nvme_core i2c_designware_pci realtek i2c_ccgx_ucsi video wmi hid_generic cdc_ether usbnet usbhid hid r8152 mii [ 364.049576] CPU: 6 PID: 1964 Comm: rocminfo Tainted: G OE 6.10.0-custom #492 [ 364.049579] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS RMJ1009A 06/13/2021 [ 364.049582] RIP: 0010:debug_dma_map_sg+0x2dc/0x370 [ 364.049585] Code: 89 4d b8 e8 36 b1 86 00 8b 4d b8 48 8b 55 b0 44 8b 45 a8 4c 8b 4d a0 48 89 c6 48 c7 c7 00 4b 74 bc 4c 89 4d b8 e8 b4 73 f3 ff <0f> 0b 4c 8b 4d b8 8b 15 c8 2c b8 01 85 d2 0f 85 ee fd ff ff 8b 05 [ 364.049588] RSP: 0018:ffff9ca600b57ac0 EFLAGS: 00010286 [ 364.049590] RAX: 0000000000000000 RBX: ffff88b7c132b0c8 RCX: 0000000000000027 [ 364.049592] RDX: ffff88bb0f521688 RSI: 0000000000000001 RDI: ffff88bb0f521680 [ 364.049594] RBP: ffff9ca600b57b20 R08: 000000000000006f R09: ffff9ca600b57930 [ 364.049596] R10: ffff9ca600b57928 R11: ffffffffbcb46328 R12: 0000000000000000 [ 364.049597] R13: 0000000000000001 R14: ffff88b7c19c0700 R15: ffff88b7c9059800 [ 364.049599] FS: 00007fb2d3516e80(0000) GS:ffff88bb0f500000(0000) knlGS:0000000000000000 [ 364.049601] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 364.049603] CR2: 000055610bd03598 CR3: 00000001049f6000 CR4: 0000000000350ef0 [ 364.049605] Call Trace: [ 364.049607] <TASK> [ 364.049609] ? show_regs+0x6d/0x80 [ 364.049614] ? __warn+0x8c/0x140 [ 364.049618] ? debug_dma_map_sg+0x2dc/0x370 [ 364.049621] ? report_bug+0x193/0x1a0 [ 364.049627] ? handle_bug+0x46/0x80 [ 364.049631] ? exc_invalid_op+0x1d/0x80 [ 364.049635] ? asm_exc_invalid_op+0x1f/0x30 [ 364.049642] ? debug_dma_map_sg+0x2dc/0x370 [ 364.049647] __dma_map_sg_attrs+0x90/0xe0 [ 364.049651] dma_map_sgtable+0x25/0x40 [ 364.049654] amdgpu_bo_move+0x59a/0x850 [amdgpu] [ 364.049935] ? srso_return_thunk+0x5/0x5f [ 364.049939] ? amdgpu_ttm_tt_populate+0x5d/0xc0 [amdgpu] [ 364.050095] ttm_bo_handle_move_mem+0xc3/0x180 [ttm] [ 364.050103] ttm_bo_validate+0xc1/0x160 [ttm] [ 364.050108] ? amdgpu_ttm_tt_get_user_pages+0xe5/0x1b0 [amdgpu] [ 364.050263] amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0xa12/0xc90 [amdgpu] [ 364.050473] kfd_ioctl_alloc_memory_of_gpu+0x16b/0x3b0 [amdgpu] [ 364.050680] kfd_ioctl+0x3c2/0x530 [amdgpu] [ 364.050866] ? __pfx_kfd_ioctl_alloc_memory_of_gpu+0x10/0x10 [amdgpu] [ 364.051054] ? srso_return_thunk+0x5/0x5f [ 364.051057] ? tomoyo_file_ioctl+0x20/0x30 [ 364.051063] __x64_sys_ioctl+0x9c/0xd0 [ 364.051068] x64_sys_call+0x1219/0x20d0 [ 364.051073] do_syscall_64+0x51/0x120 [ 364.051077] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 364.051081] RIP: 0033:0x7fb2d2f1a94f Signed-off-by: Prike Liang <Prike.Liang(a)amd.com> Reviewed-by: Christian König <christian.koenig(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c index 8c3fb1562ffe..281daa55523e 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c @@ -1833,6 +1833,7 @@ int amdgpu_ttm_init(struct amdgpu_device *adev) mutex_init(&adev->mman.gtt_window_lock); + dma_set_max_seg_size(adev->dev, UINT_MAX); /* No others user of address space so set it to 0 */ r = ttm_device_init(&adev->mman.bdev, &amdgpu_bo_driver, adev->dev, adev_to_drm(adev)->anon_inode->i_mapping, -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2024-53224
by Pu Lehui 03 Jan '25

03 Jan '25

Jianbo Liu (1): IB/mlx5: Allocate resources just before first QP/SRQ is created Patrisious Haddad (1): RDMA/mlx5: Move events notifier registration to be after device registration drivers/infiniband/hw/mlx5/main.c | 185 ++++++++++++++++++--------- drivers/infiniband/hw/mlx5/mlx5_ib.h | 6 +- drivers/infiniband/hw/mlx5/qp.c | 4 + drivers/infiniband/hw/mlx5/srq.c | 4 + 4 files changed, 136 insertions(+), 63 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] drm/amdgpu: set the right AMDGPU sg segment limitation
by Zicheng Qu 03 Jan '25

03 Jan '25

From: Prike Liang <Prike.Liang(a)amd.com> stable inclusion from stable-v5.10.231 commit 13c3a54f48a612a117dfd82a9dd91732261e869d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOA CVE: CVE-2024-56594 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e2e97435783979124ba92d6870415c57ecfef6a5 ] The driver needs to set the correct max_segment_size; otherwise debug_dma_map_sg() will complain about the over-mapping of the AMDGPU sg length as following: WARNING: CPU: 6 PID: 1964 at kernel/dma/debug.c:1178 debug_dma_map_sg+0x2dc/0x370 [ 364.049444] Modules linked in: veth amdgpu(OE) amdxcp drm_exec gpu_sched drm_buddy drm_ttm_helper ttm(OE) drm_suballoc_helper drm_display_helper drm_kms_helper i2c_algo_bit rpcsec_gss_krb5 auth_rpcgss nfsv4 nfs lockd grace netfs xt_conntrack xt_MASQUERADE nf_conntrack_netlink xfrm_user xfrm_algo iptable_nat xt_addrtype iptable_filter br_netfilter nvme_fabrics overlay nfnetlink_cttimeout nfnetlink openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c bridge stp llc amd_atl intel_rapl_msr intel_rapl_common sunrpc sch_fq_codel snd_hda_codec_realtek snd_hda_codec_generic snd_hda_scodec_component snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg edac_mce_amd binfmt_misc snd_hda_codec snd_pci_acp6x snd_hda_core snd_acp_config snd_hwdep snd_soc_acpi kvm_amd snd_pcm kvm snd_seq_midi snd_seq_midi_event crct10dif_pclmul ghash_clmulni_intel sha512_ssse3 snd_rawmidi sha256_ssse3 sha1_ssse3 aesni_intel snd_seq nls_iso8859_1 crypto_simd snd_seq_device cryptd snd_timer rapl input_leds snd [ 364.049532] ipmi_devintf wmi_bmof ccp serio_raw k10temp sp5100_tco soundcore ipmi_msghandler cm32181 industrialio mac_hid msr parport_pc ppdev lp parport drm efi_pstore ip_tables x_tables pci_stub crc32_pclmul nvme ahci libahci i2c_piix4 r8169 nvme_core i2c_designware_pci realtek i2c_ccgx_ucsi video wmi hid_generic cdc_ether usbnet usbhid hid r8152 mii [ 364.049576] CPU: 6 PID: 1964 Comm: rocminfo Tainted: G OE 6.10.0-custom #492 [ 364.049579] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS RMJ1009A 06/13/2021 [ 364.049582] RIP: 0010:debug_dma_map_sg+0x2dc/0x370 [ 364.049585] Code: 89 4d b8 e8 36 b1 86 00 8b 4d b8 48 8b 55 b0 44 8b 45 a8 4c 8b 4d a0 48 89 c6 48 c7 c7 00 4b 74 bc 4c 89 4d b8 e8 b4 73 f3 ff <0f> 0b 4c 8b 4d b8 8b 15 c8 2c b8 01 85 d2 0f 85 ee fd ff ff 8b 05 [ 364.049588] RSP: 0018:ffff9ca600b57ac0 EFLAGS: 00010286 [ 364.049590] RAX: 0000000000000000 RBX: ffff88b7c132b0c8 RCX: 0000000000000027 [ 364.049592] RDX: ffff88bb0f521688 RSI: 0000000000000001 RDI: ffff88bb0f521680 [ 364.049594] RBP: ffff9ca600b57b20 R08: 000000000000006f R09: ffff9ca600b57930 [ 364.049596] R10: ffff9ca600b57928 R11: ffffffffbcb46328 R12: 0000000000000000 [ 364.049597] R13: 0000000000000001 R14: ffff88b7c19c0700 R15: ffff88b7c9059800 [ 364.049599] FS: 00007fb2d3516e80(0000) GS:ffff88bb0f500000(0000) knlGS:0000000000000000 [ 364.049601] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 364.049603] CR2: 000055610bd03598 CR3: 00000001049f6000 CR4: 0000000000350ef0 [ 364.049605] Call Trace: [ 364.049607] <TASK> [ 364.049609] ? show_regs+0x6d/0x80 [ 364.049614] ? __warn+0x8c/0x140 [ 364.049618] ? debug_dma_map_sg+0x2dc/0x370 [ 364.049621] ? report_bug+0x193/0x1a0 [ 364.049627] ? handle_bug+0x46/0x80 [ 364.049631] ? exc_invalid_op+0x1d/0x80 [ 364.049635] ? asm_exc_invalid_op+0x1f/0x30 [ 364.049642] ? debug_dma_map_sg+0x2dc/0x370 [ 364.049647] __dma_map_sg_attrs+0x90/0xe0 [ 364.049651] dma_map_sgtable+0x25/0x40 [ 364.049654] amdgpu_bo_move+0x59a/0x850 [amdgpu] [ 364.049935] ? srso_return_thunk+0x5/0x5f [ 364.049939] ? amdgpu_ttm_tt_populate+0x5d/0xc0 [amdgpu] [ 364.050095] ttm_bo_handle_move_mem+0xc3/0x180 [ttm] [ 364.050103] ttm_bo_validate+0xc1/0x160 [ttm] [ 364.050108] ? amdgpu_ttm_tt_get_user_pages+0xe5/0x1b0 [amdgpu] [ 364.050263] amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0xa12/0xc90 [amdgpu] [ 364.050473] kfd_ioctl_alloc_memory_of_gpu+0x16b/0x3b0 [amdgpu] [ 364.050680] kfd_ioctl+0x3c2/0x530 [amdgpu] [ 364.050866] ? __pfx_kfd_ioctl_alloc_memory_of_gpu+0x10/0x10 [amdgpu] [ 364.051054] ? srso_return_thunk+0x5/0x5f [ 364.051057] ? tomoyo_file_ioctl+0x20/0x30 [ 364.051063] __x64_sys_ioctl+0x9c/0xd0 [ 364.051068] x64_sys_call+0x1219/0x20d0 [ 364.051073] do_syscall_64+0x51/0x120 [ 364.051077] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 364.051081] RIP: 0033:0x7fb2d2f1a94f Signed-off-by: Prike Liang <Prike.Liang(a)amd.com> Reviewed-by: Christian König <christian.koenig(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c index 7d4a54025e18..06a0cef24c6d 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c @@ -1885,6 +1885,7 @@ int amdgpu_ttm_init(struct amdgpu_device *adev) mutex_init(&adev->mman.gtt_window_lock); + dma_set_max_seg_size(adev->dev, UINT_MAX); /* No others user of address space so set it to 0 */ r = ttm_bo_device_init(&adev->mman.bdev, &amdgpu_bo_driver, -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2024-56609
by Zicheng Qu 03 Jan '25

03 Jan '25

CVE-2024-56609 Ping-Ke Shih (2): wifi: mac80211: export ieee80211_purge_tx_queue() for drivers wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb drivers/net/wireless/realtek/rtw88/sdio.c | 6 +++--- drivers/net/wireless/realtek/rtw88/usb.c | 5 +++-- include/net/mac80211.h | 13 +++++++++++++ net/mac80211/ieee80211_i.h | 2 -- net/mac80211/status.c | 1 + 5 files changed, 20 insertions(+), 7 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] The bugfix for LPM trie
by Tengda Wu 03 Jan '25

03 Jan '25

This is a small bugfix for bpf LPM trie. Hou Tao (2): bpf: Handle BPF_EXIST and BPF_NOEXIST for LPM trie bpf: Handle in-place update for full LPM trie correctly kernel/bpf/lpm_trie.c | 44 +++++++++++++++++++++++++++++-------------- 1 file changed, 30 insertions(+), 14 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] The bugfix for LPM trie
by Tengda Wu 03 Jan '25

03 Jan '25

This is a small bugfix for LPM trie. Hou Tao (2): bpf: Handle BPF_EXIST and BPF_NOEXIST for LPM trie bpf: Handle in-place update for full LPM trie correctly kernel/bpf/lpm_trie.c | 44 +++++++++++++++++++++++++++++-------------- 1 file changed, 30 insertions(+), 14 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-53158
by Lin Yujun 03 Jan '25

03 Jan '25

Dan Carpenter (1): soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() drivers/soc/qcom/qcom-geni-se.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] netlink: terminate outstanding dump on socket close
by Wang Liang 03 Jan '25

03 Jan '25

From: Jakub Kicinski <kuba(a)kernel.org> stable inclusion from stable-v4.19.325 commit 114a61d8d94ae3a43b82446cf737fd757021b834 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB956K CVE: CVE-2024-53140 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1904fb9ebf911441f90a68e96b22aa73e4410505 ] Netlink supports iterative dumping of data. It provides the families the following ops: - start - (optional) kicks off the dumping process - dump - actual dump helper, keeps getting called until it returns 0 - done - (optional) pairs with .start, can be used for cleanup The whole process is asynchronous and the repeated calls to .dump don't actually happen in a tight loop, but rather are triggered in response to recvmsg() on the socket. This gives the user full control over the dump, but also means that the user can close the socket without getting to the end of the dump. To make sure .start is always paired with .done we check if there is an ongoing dump before freeing the socket, and if so call .done. The complication is that sockets can get freed from BH and .done is allowed to sleep. So we use a workqueue to defer the call, when needed. Unfortunately this does not work correctly. What we defer is not the cleanup but rather releasing a reference on the socket. We have no guarantee that we own the last reference, if someone else holds the socket they may release it in BH and we're back to square one. The whole dance, however, appears to be unnecessary. Only the user can interact with dumps, so we can clean up when socket is closed. And close always happens in process context. Some async code may still access the socket after close, queue notification skbs to it etc. but no dumps can start, end or otherwise make progress. Delete the workqueue and flush the dump state directly from the release handler. Note that further cleanup is possible in -next, for instance we now always call .done before releasing the main module reference, so dump doesn't have to take a reference of its own. Reported-by: syzkaller <syzkaller(a)googlegroups.com> Fixes: ed5d7788a934 ("netlink: Do not schedule work from sk_destruct") Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20241106015235.2458807-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/netlink/af_netlink.c | 31 ++++++++----------------------- net/netlink/af_netlink.h | 2 -- 2 files changed, 8 insertions(+), 25 deletions(-) diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c index 766096493494..9f3cf7e5cce0 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -393,15 +393,6 @@ static void netlink_skb_set_owner_r(struct sk_buff *skb, struct sock *sk) static void netlink_sock_destruct(struct sock *sk) { - struct netlink_sock *nlk = nlk_sk(sk); - - if (nlk->cb_running) { - if (nlk->cb.done) - nlk->cb.done(&nlk->cb); - module_put(nlk->cb.module); - kfree_skb(nlk->cb.skb); - } - skb_queue_purge(&sk->sk_receive_queue); if (!sock_flag(sk, SOCK_DEAD)) { @@ -414,14 +405,6 @@ static void netlink_sock_destruct(struct sock *sk) WARN_ON(nlk_sk(sk)->groups); } -static void netlink_sock_destruct_work(struct work_struct *work) -{ - struct netlink_sock *nlk = container_of(work, struct netlink_sock, - work); - - sk_free(&nlk->sk); -} - /* This lock without WQ_FLAG_EXCLUSIVE is good on UP and it is _very_ bad on * SMP. Look, when several writers sleep and reader wakes them up, all but one * immediately hit write lock and grab all the cpus. Exclusive sleep solves @@ -738,12 +721,6 @@ static void deferred_put_nlk_sk(struct rcu_head *head) if (!refcount_dec_and_test(&sk->sk_refcnt)) return; - if (nlk->cb_running && nlk->cb.done) { - INIT_WORK(&nlk->work, netlink_sock_destruct_work); - schedule_work(&nlk->work); - return; - } - sk_free(sk); } @@ -793,6 +770,14 @@ static int netlink_release(struct socket *sock) NETLINK_URELEASE, &n); } + /* Terminate any outstanding dump */ + if (nlk->cb_running) { + if (nlk->cb.done) + nlk->cb.done(&nlk->cb); + module_put(nlk->cb.module); + kfree_skb(nlk->cb.skb); + } + module_put(nlk->module); if (netlink_is_kernel(sk)) { diff --git a/net/netlink/af_netlink.h b/net/netlink/af_netlink.h index 962de7b3c023..c61e634693ea 100644 --- a/net/netlink/af_netlink.h +++ b/net/netlink/af_netlink.h @@ -4,7 +4,6 @@ #include <linux/rhashtable.h> #include <linux/atomic.h> -#include <linux/workqueue.h> #include <net/sock.h> /* flags */ @@ -45,7 +44,6 @@ struct netlink_sock { struct rhash_head node; struct rcu_head rcu; - struct work_struct work; }; static inline struct netlink_sock *nlk_sk(struct sock *sk) -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 4c116febc8d53bc1f8f25a3d60db331f17ab8cd8
by kernel test robot 03 Jan '25

03 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 4c116febc8d53bc1f8f25a3d60db331f17ab8cd8 !14398 printk: Skip log flush in NMI context when logbuf_lock is held Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202501022347.2K2GsA8U-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202501030757.m59EWrOL-lkp@intel.com drivers/gpu/drm/phytium/phytium_debugfs.c:340:35-56: opportunity for str_yes_no(phytium_dp -> has_audio) drivers/gpu/drm/phytium/phytium_dp.c:1279:10-34: opportunity for str_enable_disable(mode == DRM_MODE_DPMS_ON) drivers/gpu/drm/phytium/phytium_panel.c:79:10-16: opportunity for str_enable_disable(enable) drivers/media/i2c/adv7511-v4l2.o: warning: objtool: adv7511_set_fmt()+0x805: unreachable instruction sound/pci/lola/lola_clock.o: warning: objtool: lola_sample_rate_convert()+0x46: can't find switch jump table Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-defconfig | `-- net-ipv4-route.c:warning:array-subscript-is-outside-array-bounds-of-struct-fib_nh |-- arm64-randconfig-001-20250102 | |-- drivers-iommu-arm-smmu-v3.c:error:CONFIG_CMA_ALIGNMENT-undeclared-(first-use-in-this-function) | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- fs-ocfs2-alloc.c:warning:array-subscript-idx-is-outside-array-bounds-of-struct-ocfs2_extent_rec | |-- fs-ocfs2-alloc.c:warning:array-subscript-tail_index-is-outside-array-bounds-of-struct-ocfs2_truncate_rec | |-- fs-ocfs2-xattr.c:warning:array-subscript-count-is-outside-array-bounds-of-struct-ocfs2_xattr_entry | |-- include-linux-kernel.h:error:first-argument-to-__builtin_choose_expr-not-a-constant | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | |-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled | `-- net-ipv4-route.c:warning:array-subscript-is-outside-array-bounds-of-struct-fib_nh |-- arm64-randconfig-002-20250102 | |-- aarch64-linux-ld:binfmt_elf32.c:(.text):undefined-reference-to-elf_core_extra_data_size | |-- aarch64-linux-ld:binfmt_elf32.c:(.text):undefined-reference-to-elf_core_write_extra_data | |-- aarch64-linux-ld:binfmt_elf32.c:(.text):undefined-reference-to-elf_core_write_extra_phdrs | |-- aarch64-linux-ld:super.c:(.init.text):undefined-reference-to-__netlink_kernel_create | |-- aarch64-linux-ld:super.c:(.init.text):undefined-reference-to-init_net | |-- aarch64-linux-ld:super.c:(.text):undefined-reference-to-__nlmsg_put | |-- aarch64-linux-ld:super.c:(.text):undefined-reference-to-kfree_skb | |-- aarch64-linux-ld:super.c:(.text):undefined-reference-to-netlink_broadcast | |-- binfmt_elf32.c:(.text):undefined-reference-to-elf_core_extra_phdrs | |-- drivers-staging-gmjstcm-tcm_tis_spi.c:warning:tcm_tis_spi_acpi_match-defined-but-not-used | |-- super.c:(.exit.text):undefined-reference-to-netlink_kernel_release | |-- super.c:(.init.text):undefined-reference-to-init_net | `-- super.c:(.text):undefined-reference-to-__alloc_skb |-- arm64-randconfig-003-20250102 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | |-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled | |-- sound-soc-codecs-88pm86-codec.c:warning:aif1_mux-defined-but-not-used | `-- sound-soc-codecs-88pm86-codec.c:warning:pcm_switch_controls-defined-but-not-used |-- arm64-randconfig-004-20250102 | |-- drivers-tty-serial-sc16is7xx.c:warning:label-err_i2c-defined-but-not-used | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-r064-20250103 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-gpu-drm-phytium-phytium_debugfs.c:opportunity-for-str_enabled_disabled(phytium_dp-panel-.-backlight_enabled) | |-- drivers-gpu-drm-phytium-phytium_debugfs.c:opportunity-for-str_enabled_disabled(phytium_dp-panel-.-power_enabled) | |-- drivers-gpu-drm-phytium-phytium_debugfs.c:opportunity-for-str_yes_no(phytium_dp-has_audio) | |-- drivers-gpu-drm-phytium-phytium_dp.c:opportunity-for-str_enable_disable(mode-DRM_MODE_DPMS_ON) | |-- drivers-gpu-drm-phytium-phytium_panel.c:opportunity-for-str_enable_disable(enable) | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-allnoconfig | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- drivers-net-ethernet-hisilicon-hns3-hns3_extension-hns3_enet_it.c:warning:no-previous-prototype-for-function-hns3_nic_select_queue_it | `-- samples-vfio-mdev-.tmp_mdpy-fb.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-001-20250102 | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-buildonly-randconfig-002-20250102 | |-- arch-x86-kernel-idt.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-char-tpm-eventlog-efi.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-char-tpm-eventlog-of.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-fpga-dfl-fme-mgr.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-gpu-drm-panel-panel-ilitek-ili9881c.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-hwmon-mlxreg-fan.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-hwtracing-intel_th-debug.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-iio-dac-ti-dac5571.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-light-tsl2772.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-dvb-frontends-dvb-pll.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-dvb-frontends-lgdt33.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-dvb-frontends-mn88443x.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-tuners-qm1d1b0004.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-net-phy-mdio-mscc-miim.o:warning:objtool:missing-symbol-for-section-.init.text | |-- fs-autofs-init.o:warning:objtool:missing-symbol-for-section-.init.text | |-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | |-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled | `-- net-sched-sch_etf.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-003-20250102 | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-buildonly-randconfig-004-20250102 | |-- drivers-media-i2c-adv7511-v4l2.o:warning:objtool:adv7511_set_fmt:unreachable-instruction | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-005-20250102 | |-- drivers-tty-serial-sc16is7xx.c:warning:label-err_i2c-defined-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-buildonly-randconfig-006-20250102 | |-- drivers-char-tpm-eventlog-.tmp_common.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-hwtracing-intel_th-.tmp_msu-sink.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-input-keyboard-.tmp_mtk-pmic-keys.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-mmc-core-.tmp_core.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-staging-greybus-.tmp_core.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- fs-notify-.tmp_fdinfo.o:warning:objtool:missing-symbol-for-section-.text | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-defconfig | |-- kernel-sched-pelt.o:warning:objtool:missing-symbol-for-section-.text | |-- net-ipv4-metrics.o:warning:objtool:missing-symbol-for-section-.text | `-- net-ipv4-netlink.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-randconfig-101-20250103 | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-102-20250103 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-103-20250103 | `-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace |-- x86_64-randconfig-104-20250101 | `-- sound-pci-lola-lola_clock.o:warning:objtool:lola_sample_rate_convert:can-t-find-switch-jump-table |-- x86_64-randconfig-104-20250103 | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-123-20250102 | `-- sound-usb-validate.c:sparse:sparse:restricted-__le16-degrades-to-integer |-- x86_64-randconfig-161-20250103 | |-- block-blk-io-hierarchy-debugfs.c:error:implicit-declaration-of-function-hierarchy_show_slow_io-Werror-Wimplicit-function-declaration | |-- drivers-gpu-drm-nouveau-nvkm-subdev-clk-nv50.o:warning:objtool:nv50_clk_read:can-t-find-switch-jump-table | |-- drivers-gpu-drm-nouveau-nvkm-subdev-therm-temp.o:warning:objtool:nvkm_therm_sensor_event:can-t-find-switch-jump-table | |-- drivers-media-i2c-saa7115.o:warning:objtool:saa711x_querystd:can-t-find-switch-jump-table | |-- drivers-of-dynamic.o:warning:objtool:of_reconfig_get_state_change:can-t-find-switch-jump-table | |-- fs-select.o:warning:objtool:poll_select_finish:can-t-find-switch-jump-table | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-r054-20250103 | |-- include-linux-kern_levels.h:warning:format-d-expects-argument-of-type-int-but-argument-has-type-long-unsigned-int | |-- include-linux-kern_levels.h:warning:format-lu-expects-argument-of-type-long-unsigned-int-but-argument-has-type-int | |-- include-linux-kern_levels.h:warning:format-lx-expects-argument-of-type-long-unsigned-int-but-argument-has-type-const-long-unsigned-int | |-- include-linux-kern_levels.h:warning:format-p-expects-a-matching-void-argument | |-- include-linux-kern_levels.h:warning:format-p-expects-argument-of-type-void-but-argument-has-type-long-unsigned-int | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled `-- x86_64-randconfig-r062-20250103 |-- block-blk-throttle.c:preceding-lock-on-line |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- kernel-sched-debug.c:error:struct-dyn_affinity_stats-has-no-member-named-nr_wakeups_force_preferred_cpus `-- kernel-sched-debug.c:error:struct-dyn_affinity_stats-has-no-member-named-nr_wakeups_preferred_cpus elapsed time: 725m configs tested: 16 configs skipped: 128 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250102 gcc-14.2.0 arm64 randconfig-002-20250102 gcc-14.2.0 arm64 randconfig-003-20250102 gcc-14.2.0 arm64 randconfig-004-20250102 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250102 gcc-12 x86_64 buildonly-randconfig-002-20250102 gcc-12 x86_64 buildonly-randconfig-003-20250102 gcc-12 x86_64 buildonly-randconfig-004-20250102 clang-19 x86_64 buildonly-randconfig-005-20250102 gcc-12 x86_64 buildonly-randconfig-006-20250102 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog
by Pu Lehui 03 Jan '25

03 Jan '25

From: Jiri Olsa <jolsa(a)kernel.org> stable inclusion from stable-v6.6.67 commit c2b6b47662d5f2dfce92e5ffbdcac8229f321d9d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAN1 CVE: CVE-2024-56665 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 978c4486cca5c7b9253d3ab98a88c8e769cb9bbd upstream. Syzbot reported [1] crash that happens for following tracing scenario: - create tracepoint perf event with attr.inherit=1, attach it to the process and set bpf program to it - attached process forks -> chid creates inherited event the new child event shares the parent's bpf program and tp_event (hence prog_array) which is global for tracepoint - exit both process and its child -> release both events - first perf_event_detach_bpf_prog call will release tp_event->prog_array and second perf_event_detach_bpf_prog will crash, because tp_event->prog_array is NULL The fix makes sure the perf_event_detach_bpf_prog checks prog_array is valid before it tries to remove the bpf program from it. [1] https://lore.kernel.org/bpf/Z1MR6dCIKajNS6nU@krava/T/#m91dbf0688221ec7a7fc9… Fixes: 0ee288e69d03 ("bpf,perf: Fix perf_event_detach_bpf_prog error handling") Reported-by: syzbot+2e0d2840414ce817aaac(a)syzkaller.appspotmail.com Signed-off-by: Jiri Olsa <jolsa(a)kernel.org> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Link: https://lore.kernel.org/bpf/20241208142507.1207698-1-jolsa@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/trace/bpf_trace.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index b084fe1dbe12..4485f5f383cc 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -2216,6 +2216,9 @@ void perf_event_detach_bpf_prog(struct perf_event *event) goto unlock; old_array = bpf_event_rcu_dereference(event->tp_event->prog_array); + if (!old_array) + goto put; + ret = bpf_prog_array_copy(old_array, event->prog, NULL, 0, &new_array); if (ret < 0) { bpf_prog_array_delete_safe(old_array, event->prog); @@ -2224,6 +2227,7 @@ void perf_event_detach_bpf_prog(struct perf_event *event) bpf_prog_array_free_sleepable(old_array); } +put: /* * It could be that the bpf_prog is not sleepable (and will be freed * via normal RCU), but is called from a point that supports sleepable -- 2.34.1

2 1

[openeuler:OLK-6.6] BUILD REGRESSION c2f1662c3fb301fe7ba127fe06c14538112982d4
by kernel test robot 03 Jan '25

03 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: c2f1662c3fb301fe7ba127fe06c14538112982d4 !14102 OLK-6.6-fix-CVE-2024-49906 Error/Warning (recently discovered and may have been fixed): ./samples/trace_events/trace_custom_sched.c: 11 linux/version.h not needed. drivers/net/ethernet/huawei/hinic/hinic_lld.c:2138:10: error: use of undeclared identifier 'disable_vf_load' Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-CRYPTO_DRBG_CTR-when-selected-by-CRYPTO_DEV_HISI_TRNG | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-HALTPOLL_CPUIDLE-when-selected-by-ARM64 |-- arm64-randconfig-001-20241231 | `-- drivers-net-ethernet-huawei-hinic-hinic_lld.c:error:use-of-undeclared-identifier-disable_vf_load |-- loongarch-allmodconfig | |-- arch-loongarch-kernel-paravirt.c:error:KVM_HCALL_FUNC_PV_IPI-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:mp_ops-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-paravt_steal_clock | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-parse_no_stealacc | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_cpu_reboot | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_disable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_enable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_nb | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_notify | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_down_prepare | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_online | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_init | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-steal_acc | |-- arch-loongarch-kernel-paravirt.c:warning:paravt_steal_clock-defined-but-not-used | |-- arch-loongarch-kvm-intc-pch_pic.c:warning:variable-ret-set-but-not-used | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-e-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-irq_source_id-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-kvm-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-level-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-line_status-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpu-set-but-not-used | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpus-set-but-not-used | |-- drivers-iommu-loongarch_iommu.c:warning:Function-parameter-or-member-ivrs-not-described-in-get_highest_supported_ivhd_type | |-- drivers-iommu-loongarch_iommu.c:warning:la_iommu_setup-defined-but-not-used | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-check_device_compat | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-create_rlookup_entry | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_attach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_deattach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-find_iommu_by_dev | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-get_iommu_info_from_dom | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-iommu_init_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-la_iommu_probe_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-lookup_rlooptable | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-loongarch_get_iommu_by_devid | |-- drivers-scsi-leapioraid-leapioraid_func.c:warning:mq-poll-directive-output-may-be-truncated-writing-bytes-into-a-region-of-size-between-and | |-- drivers-scsi-leapioraid-leapioraid_func.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- include-linux-init.h:error:redefinition-of-parse_no_stealacc | `-- include-linux-init.h:error:redefinition-of-str_parse_no_stealacc |-- loongarch-allnoconfig | |-- arch-loongarch-kernel-efi.c:error:implicit-declaration-of-function-pmd_mkhuge | |-- arch-loongarch-kernel-efi.c:error:incompatible-types-when-assigning-to-type-pmd_t-from-type-int | |-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) | `-- include-linux-suspend.h:error:expected-)-before-numeric-constant |-- loongarch-allyesconfig | |-- arch-loongarch-kernel-paravirt.c:error:KVM_HCALL_FUNC_PV_IPI-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:mp_ops-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-paravt_steal_clock | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-parse_no_stealacc | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_cpu_reboot | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_disable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_enable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_nb | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_notify | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_down_prepare | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_online | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_init | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-steal_acc | |-- arch-loongarch-kernel-paravirt.c:warning:paravt_steal_clock-defined-but-not-used | |-- arch-loongarch-kvm-intc-pch_pic.c:warning:variable-ret-set-but-not-used | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-e-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-irq_source_id-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-kvm-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-level-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-line_status-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpu-set-but-not-used | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpus-set-but-not-used | |-- drivers-iommu-loongarch_iommu.c:warning:Function-parameter-or-member-ivrs-not-described-in-get_highest_supported_ivhd_type | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-check_device_compat | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-create_rlookup_entry | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_attach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_deattach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-find_iommu_by_dev | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-get_iommu_info_from_dom | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-iommu_init_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-la_iommu_probe_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-lookup_rlooptable | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-loongarch_get_iommu_by_devid | |-- drivers-scsi-leapioraid-leapioraid_func.c:warning:mq-poll-directive-output-may-be-truncated-writing-bytes-into-a-region-of-size-between-and | |-- drivers-scsi-leapioraid-leapioraid_func.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- include-linux-init.h:error:redefinition-of-parse_no_stealacc | `-- include-linux-init.h:error:redefinition-of-str_parse_no_stealacc |-- loongarch-defconfig | |-- arch-loongarch-kvm-intc-pch_pic.c:warning:variable-ret-set-but-not-used | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-e-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-irq_source_id-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-kvm-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-level-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-line_status-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpu-set-but-not-used | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpus-set-but-not-used | |-- drivers-iommu-loongarch_iommu.c:warning:Function-parameter-or-member-ivrs-not-described-in-get_highest_supported_ivhd_type | |-- drivers-iommu-loongarch_iommu.c:warning:la_iommu_setup-defined-but-not-used | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-check_device_compat | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-create_rlookup_entry | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_attach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_deattach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-find_iommu_by_dev | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-get_iommu_info_from_dom | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-iommu_init_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-la_iommu_probe_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-lookup_rlooptable | `-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-loongarch_get_iommu_by_devid |-- loongarch-randconfig-001-20250102 | |-- arch-loongarch-kernel-efi.c:error:implicit-declaration-of-function-pmd_mkhuge | |-- arch-loongarch-kernel-efi.c:error:incompatible-types-when-assigning-to-type-pmd_t-from-type-int | |-- arch-loongarch-kernel-paravirt.c:error:KVM_HCALL_FUNC_PV_IPI-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:mp_ops-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-paravt_steal_clock | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-parse_no_stealacc | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_cpu_reboot | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_disable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_enable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_nb | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_notify | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_down_prepare | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_online | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_init | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-steal_acc | |-- arch-loongarch-kernel-paravirt.c:warning:paravt_steal_clock-defined-but-not-used | |-- arch-loongarch-kvm-intc-pch_pic.c:warning:variable-ret-set-but-not-used | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-e-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-irq_source_id-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-kvm-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-level-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-line_status-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpu-set-but-not-used | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpus-set-but-not-used | |-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) | |-- include-linux-init.h:error:redefinition-of-parse_no_stealacc | |-- include-linux-init.h:error:redefinition-of-str_parse_no_stealacc | `-- include-linux-suspend.h:error:expected-)-before-numeric-constant |-- loongarch-randconfig-002-20250102 | |-- arch-loongarch-kernel-paravirt.c:error:KVM_HCALL_FUNC_PV_IPI-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:mp_ops-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-paravt_steal_clock | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-parse_no_stealacc | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_cpu_reboot | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_disable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_enable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_nb | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_notify | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_down_prepare | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_online | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_init | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-steal_acc | |-- arch-loongarch-kernel-paravirt.c:warning:paravt_steal_clock-defined-but-not-used | |-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) | |-- include-linux-init.h:error:redefinition-of-parse_no_stealacc | `-- include-linux-init.h:error:redefinition-of-str_parse_no_stealacc |-- loongarch-randconfig-r052-20250103 | |-- arch-loongarch-kernel-paravirt.c:error:KVM_HCALL_FUNC_PV_IPI-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:mp_ops-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-paravt_steal_clock | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-parse_no_stealacc | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_cpu_reboot | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_disable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_enable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_nb | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_notify | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_down_prepare | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_online | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_init | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-steal_acc | |-- arch-loongarch-kernel-paravirt.c:warning:paravt_steal_clock-defined-but-not-used | |-- arch-loongarch-kernel-smp.c:WARNING:Unsigned-expression-compared-with-zero:cpu | |-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) | |-- include-linux-init.h:error:redefinition-of-parse_no_stealacc | |-- include-linux-init.h:error:redefinition-of-str_parse_no_stealacc | `-- include-linux-suspend.h:error:expected-)-before-numeric-constant |-- loongarch-randconfig-r112-20250103 | |-- arch-loongarch-kernel-dma.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-void-volatile | |-- arch-loongarch-kernel-efi.c:error:implicit-declaration-of-function-pmd_mkhuge | |-- arch-loongarch-kernel-efi.c:error:incompatible-types-when-assigning-to-type-pmd_t-from-type-int | |-- arch-loongarch-kernel-kfpu.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-ptr-got-bool-noderef-__percpu | |-- arch-loongarch-kernel-legacy_boot.c:sparse:sparse:symbol-pchlpc_default-was-not-declared.-Should-it-be-static | |-- arch-loongarch-kernel-paravirt.c:error:KVM_HCALL_FUNC_PV_IPI-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:mp_ops-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-paravt_steal_clock | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-parse_no_stealacc | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_cpu_reboot | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_disable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_enable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_nb | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_notify | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_down_prepare | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_online | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_init | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-steal_acc | |-- arch-loongarch-kernel-paravirt.c:warning:paravt_steal_clock-defined-but-not-used | |-- arch-loongarch-kvm-intc-pch_pic.c:warning:variable-ret-set-but-not-used | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-e-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-irq_source_id-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-kvm-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-level-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-line_status-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpu-set-but-not-used | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpus-set-but-not-used | |-- drivers-acpi-pptt.c:sparse:sparse:symbol-acpi_pptt_for_each_container-was-not-declared.-Should-it-be-static | |-- drivers-char-loongson_se.c:sparse:sparse:incorrect-type-in-argument-(different-modifiers)-expected-struct-miscdevice-misc-got-struct-miscdevice-const | |-- drivers-char-lsse_sdf_cdev.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-char-buf-got-char-noderef-__user-buf | |-- drivers-char-lsse_sdf_cdev.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-char-const-buf-got-char-const-noderef-__user-buf | |-- drivers-char-lsse_sdf_cdev.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-char-const-buf | |-- drivers-char-lsse_sdf_cdev.c:sparse:sparse:incorrect-type-in-argument-(different-modifiers)-expected-struct-miscdevice-misc-got-struct-miscdevice-const | |-- drivers-pci-controller-pci-loongson.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-volatile-noderef-__iomem-addr-got-void-volatile | |-- include-linux-cpuidle.h:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-ptr-got-int-noderef-__percpu | |-- include-linux-cpuidle.h:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-ptr-got-unsigned-int-noderef-__percpu | |-- include-linux-entry-common.h:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-ptr-got-int-noderef-__percpu | |-- include-linux-entry-common.h:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-ptr-got-unsigned-int-noderef-__percpu | |-- include-linux-init.h:error:redefinition-of-parse_no_stealacc | |-- include-linux-init.h:error:redefinition-of-str_parse_no_stealacc | |-- mm-gup.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-ptr-got-int-noderef-__percpu | |-- mm-gup.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-ptr-got-unsigned-int-noderef-__percpu | `-- mm-show_mem.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-ptr-got-int-noderef-__percpu |-- x86_64-allnoconfig | |-- drivers-scsi-leapioraid-leapioraid_app.c:leapioraid_func.h-is-included-more-than-once. | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-ACPI_HOTPLUG_IGNORE_OSC-when-selected-by-X86 | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-VFIO_MDEV-when-selected-by-CRYPTO_DEV_HCT | `-- samples-trace_events-trace_custom_sched.c:linux-version.h-not-needed. |-- x86_64-allyesconfig | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-sm3_generic_block_fn | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-zx_sm3_finup | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-zx_sm3_update | |-- arch-x86-crypto-sm4-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-gmi_sm4_set_key | |-- arch-x86-kernel-cpu-hygon.c:warning:no-previous-prototype-for-function-get_nt_block_copy_mini_len | |-- arch-x86-kernel-cpu-hygon.c:warning:no-previous-prototype-for-function-set_c86_features_para_invalid | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpustate_free_space | |-- arch-x86-kvm-svm-csv.c:warning:no-previous-prototype-for-function-csv_vm_attestation | |-- arch-x86-kvm-svm-sev.c:warning:no-previous-prototype-for-function-sev_install_hooks | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-add_sgpio_zhaoxin | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-ahci_wait_em_reset | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-ahci_zhaoxin_set_em_sgpio | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-ahci_zhaoxin_set_em_sgpio_gpmode | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-remove_sgpio_zhaoxin | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-set_em_messages | |-- drivers-gpu-drm-amd-amdgpu-..-amdkfd-kfd_topology.c:warning:stack-frame-size-()-exceeds-limit-()-in-kfd_topology_add_device | |-- drivers-gpu-drm-amd-amdgpu-..-display-dc-dml-calcs-dcn_calc_auto.c:warning:stack-frame-size-()-exceeds-limit-()-in-mode_support_and_system_configuration | |-- drivers-gpu-drm-amd-amdgpu-..-display-dc-dml-dcn30-display_mode_vba_30.c:warning:stack-frame-size-()-exceeds-limit-()-in-dml30_ModeSupportAndSystemConfigurationFull | |-- net-ipv4-tcp_comp.c:warning:no-previous-prototype-for-function-comp_setup_strp | `-- net-ipv4-tcp_comp.c:warning:no-previous-prototype-for-function-comp_stream_read |-- x86_64-buildonly-randconfig-001-20250102 | `-- vmlinux.o:warning:objtool:.text:unreachable-instruction |-- x86_64-buildonly-randconfig-002-20250102 | `-- kernel-sched-isolation.c:error:setup_max_cpus-undeclared-(first-use-in-this-function) |-- x86_64-buildonly-randconfig-004-20250102 | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-add_sgpio_zhaoxin | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-ahci_wait_em_reset | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-ahci_zhaoxin_set_em_sgpio | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-ahci_zhaoxin_set_em_sgpio_gpmode | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-remove_sgpio_zhaoxin | `-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-set_em_messages |-- x86_64-buildonly-randconfig-005-20250102 | `-- kernel-sched-isolation.c:error:setup_max_cpus-undeclared-(first-use-in-this-function) `-- x86_64-randconfig-161-20250103 |-- drivers-ata-ahci_zhaoxin_sgpio.c-ahci_wait_em_reset()-warn:variable-dereferenced-before-check-sgpio_zhaoxin-(see-line-) |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-add_sgpio_zhaoxin |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-ahci_wait_em_reset |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-ahci_zhaoxin_set_em_sgpio |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-ahci_zhaoxin_set_em_sgpio_gpmode |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-remove_sgpio_zhaoxin |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-set_em_messages |-- drivers-gpu-drm-amd-amdgpu-..-display-dc-dcn32-dcn32_hwseq.c-dcn32_apply_idle_power_optimizations()-warn:variable-dereferenced-before-check-dc-current_state-(see-line-) |-- drivers-gpu-drm-amd-amdgpu-..-display-dc-link-link_dpms.c-link_set_dpms_on()-warn:if-statement-not-indented `-- drivers-gpu-drm-amd-amdgpu-..-display-dc-link-protocols-link_dp_training_dpia.c-dpia_training_eq_non_transparent()-error:uninitialized-symbol-wait_time_microsec-. elapsed time: 722m configs tested: 21 configs skipped: 124 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250102 clang-20 arm64 randconfig-002-20250102 gcc-14.2.0 arm64 randconfig-003-20250102 clang-20 arm64 randconfig-004-20250102 gcc-14.2.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch defconfig gcc-14.2.0 loongarch randconfig-001-20250102 gcc-14.2.0 loongarch randconfig-002-20250102 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250102 gcc-12 x86_64 buildonly-randconfig-002-20250102 gcc-12 x86_64 buildonly-randconfig-003-20250102 gcc-12 x86_64 buildonly-randconfig-004-20250102 clang-19 x86_64 buildonly-randconfig-005-20250102 gcc-12 x86_64 buildonly-randconfig-006-20250102 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1365/1365] kernel/sched/debug.c:990:29: error: 'struct dyn_affinity_stats' has no member named 'nr_wakeups_preferred_cpus'
by kernel test robot 03 Jan '25

03 Jan '25

Hi Hui, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4c116febc8d53bc1f8f25a3d60db331f17ab8cd8 commit: ebca52abe099caa97d7669d0acc71209ea80cfec [1365/1365] sched: Add statistics for scheduler dynamic affinity config: x86_64-randconfig-r062-20250103 (https://download.01.org/0day-ci/archive/20250103/202501030826.kEDgBIqw-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250103/202501030826.kEDgBIqw-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501030826.kEDgBIqw-lkp@intel.com/ All errors (new ones prefixed by >>): kernel/sched/debug.c:815:6: warning: no previous prototype for 'sysrq_sched_debug_tidy' [-Wmissing-prototypes] 815 | void sysrq_sched_debug_tidy(void) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/sched/debug.c: In function 'proc_sched_show_task': >> kernel/sched/debug.c:990:29: error: 'struct dyn_affinity_stats' has no member named 'nr_wakeups_preferred_cpus' 990 | __P(dyn_affi->nr_wakeups_preferred_cpus); | ^~ kernel/sched/debug.c:21:31: note: in definition of macro 'SEQ_printf' 21 | seq_printf(m, x); \ | ^ kernel/sched/debug.c:990:17: note: in expansion of macro '__P' 990 | __P(dyn_affi->nr_wakeups_preferred_cpus); | ^~~ In file included from include/linux/kernel.h:14, from arch/x86/include/asm/percpu.h:45, from arch/x86/include/asm/current.h:6, from include/linux/sched.h:12, from kernel/sched/sched.h:5, from kernel/sched/debug.c:12: >> kernel/sched/debug.c:990:29: error: 'struct dyn_affinity_stats' has no member named 'nr_wakeups_preferred_cpus' 990 | __P(dyn_affi->nr_wakeups_preferred_cpus); | ^~ include/linux/printk.h:362:33: note: in definition of macro 'pr_cont' 362 | printk(KERN_CONT fmt, ##__VA_ARGS__) | ^~~~~~~~~~~ kernel/sched/debug.c:939:9: note: in expansion of macro 'SEQ_printf' 939 | SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) | ^~~~~~~~~~ kernel/sched/debug.c:990:17: note: in expansion of macro '__P' 990 | __P(dyn_affi->nr_wakeups_preferred_cpus); | ^~~ >> kernel/sched/debug.c:991:29: error: 'struct dyn_affinity_stats' has no member named 'nr_wakeups_force_preferred_cpus' 991 | __P(dyn_affi->nr_wakeups_force_preferred_cpus); | ^~ kernel/sched/debug.c:21:31: note: in definition of macro 'SEQ_printf' 21 | seq_printf(m, x); \ | ^ kernel/sched/debug.c:991:17: note: in expansion of macro '__P' 991 | __P(dyn_affi->nr_wakeups_force_preferred_cpus); | ^~~ >> kernel/sched/debug.c:991:29: error: 'struct dyn_affinity_stats' has no member named 'nr_wakeups_force_preferred_cpus' 991 | __P(dyn_affi->nr_wakeups_force_preferred_cpus); | ^~ include/linux/printk.h:362:33: note: in definition of macro 'pr_cont' 362 | printk(KERN_CONT fmt, ##__VA_ARGS__) | ^~~~~~~~~~~ kernel/sched/debug.c:939:9: note: in expansion of macro 'SEQ_printf' 939 | SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) | ^~~~~~~~~~ kernel/sched/debug.c:991:17: note: in expansion of macro '__P' 991 | __P(dyn_affi->nr_wakeups_force_preferred_cpus); | ^~~ In file included from include/linux/migrate.h:6, from kernel/sched/sched.h:52: include/linux/mempolicy.h: At top level: include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ vim +990 kernel/sched/debug.c 814 > 815 void sysrq_sched_debug_tidy(void) 816 { 817 int cpu; 818 819 SEQ_printf(NULL, "Sched Debug Version: v0.11, %s %.*s\n", 820 init_utsname()->release, 821 (int)strcspn(init_utsname()->version, " "), 822 init_utsname()->version); 823 824 for_each_online_cpu(cpu) 825 print_cpu_tidy(NULL, cpu); 826 } 827 828 /* 829 * This itererator needs some explanation. 830 * It returns 1 for the header position. 831 * This means 2 is CPU 0. 832 * In a hotplugged system some CPUs, including CPU 0, may be missing so we have 833 * to use cpumask_* to iterate over the CPUs. 834 */ 835 static void *sched_debug_start(struct seq_file *file, loff_t *offset) 836 { 837 unsigned long n = *offset; 838 839 if (n == 0) 840 return (void *) 1; 841 842 n--; 843 844 if (n > 0) 845 n = cpumask_next(n - 1, cpu_online_mask); 846 else 847 n = cpumask_first(cpu_online_mask); 848 849 *offset = n + 1; 850 851 if (n < nr_cpu_ids) 852 return (void *)(unsigned long)(n + 2); 853 854 return NULL; 855 } 856 857 static void *sched_debug_next(struct seq_file *file, void *data, loff_t *offset) 858 { 859 (*offset)++; 860 return sched_debug_start(file, offset); 861 } 862 863 static void sched_debug_stop(struct seq_file *file, void *data) 864 { 865 } 866 867 static const struct seq_operations sched_debug_sops = { 868 .start = sched_debug_start, 869 .next = sched_debug_next, 870 .stop = sched_debug_stop, 871 .show = sched_debug_show, 872 }; 873 874 static int __init init_sched_debug_procfs(void) 875 { 876 if (!proc_create_seq("sched_debug", 0444, NULL, &sched_debug_sops)) 877 return -ENOMEM; 878 return 0; 879 } 880 881 __initcall(init_sched_debug_procfs); 882 883 #define __P(F) SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) 884 #define P(F) SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)p->F) 885 #define __PN(F) SEQ_printf(m, "%-45s:%14Ld.%06ld\n", #F, SPLIT_NS((long long)F)) 886 #define PN(F) SEQ_printf(m, "%-45s:%14Ld.%06ld\n", #F, SPLIT_NS((long long)p->F)) 887 888 889 #ifdef CONFIG_NUMA_BALANCING 890 void print_numa_stats(struct seq_file *m, int node, unsigned long tsf, 891 unsigned long tpf, unsigned long gsf, unsigned long gpf) 892 { 893 SEQ_printf(m, "numa_faults node=%d ", node); 894 SEQ_printf(m, "task_private=%lu task_shared=%lu ", tpf, tsf); 895 SEQ_printf(m, "group_private=%lu group_shared=%lu\n", gpf, gsf); 896 } 897 #endif 898 899 900 static void sched_show_numa(struct task_struct *p, struct seq_file *m) 901 { 902 #ifdef CONFIG_NUMA_BALANCING 903 struct mempolicy *pol; 904 905 if (p->mm) 906 P(mm->numa_scan_seq); 907 908 task_lock(p); 909 pol = p->mempolicy; 910 if (pol && !(pol->flags & MPOL_F_MORON)) 911 pol = NULL; 912 mpol_get(pol); 913 task_unlock(p); 914 915 P(numa_pages_migrated); 916 P(numa_preferred_nid); 917 P(total_numa_faults); 918 SEQ_printf(m, "current_node=%d, numa_group_id=%d\n", 919 task_node(p), task_numa_group_id(p)); 920 show_numa_stats(p, m); 921 mpol_put(pol); 922 #endif 923 } 924 925 void proc_sched_show_task(struct task_struct *p, struct pid_namespace *ns, 926 struct seq_file *m) 927 { 928 #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY 929 struct dyn_affinity_stats *dyn_affi = p->se.dyn_affi_stats; 930 #endif 931 unsigned long nr_switches; 932 933 SEQ_printf(m, "%s (%d, #threads: %d)\n", p->comm, task_pid_nr_ns(p, ns), 934 get_nr_threads(p)); 935 SEQ_printf(m, 936 "---------------------------------------------------------" 937 "----------\n"); 938 #define __P(F) \ > 939 SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) 940 #define P(F) \ 941 SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)p->F) 942 #define P_SCHEDSTAT(F) \ 943 SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)schedstat_val(p->F)) 944 #define __PN(F) \ 945 SEQ_printf(m, "%-45s:%14Ld.%06ld\n", #F, SPLIT_NS((long long)F)) 946 #define PN(F) \ 947 SEQ_printf(m, "%-45s:%14Ld.%06ld\n", #F, SPLIT_NS((long long)p->F)) 948 #define PN_SCHEDSTAT(F) \ 949 SEQ_printf(m, "%-45s:%14Ld.%06ld\n", #F, SPLIT_NS((long long)schedstat_val(p->F))) 950 951 PN(se.exec_start); 952 PN(se.vruntime); 953 PN(se.sum_exec_runtime); 954 955 nr_switches = p->nvcsw + p->nivcsw; 956 957 P(se.nr_migrations); 958 959 if (schedstat_enabled()) { 960 u64 avg_atom, avg_per_cpu; 961 962 PN_SCHEDSTAT(se.statistics.sum_sleep_runtime); 963 PN_SCHEDSTAT(se.statistics.wait_start); 964 PN_SCHEDSTAT(se.statistics.sleep_start); 965 PN_SCHEDSTAT(se.statistics.block_start); 966 PN_SCHEDSTAT(se.statistics.sleep_max); 967 PN_SCHEDSTAT(se.statistics.block_max); 968 PN_SCHEDSTAT(se.statistics.exec_max); 969 PN_SCHEDSTAT(se.statistics.slice_max); 970 PN_SCHEDSTAT(se.statistics.wait_max); 971 PN_SCHEDSTAT(se.statistics.wait_sum); 972 P_SCHEDSTAT(se.statistics.wait_count); 973 PN_SCHEDSTAT(se.statistics.iowait_sum); 974 P_SCHEDSTAT(se.statistics.iowait_count); 975 P_SCHEDSTAT(se.statistics.nr_migrations_cold); 976 P_SCHEDSTAT(se.statistics.nr_failed_migrations_affine); 977 P_SCHEDSTAT(se.statistics.nr_failed_migrations_running); 978 P_SCHEDSTAT(se.statistics.nr_failed_migrations_hot); 979 P_SCHEDSTAT(se.statistics.nr_forced_migrations); 980 P_SCHEDSTAT(se.statistics.nr_wakeups); 981 P_SCHEDSTAT(se.statistics.nr_wakeups_sync); 982 P_SCHEDSTAT(se.statistics.nr_wakeups_migrate); 983 P_SCHEDSTAT(se.statistics.nr_wakeups_local); 984 P_SCHEDSTAT(se.statistics.nr_wakeups_remote); 985 P_SCHEDSTAT(se.statistics.nr_wakeups_affine); 986 P_SCHEDSTAT(se.statistics.nr_wakeups_affine_attempts); 987 P_SCHEDSTAT(se.statistics.nr_wakeups_passive); 988 P_SCHEDSTAT(se.statistics.nr_wakeups_idle); 989 #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY > 990 __P(dyn_affi->nr_wakeups_preferred_cpus); > 991 __P(dyn_affi->nr_wakeups_force_preferred_cpus); 992 #endif 993 994 avg_atom = p->se.sum_exec_runtime; 995 if (nr_switches) 996 avg_atom = div64_ul(avg_atom, nr_switches); 997 else 998 avg_atom = -1LL; 999 1000 avg_per_cpu = p->se.sum_exec_runtime; 1001 if (p->se.nr_migrations) { 1002 avg_per_cpu = div64_u64(avg_per_cpu, 1003 p->se.nr_migrations); 1004 } else { 1005 avg_per_cpu = -1LL; 1006 } 1007 1008 __PN(avg_atom); 1009 __PN(avg_per_cpu); 1010 } 1011 1012 __P(nr_switches); 1013 SEQ_printf(m, "%-45s:%21Ld\n", 1014 "nr_voluntary_switches", (long long)p->nvcsw); 1015 SEQ_printf(m, "%-45s:%21Ld\n", 1016 "nr_involuntary_switches", (long long)p->nivcsw); 1017 1018 P(se.load.weight); 1019 P(se.runnable_weight); 1020 #ifdef CONFIG_SMP 1021 P(se.avg.load_sum); 1022 P(se.avg.runnable_load_sum); 1023 P(se.avg.util_sum); 1024 P(se.avg.load_avg); 1025 P(se.avg.runnable_load_avg); 1026 P(se.avg.util_avg); 1027 P(se.avg.last_update_time); 1028 P(se.avg.util_est.ewma); 1029 P(se.avg.util_est.enqueued); 1030 #endif 1031 P(policy); 1032 P(prio); 1033 if (task_has_dl_policy(p)) { 1034 P(dl.runtime); 1035 P(dl.deadline); 1036 } 1037 #undef PN_SCHEDSTAT 1038 #undef PN 1039 #undef __PN 1040 #undef P_SCHEDSTAT 1041 #undef P 1042 #undef __P 1043 1044 { 1045 unsigned int this_cpu = raw_smp_processor_id(); 1046 u64 t0, t1; 1047 1048 t0 = cpu_clock(this_cpu); 1049 t1 = cpu_clock(this_cpu); 1050 SEQ_printf(m, "%-45s:%21Ld\n", 1051 "clock-delta", (long long)(t1-t0)); 1052 } 1053 1054 sched_show_numa(p, m); 1055 } 1056 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1365/1365] drivers/gpu/drm/phytium/phytium_debugfs.c:189:34-69: opportunity for str_enabled_disabled(phytium_dp -> panel . backlight_enabled)
by kernel test robot 03 Jan '25

03 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4c116febc8d53bc1f8f25a3d60db331f17ab8cd8 commit: cad0702e5286d3cc80afe545de027858b855dd5a [1365/1365] DRM: Phytium display DRM driver config: arm64-randconfig-r064-20250103 (https://download.01.org/0day-ci/archive/20250103/202501030757.m59EWrOL-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501030757.m59EWrOL-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/gpu/drm/phytium/phytium_debugfs.c:189:34-69: opportunity for str_enabled_disabled(phytium_dp -> panel . backlight_enabled) >> drivers/gpu/drm/phytium/phytium_debugfs.c:217:30-61: opportunity for str_enabled_disabled(phytium_dp -> panel . power_enabled) >> drivers/gpu/drm/phytium/phytium_debugfs.c:340:35-56: opportunity for str_yes_no(phytium_dp -> has_audio) -- >> drivers/gpu/drm/phytium/phytium_dp.c:1279:10-34: opportunity for str_enable_disable(mode == DRM_MODE_DPMS_ON) -- >> drivers/gpu/drm/phytium/phytium_panel.c:79:10-16: opportunity for str_enable_disable(enable) vim +189 drivers/gpu/drm/phytium/phytium_debugfs.c 179 180 static int phytium_edp_backlight_show(struct seq_file *m, void *data) 181 { 182 struct drm_connector *connector = m->private; 183 struct phytium_dp_device *phytium_dp = connector_to_dp_device(connector); 184 185 if (!phytium_dp->is_edp) 186 return -ENODEV; 187 188 mutex_lock(&phytium_dp->panel.panel_lock); > 189 seq_printf(m, "backlight: %s\n", phytium_dp->panel.backlight_enabled?"enabled":"disabled"); 190 mutex_unlock(&phytium_dp->panel.panel_lock); 191 192 return 0; 193 } 194 195 static int phytium_edp_backlight_open(struct inode *inode, struct file *file) 196 { 197 return single_open(file, phytium_edp_backlight_show, inode->i_private); 198 } 199 200 static const struct file_operations phytium_edp_backlight_fops = { 201 .owner = THIS_MODULE, 202 .open = phytium_edp_backlight_open, 203 .read = seq_read, 204 .llseek = seq_lseek, 205 .release = single_release, 206 }; 207 208 static int phytium_edp_power_show(struct seq_file *m, void *data) 209 { 210 struct drm_connector *connector = m->private; 211 struct phytium_dp_device *phytium_dp = connector_to_dp_device(connector); 212 213 if (!phytium_dp->is_edp) 214 return -ENODEV; 215 216 mutex_lock(&phytium_dp->panel.panel_lock); > 217 seq_printf(m, "power: %s\n", phytium_dp->panel.power_enabled?"enabled":"disabled"); 218 mutex_unlock(&phytium_dp->panel.panel_lock); 219 220 return 0; 221 } 222 223 static int phytium_edp_power_open(struct inode *inode, struct file *file) 224 { 225 return single_open(file, phytium_edp_power_show, inode->i_private); 226 } 227 228 static const struct file_operations phytium_edp_power_fops = { 229 .owner = THIS_MODULE, 230 .open = phytium_edp_power_open, 231 .read = seq_read, 232 .llseek = seq_lseek, 233 .release = single_release, 234 }; 235 236 struct dpcd_block { 237 /* DPCD dump start address. */ 238 unsigned int offset; 239 /* DPCD dump end address, inclusive. If unset, .size will be used. */ 240 unsigned int end; 241 /* DPCD dump size. Used if .end is unset. If unset, defaults to 1. */ 242 size_t size; 243 /* Only valid for eDP. */ 244 bool edp; 245 }; 246 247 static const struct dpcd_block phytium_dpcd_debug[] = { 248 { .offset = DP_DPCD_REV, .size = DP_RECEIVER_CAP_SIZE }, 249 { .offset = DP_PSR_SUPPORT, .end = DP_PSR_CAPS }, 250 { .offset = DP_DOWNSTREAM_PORT_0, .size = 16 }, 251 { .offset = DP_LINK_BW_SET, .end = DP_EDP_CONFIGURATION_SET }, 252 { .offset = DP_SINK_COUNT, .end = DP_ADJUST_REQUEST_LANE2_3 }, 253 { .offset = DP_SET_POWER }, 254 { .offset = DP_EDP_DPCD_REV }, 255 { .offset = DP_EDP_GENERAL_CAP_1, .end = DP_EDP_GENERAL_CAP_3 }, 256 { .offset = DP_EDP_DISPLAY_CONTROL_REGISTER, .end = DP_EDP_BACKLIGHT_FREQ_CAP_MAX_LSB }, 257 { .offset = DP_EDP_DBC_MINIMUM_BRIGHTNESS_SET, .end = DP_EDP_DBC_MAXIMUM_BRIGHTNESS_SET }, 258 { .offset = DP_DEVICE_SERVICE_IRQ_VECTOR, .size = 1 }, 259 { .offset = DP_TEST_REQUEST, .end = DP_TEST_PATTERN }, 260 }; 261 262 static int phytium_dpcd_show(struct seq_file *m, void *data) 263 { 264 struct drm_connector *connector = m->private; 265 struct phytium_dp_device *phytium_dp = connector_to_dp_device(connector); 266 uint8_t buf[16], i; 267 ssize_t err; 268 269 if (connector->status != connector_status_connected) 270 return -ENODEV; 271 272 for (i = 0; i < ARRAY_SIZE(phytium_dpcd_debug); i++) { 273 const struct dpcd_block *b = &phytium_dpcd_debug[i]; 274 size_t size = b->end ? b->end - b->offset + 1 : (b->size ?: 1); 275 276 if (WARN_ON(size > sizeof(buf))) 277 continue; 278 279 err = drm_dp_dpcd_read(&phytium_dp->aux, b->offset, buf, size); 280 if (err <= 0) { 281 DRM_ERROR("dpcd read (%zu bytes at %u) failed (%zd)\n", 282 size, b->offset, err); 283 continue; 284 } 285 286 seq_printf(m, "%04x: %*ph\n", b->offset, (int) size, buf); 287 } 288 289 return 0; 290 } 291 292 static int phytium_dpcd_open(struct inode *inode, struct file *file) 293 { 294 return single_open(file, phytium_dpcd_show, inode->i_private); 295 } 296 297 static const struct file_operations phytium_dpcd_fops = { 298 .owner = THIS_MODULE, 299 .open = phytium_dpcd_open, 300 .read = seq_read, 301 .llseek = seq_lseek, 302 .release = single_release, 303 }; 304 305 static ssize_t 306 phytium_dp_state_write(struct file *filp, 307 const char __user *ubuf, 308 size_t len, 309 loff_t *ppos) 310 { 311 char tmp[16]; 312 313 if (len >= sizeof(tmp)) 314 return -EINVAL; 315 316 memset(tmp, 0, sizeof(tmp)); 317 if (copy_from_user(tmp, ubuf, len)) 318 return -EFAULT; 319 tmp[len] = '\0'; 320 321 return len; 322 } 323 324 static int phytium_dp_state_show(struct seq_file *m, void *data) 325 { 326 struct drm_connector *connector = m->private; 327 struct phytium_dp_device *phytium_dp = connector_to_dp_device(connector); 328 329 seq_printf(m, "port number: %d\n", phytium_dp->port); 330 seq_printf(m, "source_max_lane_count: %d\n", phytium_dp->source_max_lane_count); 331 seq_printf(m, "max_source_rates: %d\n", 332 phytium_dp->source_rates[phytium_dp->num_source_rates-1]); 333 if (connector->status == connector_status_connected) { 334 seq_printf(m, "sink_max_lane_count: %d\n", phytium_dp->sink_max_lane_count); 335 seq_printf(m, "max_sink_rates: %d\n", 336 phytium_dp->sink_rates[phytium_dp->num_sink_rates-1]); 337 seq_printf(m, "link_rate: %d\n", phytium_dp->link_rate); 338 seq_printf(m, "link_lane_count: %d\n", phytium_dp->link_lane_count); 339 seq_printf(m, "train_set[0]: %d\n", phytium_dp->train_set[0]); > 340 seq_printf(m, "has_audio: %s\n", phytium_dp->has_audio?"yes":"no"); 341 } 342 343 return 0; 344 } 345 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1364/1364] sound/usb/validate.c:113:26: sparse: sparse: restricted __le16 degrades to integer
by kernel test robot 02 Jan '25

02 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4c116febc8d53bc1f8f25a3d60db331f17ab8cd8 commit: c6a3607c78f8035db0efc67cb41374fe49e4709d [1364/1364] ALSA: usb-audio: More validations of descriptor units config: x86_64-randconfig-123-20250102 (https://download.01.org/0day-ci/archive/20250102/202501022347.2K2GsA8U-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250102/202501022347.2K2GsA8U-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501022347.2K2GsA8U-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> sound/usb/validate.c:113:26: sparse: sparse: restricted __le16 degrades to integer >> sound/usb/validate.c:113:26: sparse: sparse: restricted __le16 degrades to integer sound/usb/validate.c:128:26: sparse: sparse: restricted __le16 degrades to integer sound/usb/validate.c:128:26: sparse: sparse: restricted __le16 degrades to integer sound/usb/validate.c:145:26: sparse: sparse: restricted __le16 degrades to integer sound/usb/validate.c:145:26: sparse: sparse: restricted __le16 degrades to integer vim +113 sound/usb/validate.c 67 68 /* both for processing and extension units; covering all UACs */ 69 static bool validate_processing_unit(const void *p, 70 const struct usb_desc_validator *v) 71 { 72 const struct uac_processing_unit_descriptor *d = p; 73 const unsigned char *hdr = p; 74 size_t len, m; 75 76 if (d->bLength < sizeof(*d)) 77 return false; 78 len = d->bLength < sizeof(*d) + d->bNrInPins; 79 if (d->bLength < len) 80 return false; 81 switch (v->protocol) { 82 case UAC_VERSION_1: 83 default: 84 /* bNrChannels, wChannelConfig, iChannelNames, bControlSize */ 85 len += 1 + 2 + 1 + 1; 86 if (d->bLength < len) /* bControlSize */ 87 return false; 88 m = hdr[len]; 89 len += 1 + m + 1; /* bControlSize, bmControls, iProcessing */ 90 break; 91 case UAC_VERSION_2: 92 /* bNrChannels, bmChannelConfig, iChannelNames */ 93 len += 1 + 4 + 1; 94 if (v->type == UAC2_PROCESSING_UNIT_V2) 95 len += 2; /* bmControls -- 2 bytes for PU */ 96 else 97 len += 1; /* bmControls -- 1 byte for EU */ 98 len += 1; /* iProcessing */ 99 break; 100 case UAC_VERSION_3: 101 /* wProcessingDescrStr, bmControls */ 102 len += 2 + 4; 103 break; 104 } 105 if (d->bLength < len) 106 return false; 107 108 switch (v->protocol) { 109 case UAC_VERSION_1: 110 default: 111 if (v->type == UAC1_EXTENSION_UNIT) 112 return true; /* OK */ > 113 switch (d->wProcessType) { 114 case UAC_PROCESS_UP_DOWNMIX: 115 case UAC_PROCESS_DOLBY_PROLOGIC: 116 if (d->bLength < len + 1) /* bNrModes */ 117 return false; 118 m = hdr[len]; 119 len += 1 + m * 2; /* bNrModes, waModes(n) */ 120 break; 121 default: 122 break; 123 } 124 break; 125 case UAC_VERSION_2: 126 if (v->type == UAC2_EXTENSION_UNIT_V2) 127 return true; /* OK */ 128 switch (d->wProcessType) { 129 case UAC2_PROCESS_UP_DOWNMIX: 130 case UAC2_PROCESS_DOLBY_PROLOCIC: /* SiC! */ 131 if (d->bLength < len + 1) /* bNrModes */ 132 return false; 133 m = hdr[len]; 134 len += 1 + m * 4; /* bNrModes, daModes(n) */ 135 break; 136 default: 137 break; 138 } 139 break; 140 case UAC_VERSION_3: 141 if (v->type == UAC3_EXTENSION_UNIT) { 142 len += 2; /* wClusterDescrID */ 143 break; 144 } 145 switch (d->wProcessType) { 146 case UAC3_PROCESS_UP_DOWNMIX: 147 if (d->bLength < len + 1) /* bNrModes */ 148 return false; 149 m = hdr[len]; 150 len += 1 + m * 2; /* bNrModes, waClusterDescrID(n) */ 151 break; 152 case UAC3_PROCESS_MULTI_FUNCTION: 153 len += 2 + 4; /* wClusterDescrID, bmAlgorighms */ 154 break; 155 default: 156 break; 157 } 158 break; 159 } 160 if (d->bLength < len) 161 return false; 162 163 return true; 164 } 165 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] hfsplus: don't query the device logical block size multiple times
by Chen Zhongjin 02 Jan '25

02 Jan '25

From: Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> stable inclusion from stable-v6.6.64 commit 21900e8478126ff6afe3b66679f676e74d1f8830 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEADN CVE: CVE-2024-56548 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 1c82587cb57687de3f18ab4b98a8850c789bedcf ] Devices block sizes may change. One of these cases is a loop device by using ioctl LOOP_SET_BLOCK_SIZE. While this may cause other issues like IO being rejected, in the case of hfsplus, it will allocate a block by using that size and potentially write out-of-bounds when hfsplus_read_wrapper calls hfsplus_submit_bio and the latter function reads a different io_size. Using a new min_io_size initally set to sb_min_blocksize works for the purposes of the original fix, since it will be set to the max between HFSPLUS_SECTOR_SIZE and the first seen logical block size. We still use the max between HFSPLUS_SECTOR_SIZE and min_io_size in case the latter is not initialized. Tested by mounting an hfsplus filesystem with loop block sizes 512, 1024 and 4096. The produced KASAN report before the fix looks like this: [ 419.944641] ================================================================== [ 419.945655] BUG: KASAN: slab-use-after-free in hfsplus_read_wrapper+0x659/0xa0a [ 419.946703] Read of size 2 at addr ffff88800721fc00 by task repro/10678 [ 419.947612] [ 419.947846] CPU: 0 UID: 0 PID: 10678 Comm: repro Not tainted 6.12.0-rc5-00008-gdf56e0f2f3ca #84 [ 419.949007] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 [ 419.950035] Call Trace: [ 419.950384] <TASK> [ 419.950676] dump_stack_lvl+0x57/0x78 [ 419.951212] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.951830] print_report+0x14c/0x49e [ 419.952361] ? __virt_addr_valid+0x267/0x278 [ 419.952979] ? kmem_cache_debug_flags+0xc/0x1d [ 419.953561] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.954231] kasan_report+0x89/0xb0 [ 419.954748] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.955367] hfsplus_read_wrapper+0x659/0xa0a [ 419.955948] ? __pfx_hfsplus_read_wrapper+0x10/0x10 [ 419.956618] ? do_raw_spin_unlock+0x59/0x1a9 [ 419.957214] ? _raw_spin_unlock+0x1a/0x2e [ 419.957772] hfsplus_fill_super+0x348/0x1590 [ 419.958355] ? hlock_class+0x4c/0x109 [ 419.958867] ? __pfx_hfsplus_fill_super+0x10/0x10 [ 419.959499] ? __pfx_string+0x10/0x10 [ 419.960006] ? lock_acquire+0x3e2/0x454 [ 419.960532] ? bdev_name.constprop.0+0xce/0x243 [ 419.961129] ? __pfx_bdev_name.constprop.0+0x10/0x10 [ 419.961799] ? pointer+0x3f0/0x62f [ 419.962277] ? __pfx_pointer+0x10/0x10 [ 419.962761] ? vsnprintf+0x6c4/0xfba [ 419.963178] ? __pfx_vsnprintf+0x10/0x10 [ 419.963621] ? setup_bdev_super+0x376/0x3b3 [ 419.964029] ? snprintf+0x9d/0xd2 [ 419.964344] ? __pfx_snprintf+0x10/0x10 [ 419.964675] ? lock_acquired+0x45c/0x5e9 [ 419.965016] ? set_blocksize+0x139/0x1c1 [ 419.965381] ? sb_set_blocksize+0x6d/0xae [ 419.965742] ? __pfx_hfsplus_fill_super+0x10/0x10 [ 419.966179] mount_bdev+0x12f/0x1bf [ 419.966512] ? __pfx_mount_bdev+0x10/0x10 [ 419.966886] ? vfs_parse_fs_string+0xce/0x111 [ 419.967293] ? __pfx_vfs_parse_fs_string+0x10/0x10 [ 419.967702] ? __pfx_hfsplus_mount+0x10/0x10 [ 419.968073] legacy_get_tree+0x104/0x178 [ 419.968414] vfs_get_tree+0x86/0x296 [ 419.968751] path_mount+0xba3/0xd0b [ 419.969157] ? __pfx_path_mount+0x10/0x10 [ 419.969594] ? kmem_cache_free+0x1e2/0x260 [ 419.970311] do_mount+0x99/0xe0 [ 419.970630] ? __pfx_do_mount+0x10/0x10 [ 419.971008] __do_sys_mount+0x199/0x1c9 [ 419.971397] do_syscall_64+0xd0/0x135 [ 419.971761] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 419.972233] RIP: 0033:0x7c3cb812972e [ 419.972564] Code: 48 8b 0d f5 46 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c2 46 0d 00 f7 d8 64 89 01 48 [ 419.974371] RSP: 002b:00007ffe30632548 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 419.975048] RAX: ffffffffffffffda RBX: 00007ffe306328d8 RCX: 00007c3cb812972e [ 419.975701] RDX: 0000000020000000 RSI: 0000000020000c80 RDI: 00007ffe306325d0 [ 419.976363] RBP: 00007ffe30632720 R08: 00007ffe30632610 R09: 0000000000000000 [ 419.977034] R10: 0000000000200008 R11: 0000000000000286 R12: 0000000000000000 [ 419.977713] R13: 00007ffe306328e8 R14: 00005a0eb298bc68 R15: 00007c3cb8356000 [ 419.978375] </TASK> [ 419.978589] Fixes: 6596528e391a ("hfsplus: ensure bio requests are not smaller than the hardware sectors") Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> Link: https://lore.kernel.org/r/20241107114109.839253-1-cascardo@igalia.com Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- fs/hfsplus/hfsplus_fs.h | 3 ++- fs/hfsplus/wrapper.c | 2 ++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h index 583c196ecd52..1473b04fc0f3 100644 --- a/fs/hfsplus/hfsplus_fs.h +++ b/fs/hfsplus/hfsplus_fs.h @@ -156,6 +156,7 @@ struct hfsplus_sb_info { /* Runtime variables */ u32 blockoffset; + u32 min_io_size; sector_t part_start; sector_t sect_count; int fs_shift; @@ -306,7 +307,7 @@ struct hfsplus_readdir_data { */ static inline unsigned short hfsplus_min_io_size(struct super_block *sb) { - return max_t(unsigned short, bdev_logical_block_size(sb->s_bdev), + return max_t(unsigned short, HFSPLUS_SB(sb)->min_io_size, HFSPLUS_SECTOR_SIZE); } diff --git a/fs/hfsplus/wrapper.c b/fs/hfsplus/wrapper.c index 0b791adf02e5..a51a58db3fef 100644 --- a/fs/hfsplus/wrapper.c +++ b/fs/hfsplus/wrapper.c @@ -171,6 +171,8 @@ int hfsplus_read_wrapper(struct super_block *sb) if (!blocksize) goto out; + sbi->min_io_size = blocksize; + if (hfsplus_get_last_session(sb, &part_start, &part_size)) goto out; -- 2.25.1

2 1

[PATCH OLK-6.6] scsi: bfa: Fix use-after-free in bfad_im_module_exit()
by Chen Zhongjin 02 Jan '25

02 Jan '25

From: Ye Bin <yebin10(a)huawei.com> stable inclusion from stable-v6.6.64 commit c28409f851abd93b37969cac7498828ad533afd9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAFA CVE: CVE-2024-53227 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 178b8f38932d635e90f5f0e9af1986c6f4a89271 ] BUG: KASAN: slab-use-after-free in __lock_acquire+0x2aca/0x3a20 Read of size 8 at addr ffff8881082d80c8 by task modprobe/25303 Call Trace: <TASK> dump_stack_lvl+0x95/0xe0 print_report+0xcb/0x620 kasan_report+0xbd/0xf0 __lock_acquire+0x2aca/0x3a20 lock_acquire+0x19b/0x520 _raw_spin_lock+0x2b/0x40 attribute_container_unregister+0x30/0x160 fc_release_transport+0x19/0x90 [scsi_transport_fc] bfad_im_module_exit+0x23/0x60 [bfa] bfad_init+0xdb/0xff0 [bfa] do_one_initcall+0xdc/0x550 do_init_module+0x22d/0x6b0 load_module+0x4e96/0x5ff0 init_module_from_file+0xcd/0x130 idempotent_init_module+0x330/0x620 __x64_sys_finit_module+0xb3/0x110 do_syscall_64+0xc1/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Allocated by task 25303: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90 fc_attach_transport+0x4f/0x4740 [scsi_transport_fc] bfad_im_module_init+0x17/0x80 [bfa] bfad_init+0x23/0xff0 [bfa] do_one_initcall+0xdc/0x550 do_init_module+0x22d/0x6b0 load_module+0x4e96/0x5ff0 init_module_from_file+0xcd/0x130 idempotent_init_module+0x330/0x620 __x64_sys_finit_module+0xb3/0x110 do_syscall_64+0xc1/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 25303: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x38/0x50 kfree+0x212/0x480 bfad_im_module_init+0x7e/0x80 [bfa] bfad_init+0x23/0xff0 [bfa] do_one_initcall+0xdc/0x550 do_init_module+0x22d/0x6b0 load_module+0x4e96/0x5ff0 init_module_from_file+0xcd/0x130 idempotent_init_module+0x330/0x620 __x64_sys_finit_module+0xb3/0x110 do_syscall_64+0xc1/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Above issue happens as follows: bfad_init error = bfad_im_module_init() fc_release_transport(bfad_im_scsi_transport_template); if (error) goto ext; ext: bfad_im_module_exit(); fc_release_transport(bfad_im_scsi_transport_template); --> Trigger double release Don't call bfad_im_module_exit() if bfad_im_module_init() failed. Fixes: 7725ccfda597 ("[SCSI] bfa: Brocade BFA FC SCSI driver") Signed-off-by: Ye Bin <yebin10(a)huawei.com> Link: https://lore.kernel.org/r/20241023011809.63466-1-yebin@huaweicloud.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/scsi/bfa/bfad.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/scsi/bfa/bfad.c b/drivers/scsi/bfa/bfad.c index 62cb7a864fd5..70c7515a822f 100644 --- a/drivers/scsi/bfa/bfad.c +++ b/drivers/scsi/bfa/bfad.c @@ -1693,9 +1693,8 @@ bfad_init(void) error = bfad_im_module_init(); if (error) { - error = -ENOMEM; printk(KERN_WARNING "bfad_im_module_init failure\n"); - goto ext; + return -ENOMEM; } if (strcmp(FCPI_NAME, " fcpim") == 0) -- 2.25.1

2 1

[PATCH OLK-6.6] f2fs: fix null-ptr-deref in f2fs_submit_page_bio()
by Chen Zhongjin 02 Jan '25

02 Jan '25

From: Ye Bin <yebin10(a)huawei.com> mainline inclusion from mainline-v6.13-rc1 commit b7d0a97b28083084ebdd8e5c6bccd12e6ec18faa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAFK CVE: CVE-2024-53221 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There's issue as follows when concurrently installing the f2fs.ko module and mounting the f2fs file system: KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] RIP: 0010:__bio_alloc+0x2fb/0x6c0 [f2fs] Call Trace: <TASK> f2fs_submit_page_bio+0x126/0x8b0 [f2fs] __get_meta_page+0x1d4/0x920 [f2fs] get_checkpoint_version.constprop.0+0x2b/0x3c0 [f2fs] validate_checkpoint+0xac/0x290 [f2fs] f2fs_get_valid_checkpoint+0x207/0x950 [f2fs] f2fs_fill_super+0x1007/0x39b0 [f2fs] mount_bdev+0x183/0x250 legacy_get_tree+0xf4/0x1e0 vfs_get_tree+0x88/0x340 do_new_mount+0x283/0x5e0 path_mount+0x2b2/0x15b0 __x64_sys_mount+0x1fe/0x270 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Above issue happens as the biset of the f2fs file system is not initialized before register "f2fs_fs_type". To address above issue just register "f2fs_fs_type" at the last in init_f2fs_fs(). Ensure that all f2fs file system resources are initialized. Fixes: f543805fcd60 ("f2fs: introduce private bioset") Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Conflicts: fs/f2fs/super.c [Conflict caused by commit bfcba5ba39cb has not been merged] Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- fs/f2fs/super.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c index d60ade04854b..a9b300b77368 100644 --- a/fs/f2fs/super.c +++ b/fs/f2fs/super.c @@ -4919,9 +4919,6 @@ static int __init init_f2fs_fs(void) err = register_shrinker(&f2fs_shrinker_info, "f2fs-shrinker"); if (err) goto free_sysfs; - err = register_filesystem(&f2fs_fs_type); - if (err) - goto free_shrinker; f2fs_create_root_stats(); err = f2fs_init_post_read_processing(); if (err) @@ -4944,7 +4941,12 @@ static int __init init_f2fs_fs(void) err = f2fs_create_casefold_cache(); if (err) goto free_compress_cache; + err = register_filesystem(&f2fs_fs_type); + if (err) + goto free_casefold_cache; return 0; +free_casefold_cache: + f2fs_destroy_casefold_cache(); free_compress_cache: f2fs_destroy_compress_cache(); free_compress_mempool: @@ -4959,8 +4961,6 @@ static int __init init_f2fs_fs(void) f2fs_destroy_post_read_processing(); free_root_stats: f2fs_destroy_root_stats(); - unregister_filesystem(&f2fs_fs_type); -free_shrinker: unregister_shrinker(&f2fs_shrinker_info); free_sysfs: f2fs_exit_sysfs(); @@ -4984,6 +4984,7 @@ static int __init init_f2fs_fs(void) static void __exit exit_f2fs_fs(void) { + unregister_filesystem(&f2fs_fs_type); f2fs_destroy_casefold_cache(); f2fs_destroy_compress_cache(); f2fs_destroy_compress_mempool(); @@ -4992,7 +4993,6 @@ static void __exit exit_f2fs_fs(void) f2fs_destroy_iostat_processing(); f2fs_destroy_post_read_processing(); f2fs_destroy_root_stats(); - unregister_filesystem(&f2fs_fs_type); unregister_shrinker(&f2fs_shrinker_info); f2fs_exit_sysfs(); f2fs_destroy_garbage_collection_cache(); -- 2.25.1

2 1

[PATCH OLK-5.10] hfsplus: don't query the device logical block size multiple times
by Chen Zhongjin 02 Jan '25

02 Jan '25

From: Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> stable inclusion from stable-v5.10.231 commit e8a2b1c1c2ea85e9a5a2d0c5a5a7e7c639feb866 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEADN CVE: CVE-2024-56548 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 1c82587cb57687de3f18ab4b98a8850c789bedcf ] Devices block sizes may change. One of these cases is a loop device by using ioctl LOOP_SET_BLOCK_SIZE. While this may cause other issues like IO being rejected, in the case of hfsplus, it will allocate a block by using that size and potentially write out-of-bounds when hfsplus_read_wrapper calls hfsplus_submit_bio and the latter function reads a different io_size. Using a new min_io_size initally set to sb_min_blocksize works for the purposes of the original fix, since it will be set to the max between HFSPLUS_SECTOR_SIZE and the first seen logical block size. We still use the max between HFSPLUS_SECTOR_SIZE and min_io_size in case the latter is not initialized. Tested by mounting an hfsplus filesystem with loop block sizes 512, 1024 and 4096. The produced KASAN report before the fix looks like this: [ 419.944641] ================================================================== [ 419.945655] BUG: KASAN: slab-use-after-free in hfsplus_read_wrapper+0x659/0xa0a [ 419.946703] Read of size 2 at addr ffff88800721fc00 by task repro/10678 [ 419.947612] [ 419.947846] CPU: 0 UID: 0 PID: 10678 Comm: repro Not tainted 6.12.0-rc5-00008-gdf56e0f2f3ca #84 [ 419.949007] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 [ 419.950035] Call Trace: [ 419.950384] <TASK> [ 419.950676] dump_stack_lvl+0x57/0x78 [ 419.951212] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.951830] print_report+0x14c/0x49e [ 419.952361] ? __virt_addr_valid+0x267/0x278 [ 419.952979] ? kmem_cache_debug_flags+0xc/0x1d [ 419.953561] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.954231] kasan_report+0x89/0xb0 [ 419.954748] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.955367] hfsplus_read_wrapper+0x659/0xa0a [ 419.955948] ? __pfx_hfsplus_read_wrapper+0x10/0x10 [ 419.956618] ? do_raw_spin_unlock+0x59/0x1a9 [ 419.957214] ? _raw_spin_unlock+0x1a/0x2e [ 419.957772] hfsplus_fill_super+0x348/0x1590 [ 419.958355] ? hlock_class+0x4c/0x109 [ 419.958867] ? __pfx_hfsplus_fill_super+0x10/0x10 [ 419.959499] ? __pfx_string+0x10/0x10 [ 419.960006] ? lock_acquire+0x3e2/0x454 [ 419.960532] ? bdev_name.constprop.0+0xce/0x243 [ 419.961129] ? __pfx_bdev_name.constprop.0+0x10/0x10 [ 419.961799] ? pointer+0x3f0/0x62f [ 419.962277] ? __pfx_pointer+0x10/0x10 [ 419.962761] ? vsnprintf+0x6c4/0xfba [ 419.963178] ? __pfx_vsnprintf+0x10/0x10 [ 419.963621] ? setup_bdev_super+0x376/0x3b3 [ 419.964029] ? snprintf+0x9d/0xd2 [ 419.964344] ? __pfx_snprintf+0x10/0x10 [ 419.964675] ? lock_acquired+0x45c/0x5e9 [ 419.965016] ? set_blocksize+0x139/0x1c1 [ 419.965381] ? sb_set_blocksize+0x6d/0xae [ 419.965742] ? __pfx_hfsplus_fill_super+0x10/0x10 [ 419.966179] mount_bdev+0x12f/0x1bf [ 419.966512] ? __pfx_mount_bdev+0x10/0x10 [ 419.966886] ? vfs_parse_fs_string+0xce/0x111 [ 419.967293] ? __pfx_vfs_parse_fs_string+0x10/0x10 [ 419.967702] ? __pfx_hfsplus_mount+0x10/0x10 [ 419.968073] legacy_get_tree+0x104/0x178 [ 419.968414] vfs_get_tree+0x86/0x296 [ 419.968751] path_mount+0xba3/0xd0b [ 419.969157] ? __pfx_path_mount+0x10/0x10 [ 419.969594] ? kmem_cache_free+0x1e2/0x260 [ 419.970311] do_mount+0x99/0xe0 [ 419.970630] ? __pfx_do_mount+0x10/0x10 [ 419.971008] __do_sys_mount+0x199/0x1c9 [ 419.971397] do_syscall_64+0xd0/0x135 [ 419.971761] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 419.972233] RIP: 0033:0x7c3cb812972e [ 419.972564] Code: 48 8b 0d f5 46 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c2 46 0d 00 f7 d8 64 89 01 48 [ 419.974371] RSP: 002b:00007ffe30632548 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 419.975048] RAX: ffffffffffffffda RBX: 00007ffe306328d8 RCX: 00007c3cb812972e [ 419.975701] RDX: 0000000020000000 RSI: 0000000020000c80 RDI: 00007ffe306325d0 [ 419.976363] RBP: 00007ffe30632720 R08: 00007ffe30632610 R09: 0000000000000000 [ 419.977034] R10: 0000000000200008 R11: 0000000000000286 R12: 0000000000000000 [ 419.977713] R13: 00007ffe306328e8 R14: 00005a0eb298bc68 R15: 00007c3cb8356000 [ 419.978375] </TASK> [ 419.978589] Fixes: 6596528e391a ("hfsplus: ensure bio requests are not smaller than the hardware sectors") Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> Link: https://lore.kernel.org/r/20241107114109.839253-1-cascardo@igalia.com Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- fs/hfsplus/hfsplus_fs.h | 3 ++- fs/hfsplus/wrapper.c | 2 ++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h index c438680ef9f7..fed50472745f 100644 --- a/fs/hfsplus/hfsplus_fs.h +++ b/fs/hfsplus/hfsplus_fs.h @@ -156,6 +156,7 @@ struct hfsplus_sb_info { /* Runtime variables */ u32 blockoffset; + u32 min_io_size; sector_t part_start; sector_t sect_count; int fs_shift; @@ -306,7 +307,7 @@ struct hfsplus_readdir_data { */ static inline unsigned short hfsplus_min_io_size(struct super_block *sb) { - return max_t(unsigned short, bdev_logical_block_size(sb->s_bdev), + return max_t(unsigned short, HFSPLUS_SB(sb)->min_io_size, HFSPLUS_SECTOR_SIZE); } diff --git a/fs/hfsplus/wrapper.c b/fs/hfsplus/wrapper.c index 0350dc7821bf..59ba0a30f539 100644 --- a/fs/hfsplus/wrapper.c +++ b/fs/hfsplus/wrapper.c @@ -173,6 +173,8 @@ int hfsplus_read_wrapper(struct super_block *sb) if (!blocksize) goto out; + sbi->min_io_size = blocksize; + if (hfsplus_get_last_session(sb, &part_start, &part_size)) goto out; -- 2.25.1

2 1

[PATCH OLK-5.10] [Backport] hfsplus: don't query the device logical block size multiple times
by Chen Zhongjin 02 Jan '25

02 Jan '25

From: Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> stable inclusion from stable-v5.10.231 commit e8a2b1c1c2ea85e9a5a2d0c5a5a7e7c639feb866 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEADN CVE: CVE-2024-56548 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 1c82587cb57687de3f18ab4b98a8850c789bedcf ] Devices block sizes may change. One of these cases is a loop device by using ioctl LOOP_SET_BLOCK_SIZE. While this may cause other issues like IO being rejected, in the case of hfsplus, it will allocate a block by using that size and potentially write out-of-bounds when hfsplus_read_wrapper calls hfsplus_submit_bio and the latter function reads a different io_size. Using a new min_io_size initally set to sb_min_blocksize works for the purposes of the original fix, since it will be set to the max between HFSPLUS_SECTOR_SIZE and the first seen logical block size. We still use the max between HFSPLUS_SECTOR_SIZE and min_io_size in case the latter is not initialized. Tested by mounting an hfsplus filesystem with loop block sizes 512, 1024 and 4096. The produced KASAN report before the fix looks like this: [ 419.944641] ================================================================== [ 419.945655] BUG: KASAN: slab-use-after-free in hfsplus_read_wrapper+0x659/0xa0a [ 419.946703] Read of size 2 at addr ffff88800721fc00 by task repro/10678 [ 419.947612] [ 419.947846] CPU: 0 UID: 0 PID: 10678 Comm: repro Not tainted 6.12.0-rc5-00008-gdf56e0f2f3ca #84 [ 419.949007] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 [ 419.950035] Call Trace: [ 419.950384] <TASK> [ 419.950676] dump_stack_lvl+0x57/0x78 [ 419.951212] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.951830] print_report+0x14c/0x49e [ 419.952361] ? __virt_addr_valid+0x267/0x278 [ 419.952979] ? kmem_cache_debug_flags+0xc/0x1d [ 419.953561] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.954231] kasan_report+0x89/0xb0 [ 419.954748] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.955367] hfsplus_read_wrapper+0x659/0xa0a [ 419.955948] ? __pfx_hfsplus_read_wrapper+0x10/0x10 [ 419.956618] ? do_raw_spin_unlock+0x59/0x1a9 [ 419.957214] ? _raw_spin_unlock+0x1a/0x2e [ 419.957772] hfsplus_fill_super+0x348/0x1590 [ 419.958355] ? hlock_class+0x4c/0x109 [ 419.958867] ? __pfx_hfsplus_fill_super+0x10/0x10 [ 419.959499] ? __pfx_string+0x10/0x10 [ 419.960006] ? lock_acquire+0x3e2/0x454 [ 419.960532] ? bdev_name.constprop.0+0xce/0x243 [ 419.961129] ? __pfx_bdev_name.constprop.0+0x10/0x10 [ 419.961799] ? pointer+0x3f0/0x62f [ 419.962277] ? __pfx_pointer+0x10/0x10 [ 419.962761] ? vsnprintf+0x6c4/0xfba [ 419.963178] ? __pfx_vsnprintf+0x10/0x10 [ 419.963621] ? setup_bdev_super+0x376/0x3b3 [ 419.964029] ? snprintf+0x9d/0xd2 [ 419.964344] ? __pfx_snprintf+0x10/0x10 [ 419.964675] ? lock_acquired+0x45c/0x5e9 [ 419.965016] ? set_blocksize+0x139/0x1c1 [ 419.965381] ? sb_set_blocksize+0x6d/0xae [ 419.965742] ? __pfx_hfsplus_fill_super+0x10/0x10 [ 419.966179] mount_bdev+0x12f/0x1bf [ 419.966512] ? __pfx_mount_bdev+0x10/0x10 [ 419.966886] ? vfs_parse_fs_string+0xce/0x111 [ 419.967293] ? __pfx_vfs_parse_fs_string+0x10/0x10 [ 419.967702] ? __pfx_hfsplus_mount+0x10/0x10 [ 419.968073] legacy_get_tree+0x104/0x178 [ 419.968414] vfs_get_tree+0x86/0x296 [ 419.968751] path_mount+0xba3/0xd0b [ 419.969157] ? __pfx_path_mount+0x10/0x10 [ 419.969594] ? kmem_cache_free+0x1e2/0x260 [ 419.970311] do_mount+0x99/0xe0 [ 419.970630] ? __pfx_do_mount+0x10/0x10 [ 419.971008] __do_sys_mount+0x199/0x1c9 [ 419.971397] do_syscall_64+0xd0/0x135 [ 419.971761] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 419.972233] RIP: 0033:0x7c3cb812972e [ 419.972564] Code: 48 8b 0d f5 46 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c2 46 0d 00 f7 d8 64 89 01 48 [ 419.974371] RSP: 002b:00007ffe30632548 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 419.975048] RAX: ffffffffffffffda RBX: 00007ffe306328d8 RCX: 00007c3cb812972e [ 419.975701] RDX: 0000000020000000 RSI: 0000000020000c80 RDI: 00007ffe306325d0 [ 419.976363] RBP: 00007ffe30632720 R08: 00007ffe30632610 R09: 0000000000000000 [ 419.977034] R10: 0000000000200008 R11: 0000000000000286 R12: 0000000000000000 [ 419.977713] R13: 00007ffe306328e8 R14: 00005a0eb298bc68 R15: 00007c3cb8356000 [ 419.978375] </TASK> [ 419.978589] Fixes: 6596528e391a ("hfsplus: ensure bio requests are not smaller than the hardware sectors") Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> Link: https://lore.kernel.org/r/20241107114109.839253-1-cascardo@igalia.com Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- fs/hfsplus/hfsplus_fs.h | 3 ++- fs/hfsplus/wrapper.c | 2 ++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h index c438680ef9f7..fed50472745f 100644 --- a/fs/hfsplus/hfsplus_fs.h +++ b/fs/hfsplus/hfsplus_fs.h @@ -156,6 +156,7 @@ struct hfsplus_sb_info { /* Runtime variables */ u32 blockoffset; + u32 min_io_size; sector_t part_start; sector_t sect_count; int fs_shift; @@ -306,7 +307,7 @@ struct hfsplus_readdir_data { */ static inline unsigned short hfsplus_min_io_size(struct super_block *sb) { - return max_t(unsigned short, bdev_logical_block_size(sb->s_bdev), + return max_t(unsigned short, HFSPLUS_SB(sb)->min_io_size, HFSPLUS_SECTOR_SIZE); } diff --git a/fs/hfsplus/wrapper.c b/fs/hfsplus/wrapper.c index 0350dc7821bf..59ba0a30f539 100644 --- a/fs/hfsplus/wrapper.c +++ b/fs/hfsplus/wrapper.c @@ -173,6 +173,8 @@ int hfsplus_read_wrapper(struct super_block *sb) if (!blocksize) goto out; + sbi->min_io_size = blocksize; + if (hfsplus_get_last_session(sb, &part_start, &part_size)) goto out; -- 2.25.1

2 1

[PATCH OLK-5.10] scsi: bfa: Fix use-after-free in bfad_im_module_exit()
by Chen Zhongjin 02 Jan '25

02 Jan '25

From: Ye Bin <yebin10(a)huawei.com> stable inclusion from stable-v5.10.231 commit ef2c2580189ea88a0dcaf56eb3a565763a900edb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAFA CVE: CVE-2024-53227 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 178b8f38932d635e90f5f0e9af1986c6f4a89271 ] BUG: KASAN: slab-use-after-free in __lock_acquire+0x2aca/0x3a20 Read of size 8 at addr ffff8881082d80c8 by task modprobe/25303 Call Trace: <TASK> dump_stack_lvl+0x95/0xe0 print_report+0xcb/0x620 kasan_report+0xbd/0xf0 __lock_acquire+0x2aca/0x3a20 lock_acquire+0x19b/0x520 _raw_spin_lock+0x2b/0x40 attribute_container_unregister+0x30/0x160 fc_release_transport+0x19/0x90 [scsi_transport_fc] bfad_im_module_exit+0x23/0x60 [bfa] bfad_init+0xdb/0xff0 [bfa] do_one_initcall+0xdc/0x550 do_init_module+0x22d/0x6b0 load_module+0x4e96/0x5ff0 init_module_from_file+0xcd/0x130 idempotent_init_module+0x330/0x620 __x64_sys_finit_module+0xb3/0x110 do_syscall_64+0xc1/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Allocated by task 25303: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90 fc_attach_transport+0x4f/0x4740 [scsi_transport_fc] bfad_im_module_init+0x17/0x80 [bfa] bfad_init+0x23/0xff0 [bfa] do_one_initcall+0xdc/0x550 do_init_module+0x22d/0x6b0 load_module+0x4e96/0x5ff0 init_module_from_file+0xcd/0x130 idempotent_init_module+0x330/0x620 __x64_sys_finit_module+0xb3/0x110 do_syscall_64+0xc1/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 25303: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x38/0x50 kfree+0x212/0x480 bfad_im_module_init+0x7e/0x80 [bfa] bfad_init+0x23/0xff0 [bfa] do_one_initcall+0xdc/0x550 do_init_module+0x22d/0x6b0 load_module+0x4e96/0x5ff0 init_module_from_file+0xcd/0x130 idempotent_init_module+0x330/0x620 __x64_sys_finit_module+0xb3/0x110 do_syscall_64+0xc1/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Above issue happens as follows: bfad_init error = bfad_im_module_init() fc_release_transport(bfad_im_scsi_transport_template); if (error) goto ext; ext: bfad_im_module_exit(); fc_release_transport(bfad_im_scsi_transport_template); --> Trigger double release Don't call bfad_im_module_exit() if bfad_im_module_init() failed. Fixes: 7725ccfda597 ("[SCSI] bfa: Brocade BFA FC SCSI driver") Signed-off-by: Ye Bin <yebin10(a)huawei.com> Link: https://lore.kernel.org/r/20241023011809.63466-1-yebin@huaweicloud.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/scsi/bfa/bfad.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/scsi/bfa/bfad.c b/drivers/scsi/bfa/bfad.c index 440ef32be048..45b5f83ad6da 100644 --- a/drivers/scsi/bfa/bfad.c +++ b/drivers/scsi/bfa/bfad.c @@ -1705,9 +1705,8 @@ bfad_init(void) error = bfad_im_module_init(); if (error) { - error = -ENOMEM; printk(KERN_WARNING "bfad_im_module_init failure\n"); - goto ext; + return -ENOMEM; } if (strcmp(FCPI_NAME, " fcpim") == 0) -- 2.25.1

2 1

[PATCH OLK-5.10] f2fs: fix null-ptr-deref in f2fs_submit_page_bio()
by Chen Zhongjin 02 Jan '25

02 Jan '25

From: Ye Bin <yebin10(a)huawei.com> mainline inclusion from mainline-v6.13-rc1 commit b7d0a97b28083084ebdd8e5c6bccd12e6ec18faa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAFK CVE: CVE-2024-53221 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There's issue as follows when concurrently installing the f2fs.ko module and mounting the f2fs file system: KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] RIP: 0010:__bio_alloc+0x2fb/0x6c0 [f2fs] Call Trace: <TASK> f2fs_submit_page_bio+0x126/0x8b0 [f2fs] __get_meta_page+0x1d4/0x920 [f2fs] get_checkpoint_version.constprop.0+0x2b/0x3c0 [f2fs] validate_checkpoint+0xac/0x290 [f2fs] f2fs_get_valid_checkpoint+0x207/0x950 [f2fs] f2fs_fill_super+0x1007/0x39b0 [f2fs] mount_bdev+0x183/0x250 legacy_get_tree+0xf4/0x1e0 vfs_get_tree+0x88/0x340 do_new_mount+0x283/0x5e0 path_mount+0x2b2/0x15b0 __x64_sys_mount+0x1fe/0x270 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Above issue happens as the biset of the f2fs file system is not initialized before register "f2fs_fs_type". To address above issue just register "f2fs_fs_type" at the last in init_f2fs_fs(). Ensure that all f2fs file system resources are initialized. Fixes: f543805fcd60 ("f2fs: introduce private bioset") Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Conflicts: fs/f2fs/super.c [Conflict caused by commit 4d9a2bb1a6ba has not been merged] Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- fs/f2fs/super.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c index 42d18166f10a..28f8b88a59ea 100644 --- a/fs/f2fs/super.c +++ b/fs/f2fs/super.c @@ -4116,9 +4116,6 @@ static int __init init_f2fs_fs(void) err = register_shrinker(&f2fs_shrinker_info); if (err) goto free_sysfs; - err = register_filesystem(&f2fs_fs_type); - if (err) - goto free_shrinker; f2fs_create_root_stats(); err = f2fs_init_post_read_processing(); if (err) @@ -4135,7 +4132,12 @@ static int __init init_f2fs_fs(void) err = f2fs_init_compress_cache(); if (err) goto free_compress_mempool; + err = register_filesystem(&f2fs_fs_type); + if (err) + goto free_compress_cache; return 0; +free_compress_cache: + f2fs_destroy_compress_cache(); free_compress_mempool: f2fs_destroy_compress_mempool(); free_bioset: @@ -4146,8 +4148,6 @@ static int __init init_f2fs_fs(void) f2fs_destroy_post_read_processing(); free_root_stats: f2fs_destroy_root_stats(); - unregister_filesystem(&f2fs_fs_type); -free_shrinker: unregister_shrinker(&f2fs_shrinker_info); free_sysfs: f2fs_exit_sysfs(); @@ -4171,13 +4171,13 @@ static int __init init_f2fs_fs(void) static void __exit exit_f2fs_fs(void) { + unregister_filesystem(&f2fs_fs_type); f2fs_destroy_compress_cache(); f2fs_destroy_compress_mempool(); f2fs_destroy_bioset(); f2fs_destroy_bio_entry_cache(); f2fs_destroy_post_read_processing(); f2fs_destroy_root_stats(); - unregister_filesystem(&f2fs_fs_type); unregister_shrinker(&f2fs_shrinker_info); f2fs_exit_sysfs(); f2fs_destroy_garbage_collection_cache(); -- 2.25.1

2 1

[PATCH OLK-6.6 V1] netfilter: nft_inner: incorrect percpu area handling under softirq
by Cheng Yu 02 Jan '25

02 Jan '25

From: Pablo Neira Ayuso <pablo(a)netfilter.org> stable inclusion from stable-v6.6.66 commit 53c7314208c865086d78b4e88da53bc33da0b603 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOQ CVE: CVE-2024-56638 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 7b1d83da254be3bf054965c8f3b1ad976f460ae5 ] Softirq can interrupt ongoing packet from process context that is walking over the percpu area that contains inner header offsets. Disable bh and perform three checks before restoring the percpu inner header offsets to validate that the percpu area is valid for this skbuff: 1) If the NFT_PKTINFO_INNER_FULL flag is set on, then this skbuff has already been parsed before for inner header fetching to register. 2) Validate that the percpu area refers to this skbuff using the skbuff pointer as a cookie. If there is a cookie mismatch, then this skbuff needs to be parsed again. 3) Finally, validate if the percpu area refers to this tunnel type. Only after these three checks the percpu area is restored to a on-stack copy and bh is enabled again. After inner header fetching, the on-stack copy is stored back to the percpu area. Fixes: 3a07327d10a0 ("netfilter: nft_inner: support for inner tunnel header matching") Reported-by: syzbot+84d0441b9860f0d63285(a)syzkaller.appspotmail.com Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- include/net/netfilter/nf_tables_core.h | 1 + net/netfilter/nft_inner.c | 57 ++++++++++++++++++++------ 2 files changed, 46 insertions(+), 12 deletions(-) diff --git a/include/net/netfilter/nf_tables_core.h b/include/net/netfilter/nf_tables_core.h index 780a5f6ad4a6..16855c2a03f8 100644 --- a/include/net/netfilter/nf_tables_core.h +++ b/include/net/netfilter/nf_tables_core.h @@ -161,6 +161,7 @@ enum { }; struct nft_inner_tun_ctx { + unsigned long cookie; u16 type; u16 inner_tunoff; u16 inner_lloff; diff --git a/net/netfilter/nft_inner.c b/net/netfilter/nft_inner.c index 928312d01eb1..817ab978d24a 100644 --- a/net/netfilter/nft_inner.c +++ b/net/netfilter/nft_inner.c @@ -210,35 +210,66 @@ static int nft_inner_parse(const struct nft_inner *priv, struct nft_pktinfo *pkt, struct nft_inner_tun_ctx *tun_ctx) { - struct nft_inner_tun_ctx ctx = {}; u32 off = pkt->inneroff; if (priv->flags & NFT_INNER_HDRSIZE && - nft_inner_parse_tunhdr(priv, pkt, &ctx, &off) < 0) + nft_inner_parse_tunhdr(priv, pkt, tun_ctx, &off) < 0) return -1; if (priv->flags & (NFT_INNER_LL | NFT_INNER_NH)) { - if (nft_inner_parse_l2l3(priv, pkt, &ctx, off) < 0) + if (nft_inner_parse_l2l3(priv, pkt, tun_ctx, off) < 0) return -1; } else if (priv->flags & NFT_INNER_TH) { - ctx.inner_thoff = off; - ctx.flags |= NFT_PAYLOAD_CTX_INNER_TH; + tun_ctx->inner_thoff = off; + tun_ctx->flags |= NFT_PAYLOAD_CTX_INNER_TH; } - *tun_ctx = ctx; tun_ctx->type = priv->type; + tun_ctx->cookie = (unsigned long)pkt->skb; pkt->flags |= NFT_PKTINFO_INNER_FULL; return 0; } +static bool nft_inner_restore_tun_ctx(const struct nft_pktinfo *pkt, + struct nft_inner_tun_ctx *tun_ctx) +{ + struct nft_inner_tun_ctx *this_cpu_tun_ctx; + + local_bh_disable(); + this_cpu_tun_ctx = this_cpu_ptr(&nft_pcpu_tun_ctx); + if (this_cpu_tun_ctx->cookie != (unsigned long)pkt->skb) { + local_bh_enable(); + return false; + } + *tun_ctx = *this_cpu_tun_ctx; + local_bh_enable(); + + return true; +} + +static void nft_inner_save_tun_ctx(const struct nft_pktinfo *pkt, + const struct nft_inner_tun_ctx *tun_ctx) +{ + struct nft_inner_tun_ctx *this_cpu_tun_ctx; + + local_bh_disable(); + this_cpu_tun_ctx = this_cpu_ptr(&nft_pcpu_tun_ctx); + if (this_cpu_tun_ctx->cookie != tun_ctx->cookie) + *this_cpu_tun_ctx = *tun_ctx; + local_bh_enable(); +} + static bool nft_inner_parse_needed(const struct nft_inner *priv, const struct nft_pktinfo *pkt, - const struct nft_inner_tun_ctx *tun_ctx) + struct nft_inner_tun_ctx *tun_ctx) { if (!(pkt->flags & NFT_PKTINFO_INNER_FULL)) return true; + if (!nft_inner_restore_tun_ctx(pkt, tun_ctx)) + return true; + if (priv->type != tun_ctx->type) return true; @@ -248,27 +279,29 @@ static bool nft_inner_parse_needed(const struct nft_inner *priv, static void nft_inner_eval(const struct nft_expr *expr, struct nft_regs *regs, const struct nft_pktinfo *pkt) { - struct nft_inner_tun_ctx *tun_ctx = this_cpu_ptr(&nft_pcpu_tun_ctx); const struct nft_inner *priv = nft_expr_priv(expr); + struct nft_inner_tun_ctx tun_ctx = {}; if (nft_payload_inner_offset(pkt) < 0) goto err; - if (nft_inner_parse_needed(priv, pkt, tun_ctx) && - nft_inner_parse(priv, (struct nft_pktinfo *)pkt, tun_ctx) < 0) + if (nft_inner_parse_needed(priv, pkt, &tun_ctx) && + nft_inner_parse(priv, (struct nft_pktinfo *)pkt, &tun_ctx) < 0) goto err; switch (priv->expr_type) { case NFT_INNER_EXPR_PAYLOAD: - nft_payload_inner_eval((struct nft_expr *)&priv->expr, regs, pkt, tun_ctx); + nft_payload_inner_eval((struct nft_expr *)&priv->expr, regs, pkt, &tun_ctx); break; case NFT_INNER_EXPR_META: - nft_meta_inner_eval((struct nft_expr *)&priv->expr, regs, pkt, tun_ctx); + nft_meta_inner_eval((struct nft_expr *)&priv->expr, regs, pkt, &tun_ctx); break; default: WARN_ON_ONCE(1); goto err; } + nft_inner_save_tun_ctx(pkt, &tun_ctx); + return; err: regs->verdict.code = NFT_BREAK; -- 2.25.1

2 1

[PATCH OLK-5.10 V1] sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers
by Cheng Yu 02 Jan '25

02 Jan '25

From: Qun-Wei Lin <qun-wei.lin(a)mediatek.com> stable inclusion from stable-v6.11.10 commit fbfe23012cec509dfbe09852019c4e4bb84999d0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB957H CVE: CVE-2024-53128 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit fd7b4f9f46d46acbc7af3a439bb0d869efdc5c58 upstream. When CONFIG_KASAN_SW_TAGS and CONFIG_KASAN_STACK are enabled, the object_is_on_stack() function may produce incorrect results due to the presence of tags in the obj pointer, while the stack pointer does not have tags. This discrepancy can lead to incorrect stack object detection and subsequently trigger warnings if CONFIG_DEBUG_OBJECTS is also enabled. Example of the warning: ODEBUG: object 3eff800082ea7bb0 is NOT on stack ffff800082ea0000, but annotated. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1 at lib/debugobjects.c:557 __debug_object_init+0x330/0x364 Modules linked in: CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.0-rc5 #4 Hardware name: linux,dummy-virt (DT) pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __debug_object_init+0x330/0x364 lr : __debug_object_init+0x330/0x364 sp : ffff800082ea7b40 x29: ffff800082ea7b40 x28: 98ff0000c0164518 x27: 98ff0000c0164534 x26: ffff800082d93ec8 x25: 0000000000000001 x24: 1cff0000c00172a0 x23: 0000000000000000 x22: ffff800082d93ed0 x21: ffff800081a24418 x20: 3eff800082ea7bb0 x19: efff800000000000 x18: 0000000000000000 x17: 00000000000000ff x16: 0000000000000047 x15: 206b63617473206e x14: 0000000000000018 x13: ffff800082ea7780 x12: 0ffff800082ea78e x11: 0ffff800082ea790 x10: 0ffff800082ea79d x9 : 34d77febe173e800 x8 : 34d77febe173e800 x7 : 0000000000000001 x6 : 0000000000000001 x5 : feff800082ea74b8 x4 : ffff800082870a90 x3 : ffff80008018d3c4 x2 : 0000000000000001 x1 : ffff800082858810 x0 : 0000000000000050 Call trace: __debug_object_init+0x330/0x364 debug_object_init_on_stack+0x30/0x3c schedule_hrtimeout_range_clock+0xac/0x26c schedule_hrtimeout+0x1c/0x30 wait_task_inactive+0x1d4/0x25c kthread_bind_mask+0x28/0x98 init_rescuer+0x1e8/0x280 workqueue_init+0x1a0/0x3cc kernel_init_freeable+0x118/0x200 kernel_init+0x28/0x1f0 ret_from_fork+0x10/0x20 ---[ end trace 0000000000000000 ]--- ODEBUG: object 3eff800082ea7bb0 is NOT on stack ffff800082ea0000, but annotated. ------------[ cut here ]------------ Link: https://lkml.kernel.org/r/20241113042544.19095-1-qun-wei.lin@mediatek.com Signed-off-by: Qun-Wei Lin <qun-wei.lin(a)mediatek.com> Cc: Andrew Yang <andrew.yang(a)mediatek.com> Cc: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> Cc: Casper Li <casper.li(a)mediatek.com> Cc: Catalin Marinas <catalin.marinas(a)arm.com> Cc: Chinwen Chang <chinwen.chang(a)mediatek.com> Cc: Kent Overstreet <kent.overstreet(a)linux.dev> Cc: Matthias Brugger <matthias.bgg(a)gmail.com> Cc: Pasha Tatashin <pasha.tatashin(a)soleen.com> Cc: Shakeel Butt <shakeel.butt(a)linux.dev> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: include/linux/sched/task_stack.h [Context conflict caused by commit f6120d527b861("task_stack.h: add missing include") has not been merged.] Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- include/linux/sched/task_stack.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/include/linux/sched/task_stack.h b/include/linux/sched/task_stack.h index 879a5c8f930b..547d7cc9097e 100644 --- a/include/linux/sched/task_stack.h +++ b/include/linux/sched/task_stack.h @@ -8,6 +8,7 @@ #include <linux/sched.h> #include <linux/magic.h> +#include <linux/kasan.h> #ifdef CONFIG_THREAD_INFO_IN_TASK @@ -86,6 +87,7 @@ static inline int object_is_on_stack(const void *obj) { void *stack = task_stack_page(current); + obj = kasan_reset_tag(obj); return (obj >= stack) && (obj < (stack + THREAD_SIZE)); } -- 2.25.1

2 1

[PATCH OLK-6.6 V1] sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers
by Cheng Yu 02 Jan '25

02 Jan '25

From: Qun-Wei Lin <qun-wei.lin(a)mediatek.com> stable inclusion from stable-v6.11.10 commit fbfe23012cec509dfbe09852019c4e4bb84999d0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB957H CVE: CVE-2024-53128 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit fd7b4f9f46d46acbc7af3a439bb0d869efdc5c58 upstream. When CONFIG_KASAN_SW_TAGS and CONFIG_KASAN_STACK are enabled, the object_is_on_stack() function may produce incorrect results due to the presence of tags in the obj pointer, while the stack pointer does not have tags. This discrepancy can lead to incorrect stack object detection and subsequently trigger warnings if CONFIG_DEBUG_OBJECTS is also enabled. Example of the warning: ODEBUG: object 3eff800082ea7bb0 is NOT on stack ffff800082ea0000, but annotated. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1 at lib/debugobjects.c:557 __debug_object_init+0x330/0x364 Modules linked in: CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.0-rc5 #4 Hardware name: linux,dummy-virt (DT) pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __debug_object_init+0x330/0x364 lr : __debug_object_init+0x330/0x364 sp : ffff800082ea7b40 x29: ffff800082ea7b40 x28: 98ff0000c0164518 x27: 98ff0000c0164534 x26: ffff800082d93ec8 x25: 0000000000000001 x24: 1cff0000c00172a0 x23: 0000000000000000 x22: ffff800082d93ed0 x21: ffff800081a24418 x20: 3eff800082ea7bb0 x19: efff800000000000 x18: 0000000000000000 x17: 00000000000000ff x16: 0000000000000047 x15: 206b63617473206e x14: 0000000000000018 x13: ffff800082ea7780 x12: 0ffff800082ea78e x11: 0ffff800082ea790 x10: 0ffff800082ea79d x9 : 34d77febe173e800 x8 : 34d77febe173e800 x7 : 0000000000000001 x6 : 0000000000000001 x5 : feff800082ea74b8 x4 : ffff800082870a90 x3 : ffff80008018d3c4 x2 : 0000000000000001 x1 : ffff800082858810 x0 : 0000000000000050 Call trace: __debug_object_init+0x330/0x364 debug_object_init_on_stack+0x30/0x3c schedule_hrtimeout_range_clock+0xac/0x26c schedule_hrtimeout+0x1c/0x30 wait_task_inactive+0x1d4/0x25c kthread_bind_mask+0x28/0x98 init_rescuer+0x1e8/0x280 workqueue_init+0x1a0/0x3cc kernel_init_freeable+0x118/0x200 kernel_init+0x28/0x1f0 ret_from_fork+0x10/0x20 ---[ end trace 0000000000000000 ]--- ODEBUG: object 3eff800082ea7bb0 is NOT on stack ffff800082ea0000, but annotated. ------------[ cut here ]------------ Link: https://lkml.kernel.org/r/20241113042544.19095-1-qun-wei.lin@mediatek.com Signed-off-by: Qun-Wei Lin <qun-wei.lin(a)mediatek.com> Cc: Andrew Yang <andrew.yang(a)mediatek.com> Cc: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> Cc: Casper Li <casper.li(a)mediatek.com> Cc: Catalin Marinas <catalin.marinas(a)arm.com> Cc: Chinwen Chang <chinwen.chang(a)mediatek.com> Cc: Kent Overstreet <kent.overstreet(a)linux.dev> Cc: Matthias Brugger <matthias.bgg(a)gmail.com> Cc: Pasha Tatashin <pasha.tatashin(a)soleen.com> Cc: Shakeel Butt <shakeel.butt(a)linux.dev> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: include/linux/sched/task_stack.h [Context conflict caused by commit f6120d527b861("task_stack.h: add missing include") has not been merged.] Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- include/linux/sched/task_stack.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/include/linux/sched/task_stack.h b/include/linux/sched/task_stack.h index f158b025c175..d2117e1c8fa5 100644 --- a/include/linux/sched/task_stack.h +++ b/include/linux/sched/task_stack.h @@ -8,6 +8,7 @@ #include <linux/sched.h> #include <linux/magic.h> +#include <linux/kasan.h> #ifdef CONFIG_THREAD_INFO_IN_TASK @@ -88,6 +89,7 @@ static inline int object_is_on_stack(const void *obj) { void *stack = task_stack_page(current); + obj = kasan_reset_tag(obj); return (obj >= stack) && (obj < (stack + THREAD_SIZE)); } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 V1] sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers
by Cheng Yu 02 Jan '25

02 Jan '25

From: Qun-Wei Lin <qun-wei.lin(a)mediatek.com> stable inclusion from stable-v6.11.10 commit fbfe23012cec509dfbe09852019c4e4bb84999d0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB957H CVE: CVE-2024-53128 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit fd7b4f9f46d46acbc7af3a439bb0d869efdc5c58 upstream. When CONFIG_KASAN_SW_TAGS and CONFIG_KASAN_STACK are enabled, the object_is_on_stack() function may produce incorrect results due to the presence of tags in the obj pointer, while the stack pointer does not have tags. This discrepancy can lead to incorrect stack object detection and subsequently trigger warnings if CONFIG_DEBUG_OBJECTS is also enabled. Example of the warning: ODEBUG: object 3eff800082ea7bb0 is NOT on stack ffff800082ea0000, but annotated. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1 at lib/debugobjects.c:557 __debug_object_init+0x330/0x364 Modules linked in: CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.0-rc5 #4 Hardware name: linux,dummy-virt (DT) pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __debug_object_init+0x330/0x364 lr : __debug_object_init+0x330/0x364 sp : ffff800082ea7b40 x29: ffff800082ea7b40 x28: 98ff0000c0164518 x27: 98ff0000c0164534 x26: ffff800082d93ec8 x25: 0000000000000001 x24: 1cff0000c00172a0 x23: 0000000000000000 x22: ffff800082d93ed0 x21: ffff800081a24418 x20: 3eff800082ea7bb0 x19: efff800000000000 x18: 0000000000000000 x17: 00000000000000ff x16: 0000000000000047 x15: 206b63617473206e x14: 0000000000000018 x13: ffff800082ea7780 x12: 0ffff800082ea78e x11: 0ffff800082ea790 x10: 0ffff800082ea79d x9 : 34d77febe173e800 x8 : 34d77febe173e800 x7 : 0000000000000001 x6 : 0000000000000001 x5 : feff800082ea74b8 x4 : ffff800082870a90 x3 : ffff80008018d3c4 x2 : 0000000000000001 x1 : ffff800082858810 x0 : 0000000000000050 Call trace: __debug_object_init+0x330/0x364 debug_object_init_on_stack+0x30/0x3c schedule_hrtimeout_range_clock+0xac/0x26c schedule_hrtimeout+0x1c/0x30 wait_task_inactive+0x1d4/0x25c kthread_bind_mask+0x28/0x98 init_rescuer+0x1e8/0x280 workqueue_init+0x1a0/0x3cc kernel_init_freeable+0x118/0x200 kernel_init+0x28/0x1f0 ret_from_fork+0x10/0x20 ---[ end trace 0000000000000000 ]--- ODEBUG: object 3eff800082ea7bb0 is NOT on stack ffff800082ea0000, but annotated. ------------[ cut here ]------------ Link: https://lkml.kernel.org/r/20241113042544.19095-1-qun-wei.lin@mediatek.com Signed-off-by: Qun-Wei Lin <qun-wei.lin(a)mediatek.com> Cc: Andrew Yang <andrew.yang(a)mediatek.com> Cc: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> Cc: Casper Li <casper.li(a)mediatek.com> Cc: Catalin Marinas <catalin.marinas(a)arm.com> Cc: Chinwen Chang <chinwen.chang(a)mediatek.com> Cc: Kent Overstreet <kent.overstreet(a)linux.dev> Cc: Matthias Brugger <matthias.bgg(a)gmail.com> Cc: Pasha Tatashin <pasha.tatashin(a)soleen.com> Cc: Shakeel Butt <shakeel.butt(a)linux.dev> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: include/linux/sched/task_stack.h [Context conflict caused by commit f6120d527b861("task_stack.h: add missing include") has not been merged.] Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- include/linux/sched/task_stack.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/include/linux/sched/task_stack.h b/include/linux/sched/task_stack.h index d10150587d81..4424aff0cfce 100644 --- a/include/linux/sched/task_stack.h +++ b/include/linux/sched/task_stack.h @@ -8,6 +8,7 @@ #include <linux/sched.h> #include <linux/magic.h> +#include <linux/kasan.h> #ifdef CONFIG_THREAD_INFO_IN_TASK @@ -86,6 +87,7 @@ static inline int object_is_on_stack(const void *obj) { void *stack = task_stack_page(current); + obj = kasan_reset_tag(obj); return (obj >= stack) && (obj < (stack + THREAD_SIZE)); } -- 2.25.1

2 1

[PATCH OLK-6.6 V1] sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers
by Cheng Yu 02 Jan '25

02 Jan '25

From: Qun-Wei Lin <qun-wei.lin(a)mediatek.com> stable inclusion from stable-v6.11.10 commit fbfe23012cec509dfbe09852019c4e4bb84999d0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB957H CVE: CVE-2024-53128 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit fd7b4f9f46d46acbc7af3a439bb0d869efdc5c58 upstream. When CONFIG_KASAN_SW_TAGS and CONFIG_KASAN_STACK are enabled, the object_is_on_stack() function may produce incorrect results due to the presence of tags in the obj pointer, while the stack pointer does not have tags. This discrepancy can lead to incorrect stack object detection and subsequently trigger warnings if CONFIG_DEBUG_OBJECTS is also enabled. Example of the warning: ODEBUG: object 3eff800082ea7bb0 is NOT on stack ffff800082ea0000, but annotated. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1 at lib/debugobjects.c:557 __debug_object_init+0x330/0x364 Modules linked in: CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.0-rc5 #4 Hardware name: linux,dummy-virt (DT) pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __debug_object_init+0x330/0x364 lr : __debug_object_init+0x330/0x364 sp : ffff800082ea7b40 x29: ffff800082ea7b40 x28: 98ff0000c0164518 x27: 98ff0000c0164534 x26: ffff800082d93ec8 x25: 0000000000000001 x24: 1cff0000c00172a0 x23: 0000000000000000 x22: ffff800082d93ed0 x21: ffff800081a24418 x20: 3eff800082ea7bb0 x19: efff800000000000 x18: 0000000000000000 x17: 00000000000000ff x16: 0000000000000047 x15: 206b63617473206e x14: 0000000000000018 x13: ffff800082ea7780 x12: 0ffff800082ea78e x11: 0ffff800082ea790 x10: 0ffff800082ea79d x9 : 34d77febe173e800 x8 : 34d77febe173e800 x7 : 0000000000000001 x6 : 0000000000000001 x5 : feff800082ea74b8 x4 : ffff800082870a90 x3 : ffff80008018d3c4 x2 : 0000000000000001 x1 : ffff800082858810 x0 : 0000000000000050 Call trace: __debug_object_init+0x330/0x364 debug_object_init_on_stack+0x30/0x3c schedule_hrtimeout_range_clock+0xac/0x26c schedule_hrtimeout+0x1c/0x30 wait_task_inactive+0x1d4/0x25c kthread_bind_mask+0x28/0x98 init_rescuer+0x1e8/0x280 workqueue_init+0x1a0/0x3cc kernel_init_freeable+0x118/0x200 kernel_init+0x28/0x1f0 ret_from_fork+0x10/0x20 ---[ end trace 0000000000000000 ]--- ODEBUG: object 3eff800082ea7bb0 is NOT on stack ffff800082ea0000, but annotated. ------------[ cut here ]------------ Link: https://lkml.kernel.org/r/20241113042544.19095-1-qun-wei.lin@mediatek.com Signed-off-by: Qun-Wei Lin <qun-wei.lin(a)mediatek.com> Cc: Andrew Yang <andrew.yang(a)mediatek.com> Cc: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> Cc: Casper Li <casper.li(a)mediatek.com> Cc: Catalin Marinas <catalin.marinas(a)arm.com> Cc: Chinwen Chang <chinwen.chang(a)mediatek.com> Cc: Kent Overstreet <kent.overstreet(a)linux.dev> Cc: Matthias Brugger <matthias.bgg(a)gmail.com> Cc: Pasha Tatashin <pasha.tatashin(a)soleen.com> Cc: Shakeel Butt <shakeel.butt(a)linux.dev> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: include/linux/sched/task_stack.h [Context conflict caused by commit f6120d527b861("task_stack.h: add missing include") has not been merged.] Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- include/linux/sched/task_stack.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/include/linux/sched/task_stack.h b/include/linux/sched/task_stack.h index f158b025c175..d2117e1c8fa5 100644 --- a/include/linux/sched/task_stack.h +++ b/include/linux/sched/task_stack.h @@ -8,6 +8,7 @@ #include <linux/sched.h> #include <linux/magic.h> +#include <linux/kasan.h> #ifdef CONFIG_THREAD_INFO_IN_TASK @@ -88,6 +89,7 @@ static inline int object_is_on_stack(const void *obj) { void *stack = task_stack_page(current); + obj = kasan_reset_tag(obj); return (obj >= stack) && (obj < (stack + THREAD_SIZE)); } -- 2.25.1

2 1

[PATCH OLK-6.6] iommufd: Fix out_fput in iommufd_fault_alloc()
by GONG Ruiqi 02 Jan '25

02 Jan '25

From: Nicolin Chen <nicolinc(a)nvidia.com> mainline inclusion from mainline-v6.13-rc2 commit af7f4780514f850322b2959032ecaa96e4b26472 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOW CVE: CVE-2024-56624 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As fput() calls the file->f_op->release op, where fault obj and ictx are getting released, there is no need to release these two after fput() one more time, which would result in imbalanced refcounts: refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 48 PID: 2369 at lib/refcount.c:31 refcount_warn_saturate+0x60/0x230 Call trace: refcount_warn_saturate+0x60/0x230 (P) refcount_warn_saturate+0x60/0x230 (L) iommufd_fault_fops_release+0x9c/0xe0 [iommufd] ... VFS: Close: file count is 0 (f_op=iommufd_fops [iommufd]) WARNING: CPU: 48 PID: 2369 at fs/open.c:1507 filp_flush+0x3c/0xf0 Call trace: filp_flush+0x3c/0xf0 (P) filp_flush+0x3c/0xf0 (L) __arm64_sys_close+0x34/0x98 ... imbalanced put on file reference count WARNING: CPU: 48 PID: 2369 at fs/file.c:74 __file_ref_put+0x100/0x138 Call trace: __file_ref_put+0x100/0x138 (P) __file_ref_put+0x100/0x138 (L) __fput_sync+0x4c/0xd0 Drop those two lines to fix the warnings above. Cc: stable(a)vger.kernel.org Fixes: 07838f7fd529 ("iommufd: Add iommufd fault object") Link: https://patch.msgid.link/r/b5651beb3a6b1adeef26fffac24607353bf67ba1.1733212… Signed-off-by: Nicolin Chen <nicolinc(a)nvidia.com> Reviewed-by: Yi Liu <yi.l.liu(a)intel.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: GONG Ruiqi <gongruiqi1(a)huawei.com> --- drivers/iommu/iommufd/fault.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/iommu/iommufd/fault.c b/drivers/iommu/iommufd/fault.c index 11c70922ec47..f8c8bbf8e457 100644 --- a/drivers/iommu/iommufd/fault.c +++ b/drivers/iommu/iommufd/fault.c @@ -431,8 +431,6 @@ int iommufd_fault_alloc(struct iommufd_ucmd *ucmd) put_unused_fd(fdno); out_fput: fput(filep); - refcount_dec(&fault->obj.users); - iommufd_ctx_put(fault->ictx); out_abort: iommufd_object_abort_and_destroy(ucmd->ictx, &fault->obj); -- 2.25.1

2 1

[PATCH OLK-6.6 0/1] CVE-2024-56546
by Lin Yujun 02 Jan '25

02 Jan '25

Gaosheng Cui (1): drivers: soc: xilinx: add the missing kfree in xlnx_add_cb_for_suspend() drivers/soc/xilinx/xlnx_event_manager.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6] apparmor: test: Fix memory leak for aa_unpack_strdup()
by Gu Bowen 02 Jan '25

02 Jan '25

From: Jinjie Ruan <ruanjinjie(a)huawei.com> stable inclusion from stable-v6.6.64 commit 2a9b68f2dc6812bd1b8880b5c00e60203d6f61f6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEGGQ CVE: CVE-2024-56741 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7290f59231910ccba427d441a6e8b8c6f6112448 upstream. The string allocated by kmemdup() in aa_unpack_strdup() is not freed and cause following memory leaks, free them to fix it. unreferenced object 0xffffff80c6af8a50 (size 8): comm "kunit_try_catch", pid 225, jiffies 4294894407 hex dump (first 8 bytes): 74 65 73 74 69 6e 67 00 testing. backtrace (crc 5eab668b): [<0000000001e3714d>] kmemleak_alloc+0x34/0x40 [<000000006e6c7776>] __kmalloc_node_track_caller_noprof+0x300/0x3e0 [<000000006870467c>] kmemdup_noprof+0x34/0x60 [<000000001176bb03>] aa_unpack_strdup+0xd0/0x18c [<000000008ecde918>] policy_unpack_test_unpack_strdup_with_null_name+0xf8/0x3ec [<0000000032ef8f77>] kunit_try_run_case+0x13c/0x3ac [<00000000f3edea23>] kunit_generic_run_threadfn_adapter+0x80/0xec [<00000000adf936cf>] kthread+0x2e8/0x374 [<0000000041bb1628>] ret_from_fork+0x10/0x20 unreferenced object 0xffffff80c2a29090 (size 8): comm "kunit_try_catch", pid 227, jiffies 4294894409 hex dump (first 8 bytes): 74 65 73 74 69 6e 67 00 testing. backtrace (crc 5eab668b): [<0000000001e3714d>] kmemleak_alloc+0x34/0x40 [<000000006e6c7776>] __kmalloc_node_track_caller_noprof+0x300/0x3e0 [<000000006870467c>] kmemdup_noprof+0x34/0x60 [<000000001176bb03>] aa_unpack_strdup+0xd0/0x18c [<0000000046a45c1a>] policy_unpack_test_unpack_strdup_with_name+0xd0/0x3c4 [<0000000032ef8f77>] kunit_try_run_case+0x13c/0x3ac [<00000000f3edea23>] kunit_generic_run_threadfn_adapter+0x80/0xec [<00000000adf936cf>] kthread+0x2e8/0x374 [<0000000041bb1628>] ret_from_fork+0x10/0x20 Cc: stable(a)vger.kernel.org Fixes: 4d944bcd4e73 ("apparmor: add AppArmor KUnit tests for policy unpack") Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> Signed-off-by: John Johansen <john.johansen(a)canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- security/apparmor/policy_unpack_test.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/security/apparmor/policy_unpack_test.c b/security/apparmor/policy_unpack_test.c index 2b8003eb4f46..dd551587fe4a 100644 --- a/security/apparmor/policy_unpack_test.c +++ b/security/apparmor/policy_unpack_test.c @@ -281,6 +281,8 @@ static void policy_unpack_test_unpack_strdup_with_null_name(struct kunit *test) ((uintptr_t)puf->e->start <= (uintptr_t)string) && ((uintptr_t)string <= (uintptr_t)puf->e->end)); KUNIT_EXPECT_STREQ(test, string, TEST_STRING_DATA); + + kfree(string); } static void policy_unpack_test_unpack_strdup_with_name(struct kunit *test) @@ -296,6 +298,8 @@ static void policy_unpack_test_unpack_strdup_with_name(struct kunit *test) ((uintptr_t)puf->e->start <= (uintptr_t)string) && ((uintptr_t)string <= (uintptr_t)puf->e->end)); KUNIT_EXPECT_STREQ(test, string, TEST_STRING_DATA); + + kfree(string); } static void policy_unpack_test_unpack_strdup_out_of_bounds(struct kunit *test) @@ -313,6 +317,8 @@ static void policy_unpack_test_unpack_strdup_out_of_bounds(struct kunit *test) KUNIT_EXPECT_EQ(test, size, 0); KUNIT_EXPECT_NULL(test, string); KUNIT_EXPECT_PTR_EQ(test, puf->e->pos, start); + + kfree(string); } static void policy_unpack_test_unpack_nameX_with_null_name(struct kunit *test) -- 2.25.1

2 1

[PATCH OLK-5.10] net: phy: dp83869: fix memory corruption when enabling fiber
by Zhang Changzhong 02 Jan '25

02 Jan '25

From: Ingo van Lil <inguin(a)gmx.de> stable inclusion from stable-v5.10.227 commit 21b5af7f0c99b3bf1fd02016e6708b613acbcaf4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YUE CVE: CVE-2024-50188 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a842e443ca8184f2dc82ab307b43a8b38defd6a5 ] When configuring the fiber port, the DP83869 PHY driver incorrectly calls linkmode_set_bit() with a bit mask (1 << 10) rather than a bit number (10). This corrupts some other memory location -- in case of arm64 the priv pointer in the same structure. Since the advertising flags are updated from supported at the end of the function the incorrect line isn't needed at all and can be removed. Fixes: a29de52ba2a1 ("net: dp83869: Add ability to advertise Fiber connection") Signed-off-by: Ingo van Lil <inguin(a)gmx.de> Reviewed-by: Alexander Sverdlin <alexander.sverdlin(a)siemens.com> Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> Link: https://patch.msgid.link/20241002161807.440378-1-inguin@gmx.de Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/phy/dp83869.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/phy/dp83869.c b/drivers/net/phy/dp83869.c index 65b69ff..01b593e 100644 --- a/drivers/net/phy/dp83869.c +++ b/drivers/net/phy/dp83869.c @@ -610,7 +610,6 @@ static int dp83869_configure_fiber(struct phy_device *phydev, phydev->supported); linkmode_set_bit(ETHTOOL_LINK_MODE_FIBRE_BIT, phydev->supported); - linkmode_set_bit(ADVERTISED_FIBRE, phydev->advertising); if (dp83869->mode == DP83869_RGMII_1000_BASE) { linkmode_set_bit(ETHTOOL_LINK_MODE_1000baseX_Full_BIT, -- 2.9.5

2 1

[PATCH openEuler-22.03-LTS-SP1] net: phy: dp83869: fix memory corruption when enabling fiber
by Zhang Changzhong 02 Jan '25

02 Jan '25

From: Ingo van Lil <inguin(a)gmx.de> stable inclusion from stable-v5.10.227 commit 21b5af7f0c99b3bf1fd02016e6708b613acbcaf4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YUE CVE: CVE-2024-50188 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a842e443ca8184f2dc82ab307b43a8b38defd6a5 ] When configuring the fiber port, the DP83869 PHY driver incorrectly calls linkmode_set_bit() with a bit mask (1 << 10) rather than a bit number (10). This corrupts some other memory location -- in case of arm64 the priv pointer in the same structure. Since the advertising flags are updated from supported at the end of the function the incorrect line isn't needed at all and can be removed. Fixes: a29de52ba2a1 ("net: dp83869: Add ability to advertise Fiber connection") Signed-off-by: Ingo van Lil <inguin(a)gmx.de> Reviewed-by: Alexander Sverdlin <alexander.sverdlin(a)siemens.com> Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> Link: https://patch.msgid.link/20241002161807.440378-1-inguin@gmx.de Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/phy/dp83869.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/phy/dp83869.c b/drivers/net/phy/dp83869.c index a9daff8..88d14d0 100644 --- a/drivers/net/phy/dp83869.c +++ b/drivers/net/phy/dp83869.c @@ -612,7 +612,6 @@ static int dp83869_configure_fiber(struct phy_device *phydev, phydev->supported); linkmode_set_bit(ETHTOOL_LINK_MODE_FIBRE_BIT, phydev->supported); - linkmode_set_bit(ADVERTISED_FIBRE, phydev->advertising); if (dp83869->mode == DP83869_RGMII_1000_BASE) { linkmode_set_bit(ETHTOOL_LINK_MODE_1000baseX_Full_BIT, -- 2.9.5

2 1

[PATCH OLK-6.6] erofs: handle NONHEAD !delta[1] lclusters gracefully
by Zizhi Wo 02 Jan '25

02 Jan '25

From: Gao Xiang <hsiangkao(a)linux.alibaba.com> stable inclusion from stable-v6.6.64 commit f466641debcbea8bdf78d1b63a6270aadf9301bf category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBEAED CVE: CVE-2024-53234 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 0bc8061ffc733a0a246b8689b2d32a3e9204f43c ] syzbot reported a WARNING in iomap_iter_done: iomap_fiemap+0x73b/0x9b0 fs/iomap/fiemap.c:80 ioctl_fiemap fs/ioctl.c:220 [inline] Generally, NONHEAD lclusters won't have delta[1]==0, except for crafted images and filesystems created by pre-1.0 mkfs versions. Previously, it would immediately bail out if delta[1]==0, which led to inadequate decompressed lengths (thus FIEMAP is impacted). Treat it as delta[1]=1 to work around these legacy mkfs versions. `lclusterbits > 14` is illegal for compact indexes, error out too. Reported-by: syzbot+6c0b301317aa0156f9eb(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/67373c0c.050a0220.2a2fcc.0079.GAE@google.com Tested-by: syzbot+6c0b301317aa0156f9eb(a)syzkaller.appspotmail.com Fixes: d95ae5e25326 ("erofs: add support for the full decompressed length") Fixes: 001b8ccd0650 ("erofs: fix compact 4B support for 16k block size") Signed-off-by: Gao Xiang <hsiangkao(a)linux.alibaba.com> Link: https://lore.kernel.org/r/20241115173651.3339514-1-hsiangkao@linux.alibaba.… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/erofs/zmap.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c index 6bd435a565f6..76566c2cbf63 100644 --- a/fs/erofs/zmap.c +++ b/fs/erofs/zmap.c @@ -234,7 +234,7 @@ static int z_erofs_load_compact_lcluster(struct z_erofs_maprecorder *m, unsigned int amortizedshift; erofs_off_t pos; - if (lcn >= totalidx) + if (lcn >= totalidx || vi->z_logical_clusterbits > 14) return -EINVAL; m->lcn = lcn; @@ -409,7 +409,7 @@ static int z_erofs_get_extent_decompressedlen(struct z_erofs_maprecorder *m) u64 lcn = m->lcn, headlcn = map->m_la >> lclusterbits; int err; - do { + while (1) { /* handle the last EOF pcluster (no next HEAD lcluster) */ if ((lcn << lclusterbits) >= inode->i_size) { map->m_llen = inode->i_size - map->m_la; @@ -421,14 +421,16 @@ static int z_erofs_get_extent_decompressedlen(struct z_erofs_maprecorder *m) return err; if (m->type == Z_EROFS_LCLUSTER_TYPE_NONHEAD) { - DBG_BUGON(!m->delta[1] && - m->clusterofs != 1 << lclusterbits); + /* work around invalid d1 generated by pre-1.0 mkfs */ + if (unlikely(!m->delta[1])) { + m->delta[1] = 1; + DBG_BUGON(1); + } } else if (m->type == Z_EROFS_LCLUSTER_TYPE_PLAIN || m->type == Z_EROFS_LCLUSTER_TYPE_HEAD1 || m->type == Z_EROFS_LCLUSTER_TYPE_HEAD2) { - /* go on until the next HEAD lcluster */ if (lcn != headlcn) - break; + break; /* ends at the next HEAD lcluster */ m->delta[1] = 1; } else { erofs_err(inode->i_sb, "unknown type %u @ lcn %llu of nid %llu", @@ -437,8 +439,7 @@ static int z_erofs_get_extent_decompressedlen(struct z_erofs_maprecorder *m) return -EOPNOTSUPP; } lcn += m->delta[1]; - } while (m->delta[1]); - + } map->m_llen = (lcn << lclusterbits) + m->clusterofs - map->m_la; return 0; } -- 2.46.1

2 1

[PATCH openEuler-1.0-LTS] sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
by Liu Chuang 02 Jan '25

02 Jan '25

From: Huacai Chen <chenhuacai(a)loongson.cn> stable inclusion from stable-v4.19.325 commit 8fbb57eabfc8ae67115cb47f904614c99d626a89 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEADR CVE: CVE-2022-49034 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3c891f7c6a4e90bb1199497552f24b26e46383bc upstream. When CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are selected, cpu_max_bits_warn() generates a runtime warning similar as below when showing /proc/cpuinfo. Fix this by using nr_cpu_ids (the runtime limit) instead of NR_CPUS to iterate CPUs. [ 3.052463] ------------[ cut here ]------------ [ 3.059679] WARNING: CPU: 3 PID: 1 at include/linux/cpumask.h:108 show_cpuinfo+0x5e8/0x5f0 [ 3.070072] Modules linked in: efivarfs autofs4 [ 3.076257] CPU: 0 PID: 1 Comm: systemd Not tainted 5.19-rc5+ #1052 [ 3.099465] Stack : 9000000100157b08 9000000000f18530 9000000000cf846c 9000000100154000 [ 3.109127] 9000000100157a50 0000000000000000 9000000100157a58 9000000000ef7430 [ 3.118774] 90000001001578e8 0000000000000040 0000000000000020 ffffffffffffffff [ 3.128412] 0000000000aaaaaa 1ab25f00eec96a37 900000010021de80 900000000101c890 [ 3.138056] 0000000000000000 0000000000000000 0000000000000000 0000000000aaaaaa [ 3.147711] ffff8000339dc220 0000000000000001 0000000006ab4000 0000000000000000 [ 3.157364] 900000000101c998 0000000000000004 9000000000ef7430 0000000000000000 [ 3.167012] 0000000000000009 000000000000006c 0000000000000000 0000000000000000 [ 3.176641] 9000000000d3de08 9000000001639390 90000000002086d8 00007ffff0080286 [ 3.186260] 00000000000000b0 0000000000000004 0000000000000000 0000000000071c1c [ 3.195868] ... [ 3.199917] Call Trace: [ 3.203941] [<90000000002086d8>] show_stack+0x38/0x14c [ 3.210666] [<9000000000cf846c>] dump_stack_lvl+0x60/0x88 [ 3.217625] [<900000000023d268>] __warn+0xd0/0x100 [ 3.223958] [<9000000000cf3c90>] warn_slowpath_fmt+0x7c/0xcc [ 3.231150] [<9000000000210220>] show_cpuinfo+0x5e8/0x5f0 [ 3.238080] [<90000000004f578c>] seq_read_iter+0x354/0x4b4 [ 3.245098] [<90000000004c2e90>] new_sync_read+0x17c/0x1c4 [ 3.252114] [<90000000004c5174>] vfs_read+0x138/0x1d0 [ 3.258694] [<90000000004c55f8>] ksys_read+0x70/0x100 [ 3.265265] [<9000000000cfde9c>] do_syscall+0x7c/0x94 [ 3.271820] [<9000000000202fe4>] handle_syscall+0xc4/0x160 [ 3.281824] ---[ end trace 8b484262b4b8c24c ]--- Cc: stable(a)vger.kernel.org Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Reviewed-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> Tested-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> Signed-off-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- arch/sh/kernel/cpu/proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/sh/kernel/cpu/proc.c b/arch/sh/kernel/cpu/proc.c index 85961b4f9c69..136b4aefd73b 100644 --- a/arch/sh/kernel/cpu/proc.c +++ b/arch/sh/kernel/cpu/proc.c @@ -133,7 +133,7 @@ static int show_cpuinfo(struct seq_file *m, void *v) static void *c_start(struct seq_file *m, loff_t *pos) { - return *pos < NR_CPUS ? cpu_data + *pos : NULL; + return *pos < nr_cpu_ids ? cpu_data + *pos : NULL; } static void *c_next(struct seq_file *m, void *v, loff_t *pos) { -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2024-45009
by Wang Liang 02 Jan '25

02 Jan '25

Matthieu Baerts (NGI0) (2): mptcp: pm: only decrement add_addr_accepted for MPJ req mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow net/mptcp/pm_netlink.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-5.10] f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.
by Zizhi Wo 02 Jan '25

02 Jan '25

From: Qi Han <hanqi(a)vivo.com> stable inclusion from stable-v5.10.231 commit dff561e4060d28edc9a2960d4a87f3c945a96aa3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAPF CVE: CVE-2024-56586 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d5c367ef8287fb4d235c46a2f8c8d68715f3a0ca ] creating a large files during checkpoint disable until it runs out of space and then delete it, then remount to enable checkpoint again, and then unmount the filesystem triggers the f2fs_bug_on as below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/inode.c:896! CPU: 2 UID: 0 PID: 1286 Comm: umount Not tainted 6.11.0-rc7-dirty #360 Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:f2fs_evict_inode+0x58c/0x610 Call Trace: __die_body+0x15/0x60 die+0x33/0x50 do_trap+0x10a/0x120 f2fs_evict_inode+0x58c/0x610 do_error_trap+0x60/0x80 f2fs_evict_inode+0x58c/0x610 exc_invalid_op+0x53/0x60 f2fs_evict_inode+0x58c/0x610 asm_exc_invalid_op+0x16/0x20 f2fs_evict_inode+0x58c/0x610 evict+0x101/0x260 dispose_list+0x30/0x50 evict_inodes+0x140/0x190 generic_shutdown_super+0x2f/0x150 kill_block_super+0x11/0x40 kill_f2fs_super+0x7d/0x140 deactivate_locked_super+0x2a/0x70 cleanup_mnt+0xb3/0x140 task_work_run+0x61/0x90 The root cause is: creating large files during disable checkpoint period results in not enough free segments, so when writing back root inode will failed in f2fs_enable_checkpoint. When umount the file system after enabling checkpoint, the root inode is dirty in f2fs_evict_inode function, which triggers BUG_ON. The steps to reproduce are as follows: dd if=/dev/zero of=f2fs.img bs=1M count=55 mount f2fs.img f2fs_dir -o checkpoint=disable:10% dd if=/dev/zero of=big bs=1M count=50 sync rm big mount -o remount,checkpoint=enable f2fs_dir umount f2fs_dir Let's redirty inode when there is not free segments during checkpoint is disable. Signed-off-by: Qi Han <hanqi(a)vivo.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/inode.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c index 8f29eb07c296..1fe06f7929fb 100644 --- a/fs/f2fs/inode.c +++ b/fs/f2fs/inode.c @@ -698,8 +698,10 @@ int f2fs_write_inode(struct inode *inode, struct writeback_control *wbc) !is_inode_flag_set(inode, FI_DIRTY_INODE)) return 0; - if (!f2fs_is_checkpoint_ready(sbi)) + if (!f2fs_is_checkpoint_ready(sbi)) { + f2fs_mark_inode_dirty_sync(inode, true); return -ENOSPC; + } /* * We need to balance fs here to prevent from producing dirty node pages -- 2.46.1

2 1

[PATCH OLK-5.10] nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
by Zizhi Wo 02 Jan '25

02 Jan '25

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v5.10.231 commit e3732102a9d638d8627d14fdf7b208462f0520e0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEANS CVE: CVE-2024-56619 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit 985ebec4ab0a28bb5910c3b1481a40fbf7f9e61d upstream. Syzbot reported that when searching for records in a directory where the inode's i_size is corrupted and has a large value, memory access outside the folio/page range may occur, or a use-after-free bug may be detected if KASAN is enabled. This is because nilfs_last_byte(), which is called by nilfs_find_entry() and others to calculate the number of valid bytes of directory data in a page from i_size and the page index, loses the upper 32 bits of the 64-bit size information due to an inappropriate type of local variable to which the i_size value is assigned. This caused a large byte offset value due to underflow in the end address calculation in the calling nilfs_find_entry(), resulting in memory access that exceeds the folio/page size. Fix this issue by changing the type of the local variable causing the bit loss from "unsigned int" to "u64". The return value of nilfs_last_byte() is also of type "unsigned int", but it is truncated so as not to exceed PAGE_SIZE and no bit loss occurs, so no change is required. Link: https://lkml.kernel.org/r/20241119172403.9292-1-konishi.ryusuke@gmail.com Fixes: 2ba466d74ed7 ("nilfs2: directory entry operations") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+96d5d14c47d97015c624(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=96d5d14c47d97015c624 Tested-by: syzbot+96d5d14c47d97015c624(a)syzkaller.appspotmail.com Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/nilfs2/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c index 760a8bd01ada..f80cb1138f56 100644 --- a/fs/nilfs2/dir.c +++ b/fs/nilfs2/dir.c @@ -76,7 +76,7 @@ static inline void nilfs_put_page(struct page *page) */ static unsigned int nilfs_last_byte(struct inode *inode, unsigned long page_nr) { - unsigned int last_byte = inode->i_size; + u64 last_byte = inode->i_size; last_byte -= page_nr << PAGE_SHIFT; if (last_byte > PAGE_SIZE) -- 2.46.1

2 1

[PATCH OLK-5.10] ovl: Filter invalid inodes with missing lookup function
by Zizhi Wo 02 Jan '25

02 Jan '25

From: Vasiliy Kovalev <kovalev(a)altlinux.org> stable inclusion from stable-v5.10.231 commit 5f86e79c0b2287ffdabe6c1b305a36c4e0f40fe3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAML CVE: CVE-2024-56570 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c8b359dddb418c60df1a69beea01d1b3322bfe83 upstream. Add a check to the ovl_dentry_weird() function to prevent the processing of directory inodes that lack the lookup function. This is important because such inodes can cause errors in overlayfs when passed to the lowerstack. Reported-by: syzbot+a8c9d476508bd14a90e5(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=a8c9d476508bd14a90e5 Suggested-by: Miklos Szeredi <miklos(a)szeredi.hu> Link: https://lore.kernel.org/linux-unionfs/CAJfpegvx-oS9XGuwpJx=Xe28_jzWx5eRo1y9… Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Amir Goldstein <amir73il(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/overlayfs/util.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c index e8b14d2c180c..38601f9f51cc 100644 --- a/fs/overlayfs/util.c +++ b/fs/overlayfs/util.c @@ -115,6 +115,9 @@ void ovl_dentry_update_reval(struct dentry *dentry, struct dentry *upperdentry, bool ovl_dentry_weird(struct dentry *dentry) { + if (!d_can_lookup(dentry) && !d_is_file(dentry) && !d_is_symlink(dentry)) + return true; + return dentry->d_flags & (DCACHE_NEED_AUTOMOUNT | DCACHE_MANAGE_TRANSIT | DCACHE_OP_HASH | -- 2.46.1

2 1

[PATCH OLK-5.10] ocfs2: fix uninitialized value in ocfs2_file_read_iter()
by Zizhi Wo 02 Jan '25

02 Jan '25

From: Dmitry Antipov <dmantipov(a)yandex.ru> stable inclusion from stable-v5.10.231 commit 66b7ddd1804e2c4216dd7ead8eeb746cdbb3b62f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGQ CVE: CVE-2024-53155 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit adc77b19f62d7e80f98400b2fca9d700d2afdd6f ] Syzbot has reported the following KMSAN splat: BUG: KMSAN: uninit-value in ocfs2_file_read_iter+0x9a4/0xf80 ocfs2_file_read_iter+0x9a4/0xf80 __io_read+0x8d4/0x20f0 io_read+0x3e/0xf0 io_issue_sqe+0x42b/0x22c0 io_wq_submit_work+0xaf9/0xdc0 io_worker_handle_work+0xd13/0x2110 io_wq_worker+0x447/0x1410 ret_from_fork+0x6f/0x90 ret_from_fork_asm+0x1a/0x30 Uninit was created at: __alloc_pages_noprof+0x9a7/0xe00 alloc_pages_mpol_noprof+0x299/0x990 alloc_pages_noprof+0x1bf/0x1e0 allocate_slab+0x33a/0x1250 ___slab_alloc+0x12ef/0x35e0 kmem_cache_alloc_bulk_noprof+0x486/0x1330 __io_alloc_req_refill+0x84/0x560 io_submit_sqes+0x172f/0x2f30 __se_sys_io_uring_enter+0x406/0x41c0 __x64_sys_io_uring_enter+0x11f/0x1a0 x64_sys_call+0x2b54/0x3ba0 do_syscall_64+0xcd/0x1e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Since an instance of 'struct kiocb' may be passed from the block layer with 'private' field uninitialized, introduce 'ocfs2_iocb_init_rw_locked()' and use it from where 'ocfs2_dio_end_io()' might take care, i.e. in 'ocfs2_file_read_iter()' and 'ocfs2_file_write_iter()'. Link: https://lkml.kernel.org/r/20241029091736.1501946-1-dmantipov@yandex.ru Fixes: 7cdfc3a1c397 ("ocfs2: Remember rw lock level during direct io") Signed-off-by: Dmitry Antipov <dmantipov(a)yandex.ru> Reported-by: syzbot+a73e253cca4f0230a5a5(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a73e253cca4f0230a5a5 Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Joseph Qi <jiangqi903(a)gmail.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/ocfs2/aops.h | 2 ++ fs/ocfs2/file.c | 4 ++++ 2 files changed, 6 insertions(+) diff --git a/fs/ocfs2/aops.h b/fs/ocfs2/aops.h index 70ed4382750d..5b129ae9c3d2 100644 --- a/fs/ocfs2/aops.h +++ b/fs/ocfs2/aops.h @@ -72,6 +72,8 @@ enum ocfs2_iocb_lock_bits { OCFS2_IOCB_NUM_LOCKS }; +#define ocfs2_iocb_init_rw_locked(iocb) \ + (iocb->private = NULL) #define ocfs2_iocb_clear_rw_locked(iocb) \ clear_bit(OCFS2_IOCB_RW_LOCK, (unsigned long *)&iocb->private) #define ocfs2_iocb_rw_locked_level(iocb) \ diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c index 294fc98a900e..ca875d4cf3a2 100644 --- a/fs/ocfs2/file.c +++ b/fs/ocfs2/file.c @@ -2401,6 +2401,8 @@ static ssize_t ocfs2_file_write_iter(struct kiocb *iocb, } else inode_lock(inode); + ocfs2_iocb_init_rw_locked(iocb); + /* * Concurrent O_DIRECT writes are allowed with * mount_option "coherency=buffered". @@ -2547,6 +2549,8 @@ static ssize_t ocfs2_file_read_iter(struct kiocb *iocb, if (!direct_io && nowait) return -EOPNOTSUPP; + ocfs2_iocb_init_rw_locked(iocb); + /* * buffered reads protect themselves in ->readpage(). O_DIRECT reads * need locks to protect pending reads from racing with truncate. -- 2.46.1

2 1

[PATCH openEuler-22.03-LTS-SP1] nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
by Zizhi Wo 02 Jan '25

02 Jan '25

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v5.10.231 commit e3732102a9d638d8627d14fdf7b208462f0520e0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEANS CVE: CVE-2024-56619 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit 985ebec4ab0a28bb5910c3b1481a40fbf7f9e61d upstream. Syzbot reported that when searching for records in a directory where the inode's i_size is corrupted and has a large value, memory access outside the folio/page range may occur, or a use-after-free bug may be detected if KASAN is enabled. This is because nilfs_last_byte(), which is called by nilfs_find_entry() and others to calculate the number of valid bytes of directory data in a page from i_size and the page index, loses the upper 32 bits of the 64-bit size information due to an inappropriate type of local variable to which the i_size value is assigned. This caused a large byte offset value due to underflow in the end address calculation in the calling nilfs_find_entry(), resulting in memory access that exceeds the folio/page size. Fix this issue by changing the type of the local variable causing the bit loss from "unsigned int" to "u64". The return value of nilfs_last_byte() is also of type "unsigned int", but it is truncated so as not to exceed PAGE_SIZE and no bit loss occurs, so no change is required. Link: https://lkml.kernel.org/r/20241119172403.9292-1-konishi.ryusuke@gmail.com Fixes: 2ba466d74ed7 ("nilfs2: directory entry operations") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+96d5d14c47d97015c624(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=96d5d14c47d97015c624 Tested-by: syzbot+96d5d14c47d97015c624(a)syzkaller.appspotmail.com Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/nilfs2/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c index 760a8bd01ada..f80cb1138f56 100644 --- a/fs/nilfs2/dir.c +++ b/fs/nilfs2/dir.c @@ -76,7 +76,7 @@ static inline void nilfs_put_page(struct page *page) */ static unsigned int nilfs_last_byte(struct inode *inode, unsigned long page_nr) { - unsigned int last_byte = inode->i_size; + u64 last_byte = inode->i_size; last_byte -= page_nr << PAGE_SHIFT; if (last_byte > PAGE_SIZE) -- 2.46.1

2 1

[PATCH openEuler-22.03-LTS-SP1] f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.
by Zizhi Wo 02 Jan '25

02 Jan '25

From: Qi Han <hanqi(a)vivo.com> stable inclusion from stable-v5.10.231 commit dff561e4060d28edc9a2960d4a87f3c945a96aa3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAPF CVE: CVE-2024-56586 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d5c367ef8287fb4d235c46a2f8c8d68715f3a0ca ] creating a large files during checkpoint disable until it runs out of space and then delete it, then remount to enable checkpoint again, and then unmount the filesystem triggers the f2fs_bug_on as below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/inode.c:896! CPU: 2 UID: 0 PID: 1286 Comm: umount Not tainted 6.11.0-rc7-dirty #360 Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:f2fs_evict_inode+0x58c/0x610 Call Trace: __die_body+0x15/0x60 die+0x33/0x50 do_trap+0x10a/0x120 f2fs_evict_inode+0x58c/0x610 do_error_trap+0x60/0x80 f2fs_evict_inode+0x58c/0x610 exc_invalid_op+0x53/0x60 f2fs_evict_inode+0x58c/0x610 asm_exc_invalid_op+0x16/0x20 f2fs_evict_inode+0x58c/0x610 evict+0x101/0x260 dispose_list+0x30/0x50 evict_inodes+0x140/0x190 generic_shutdown_super+0x2f/0x150 kill_block_super+0x11/0x40 kill_f2fs_super+0x7d/0x140 deactivate_locked_super+0x2a/0x70 cleanup_mnt+0xb3/0x140 task_work_run+0x61/0x90 The root cause is: creating large files during disable checkpoint period results in not enough free segments, so when writing back root inode will failed in f2fs_enable_checkpoint. When umount the file system after enabling checkpoint, the root inode is dirty in f2fs_evict_inode function, which triggers BUG_ON. The steps to reproduce are as follows: dd if=/dev/zero of=f2fs.img bs=1M count=55 mount f2fs.img f2fs_dir -o checkpoint=disable:10% dd if=/dev/zero of=big bs=1M count=50 sync rm big mount -o remount,checkpoint=enable f2fs_dir umount f2fs_dir Let's redirty inode when there is not free segments during checkpoint is disable. Signed-off-by: Qi Han <hanqi(a)vivo.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/inode.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c index 8f29eb07c296..1fe06f7929fb 100644 --- a/fs/f2fs/inode.c +++ b/fs/f2fs/inode.c @@ -698,8 +698,10 @@ int f2fs_write_inode(struct inode *inode, struct writeback_control *wbc) !is_inode_flag_set(inode, FI_DIRTY_INODE)) return 0; - if (!f2fs_is_checkpoint_ready(sbi)) + if (!f2fs_is_checkpoint_ready(sbi)) { + f2fs_mark_inode_dirty_sync(inode, true); return -ENOSPC; + } /* * We need to balance fs here to prevent from producing dirty node pages -- 2.46.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ovl: Filter invalid inodes with missing lookup function
by Zizhi Wo 02 Jan '25

02 Jan '25

From: Vasiliy Kovalev <kovalev(a)altlinux.org> stable inclusion from stable-v5.10.231 commit 5f86e79c0b2287ffdabe6c1b305a36c4e0f40fe3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAML CVE: CVE-2024-56570 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c8b359dddb418c60df1a69beea01d1b3322bfe83 upstream. Add a check to the ovl_dentry_weird() function to prevent the processing of directory inodes that lack the lookup function. This is important because such inodes can cause errors in overlayfs when passed to the lowerstack. Reported-by: syzbot+a8c9d476508bd14a90e5(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=a8c9d476508bd14a90e5 Suggested-by: Miklos Szeredi <miklos(a)szeredi.hu> Link: https://lore.kernel.org/linux-unionfs/CAJfpegvx-oS9XGuwpJx=Xe28_jzWx5eRo1y9… Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Amir Goldstein <amir73il(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/overlayfs/util.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c index e8b14d2c180c..38601f9f51cc 100644 --- a/fs/overlayfs/util.c +++ b/fs/overlayfs/util.c @@ -115,6 +115,9 @@ void ovl_dentry_update_reval(struct dentry *dentry, struct dentry *upperdentry, bool ovl_dentry_weird(struct dentry *dentry) { + if (!d_can_lookup(dentry) && !d_is_file(dentry) && !d_is_symlink(dentry)) + return true; + return dentry->d_flags & (DCACHE_NEED_AUTOMOUNT | DCACHE_MANAGE_TRANSIT | DCACHE_OP_HASH | -- 2.46.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ocfs2: fix uninitialized value in ocfs2_file_read_iter()
by Zizhi Wo 02 Jan '25

02 Jan '25

From: Dmitry Antipov <dmantipov(a)yandex.ru> stable inclusion from stable-v5.10.231 commit 66b7ddd1804e2c4216dd7ead8eeb746cdbb3b62f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGQ CVE: CVE-2024-53155 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit adc77b19f62d7e80f98400b2fca9d700d2afdd6f ] Syzbot has reported the following KMSAN splat: BUG: KMSAN: uninit-value in ocfs2_file_read_iter+0x9a4/0xf80 ocfs2_file_read_iter+0x9a4/0xf80 __io_read+0x8d4/0x20f0 io_read+0x3e/0xf0 io_issue_sqe+0x42b/0x22c0 io_wq_submit_work+0xaf9/0xdc0 io_worker_handle_work+0xd13/0x2110 io_wq_worker+0x447/0x1410 ret_from_fork+0x6f/0x90 ret_from_fork_asm+0x1a/0x30 Uninit was created at: __alloc_pages_noprof+0x9a7/0xe00 alloc_pages_mpol_noprof+0x299/0x990 alloc_pages_noprof+0x1bf/0x1e0 allocate_slab+0x33a/0x1250 ___slab_alloc+0x12ef/0x35e0 kmem_cache_alloc_bulk_noprof+0x486/0x1330 __io_alloc_req_refill+0x84/0x560 io_submit_sqes+0x172f/0x2f30 __se_sys_io_uring_enter+0x406/0x41c0 __x64_sys_io_uring_enter+0x11f/0x1a0 x64_sys_call+0x2b54/0x3ba0 do_syscall_64+0xcd/0x1e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Since an instance of 'struct kiocb' may be passed from the block layer with 'private' field uninitialized, introduce 'ocfs2_iocb_init_rw_locked()' and use it from where 'ocfs2_dio_end_io()' might take care, i.e. in 'ocfs2_file_read_iter()' and 'ocfs2_file_write_iter()'. Link: https://lkml.kernel.org/r/20241029091736.1501946-1-dmantipov@yandex.ru Fixes: 7cdfc3a1c397 ("ocfs2: Remember rw lock level during direct io") Signed-off-by: Dmitry Antipov <dmantipov(a)yandex.ru> Reported-by: syzbot+a73e253cca4f0230a5a5(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a73e253cca4f0230a5a5 Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Joseph Qi <jiangqi903(a)gmail.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/ocfs2/aops.h | 2 ++ fs/ocfs2/file.c | 4 ++++ 2 files changed, 6 insertions(+) diff --git a/fs/ocfs2/aops.h b/fs/ocfs2/aops.h index 70ed4382750d..5b129ae9c3d2 100644 --- a/fs/ocfs2/aops.h +++ b/fs/ocfs2/aops.h @@ -72,6 +72,8 @@ enum ocfs2_iocb_lock_bits { OCFS2_IOCB_NUM_LOCKS }; +#define ocfs2_iocb_init_rw_locked(iocb) \ + (iocb->private = NULL) #define ocfs2_iocb_clear_rw_locked(iocb) \ clear_bit(OCFS2_IOCB_RW_LOCK, (unsigned long *)&iocb->private) #define ocfs2_iocb_rw_locked_level(iocb) \ diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c index 294fc98a900e..ca875d4cf3a2 100644 --- a/fs/ocfs2/file.c +++ b/fs/ocfs2/file.c @@ -2401,6 +2401,8 @@ static ssize_t ocfs2_file_write_iter(struct kiocb *iocb, } else inode_lock(inode); + ocfs2_iocb_init_rw_locked(iocb); + /* * Concurrent O_DIRECT writes are allowed with * mount_option "coherency=buffered". @@ -2547,6 +2549,8 @@ static ssize_t ocfs2_file_read_iter(struct kiocb *iocb, if (!direct_io && nowait) return -EOPNOTSUPP; + ocfs2_iocb_init_rw_locked(iocb); + /* * buffered reads protect themselves in ->readpage(). O_DIRECT reads * need locks to protect pending reads from racing with truncate. -- 2.46.1

2 1

[PATCH OLK-6.6] nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
by Zizhi Wo 02 Jan '25

02 Jan '25

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v6.6.66 commit c3afea07477baccdbdec4483f8d5e59d42a3f67f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEANS CVE: CVE-2024-56619 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit 985ebec4ab0a28bb5910c3b1481a40fbf7f9e61d upstream. Syzbot reported that when searching for records in a directory where the inode's i_size is corrupted and has a large value, memory access outside the folio/page range may occur, or a use-after-free bug may be detected if KASAN is enabled. This is because nilfs_last_byte(), which is called by nilfs_find_entry() and others to calculate the number of valid bytes of directory data in a page from i_size and the page index, loses the upper 32 bits of the 64-bit size information due to an inappropriate type of local variable to which the i_size value is assigned. This caused a large byte offset value due to underflow in the end address calculation in the calling nilfs_find_entry(), resulting in memory access that exceeds the folio/page size. Fix this issue by changing the type of the local variable causing the bit loss from "unsigned int" to "u64". The return value of nilfs_last_byte() is also of type "unsigned int", but it is truncated so as not to exceed PAGE_SIZE and no bit loss occurs, so no change is required. Link: https://lkml.kernel.org/r/20241119172403.9292-1-konishi.ryusuke@gmail.com Fixes: 2ba466d74ed7 ("nilfs2: directory entry operations") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+96d5d14c47d97015c624(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=96d5d14c47d97015c624 Tested-by: syzbot+96d5d14c47d97015c624(a)syzkaller.appspotmail.com Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/nilfs2/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c index ddf8e575e489..652279c8b168 100644 --- a/fs/nilfs2/dir.c +++ b/fs/nilfs2/dir.c @@ -76,7 +76,7 @@ static inline void nilfs_put_page(struct page *page) */ static unsigned int nilfs_last_byte(struct inode *inode, unsigned long page_nr) { - unsigned int last_byte = inode->i_size; + u64 last_byte = inode->i_size; last_byte -= page_nr << PAGE_SHIFT; if (last_byte > PAGE_SIZE) -- 2.46.1

2 1

[PATCH OLK-6.6] f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.
by Zizhi Wo 02 Jan '25

02 Jan '25

From: Qi Han <hanqi(a)vivo.com> stable inclusion from stable-v6.6.66 commit 9669b28f81e0ec6305af7773846fbe2cef1e7d61 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAPF CVE: CVE-2024-56586 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit d5c367ef8287fb4d235c46a2f8c8d68715f3a0ca ] creating a large files during checkpoint disable until it runs out of space and then delete it, then remount to enable checkpoint again, and then unmount the filesystem triggers the f2fs_bug_on as below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/inode.c:896! CPU: 2 UID: 0 PID: 1286 Comm: umount Not tainted 6.11.0-rc7-dirty #360 Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:f2fs_evict_inode+0x58c/0x610 Call Trace: __die_body+0x15/0x60 die+0x33/0x50 do_trap+0x10a/0x120 f2fs_evict_inode+0x58c/0x610 do_error_trap+0x60/0x80 f2fs_evict_inode+0x58c/0x610 exc_invalid_op+0x53/0x60 f2fs_evict_inode+0x58c/0x610 asm_exc_invalid_op+0x16/0x20 f2fs_evict_inode+0x58c/0x610 evict+0x101/0x260 dispose_list+0x30/0x50 evict_inodes+0x140/0x190 generic_shutdown_super+0x2f/0x150 kill_block_super+0x11/0x40 kill_f2fs_super+0x7d/0x140 deactivate_locked_super+0x2a/0x70 cleanup_mnt+0xb3/0x140 task_work_run+0x61/0x90 The root cause is: creating large files during disable checkpoint period results in not enough free segments, so when writing back root inode will failed in f2fs_enable_checkpoint. When umount the file system after enabling checkpoint, the root inode is dirty in f2fs_evict_inode function, which triggers BUG_ON. The steps to reproduce are as follows: dd if=/dev/zero of=f2fs.img bs=1M count=55 mount f2fs.img f2fs_dir -o checkpoint=disable:10% dd if=/dev/zero of=big bs=1M count=50 sync rm big mount -o remount,checkpoint=enable f2fs_dir umount f2fs_dir Let's redirty inode when there is not free segments during checkpoint is disable. Signed-off-by: Qi Han <hanqi(a)vivo.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/inode.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c index 0a9f17f1497b..437f48d8edcd 100644 --- a/fs/f2fs/inode.c +++ b/fs/f2fs/inode.c @@ -794,8 +794,10 @@ int f2fs_write_inode(struct inode *inode, struct writeback_control *wbc) !is_inode_flag_set(inode, FI_DIRTY_INODE)) return 0; - if (!f2fs_is_checkpoint_ready(sbi)) + if (!f2fs_is_checkpoint_ready(sbi)) { + f2fs_mark_inode_dirty_sync(inode, true); return -ENOSPC; + } /* * We need to balance fs here to prevent from producing dirty node pages -- 2.46.1

2 1

[PATCH OLK-6.6] ovl: Filter invalid inodes with missing lookup function
by Zizhi Wo 02 Jan '25

02 Jan '25

From: Vasiliy Kovalev <kovalev(a)altlinux.org> stable inclusion from stable-v6.6.64 commit 065bf5dd21639f80e68450de16bda829784dbb8c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAML CVE: CVE-2024-56570 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c8b359dddb418c60df1a69beea01d1b3322bfe83 upstream. Add a check to the ovl_dentry_weird() function to prevent the processing of directory inodes that lack the lookup function. This is important because such inodes can cause errors in overlayfs when passed to the lowerstack. Reported-by: syzbot+a8c9d476508bd14a90e5(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=a8c9d476508bd14a90e5 Suggested-by: Miklos Szeredi <miklos(a)szeredi.hu> Link: https://lore.kernel.org/linux-unionfs/CAJfpegvx-oS9XGuwpJx=Xe28_jzWx5eRo1y9… Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Amir Goldstein <amir73il(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/overlayfs/util.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c index 89e0d60d35b6..0bf3ffcd072f 100644 --- a/fs/overlayfs/util.c +++ b/fs/overlayfs/util.c @@ -171,6 +171,9 @@ void ovl_dentry_init_flags(struct dentry *dentry, struct dentry *upperdentry, bool ovl_dentry_weird(struct dentry *dentry) { + if (!d_can_lookup(dentry) && !d_is_file(dentry) && !d_is_symlink(dentry)) + return true; + return dentry->d_flags & (DCACHE_NEED_AUTOMOUNT | DCACHE_MANAGE_TRANSIT | DCACHE_OP_HASH | -- 2.46.1

2 1

[PATCH OLK-6.6] erofs: handle NONHEAD !delta[1] lclusters gracefully
by Zizhi Wo 02 Jan '25

02 Jan '25

From: Gao Xiang <hsiangkao(a)linux.alibaba.com> stable inclusion from stable-v6.6.64 commit f466641debcbea8bdf78d1b63a6270aadf9301bf category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBEAED Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 0bc8061ffc733a0a246b8689b2d32a3e9204f43c ] syzbot reported a WARNING in iomap_iter_done: iomap_fiemap+0x73b/0x9b0 fs/iomap/fiemap.c:80 ioctl_fiemap fs/ioctl.c:220 [inline] Generally, NONHEAD lclusters won't have delta[1]==0, except for crafted images and filesystems created by pre-1.0 mkfs versions. Previously, it would immediately bail out if delta[1]==0, which led to inadequate decompressed lengths (thus FIEMAP is impacted). Treat it as delta[1]=1 to work around these legacy mkfs versions. `lclusterbits > 14` is illegal for compact indexes, error out too. Reported-by: syzbot+6c0b301317aa0156f9eb(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/67373c0c.050a0220.2a2fcc.0079.GAE@google.com Tested-by: syzbot+6c0b301317aa0156f9eb(a)syzkaller.appspotmail.com Fixes: d95ae5e25326 ("erofs: add support for the full decompressed length") Fixes: 001b8ccd0650 ("erofs: fix compact 4B support for 16k block size") Signed-off-by: Gao Xiang <hsiangkao(a)linux.alibaba.com> Link: https://lore.kernel.org/r/20241115173651.3339514-1-hsiangkao@linux.alibaba.… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/erofs/zmap.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c index 6bd435a565f6..76566c2cbf63 100644 --- a/fs/erofs/zmap.c +++ b/fs/erofs/zmap.c @@ -234,7 +234,7 @@ static int z_erofs_load_compact_lcluster(struct z_erofs_maprecorder *m, unsigned int amortizedshift; erofs_off_t pos; - if (lcn >= totalidx) + if (lcn >= totalidx || vi->z_logical_clusterbits > 14) return -EINVAL; m->lcn = lcn; @@ -409,7 +409,7 @@ static int z_erofs_get_extent_decompressedlen(struct z_erofs_maprecorder *m) u64 lcn = m->lcn, headlcn = map->m_la >> lclusterbits; int err; - do { + while (1) { /* handle the last EOF pcluster (no next HEAD lcluster) */ if ((lcn << lclusterbits) >= inode->i_size) { map->m_llen = inode->i_size - map->m_la; @@ -421,14 +421,16 @@ static int z_erofs_get_extent_decompressedlen(struct z_erofs_maprecorder *m) return err; if (m->type == Z_EROFS_LCLUSTER_TYPE_NONHEAD) { - DBG_BUGON(!m->delta[1] && - m->clusterofs != 1 << lclusterbits); + /* work around invalid d1 generated by pre-1.0 mkfs */ + if (unlikely(!m->delta[1])) { + m->delta[1] = 1; + DBG_BUGON(1); + } } else if (m->type == Z_EROFS_LCLUSTER_TYPE_PLAIN || m->type == Z_EROFS_LCLUSTER_TYPE_HEAD1 || m->type == Z_EROFS_LCLUSTER_TYPE_HEAD2) { - /* go on until the next HEAD lcluster */ if (lcn != headlcn) - break; + break; /* ends at the next HEAD lcluster */ m->delta[1] = 1; } else { erofs_err(inode->i_sb, "unknown type %u @ lcn %llu of nid %llu", @@ -437,8 +439,7 @@ static int z_erofs_get_extent_decompressedlen(struct z_erofs_maprecorder *m) return -EOPNOTSUPP; } lcn += m->delta[1]; - } while (m->delta[1]); - + } map->m_llen = (lcn << lclusterbits) + m->clusterofs - map->m_la; return 0; } -- 2.46.1

2 1

[PATCH OLK-6.6] ocfs2: fix uninitialized value in ocfs2_file_read_iter()
by Zizhi Wo 02 Jan '25

02 Jan '25

From: Dmitry Antipov <dmantipov(a)yandex.ru> stable inclusion from stable-v6.6.64 commit 8e0de82ed18ba0e71f817adbd81317fd1032ca5a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGQ CVE: CVE-2024-53155 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit adc77b19f62d7e80f98400b2fca9d700d2afdd6f ] Syzbot has reported the following KMSAN splat: BUG: KMSAN: uninit-value in ocfs2_file_read_iter+0x9a4/0xf80 ocfs2_file_read_iter+0x9a4/0xf80 __io_read+0x8d4/0x20f0 io_read+0x3e/0xf0 io_issue_sqe+0x42b/0x22c0 io_wq_submit_work+0xaf9/0xdc0 io_worker_handle_work+0xd13/0x2110 io_wq_worker+0x447/0x1410 ret_from_fork+0x6f/0x90 ret_from_fork_asm+0x1a/0x30 Uninit was created at: __alloc_pages_noprof+0x9a7/0xe00 alloc_pages_mpol_noprof+0x299/0x990 alloc_pages_noprof+0x1bf/0x1e0 allocate_slab+0x33a/0x1250 ___slab_alloc+0x12ef/0x35e0 kmem_cache_alloc_bulk_noprof+0x486/0x1330 __io_alloc_req_refill+0x84/0x560 io_submit_sqes+0x172f/0x2f30 __se_sys_io_uring_enter+0x406/0x41c0 __x64_sys_io_uring_enter+0x11f/0x1a0 x64_sys_call+0x2b54/0x3ba0 do_syscall_64+0xcd/0x1e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Since an instance of 'struct kiocb' may be passed from the block layer with 'private' field uninitialized, introduce 'ocfs2_iocb_init_rw_locked()' and use it from where 'ocfs2_dio_end_io()' might take care, i.e. in 'ocfs2_file_read_iter()' and 'ocfs2_file_write_iter()'. Link: https://lkml.kernel.org/r/20241029091736.1501946-1-dmantipov@yandex.ru Fixes: 7cdfc3a1c397 ("ocfs2: Remember rw lock level during direct io") Signed-off-by: Dmitry Antipov <dmantipov(a)yandex.ru> Reported-by: syzbot+a73e253cca4f0230a5a5(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a73e253cca4f0230a5a5 Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Joseph Qi <jiangqi903(a)gmail.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/ocfs2/aops.h | 2 ++ fs/ocfs2/file.c | 4 ++++ 2 files changed, 6 insertions(+) diff --git a/fs/ocfs2/aops.h b/fs/ocfs2/aops.h index 3a520117fa59..a9ce7947228c 100644 --- a/fs/ocfs2/aops.h +++ b/fs/ocfs2/aops.h @@ -70,6 +70,8 @@ enum ocfs2_iocb_lock_bits { OCFS2_IOCB_NUM_LOCKS }; +#define ocfs2_iocb_init_rw_locked(iocb) \ + (iocb->private = NULL) #define ocfs2_iocb_clear_rw_locked(iocb) \ clear_bit(OCFS2_IOCB_RW_LOCK, (unsigned long *)&iocb->private) #define ocfs2_iocb_rw_locked_level(iocb) \ diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c index e4acb795d119..0585f281ff62 100644 --- a/fs/ocfs2/file.c +++ b/fs/ocfs2/file.c @@ -2397,6 +2397,8 @@ static ssize_t ocfs2_file_write_iter(struct kiocb *iocb, } else inode_lock(inode); + ocfs2_iocb_init_rw_locked(iocb); + /* * Concurrent O_DIRECT writes are allowed with * mount_option "coherency=buffered". @@ -2543,6 +2545,8 @@ static ssize_t ocfs2_file_read_iter(struct kiocb *iocb, if (!direct_io && nowait) return -EOPNOTSUPP; + ocfs2_iocb_init_rw_locked(iocb); + /* * buffered reads protect themselves in ->read_folio(). O_DIRECT reads * need locks to protect pending reads from racing with truncate. -- 2.46.1

2 1

[PATCH openEuler-1.0-LTS] ocfs2: fix uninitialized value in ocfs2_file_read_iter()
by Zizhi Wo 02 Jan '25

02 Jan '25

From: Dmitry Antipov <dmantipov(a)yandex.ru> stable inclusion from stable-v4.19.325 commit 6c8f8d1e595dabd5389817f6d798cc8bd95c40ab category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGQ CVE: CVE-2024-53155 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit adc77b19f62d7e80f98400b2fca9d700d2afdd6f ] Syzbot has reported the following KMSAN splat: BUG: KMSAN: uninit-value in ocfs2_file_read_iter+0x9a4/0xf80 ocfs2_file_read_iter+0x9a4/0xf80 __io_read+0x8d4/0x20f0 io_read+0x3e/0xf0 io_issue_sqe+0x42b/0x22c0 io_wq_submit_work+0xaf9/0xdc0 io_worker_handle_work+0xd13/0x2110 io_wq_worker+0x447/0x1410 ret_from_fork+0x6f/0x90 ret_from_fork_asm+0x1a/0x30 Uninit was created at: __alloc_pages_noprof+0x9a7/0xe00 alloc_pages_mpol_noprof+0x299/0x990 alloc_pages_noprof+0x1bf/0x1e0 allocate_slab+0x33a/0x1250 ___slab_alloc+0x12ef/0x35e0 kmem_cache_alloc_bulk_noprof+0x486/0x1330 __io_alloc_req_refill+0x84/0x560 io_submit_sqes+0x172f/0x2f30 __se_sys_io_uring_enter+0x406/0x41c0 __x64_sys_io_uring_enter+0x11f/0x1a0 x64_sys_call+0x2b54/0x3ba0 do_syscall_64+0xcd/0x1e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Since an instance of 'struct kiocb' may be passed from the block layer with 'private' field uninitialized, introduce 'ocfs2_iocb_init_rw_locked()' and use it from where 'ocfs2_dio_end_io()' might take care, i.e. in 'ocfs2_file_read_iter()' and 'ocfs2_file_write_iter()'. Link: https://lkml.kernel.org/r/20241029091736.1501946-1-dmantipov@yandex.ru Fixes: 7cdfc3a1c397 ("ocfs2: Remember rw lock level during direct io") Signed-off-by: Dmitry Antipov <dmantipov(a)yandex.ru> Reported-by: syzbot+a73e253cca4f0230a5a5(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a73e253cca4f0230a5a5 Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Joseph Qi <jiangqi903(a)gmail.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/ocfs2/aops.h | 2 ++ fs/ocfs2/file.c | 4 ++++ 2 files changed, 6 insertions(+) diff --git a/fs/ocfs2/aops.h b/fs/ocfs2/aops.h index 3494a62ed749..c1c218902990 100644 --- a/fs/ocfs2/aops.h +++ b/fs/ocfs2/aops.h @@ -86,6 +86,8 @@ enum ocfs2_iocb_lock_bits { OCFS2_IOCB_NUM_LOCKS }; +#define ocfs2_iocb_init_rw_locked(iocb) \ + (iocb->private = NULL) #define ocfs2_iocb_clear_rw_locked(iocb) \ clear_bit(OCFS2_IOCB_RW_LOCK, (unsigned long *)&iocb->private) #define ocfs2_iocb_rw_locked_level(iocb) \ diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c index 135b7334be7d..7097d5c856c4 100644 --- a/fs/ocfs2/file.c +++ b/fs/ocfs2/file.c @@ -2400,6 +2400,8 @@ static ssize_t ocfs2_file_write_iter(struct kiocb *iocb, } else inode_lock(inode); + ocfs2_iocb_init_rw_locked(iocb); + /* * Concurrent O_DIRECT writes are allowed with * mount_option "coherency=buffered". @@ -2546,6 +2548,8 @@ static ssize_t ocfs2_file_read_iter(struct kiocb *iocb, if (!direct_io && nowait) return -EOPNOTSUPP; + ocfs2_iocb_init_rw_locked(iocb); + /* * buffered reads protect themselves in ->readpage(). O_DIRECT reads * need locks to protect pending reads from racing with truncate. -- 2.46.1

2 1

[PATCH openEuler-1.0-LTS] ovl: Filter invalid inodes with missing lookup function
by Zizhi Wo 02 Jan '25

02 Jan '25

From: Vasiliy Kovalev <kovalev(a)altlinux.org> mainline inclusion from mainline-v6.13-rc1 commit c8b359dddb418c60df1a69beea01d1b3322bfe83 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAML CVE: CVE-2024-56570 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Add a check to the ovl_dentry_weird() function to prevent the processing of directory inodes that lack the lookup function. This is important because such inodes can cause errors in overlayfs when passed to the lowerstack. Reported-by: syzbot+a8c9d476508bd14a90e5(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=a8c9d476508bd14a90e5 Suggested-by: Miklos Szeredi <miklos(a)szeredi.hu> Link: https://lore.kernel.org/linux-unionfs/CAJfpegvx-oS9XGuwpJx=Xe28_jzWx5eRo1y9… Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Amir Goldstein <amir73il(a)gmail.com> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/overlayfs/util.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c index 06ca98f88983..3b6584a180c6 100644 --- a/fs/overlayfs/util.c +++ b/fs/overlayfs/util.c @@ -102,6 +102,9 @@ bool ovl_dentry_remote(struct dentry *dentry) bool ovl_dentry_weird(struct dentry *dentry) { + if (!d_can_lookup(dentry) && !d_is_file(dentry) && !d_is_symlink(dentry)) + return true; + return dentry->d_flags & (DCACHE_NEED_AUTOMOUNT | DCACHE_MANAGE_TRANSIT | DCACHE_OP_HASH | -- 2.46.1

2 1

[PATCH openEuler-1.0-LTS] nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
by Zizhi Wo 02 Jan '25

02 Jan '25

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v5.4.287 commit 09d6d05579fd46e61abf6e457bb100ff11f3a9d3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEANS CVE: CVE-2024-56619 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit 985ebec4ab0a28bb5910c3b1481a40fbf7f9e61d upstream. Syzbot reported that when searching for records in a directory where the inode's i_size is corrupted and has a large value, memory access outside the folio/page range may occur, or a use-after-free bug may be detected if KASAN is enabled. This is because nilfs_last_byte(), which is called by nilfs_find_entry() and others to calculate the number of valid bytes of directory data in a page from i_size and the page index, loses the upper 32 bits of the 64-bit size information due to an inappropriate type of local variable to which the i_size value is assigned. This caused a large byte offset value due to underflow in the end address calculation in the calling nilfs_find_entry(), resulting in memory access that exceeds the folio/page size. Fix this issue by changing the type of the local variable causing the bit loss from "unsigned int" to "u64". The return value of nilfs_last_byte() is also of type "unsigned int", but it is truncated so as not to exceed PAGE_SIZE and no bit loss occurs, so no change is required. Link: https://lkml.kernel.org/r/20241119172403.9292-1-konishi.ryusuke@gmail.com Fixes: 2ba466d74ed7 ("nilfs2: directory entry operations") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+96d5d14c47d97015c624(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=96d5d14c47d97015c624 Tested-by: syzbot+96d5d14c47d97015c624(a)syzkaller.appspotmail.com Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/nilfs2/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c index 7368a4f16fb0..178fd322448c 100644 --- a/fs/nilfs2/dir.c +++ b/fs/nilfs2/dir.c @@ -76,7 +76,7 @@ static inline void nilfs_put_page(struct page *page) */ static unsigned int nilfs_last_byte(struct inode *inode, unsigned long page_nr) { - unsigned int last_byte = inode->i_size; + u64 last_byte = inode->i_size; last_byte -= page_nr << PAGE_SHIFT; if (last_byte > PAGE_SIZE) -- 2.46.1

2 1

[PATCH OLK-5.10] jfs: fix array-index-out-of-bounds in jfs_readdir
by Long Li 02 Jan '25

02 Jan '25

From: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> mainline inclusion from mainline-v6.10-rc2 commit 839f102efb168f02dfdd46717b7c6dddb26b015e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOO CVE: CVE-2024-56596 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The stbl might contain some invalid values. Added a check to return error code in that case. Reported-by: syzbot+0315f8fe99120601ba88(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0315f8fe99120601ba88 Signed-off-by: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/jfs/jfs_dtree.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index defa82acb432..ec2612bddb5d 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -3189,6 +3189,14 @@ int jfs_readdir(struct file *file, struct dir_context *ctx) stbl = DT_GETSTBL(p); for (i = index; i < p->header.nextindex; i++) { + if (stbl[i] < 0 || stbl[i] > 127) { + jfs_err("JFS: Invalid stbl[%d] = %d for inode %ld, block = %lld", + i, stbl[i], (long)ip->i_ino, (long long)bn); + free_page(dirent_buf); + DT_PUTPAGE(mp); + return -EIO; + } + d = (struct ldtentry *) & p->slot[stbl[i]]; if (((long) jfs_dirent + d->namlen + 1) > -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] jfs: fix array-index-out-of-bounds in jfs_readdir
by Long Li 02 Jan '25

02 Jan '25

From: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> mainline inclusion from mainline-v6.10-rc2 commit 839f102efb168f02dfdd46717b7c6dddb26b015e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOO CVE: CVE-2024-56596 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The stbl might contain some invalid values. Added a check to return error code in that case. Reported-by: syzbot+0315f8fe99120601ba88(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0315f8fe99120601ba88 Signed-off-by: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/jfs/jfs_dtree.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index defa82acb432..ec2612bddb5d 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -3189,6 +3189,14 @@ int jfs_readdir(struct file *file, struct dir_context *ctx) stbl = DT_GETSTBL(p); for (i = index; i < p->header.nextindex; i++) { + if (stbl[i] < 0 || stbl[i] > 127) { + jfs_err("JFS: Invalid stbl[%d] = %d for inode %ld, block = %lld", + i, stbl[i], (long)ip->i_ino, (long long)bn); + free_page(dirent_buf); + DT_PUTPAGE(mp); + return -EIO; + } + d = (struct ldtentry *) & p->slot[stbl[i]]; if (((long) jfs_dirent + d->namlen + 1) > -- 2.39.2

2 1

[PATCH OLK-5.10] jfs: fix array-index-out-of-bounds in jfs_readdir
by Long Li 02 Jan '25

02 Jan '25

From: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> mainline inclusion from mainline-v6.10-rc2 commit 839f102efb168f02dfdd46717b7c6dddb26b015e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAPD CVE: CVE-2024-56596 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The stbl might contain some invalid values. Added a check to return error code in that case. Reported-by: syzbot+0315f8fe99120601ba88(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0315f8fe99120601ba88 Signed-off-by: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/jfs/jfs_dtree.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index defa82acb432..ec2612bddb5d 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -3189,6 +3189,14 @@ int jfs_readdir(struct file *file, struct dir_context *ctx) stbl = DT_GETSTBL(p); for (i = index; i < p->header.nextindex; i++) { + if (stbl[i] < 0 || stbl[i] > 127) { + jfs_err("JFS: Invalid stbl[%d] = %d for inode %ld, block = %lld", + i, stbl[i], (long)ip->i_ino, (long long)bn); + free_page(dirent_buf); + DT_PUTPAGE(mp); + return -EIO; + } + d = (struct ldtentry *) & p->slot[stbl[i]]; if (((long) jfs_dirent + d->namlen + 1) > -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS 0/1] CVE-2024-53158
by Lin Yujun 02 Jan '25

02 Jan '25

Dan Carpenter (1): soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() drivers/soc/qcom/qcom-geni-se.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1] jfs: fix array-index-out-of-bounds in jfs_readdir
by Long Li 02 Jan '25

02 Jan '25

From: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> mainline inclusion from mainline-v6.10-rc2 commit 839f102efb168f02dfdd46717b7c6dddb26b015e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAPD CVE: CVE-2024-56596 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The stbl might contain some invalid values. Added a check to return error code in that case. Reported-by: syzbot+0315f8fe99120601ba88(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0315f8fe99120601ba88 Signed-off-by: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/jfs/jfs_dtree.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index defa82acb432..ec2612bddb5d 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -3189,6 +3189,14 @@ int jfs_readdir(struct file *file, struct dir_context *ctx) stbl = DT_GETSTBL(p); for (i = index; i < p->header.nextindex; i++) { + if (stbl[i] < 0 || stbl[i] > 127) { + jfs_err("JFS: Invalid stbl[%d] = %d for inode %ld, block = %lld", + i, stbl[i], (long)ip->i_ino, (long long)bn); + free_page(dirent_buf); + DT_PUTPAGE(mp); + return -EIO; + } + d = (struct ldtentry *) & p->slot[stbl[i]]; if (((long) jfs_dirent + d->namlen + 1) > -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-53158
by Lin Yujun 02 Jan '25

02 Jan '25

Dan Carpenter (1): soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() drivers/soc/qcom/qcom-geni-se.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/9] ext4: correct behaviors under errors=remount-ro mode
by Baokun Li 02 Jan '25

02 Jan '25

Baokun Li (8): sb_writers: fix kabi broken Revert "ext4: don't set SB_RDONLY after filesystem errors" Revert "ext4: replace read-only check for shutdown check in mmp code" Revert "ext4: drop read-only check from ext4_force_commit()" Revert "ext4: drop read-only check in ext4_write_inode()" Revert "ext4: drop read-only check in ext4_init_inode_table()" Revert "ext4: warn on read-only filesystem in ext4_journal_check_start()" Revert "ext4: drop EXT4_MF_FS_ABORTED flag" Jan Kara (1): fs: fix a hungtask problem when freeze/unfreeze fs fs/ext4/ext4.h | 1 + fs/ext4/ext4_jbd2.c | 3 +-- fs/ext4/fsync.c | 7 ++++--- fs/ext4/ialloc.c | 6 ++++++ fs/ext4/inode.c | 11 +++++++---- fs/ext4/mballoc.c | 4 ++-- fs/ext4/mmp.c | 2 +- fs/ext4/super.c | 21 +++++++++++++-------- fs/super.c | 9 ++++++++- include/linux/fs.h | 5 ++++- 10 files changed, 47 insertions(+), 22 deletions(-) -- 2.46.1

2 10

[PATCH openEuler-22.03-LTS-SP1] smb: client: fix NULL ptr deref in crypto_aead_setkey()
by Baokun Li 02 Jan '25

02 Jan '25

From: Paulo Alcantara <pc(a)manguebit.com> stable inclusion from stable-v6.6.64 commit 46f8e25926817272ec8d5bfbd003569bdeb9a8c8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAG4 CVE: CVE-2024-53185 -------------------------------- commit 4bdec0d1f658f7c98749bd2c5a486e6cfa8565d2 upstream. Neither SMB3.0 or SMB3.02 supports encryption negotiate context, so when SMB2_GLOBAL_CAP_ENCRYPTION flag is set in the negotiate response, the client uses AES-128-CCM as the default cipher. See MS-SMB2 3.3.5.4. Commit b0abcd65ec54 ("smb: client: fix UAF in async decryption") added a @server->cipher_type check to conditionally call smb3_crypto_aead_allocate(), but that check would always be false as @server->cipher_type is unset for SMB3.02. Fix the following KASAN splat by setting @server->cipher_type for SMB3.02 as well. mount.cifs //srv/share /mnt -o vers=3.02,seal,... BUG: KASAN: null-ptr-deref in crypto_aead_setkey+0x2c/0x130 Read of size 8 at addr 0000000000000020 by task mount.cifs/1095 CPU: 1 UID: 0 PID: 1095 Comm: mount.cifs Not tainted 6.12.0 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-3.fc41 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x5d/0x80 ? crypto_aead_setkey+0x2c/0x130 kasan_report+0xda/0x110 ? crypto_aead_setkey+0x2c/0x130 crypto_aead_setkey+0x2c/0x130 crypt_message+0x258/0xec0 [cifs] ? __asan_memset+0x23/0x50 ? __pfx_crypt_message+0x10/0x10 [cifs] ? mark_lock+0xb0/0x6a0 ? hlock_class+0x32/0xb0 ? mark_lock+0xb0/0x6a0 smb3_init_transform_rq+0x352/0x3f0 [cifs] ? lock_acquire.part.0+0xf4/0x2a0 smb_send_rqst+0x144/0x230 [cifs] ? __pfx_smb_send_rqst+0x10/0x10 [cifs] ? hlock_class+0x32/0xb0 ? smb2_setup_request+0x225/0x3a0 [cifs] ? __pfx_cifs_compound_last_callback+0x10/0x10 [cifs] compound_send_recv+0x59b/0x1140 [cifs] ? __pfx_compound_send_recv+0x10/0x10 [cifs] ? __create_object+0x5e/0x90 ? hlock_class+0x32/0xb0 ? do_raw_spin_unlock+0x9a/0xf0 cifs_send_recv+0x23/0x30 [cifs] SMB2_tcon+0x3ec/0xb30 [cifs] ? __pfx_SMB2_tcon+0x10/0x10 [cifs] ? lock_acquire.part.0+0xf4/0x2a0 ? __pfx_lock_release+0x10/0x10 ? do_raw_spin_trylock+0xc6/0x120 ? lock_acquire+0x3f/0x90 ? _get_xid+0x16/0xd0 [cifs] ? __pfx_SMB2_tcon+0x10/0x10 [cifs] ? cifs_get_smb_ses+0xcdd/0x10a0 [cifs] cifs_get_smb_ses+0xcdd/0x10a0 [cifs] ? __pfx_cifs_get_smb_ses+0x10/0x10 [cifs] ? cifs_get_tcp_session+0xaa0/0xca0 [cifs] cifs_mount_get_session+0x8a/0x210 [cifs] dfs_mount_share+0x1b0/0x11d0 [cifs] ? __pfx___lock_acquire+0x10/0x10 ? __pfx_dfs_mount_share+0x10/0x10 [cifs] ? lock_acquire.part.0+0xf4/0x2a0 ? find_held_lock+0x8a/0xa0 ? hlock_class+0x32/0xb0 ? lock_release+0x203/0x5d0 cifs_mount+0xb3/0x3d0 [cifs] ? do_raw_spin_trylock+0xc6/0x120 ? __pfx_cifs_mount+0x10/0x10 [cifs] ? lock_acquire+0x3f/0x90 ? find_nls+0x16/0xa0 ? smb3_update_mnt_flags+0x372/0x3b0 [cifs] cifs_smb3_do_mount+0x1e2/0xc80 [cifs] ? __pfx_vfs_parse_fs_string+0x10/0x10 ? __pfx_cifs_smb3_do_mount+0x10/0x10 [cifs] smb3_get_tree+0x1bf/0x330 [cifs] vfs_get_tree+0x4a/0x160 path_mount+0x3c1/0xfb0 ? kasan_quarantine_put+0xc7/0x1d0 ? __pfx_path_mount+0x10/0x10 ? kmem_cache_free+0x118/0x3e0 ? user_path_at+0x74/0xa0 __x64_sys_mount+0x1a6/0x1e0 ? __pfx___x64_sys_mount+0x10/0x10 ? mark_held_locks+0x1a/0x90 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Cc: Tom Talpey <tom(a)talpey.com> Reported-by: Jianhong Yin <jiyin(a)redhat.com> Cc: stable(a)vger.kernel.org # v6.12 Fixes: b0abcd65ec54 ("smb: client: fix UAF in async decryption") Signed-off-by: Paulo Alcantara (Red Hat) <pc(a)manguebit.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/smb/client/smb2pdu.c fs/cifs/smb2pdu.c [Context differences because there is no commit 38c8a9a52082 ("smb: move client and server files to common directory fs/smb").] Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/cifs/smb2pdu.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c index ea82cd9e5512..c098e956d1cb 100644 --- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -958,7 +958,9 @@ SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses) * SMB3.0 supports only 1 cipher and doesn't have a encryption neg context * Set the cipher type manually. */ - if (server->dialect == SMB30_PROT_ID && (server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) + if ((server->dialect == SMB30_PROT_ID || + server->dialect == SMB302_PROT_ID) && + (server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) server->cipher_type = SMB2_ENCRYPTION_AES128_CCM; security_blob = smb2_get_data_area_len(&blob_offset, &blob_length, -- 2.46.1

2 1

[PATCH OLK-5.10] smb: client: fix NULL ptr deref in crypto_aead_setkey()
by Baokun Li 02 Jan '25

02 Jan '25

From: Paulo Alcantara <pc(a)manguebit.com> stable inclusion from stable-v6.6.64 commit 46f8e25926817272ec8d5bfbd003569bdeb9a8c8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAG4 CVE: CVE-2024-53185 -------------------------------- commit 4bdec0d1f658f7c98749bd2c5a486e6cfa8565d2 upstream. Neither SMB3.0 or SMB3.02 supports encryption negotiate context, so when SMB2_GLOBAL_CAP_ENCRYPTION flag is set in the negotiate response, the client uses AES-128-CCM as the default cipher. See MS-SMB2 3.3.5.4. Commit b0abcd65ec54 ("smb: client: fix UAF in async decryption") added a @server->cipher_type check to conditionally call smb3_crypto_aead_allocate(), but that check would always be false as @server->cipher_type is unset for SMB3.02. Fix the following KASAN splat by setting @server->cipher_type for SMB3.02 as well. mount.cifs //srv/share /mnt -o vers=3.02,seal,... BUG: KASAN: null-ptr-deref in crypto_aead_setkey+0x2c/0x130 Read of size 8 at addr 0000000000000020 by task mount.cifs/1095 CPU: 1 UID: 0 PID: 1095 Comm: mount.cifs Not tainted 6.12.0 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-3.fc41 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x5d/0x80 ? crypto_aead_setkey+0x2c/0x130 kasan_report+0xda/0x110 ? crypto_aead_setkey+0x2c/0x130 crypto_aead_setkey+0x2c/0x130 crypt_message+0x258/0xec0 [cifs] ? __asan_memset+0x23/0x50 ? __pfx_crypt_message+0x10/0x10 [cifs] ? mark_lock+0xb0/0x6a0 ? hlock_class+0x32/0xb0 ? mark_lock+0xb0/0x6a0 smb3_init_transform_rq+0x352/0x3f0 [cifs] ? lock_acquire.part.0+0xf4/0x2a0 smb_send_rqst+0x144/0x230 [cifs] ? __pfx_smb_send_rqst+0x10/0x10 [cifs] ? hlock_class+0x32/0xb0 ? smb2_setup_request+0x225/0x3a0 [cifs] ? __pfx_cifs_compound_last_callback+0x10/0x10 [cifs] compound_send_recv+0x59b/0x1140 [cifs] ? __pfx_compound_send_recv+0x10/0x10 [cifs] ? __create_object+0x5e/0x90 ? hlock_class+0x32/0xb0 ? do_raw_spin_unlock+0x9a/0xf0 cifs_send_recv+0x23/0x30 [cifs] SMB2_tcon+0x3ec/0xb30 [cifs] ? __pfx_SMB2_tcon+0x10/0x10 [cifs] ? lock_acquire.part.0+0xf4/0x2a0 ? __pfx_lock_release+0x10/0x10 ? do_raw_spin_trylock+0xc6/0x120 ? lock_acquire+0x3f/0x90 ? _get_xid+0x16/0xd0 [cifs] ? __pfx_SMB2_tcon+0x10/0x10 [cifs] ? cifs_get_smb_ses+0xcdd/0x10a0 [cifs] cifs_get_smb_ses+0xcdd/0x10a0 [cifs] ? __pfx_cifs_get_smb_ses+0x10/0x10 [cifs] ? cifs_get_tcp_session+0xaa0/0xca0 [cifs] cifs_mount_get_session+0x8a/0x210 [cifs] dfs_mount_share+0x1b0/0x11d0 [cifs] ? __pfx___lock_acquire+0x10/0x10 ? __pfx_dfs_mount_share+0x10/0x10 [cifs] ? lock_acquire.part.0+0xf4/0x2a0 ? find_held_lock+0x8a/0xa0 ? hlock_class+0x32/0xb0 ? lock_release+0x203/0x5d0 cifs_mount+0xb3/0x3d0 [cifs] ? do_raw_spin_trylock+0xc6/0x120 ? __pfx_cifs_mount+0x10/0x10 [cifs] ? lock_acquire+0x3f/0x90 ? find_nls+0x16/0xa0 ? smb3_update_mnt_flags+0x372/0x3b0 [cifs] cifs_smb3_do_mount+0x1e2/0xc80 [cifs] ? __pfx_vfs_parse_fs_string+0x10/0x10 ? __pfx_cifs_smb3_do_mount+0x10/0x10 [cifs] smb3_get_tree+0x1bf/0x330 [cifs] vfs_get_tree+0x4a/0x160 path_mount+0x3c1/0xfb0 ? kasan_quarantine_put+0xc7/0x1d0 ? __pfx_path_mount+0x10/0x10 ? kmem_cache_free+0x118/0x3e0 ? user_path_at+0x74/0xa0 __x64_sys_mount+0x1a6/0x1e0 ? __pfx___x64_sys_mount+0x10/0x10 ? mark_held_locks+0x1a/0x90 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Cc: Tom Talpey <tom(a)talpey.com> Reported-by: Jianhong Yin <jiyin(a)redhat.com> Cc: stable(a)vger.kernel.org # v6.12 Fixes: b0abcd65ec54 ("smb: client: fix UAF in async decryption") Signed-off-by: Paulo Alcantara (Red Hat) <pc(a)manguebit.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/smb/client/smb2pdu.c fs/cifs/smb2pdu.c [Context differences because there is no commit 38c8a9a52082 ("smb: move client and server files to common directory fs/smb").] Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/cifs/smb2pdu.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c index 245e2dd5a194..4197096e7fdb 100644 --- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -963,7 +963,9 @@ SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses) * SMB3.0 supports only 1 cipher and doesn't have a encryption neg context * Set the cipher type manually. */ - if (server->dialect == SMB30_PROT_ID && (server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) + if ((server->dialect == SMB30_PROT_ID || + server->dialect == SMB302_PROT_ID) && + (server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) server->cipher_type = SMB2_ENCRYPTION_AES128_CCM; security_blob = smb2_get_data_area_len(&blob_offset, &blob_length, -- 2.46.1

2 1

[PATCH OLK-6.6] jfs: fix array-index-out-of-bounds in jfs_readdir
by Long Li 02 Jan '25

02 Jan '25

From: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> mainline inclusion from mainline-v6.10-rc2 commit 839f102efb168f02dfdd46717b7c6dddb26b015e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOO CVE: CVE-2024-56596 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The stbl might contain some invalid values. Added a check to return error code in that case. Reported-by: syzbot+0315f8fe99120601ba88(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0315f8fe99120601ba88 Signed-off-by: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/jfs/jfs_dtree.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index 5d3127ca68a4..65e75d92487d 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -2891,6 +2891,14 @@ int jfs_readdir(struct file *file, struct dir_context *ctx) stbl = DT_GETSTBL(p); for (i = index; i < p->header.nextindex; i++) { + if (stbl[i] < 0 || stbl[i] > 127) { + jfs_err("JFS: Invalid stbl[%d] = %d for inode %ld, block = %lld", + i, stbl[i], (long)ip->i_ino, (long long)bn); + free_page(dirent_buf); + DT_PUTPAGE(mp); + return -EIO; + } + d = (struct ldtentry *) & p->slot[stbl[i]]; if (((long) jfs_dirent + d->namlen + 1) > -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read
by Long Li 02 Jan '25

02 Jan '25

From: Jordy Zomer <jordyzomer(a)google.com> mainline inclusion from mainline-v6.10-rc2 commit fc342cf86e2dc4d2edb0fc2ff5e28b6c7845adb9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAPD CVE: CVE-2024-56627 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- An offset from client could be a negative value, It could lead to an out-of-bounds read from the stream_buf. Note that this issue is coming when setting 'vfs objects = streams_xattr parameter' in ksmbd.conf. Cc: stable(a)vger.kernel.org # v5.15+ Reported-by: Jordy Zomer <jordyzomer(a)google.com> Signed-off-by: Jordy Zomer <jordyzomer(a)google.com> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/ksmbd/smb2pdu.c fs/smb/server/smb2pdu.c [Conflicts due to ksmbd rename to smb/server] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index f104de64493b..b6194837028a 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -6319,6 +6319,10 @@ int smb2_read(struct ksmbd_work *work) } offset = le64_to_cpu(req->Offset); + if (offset < 0) { + err = -EINVAL; + goto out; + } length = le32_to_cpu(req->Length); mincount = le32_to_cpu(req->MinimumCount); -- 2.39.2

2 1

[PATCH OLK-5.10] ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read
by Long Li 02 Jan '25

02 Jan '25

From: Jordy Zomer <jordyzomer(a)google.com> mainline inclusion from mainline-v6.10-rc2 commit fc342cf86e2dc4d2edb0fc2ff5e28b6c7845adb9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAPD CVE: CVE-2024-56627 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- An offset from client could be a negative value, It could lead to an out-of-bounds read from the stream_buf. Note that this issue is coming when setting 'vfs objects = streams_xattr parameter' in ksmbd.conf. Cc: stable(a)vger.kernel.org # v5.15+ Reported-by: Jordy Zomer <jordyzomer(a)google.com> Signed-off-by: Jordy Zomer <jordyzomer(a)google.com> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/ksmbd/smb2pdu.c fs/smb/server/smb2pdu.c [Conflicts due to ksmbd rename to smb/server] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index f104de64493b..b6194837028a 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -6319,6 +6319,10 @@ int smb2_read(struct ksmbd_work *work) } offset = le64_to_cpu(req->Offset); + if (offset < 0) { + err = -EINVAL; + goto out; + } length = le32_to_cpu(req->Length); mincount = le32_to_cpu(req->MinimumCount); -- 2.39.2

2 1

[PATCH OLK-6.6] io_uring/tctx: work around xa_store() allocation error issue
by Long Li 02 Jan '25

02 Jan '25

From: Jens Axboe <axboe(a)kernel.dk> mainline inclusion from mainline-v6.10-rc2 commit 7eb75ce7527129d7f1fee6951566af409a37a1c4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAP3 CVE: CVE-2024-56584 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot triggered the following WARN_ON: WARNING: CPU: 0 PID: 16 at io_uring/tctx.c:51 __io_uring_free+0xfa/0x140 io_uring/tctx.c:51 which is the WARN_ON_ONCE(!xa_empty(&tctx->xa)); sanity check in __io_uring_free() when a io_uring_task is going through its final put. The syzbot test case includes injecting memory allocation failures, and it very much looks like xa_store() can fail one of its memory allocations and end up with ->head being non-NULL even though no entries exist in the xarray. Until this issue gets sorted out, work around it by attempting to iterate entries in our xarray, and WARN_ON_ONCE() if one is found. Reported-by: syzbot+cc36d44ec9f368e443d3(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/io-uring/673c1643.050a0220.87769.0066.GAE@google.co… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- io_uring/tctx.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/io_uring/tctx.c b/io_uring/tctx.c index c043fe93a3f2..84f6a8385720 100644 --- a/io_uring/tctx.c +++ b/io_uring/tctx.c @@ -47,8 +47,19 @@ static struct io_wq *io_init_wq_offload(struct io_ring_ctx *ctx, void __io_uring_free(struct task_struct *tsk) { struct io_uring_task *tctx = tsk->io_uring; + struct io_tctx_node *node; + unsigned long index; - WARN_ON_ONCE(!xa_empty(&tctx->xa)); + /* + * Fault injection forcing allocation errors in the xa_store() path + * can lead to xa_empty() returning false, even though no actual + * node is stored in the xarray. Until that gets sorted out, attempt + * an iteration here and warn if any entries are found. + */ + xa_for_each(&tctx->xa, index, node) { + WARN_ON_ONCE(1); + break; + } WARN_ON_ONCE(tctx->io_wq); WARN_ON_ONCE(tctx->cached_refs); -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] io_uring/tctx: work around xa_store() allocation error issue
by Long Li 02 Jan '25

02 Jan '25

From: Jens Axboe <axboe(a)kernel.dk> mainline inclusion from mainline-v6.10-rc2 commit 7eb75ce7527129d7f1fee6951566af409a37a1c4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAP3 CVE: CVE-2024-56584 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot triggered the following WARN_ON: WARNING: CPU: 0 PID: 16 at io_uring/tctx.c:51 __io_uring_free+0xfa/0x140 io_uring/tctx.c:51 which is the WARN_ON_ONCE(!xa_empty(&tctx->xa)); sanity check in __io_uring_free() when a io_uring_task is going through its final put. The syzbot test case includes injecting memory allocation failures, and it very much looks like xa_store() can fail one of its memory allocations and end up with ->head being non-NULL even though no entries exist in the xarray. Until this issue gets sorted out, work around it by attempting to iterate entries in our xarray, and WARN_ON_ONCE() if one is found. Reported-by: syzbot+cc36d44ec9f368e443d3(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/io-uring/673c1643.050a0220.87769.0066.GAE@google.co… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: io_uring/io_uring.c io_uring/tctx.c [Conflicts due to __io_uring_free() move to io_uring/tctx.c in mainline] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- io_uring/io_uring.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 4d69fb4cf803..e058ce8bb8e2 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -8341,8 +8341,19 @@ static int io_uring_alloc_task_context(struct task_struct *task, void __io_uring_free(struct task_struct *tsk) { struct io_uring_task *tctx = tsk->io_uring; + struct io_tctx_node *node; + unsigned long index; - WARN_ON_ONCE(!xa_empty(&tctx->xa)); + /* + * Fault injection forcing allocation errors in the xa_store() path + * can lead to xa_empty() returning false, even though no actual + * node is stored in the xarray. Until that gets sorted out, attempt + * an iteration here and warn if any entries are found. + */ + xa_for_each(&tctx->xa, index, node) { + WARN_ON_ONCE(1); + break; + } WARN_ON_ONCE(tctx->io_wq); WARN_ON_ONCE(tctx->cached_refs); -- 2.39.2

2 1

[PATCH OLK-5.10] io_uring/tctx: work around xa_store() allocation error issue
by Long Li 02 Jan '25

02 Jan '25

From: Jens Axboe <axboe(a)kernel.dk> mainline inclusion from mainline-v6.10-rc2 commit 7eb75ce7527129d7f1fee6951566af409a37a1c4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAP3 CVE: CVE-2024-56584 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot triggered the following WARN_ON: WARNING: CPU: 0 PID: 16 at io_uring/tctx.c:51 __io_uring_free+0xfa/0x140 io_uring/tctx.c:51 which is the WARN_ON_ONCE(!xa_empty(&tctx->xa)); sanity check in __io_uring_free() when a io_uring_task is going through its final put. The syzbot test case includes injecting memory allocation failures, and it very much looks like xa_store() can fail one of its memory allocations and end up with ->head being non-NULL even though no entries exist in the xarray. Until this issue gets sorted out, work around it by attempting to iterate entries in our xarray, and WARN_ON_ONCE() if one is found. Reported-by: syzbot+cc36d44ec9f368e443d3(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/io-uring/673c1643.050a0220.87769.0066.GAE@google.co… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: io_uring/io_uring.c io_uring/tctx.c [Conflicts due to __io_uring_free() move to io_uring/tctx.c in mainline] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- io_uring/io_uring.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 6e5e00a7692c..170b3dbf0750 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -8537,8 +8537,19 @@ static int io_uring_alloc_task_context(struct task_struct *task, void __io_uring_free(struct task_struct *tsk) { struct io_uring_task *tctx = tsk->io_uring; + struct io_tctx_node *node; + unsigned long index; - WARN_ON_ONCE(!xa_empty(&tctx->xa)); + /* + * Fault injection forcing allocation errors in the xa_store() path + * can lead to xa_empty() returning false, even though no actual + * node is stored in the xarray. Until that gets sorted out, attempt + * an iteration here and warn if any entries are found. + */ + xa_for_each(&tctx->xa, index, node) { + WARN_ON_ONCE(1); + break; + } WARN_ON_ONCE(tctx->io_wq); WARN_ON_ONCE(tctx->cached_refs); -- 2.39.2

2 1

[openeuler:OLK-5.10 2620/2620] fs/fscache/main.c:51:21: warning: unused variable 'fscache_min_object_max_active'
by kernel test robot 02 Jan '25

02 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 7059ffd1a85492c66d87331537ee3e4bdf8bf609 commit: c55fa11d134b40dbe1a4a5512a7fe43497cb6d5e [2620/2620] fscache: limit fscache_object_max_active to avoid blocking config: x86_64-buildonly-randconfig-004-20250102 (https://download.01.org/0day-ci/archive/20250102/202501021908.g3jjkIa6-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250102/202501021908.g3jjkIa6-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501021908.g3jjkIa6-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from fs/fscache/main.c:16: In file included from fs/fscache/internal.h:27: In file included from include/linux/fscache-cache.h:17: In file included from include/linux/fscache.h:19: In file included from include/linux/pagemap.h:8: In file included from include/linux/mm.h:1587: include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ >> fs/fscache/main.c:51:21: warning: unused variable 'fscache_min_object_max_active' [-Wunused-variable] 51 | static unsigned int fscache_min_object_max_active = FSCACHE_MIN_OBJECT_MAX_ACTIVE; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> fs/fscache/main.c:52:21: warning: unused variable 'fscache_min_op_max_active' [-Wunused-variable] 52 | static unsigned int fscache_min_op_max_active = FSCACHE_MIN_OBJECT_MAX_ACTIVE / 2; | ^~~~~~~~~~~~~~~~~~~~~~~~~ 3 warnings generated. vim +/fscache_min_object_max_active +51 fs/fscache/main.c 46 47 /* these values serve as lower bounds, will be adjusted in fscache_init() */ 48 #define FSCACHE_MIN_OBJECT_MAX_ACTIVE 4 49 static unsigned int fscache_object_max_active = FSCACHE_MIN_OBJECT_MAX_ACTIVE; 50 static unsigned int fscache_op_max_active = FSCACHE_MIN_OBJECT_MAX_ACTIVE / 2; > 51 static unsigned int fscache_min_object_max_active = FSCACHE_MIN_OBJECT_MAX_ACTIVE; > 52 static unsigned int fscache_min_op_max_active = FSCACHE_MIN_OBJECT_MAX_ACTIVE / 2; 53 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] bpf: Call free_htab_elem() after htab_unlock_bucket()
by Xiaomeng Zhang 02 Jan '25

02 Jan '25

From: Hou Tao <houtao1(a)huawei.com> stable inclusion from stable-v6.6.66 commit 10e8a2dec9ff1b81de8e892b0850924038adbc6d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEANW CVE: CVE-2024-56592 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- For htab of maps, when the map is removed from the htab, it may hold the last reference of the map. bpf_map_fd_put_ptr() will invoke bpf_map_free_id() to free the id of the removed map element. However, bpf_map_fd_put_ptr() is invoked while holding a bucket lock (raw_spin_lock_t), and bpf_map_free_id() attempts to acquire map_idr_lock (spinlock_t), triggering the following lockdep warning: ============================= [ BUG: Invalid wait context ] 6.11.0-rc4+ #49 Not tainted ----------------------------- test_maps/4881 is trying to lock: ffffffff84884578 (map_idr_lock){+...}-{3:3}, at: bpf_map_free_id.part.0+0x21/0x70 other info that might help us debug this: context-{5:5} 2 locks held by test_maps/4881: #0: ffffffff846caf60 (rcu_read_lock){....}-{1:3}, at: bpf_fd_htab_map_update_elem+0xf9/0x270 #1: ffff888149ced148 (&htab->lockdep_key#2){....}-{2:2}, at: htab_map_update_elem+0x178/0xa80 stack backtrace: CPU: 0 UID: 0 PID: 4881 Comm: test_maps Not tainted 6.11.0-rc4+ #49 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), ... Call Trace: <TASK> dump_stack_lvl+0x6e/0xb0 dump_stack+0x10/0x20 __lock_acquire+0x73e/0x36c0 lock_acquire+0x182/0x450 _raw_spin_lock_irqsave+0x43/0x70 bpf_map_free_id.part.0+0x21/0x70 bpf_map_put+0xcf/0x110 bpf_map_fd_put_ptr+0x9a/0xb0 free_htab_elem+0x69/0xe0 htab_map_update_elem+0x50f/0xa80 bpf_fd_htab_map_update_elem+0x131/0x270 htab_map_update_elem+0x50f/0xa80 bpf_fd_htab_map_update_elem+0x131/0x270 bpf_map_update_value+0x266/0x380 __sys_bpf+0x21bb/0x36b0 __x64_sys_bpf+0x45/0x60 x64_sys_call+0x1b2a/0x20d0 do_syscall_64+0x5d/0x100 entry_SYSCALL_64_after_hwframe+0x76/0x7e One way to fix the lockdep warning is using raw_spinlock_t for map_idr_lock as well. However, bpf_map_alloc_id() invokes idr_alloc_cyclic() after acquiring map_idr_lock, it will trigger a similar lockdep warning because the slab's lock (s->cpu_slab->lock) is still a spinlock. Instead of changing map_idr_lock's type, fix the issue by invoking htab_put_fd_value() after htab_unlock_bucket(). However, only deferring the invocation of htab_put_fd_value() is not enough, because the old map pointers in htab of maps can not be saved during batched deletion. Therefore, also defer the invocation of free_htab_elem(), so these to-be-freed elements could be linked together similar to lru map. There are four callers for ->map_fd_put_ptr: (1) alloc_htab_elem() (through htab_put_fd_value()) It invokes ->map_fd_put_ptr() under a raw_spinlock_t. The invocation of htab_put_fd_value() can not simply move after htab_unlock_bucket(), because the old element has already been stashed in htab->extra_elems. It may be reused immediately after htab_unlock_bucket() and the invocation of htab_put_fd_value() after htab_unlock_bucket() may release the newly-added element incorrectly. Therefore, saving the map pointer of the old element for htab of maps before unlocking the bucket and releasing the map_ptr after unlock. Beside the map pointer in the old element, should do the same thing for the special fields in the old element as well. (2) free_htab_elem() (through htab_put_fd_value()) Its caller includes __htab_map_lookup_and_delete_elem(), htab_map_delete_elem() and __htab_map_lookup_and_delete_batch(). For htab_map_delete_elem(), simply invoke free_htab_elem() after htab_unlock_bucket(). For __htab_map_lookup_and_delete_batch(), just like lru map, linking the to-be-freed element into node_to_free list and invoking free_htab_elem() for these element after unlock. It is safe to reuse batch_flink as the link for node_to_free, because these elements have been removed from the hash llist. Because htab of maps doesn't support lookup_and_delete operation, __htab_map_lookup_and_delete_elem() doesn't have the problem, so kept it as is. (3) fd_htab_map_free() It invokes ->map_fd_put_ptr without raw_spinlock_t. (4) bpf_fd_htab_map_update_elem() It invokes ->map_fd_put_ptr without raw_spinlock_t. After moving free_htab_elem() outside htab bucket lock scope, using pcpu_freelist_push() instead of __pcpu_freelist_push() to disable the irq before freeing elements, and protecting the invocations of bpf_mem_cache_free() with migrate_{disable|enable} pair. Signed-off-by: Hou Tao <houtao1(a)huawei.com> Link: https://lore.kernel.org/r/20241106063542.357743-2-houtao@huaweicloud.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- kernel/bpf/hashtab.c | 56 ++++++++++++++++++++++++++++++-------------- 1 file changed, 39 insertions(+), 17 deletions(-) diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c index 7c64ad4f3732..fc34f72702cc 100644 --- a/kernel/bpf/hashtab.c +++ b/kernel/bpf/hashtab.c @@ -892,9 +892,12 @@ static int htab_map_get_next_key(struct bpf_map *map, void *key, void *next_key) static void htab_elem_free(struct bpf_htab *htab, struct htab_elem *l) { check_and_free_fields(htab, l); + + migrate_disable(); if (htab->map.map_type == BPF_MAP_TYPE_PERCPU_HASH) bpf_mem_cache_free(&htab->pcpu_ma, l->ptr_to_pptr); bpf_mem_cache_free(&htab->ma, l); + migrate_enable(); } static void htab_put_fd_value(struct bpf_htab *htab, struct htab_elem *l) @@ -944,7 +947,7 @@ static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l) if (htab_is_prealloc(htab)) { bpf_map_dec_elem_count(&htab->map); check_and_free_fields(htab, l); - __pcpu_freelist_push(&htab->freelist, &l->fnode); + pcpu_freelist_push(&htab->freelist, &l->fnode); } else { dec_elem_count(htab); htab_elem_free(htab, l); @@ -1014,7 +1017,6 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key, */ pl_new = this_cpu_ptr(htab->extra_elems); l_new = *pl_new; - htab_put_fd_value(htab, old_elem); *pl_new = old_elem; } else { struct pcpu_freelist_node *l; @@ -1100,6 +1102,7 @@ static long htab_map_update_elem(struct bpf_map *map, void *key, void *value, struct htab_elem *l_new = NULL, *l_old; struct hlist_nulls_head *head; unsigned long flags; + void *old_map_ptr; struct bucket *b; u32 key_size, hash; int ret; @@ -1178,12 +1181,27 @@ static long htab_map_update_elem(struct bpf_map *map, void *key, void *value, hlist_nulls_add_head_rcu(&l_new->hash_node, head); if (l_old) { hlist_nulls_del_rcu(&l_old->hash_node); + + /* l_old has already been stashed in htab->extra_elems, free + * its special fields before it is available for reuse. Also + * save the old map pointer in htab of maps before unlock + * and release it after unlock. + */ + old_map_ptr = NULL; + if (htab_is_prealloc(htab)) { + if (map->ops->map_fd_put_ptr) + old_map_ptr = fd_htab_map_get_ptr(map, l_old); + check_and_free_fields(htab, l_old); + } + } + htab_unlock_bucket(htab, b, hash, flags); + if (l_old) { + if (old_map_ptr) + map->ops->map_fd_put_ptr(map, old_map_ptr, true); if (!htab_is_prealloc(htab)) free_htab_elem(htab, l_old); - else - check_and_free_fields(htab, l_old); } - ret = 0; + return 0; err: htab_unlock_bucket(htab, b, hash, flags); return ret; @@ -1427,15 +1445,15 @@ static long htab_map_delete_elem(struct bpf_map *map, void *key) return ret; l = lookup_elem_raw(head, hash, key, key_size); - - if (l) { + if (l) hlist_nulls_del_rcu(&l->hash_node); - free_htab_elem(htab, l); - } else { + else ret = -ENOENT; - } htab_unlock_bucket(htab, b, hash, flags); + + if (l) + free_htab_elem(htab, l); return ret; } @@ -1842,13 +1860,14 @@ __htab_map_lookup_and_delete_batch(struct bpf_map *map, * may cause deadlock. See comments in function * prealloc_lru_pop(). Let us do bpf_lru_push_free() * after releasing the bucket lock. + * + * For htab of maps, htab_put_fd_value() in + * free_htab_elem() may acquire a spinlock with bucket + * lock being held and it violates the lock rule, so + * invoke free_htab_elem() after unlock as well. */ - if (is_lru_map) { - l->batch_flink = node_to_free; - node_to_free = l; - } else { - free_htab_elem(htab, l); - } + l->batch_flink = node_to_free; + node_to_free = l; } dst_key += key_size; dst_val += value_size; @@ -1860,7 +1879,10 @@ __htab_map_lookup_and_delete_batch(struct bpf_map *map, while (node_to_free) { l = node_to_free; node_to_free = node_to_free->batch_flink; - htab_lru_push_free(htab, l); + if (is_lru_map) + htab_lru_push_free(htab, l); + else + free_htab_elem(htab, l); } next_batch: -- 2.34.1

2 1

[PATCH OLK-5.10 0/1] CVE-2024-53158
by Lin Yujun 02 Jan '25

02 Jan '25

Dan Carpenter (1): soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() drivers/soc/qcom/qcom-geni-se.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] CVE-2024-53158
by Lin Yujun 02 Jan '25

02 Jan '25

Dan Carpenter (1): [Backport] soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() drivers/soc/qcom/qcom-geni-se.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1] crypto: bcm - add error check in the ahash_hmac_init function
by Huang Xiaojia 02 Jan '25

02 Jan '25

From: Chen Ridong <chenridong(a)huawei.com> stable inclusion from stable-v5.10.231 commit 28f8ffa945f7d7150463e15097ea73b19529d6f5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDPO CVE: CVE-2024-56681 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 19630cf57233e845b6ac57c9c969a4888925467b ] The ahash_init functions may return fails. The ahash_hmac_init should not return ok when ahash_init returns error. For an example, ahash_init will return -ENOMEM when allocation memory is error. Fixes: 9d12ba86f818 ("crypto: brcm - Add Broadcom SPU driver") Signed-off-by: Chen Ridong <chenridong(a)huawei.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- drivers/crypto/bcm/cipher.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c index 0e5537838ef3..8c8ef5b00b2c 100644 --- a/drivers/crypto/bcm/cipher.c +++ b/drivers/crypto/bcm/cipher.c @@ -2418,6 +2418,7 @@ static int ahash_hmac_setkey(struct crypto_ahash *ahash, const u8 *key, static int ahash_hmac_init(struct ahash_request *req) { + int ret; struct iproc_reqctx_s *rctx = ahash_request_ctx(req); struct crypto_ahash *tfm = crypto_ahash_reqtfm(req); struct iproc_ctx_s *ctx = crypto_ahash_ctx(tfm); @@ -2427,7 +2428,9 @@ static int ahash_hmac_init(struct ahash_request *req) flow_log("ahash_hmac_init()\n"); /* init the context as a hash */ - ahash_init(req); + ret = ahash_init(req); + if (ret) + return ret; if (!spu_no_incr_hash(ctx)) { /* SPU-M can do incr hashing but needs sw for outer HMAC */ -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
by Liu Chuang 02 Jan '25

02 Jan '25

From: Huacai Chen <chenhuacai(a)loongson.cn> stable inclusion from stable-v4.19-325 commit 8fbb57eabfc8ae67115cb47f904614c99d626a89 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEADR CVE: CVE-2022-49034 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3c891f7c6a4e90bb1199497552f24b26e46383bc upstream. When CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are selected, cpu_max_bits_warn() generates a runtime warning similar as below when showing /proc/cpuinfo. Fix this by using nr_cpu_ids (the runtime limit) instead of NR_CPUS to iterate CPUs. [ 3.052463] ------------[ cut here ]------------ [ 3.059679] WARNING: CPU: 3 PID: 1 at include/linux/cpumask.h:108 show_cpuinfo+0x5e8/0x5f0 [ 3.070072] Modules linked in: efivarfs autofs4 [ 3.076257] CPU: 0 PID: 1 Comm: systemd Not tainted 5.19-rc5+ #1052 [ 3.099465] Stack : 9000000100157b08 9000000000f18530 9000000000cf846c 9000000100154000 [ 3.109127] 9000000100157a50 0000000000000000 9000000100157a58 9000000000ef7430 [ 3.118774] 90000001001578e8 0000000000000040 0000000000000020 ffffffffffffffff [ 3.128412] 0000000000aaaaaa 1ab25f00eec96a37 900000010021de80 900000000101c890 [ 3.138056] 0000000000000000 0000000000000000 0000000000000000 0000000000aaaaaa [ 3.147711] ffff8000339dc220 0000000000000001 0000000006ab4000 0000000000000000 [ 3.157364] 900000000101c998 0000000000000004 9000000000ef7430 0000000000000000 [ 3.167012] 0000000000000009 000000000000006c 0000000000000000 0000000000000000 [ 3.176641] 9000000000d3de08 9000000001639390 90000000002086d8 00007ffff0080286 [ 3.186260] 00000000000000b0 0000000000000004 0000000000000000 0000000000071c1c [ 3.195868] ... [ 3.199917] Call Trace: [ 3.203941] [<90000000002086d8>] show_stack+0x38/0x14c [ 3.210666] [<9000000000cf846c>] dump_stack_lvl+0x60/0x88 [ 3.217625] [<900000000023d268>] __warn+0xd0/0x100 [ 3.223958] [<9000000000cf3c90>] warn_slowpath_fmt+0x7c/0xcc [ 3.231150] [<9000000000210220>] show_cpuinfo+0x5e8/0x5f0 [ 3.238080] [<90000000004f578c>] seq_read_iter+0x354/0x4b4 [ 3.245098] [<90000000004c2e90>] new_sync_read+0x17c/0x1c4 [ 3.252114] [<90000000004c5174>] vfs_read+0x138/0x1d0 [ 3.258694] [<90000000004c55f8>] ksys_read+0x70/0x100 [ 3.265265] [<9000000000cfde9c>] do_syscall+0x7c/0x94 [ 3.271820] [<9000000000202fe4>] handle_syscall+0xc4/0x160 [ 3.281824] ---[ end trace 8b484262b4b8c24c ]--- Cc: stable(a)vger.kernel.org Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Reviewed-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> Tested-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> Signed-off-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- arch/sh/kernel/cpu/proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/sh/kernel/cpu/proc.c b/arch/sh/kernel/cpu/proc.c index 85961b4f9c69..136b4aefd73b 100644 --- a/arch/sh/kernel/cpu/proc.c +++ b/arch/sh/kernel/cpu/proc.c @@ -133,7 +133,7 @@ static int show_cpuinfo(struct seq_file *m, void *v) static void *c_start(struct seq_file *m, loff_t *pos) { - return *pos < NR_CPUS ? cpu_data + *pos : NULL; + return *pos < nr_cpu_ids ? cpu_data + *pos : NULL; } static void *c_next(struct seq_file *m, void *v, loff_t *pos) { -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
by Liu Chuang 02 Jan '25

02 Jan '25

From: Huacai Chen <chenhuacai(a)loongson.cn> stable inclusion from stable-v5.10.231 commit 77755dc95ff2f9a3e473acc1e039f498629949ea category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEADR CVE: CVE-2022-49034 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3c891f7c6a4e90bb1199497552f24b26e46383bc upstream. When CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are selected, cpu_max_bits_warn() generates a runtime warning similar as below when showing /proc/cpuinfo. Fix this by using nr_cpu_ids (the runtime limit) instead of NR_CPUS to iterate CPUs. [ 3.052463] ------------[ cut here ]------------ [ 3.059679] WARNING: CPU: 3 PID: 1 at include/linux/cpumask.h:108 show_cpuinfo+0x5e8/0x5f0 [ 3.070072] Modules linked in: efivarfs autofs4 [ 3.076257] CPU: 0 PID: 1 Comm: systemd Not tainted 5.19-rc5+ #1052 [ 3.099465] Stack : 9000000100157b08 9000000000f18530 9000000000cf846c 9000000100154000 [ 3.109127] 9000000100157a50 0000000000000000 9000000100157a58 9000000000ef7430 [ 3.118774] 90000001001578e8 0000000000000040 0000000000000020 ffffffffffffffff [ 3.128412] 0000000000aaaaaa 1ab25f00eec96a37 900000010021de80 900000000101c890 [ 3.138056] 0000000000000000 0000000000000000 0000000000000000 0000000000aaaaaa [ 3.147711] ffff8000339dc220 0000000000000001 0000000006ab4000 0000000000000000 [ 3.157364] 900000000101c998 0000000000000004 9000000000ef7430 0000000000000000 [ 3.167012] 0000000000000009 000000000000006c 0000000000000000 0000000000000000 [ 3.176641] 9000000000d3de08 9000000001639390 90000000002086d8 00007ffff0080286 [ 3.186260] 00000000000000b0 0000000000000004 0000000000000000 0000000000071c1c [ 3.195868] ... [ 3.199917] Call Trace: [ 3.203941] [<90000000002086d8>] show_stack+0x38/0x14c [ 3.210666] [<9000000000cf846c>] dump_stack_lvl+0x60/0x88 [ 3.217625] [<900000000023d268>] __warn+0xd0/0x100 [ 3.223958] [<9000000000cf3c90>] warn_slowpath_fmt+0x7c/0xcc [ 3.231150] [<9000000000210220>] show_cpuinfo+0x5e8/0x5f0 [ 3.238080] [<90000000004f578c>] seq_read_iter+0x354/0x4b4 [ 3.245098] [<90000000004c2e90>] new_sync_read+0x17c/0x1c4 [ 3.252114] [<90000000004c5174>] vfs_read+0x138/0x1d0 [ 3.258694] [<90000000004c55f8>] ksys_read+0x70/0x100 [ 3.265265] [<9000000000cfde9c>] do_syscall+0x7c/0x94 [ 3.271820] [<9000000000202fe4>] handle_syscall+0xc4/0x160 [ 3.281824] ---[ end trace 8b484262b4b8c24c ]--- Cc: stable(a)vger.kernel.org Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Reviewed-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> Tested-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> Signed-off-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- arch/sh/kernel/cpu/proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/sh/kernel/cpu/proc.c b/arch/sh/kernel/cpu/proc.c index a306bcd6b341..5f6d0e827bae 100644 --- a/arch/sh/kernel/cpu/proc.c +++ b/arch/sh/kernel/cpu/proc.c @@ -132,7 +132,7 @@ static int show_cpuinfo(struct seq_file *m, void *v) static void *c_start(struct seq_file *m, loff_t *pos) { - return *pos < NR_CPUS ? cpu_data + *pos : NULL; + return *pos < nr_cpu_ids ? cpu_data + *pos : NULL; } static void *c_next(struct seq_file *m, void *v, loff_t *pos) { -- 2.34.1

2 1

[PATCH OLK-5.10] sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
by Liu Chuang 02 Jan '25

02 Jan '25

From: Huacai Chen <chenhuacai(a)loongson.cn> stable inclusion from stable-v5.10.231 commit 77755dc95ff2f9a3e473acc1e039f498629949ea category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEADR CVE: CVE-2022-49034 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3c891f7c6a4e90bb1199497552f24b26e46383bc upstream. When CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are selected, cpu_max_bits_warn() generates a runtime warning similar as below when showing /proc/cpuinfo. Fix this by using nr_cpu_ids (the runtime limit) instead of NR_CPUS to iterate CPUs. [ 3.052463] ------------[ cut here ]------------ [ 3.059679] WARNING: CPU: 3 PID: 1 at include/linux/cpumask.h:108 show_cpuinfo+0x5e8/0x5f0 [ 3.070072] Modules linked in: efivarfs autofs4 [ 3.076257] CPU: 0 PID: 1 Comm: systemd Not tainted 5.19-rc5+ #1052 [ 3.099465] Stack : 9000000100157b08 9000000000f18530 9000000000cf846c 9000000100154000 [ 3.109127] 9000000100157a50 0000000000000000 9000000100157a58 9000000000ef7430 [ 3.118774] 90000001001578e8 0000000000000040 0000000000000020 ffffffffffffffff [ 3.128412] 0000000000aaaaaa 1ab25f00eec96a37 900000010021de80 900000000101c890 [ 3.138056] 0000000000000000 0000000000000000 0000000000000000 0000000000aaaaaa [ 3.147711] ffff8000339dc220 0000000000000001 0000000006ab4000 0000000000000000 [ 3.157364] 900000000101c998 0000000000000004 9000000000ef7430 0000000000000000 [ 3.167012] 0000000000000009 000000000000006c 0000000000000000 0000000000000000 [ 3.176641] 9000000000d3de08 9000000001639390 90000000002086d8 00007ffff0080286 [ 3.186260] 00000000000000b0 0000000000000004 0000000000000000 0000000000071c1c [ 3.195868] ... [ 3.199917] Call Trace: [ 3.203941] [<90000000002086d8>] show_stack+0x38/0x14c [ 3.210666] [<9000000000cf846c>] dump_stack_lvl+0x60/0x88 [ 3.217625] [<900000000023d268>] __warn+0xd0/0x100 [ 3.223958] [<9000000000cf3c90>] warn_slowpath_fmt+0x7c/0xcc [ 3.231150] [<9000000000210220>] show_cpuinfo+0x5e8/0x5f0 [ 3.238080] [<90000000004f578c>] seq_read_iter+0x354/0x4b4 [ 3.245098] [<90000000004c2e90>] new_sync_read+0x17c/0x1c4 [ 3.252114] [<90000000004c5174>] vfs_read+0x138/0x1d0 [ 3.258694] [<90000000004c55f8>] ksys_read+0x70/0x100 [ 3.265265] [<9000000000cfde9c>] do_syscall+0x7c/0x94 [ 3.271820] [<9000000000202fe4>] handle_syscall+0xc4/0x160 [ 3.281824] ---[ end trace 8b484262b4b8c24c ]--- Cc: stable(a)vger.kernel.org Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Reviewed-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> Tested-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> Signed-off-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- arch/sh/kernel/cpu/proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/sh/kernel/cpu/proc.c b/arch/sh/kernel/cpu/proc.c index a306bcd6b341..5f6d0e827bae 100644 --- a/arch/sh/kernel/cpu/proc.c +++ b/arch/sh/kernel/cpu/proc.c @@ -132,7 +132,7 @@ static int show_cpuinfo(struct seq_file *m, void *v) static void *c_start(struct seq_file *m, loff_t *pos) { - return *pos < NR_CPUS ? cpu_data + *pos : NULL; + return *pos < nr_cpu_ids ? cpu_data + *pos : NULL; } static void *c_next(struct seq_file *m, void *v, loff_t *pos) { -- 2.34.1

2 1

[PATCH OLK-6.6] sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
by Liu Chuang 02 Jan '25

02 Jan '25

From: Huacai Chen <chenhuacai(a)loongson.cn> stable inclusion from stable-v6.6.64 commit 09faf32c682ea4a547200b8b9e04d8b3c8e84b55 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEADR CVE: CVE-2022-49034 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3c891f7c6a4e90bb1199497552f24b26e46383bc upstream. When CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are selected, cpu_max_bits_warn() generates a runtime warning similar as below when showing /proc/cpuinfo. Fix this by using nr_cpu_ids (the runtime limit) instead of NR_CPUS to iterate CPUs. [ 3.052463] ------------[ cut here ]------------ [ 3.059679] WARNING: CPU: 3 PID: 1 at include/linux/cpumask.h:108 show_cpuinfo+0x5e8/0x5f0 [ 3.070072] Modules linked in: efivarfs autofs4 [ 3.076257] CPU: 0 PID: 1 Comm: systemd Not tainted 5.19-rc5+ #1052 [ 3.099465] Stack : 9000000100157b08 9000000000f18530 9000000000cf846c 9000000100154000 [ 3.109127] 9000000100157a50 0000000000000000 9000000100157a58 9000000000ef7430 [ 3.118774] 90000001001578e8 0000000000000040 0000000000000020 ffffffffffffffff [ 3.128412] 0000000000aaaaaa 1ab25f00eec96a37 900000010021de80 900000000101c890 [ 3.138056] 0000000000000000 0000000000000000 0000000000000000 0000000000aaaaaa [ 3.147711] ffff8000339dc220 0000000000000001 0000000006ab4000 0000000000000000 [ 3.157364] 900000000101c998 0000000000000004 9000000000ef7430 0000000000000000 [ 3.167012] 0000000000000009 000000000000006c 0000000000000000 0000000000000000 [ 3.176641] 9000000000d3de08 9000000001639390 90000000002086d8 00007ffff0080286 [ 3.186260] 00000000000000b0 0000000000000004 0000000000000000 0000000000071c1c [ 3.195868] ... [ 3.199917] Call Trace: [ 3.203941] [<90000000002086d8>] show_stack+0x38/0x14c [ 3.210666] [<9000000000cf846c>] dump_stack_lvl+0x60/0x88 [ 3.217625] [<900000000023d268>] __warn+0xd0/0x100 [ 3.223958] [<9000000000cf3c90>] warn_slowpath_fmt+0x7c/0xcc [ 3.231150] [<9000000000210220>] show_cpuinfo+0x5e8/0x5f0 [ 3.238080] [<90000000004f578c>] seq_read_iter+0x354/0x4b4 [ 3.245098] [<90000000004c2e90>] new_sync_read+0x17c/0x1c4 [ 3.252114] [<90000000004c5174>] vfs_read+0x138/0x1d0 [ 3.258694] [<90000000004c55f8>] ksys_read+0x70/0x100 [ 3.265265] [<9000000000cfde9c>] do_syscall+0x7c/0x94 [ 3.271820] [<9000000000202fe4>] handle_syscall+0xc4/0x160 [ 3.281824] ---[ end trace 8b484262b4b8c24c ]--- Cc: stable(a)vger.kernel.org Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Reviewed-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> Tested-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> Signed-off-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- arch/sh/kernel/cpu/proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/sh/kernel/cpu/proc.c b/arch/sh/kernel/cpu/proc.c index a306bcd6b341..5f6d0e827bae 100644 --- a/arch/sh/kernel/cpu/proc.c +++ b/arch/sh/kernel/cpu/proc.c @@ -132,7 +132,7 @@ static int show_cpuinfo(struct seq_file *m, void *v) static void *c_start(struct seq_file *m, loff_t *pos) { - return *pos < NR_CPUS ? cpu_data + *pos : NULL; + return *pos < nr_cpu_ids ? cpu_data + *pos : NULL; } static void *c_next(struct seq_file *m, void *v, loff_t *pos) { -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] cgroup: Fix potential overflow issue when checking max_depth
by Chen Ridong 02 Jan '25

02 Jan '25

From: Xiu Jianfeng <xiujianfeng(a)huawei.com> stable inclusion from stable-v5.10.229 commit ffbb1f15bae7619be8939566f447de1e0b021c38 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBF69F Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3cc4e13bb1617f6a13e5e6882465984148743cf4 ] cgroup.max.depth is the maximum allowed descent depth below the current cgroup. If the actual descent depth is equal or larger, an attempt to create a new child cgroup will fail. However due to the cgroup->max_depth is of int type and having the default value INT_MAX, the condition 'level > cgroup->max_depth' will never be satisfied, and it will cause an overflow of the level after it reaches to INT_MAX. Fix it by starting the level from 0 and using '>=' instead. It's worth mentioning that this issue is unlikely to occur in reality, as it's impossible to have a depth of INT_MAX hierarchy, but should be be avoided logically. Fixes: 1a926e0bbab8 ("cgroup: implement hierarchy limits") Signed-off-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Michal Koutný <mkoutny(a)suse.com> Signed-off-by: Tejun Heo <tj(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Ridong <chenridong(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> --- kernel/cgroup/cgroup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index 1fb98d4dff48..22d39f82a0aa 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -5623,7 +5623,7 @@ static bool cgroup_check_hierarchy_limits(struct cgroup *parent) { struct cgroup *cgroup; int ret = false; - int level = 1; + int level = 0; lockdep_assert_held(&cgroup_mutex); @@ -5631,7 +5631,7 @@ static bool cgroup_check_hierarchy_limits(struct cgroup *parent) if (cgroup->nr_descendants >= cgroup->max_descendants) goto fail; - if (level > cgroup->max_depth) + if (level >= cgroup->max_depth) goto fail; level++; -- 2.34.1

2 1

[PATCH OLK-5.10] cgroup: Fix potential overflow issue when checking max_depth
by Chen Ridong 02 Jan '25

02 Jan '25

From: Xiu Jianfeng <xiujianfeng(a)huawei.com> stable inclusion from stable-v5.10.229 commit ffbb1f15bae7619be8939566f447de1e0b021c38 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBF69F Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3cc4e13bb1617f6a13e5e6882465984148743cf4 ] cgroup.max.depth is the maximum allowed descent depth below the current cgroup. If the actual descent depth is equal or larger, an attempt to create a new child cgroup will fail. However due to the cgroup->max_depth is of int type and having the default value INT_MAX, the condition 'level > cgroup->max_depth' will never be satisfied, and it will cause an overflow of the level after it reaches to INT_MAX. Fix it by starting the level from 0 and using '>=' instead. It's worth mentioning that this issue is unlikely to occur in reality, as it's impossible to have a depth of INT_MAX hierarchy, but should be be avoided logically. Fixes: 1a926e0bbab8 ("cgroup: implement hierarchy limits") Signed-off-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Michal Koutný <mkoutny(a)suse.com> Signed-off-by: Tejun Heo <tj(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Ridong <chenridong(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> --- kernel/cgroup/cgroup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index 1fb98d4dff48..22d39f82a0aa 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -5623,7 +5623,7 @@ static bool cgroup_check_hierarchy_limits(struct cgroup *parent) { struct cgroup *cgroup; int ret = false; - int level = 1; + int level = 0; lockdep_assert_held(&cgroup_mutex); @@ -5631,7 +5631,7 @@ static bool cgroup_check_hierarchy_limits(struct cgroup *parent) if (cgroup->nr_descendants >= cgroup->max_descendants) goto fail; - if (level > cgroup->max_depth) + if (level >= cgroup->max_depth) goto fail; level++; -- 2.34.1

2 1

[PATCH OLK-5.10] f2fs: fix race in concurrent f2fs_stop_gc_thread
by Cai Xinchen 02 Jan '25

02 Jan '25

From: Long Li <leo.lilong(a)huawei.com> stable inclusion from stable-v6.6.64 commit 794fa8792d4eacac191f1cbcc2e81b7369e4662a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAES CVE: CVE-2024-53218 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7b0033dbc48340a1c1c3f12448ba17d6587ca092 ] In my test case, concurrent calls to f2fs shutdown report the following stack trace: Oops: general protection fault, probably for non-canonical address 0xc6cfff63bb5513fc: 0000 [#1] PREEMPT SMP PTI CPU: 0 UID: 0 PID: 678 Comm: f2fs_rep_shutdo Not tainted 6.12.0-rc5-next-20241029-g6fb2fa9805c5-dirty #85 Call Trace: <TASK> ? show_regs+0x8b/0xa0 ? __die_body+0x26/0xa0 ? die_addr+0x54/0x90 ? exc_general_protection+0x24b/0x5c0 ? asm_exc_general_protection+0x26/0x30 ? kthread_stop+0x46/0x390 f2fs_stop_gc_thread+0x6c/0x110 f2fs_do_shutdown+0x309/0x3a0 f2fs_ioc_shutdown+0x150/0x1c0 __f2fs_ioctl+0xffd/0x2ac0 f2fs_ioctl+0x76/0xe0 vfs_ioctl+0x23/0x60 __x64_sys_ioctl+0xce/0xf0 x64_sys_call+0x2b1b/0x4540 do_syscall_64+0xa7/0x240 entry_SYSCALL_64_after_hwframe+0x76/0x7e The root cause is a race condition in f2fs_stop_gc_thread() called from different f2fs shutdown paths: [CPU0] [CPU1] ---------------------- ----------------------- f2fs_stop_gc_thread f2fs_stop_gc_thread gc_th = sbi->gc_thread gc_th = sbi->gc_thread kfree(gc_th) sbi->gc_thread = NULL < gc_th != NULL > kthread_stop(gc_th->f2fs_gc_task) //UAF The commit c7f114d864ac ("f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()") attempted to fix this issue by using a read semaphore to prevent races between shutdown and remount threads, but it fails to prevent all race conditions. Fix it by converting to write lock of s_umount in f2fs_do_shutdown(). Fixes: 7950e9ac638e ("f2fs: stop gc/discard thread after fs shutdown") Signed-off-by: Long Li <leo.lilong(a)huawei.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/f2fs/file.c [Becuase the commit c7f114d864ac91515bb07ac271e9824a20f5ed95("f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()") conflicts, there is no need_lock check] Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- fs/f2fs/file.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c index d097d0793560..4269c348fe0b 100644 --- a/fs/f2fs/file.c +++ b/fs/f2fs/file.c @@ -2309,8 +2309,11 @@ static int f2fs_ioc_shutdown(struct file *filp, unsigned long arg) goto out; } - /* grab sb->s_umount to avoid racing w/ remount() */ - down_read(&sbi->sb->s_umount); + /* + * grab sb->s_umount to avoid racing w/ remount() and other shutdown + * paths. + */ + down_write(&sbi->sb->s_umount); f2fs_stop_gc_thread(sbi); f2fs_stop_discard_thread(sbi); @@ -2318,7 +2321,7 @@ static int f2fs_ioc_shutdown(struct file *filp, unsigned long arg) f2fs_drop_discard_cmd(sbi); clear_opt(sbi, DISCARD); - up_read(&sbi->sb->s_umount); + up_write(&sbi->sb->s_umount); f2fs_update_time(sbi, REQ_TIME); out: -- 2.34.1

2 1

[PATCH OLK-6.6] f2fs: fix race in concurrent f2fs_stop_gc_thread
by Cai Xinchen 02 Jan '25

02 Jan '25

From: Long Li <leo.lilong(a)huawei.com> stable inclusion from stable-v6.6.64 commit 794fa8792d4eacac191f1cbcc2e81b7369e4662a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAES CVE: CVE-2024-53218 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7b0033dbc48340a1c1c3f12448ba17d6587ca092 ] In my test case, concurrent calls to f2fs shutdown report the following stack trace: Oops: general protection fault, probably for non-canonical address 0xc6cfff63bb5513fc: 0000 [#1] PREEMPT SMP PTI CPU: 0 UID: 0 PID: 678 Comm: f2fs_rep_shutdo Not tainted 6.12.0-rc5-next-20241029-g6fb2fa9805c5-dirty #85 Call Trace: <TASK> ? show_regs+0x8b/0xa0 ? __die_body+0x26/0xa0 ? die_addr+0x54/0x90 ? exc_general_protection+0x24b/0x5c0 ? asm_exc_general_protection+0x26/0x30 ? kthread_stop+0x46/0x390 f2fs_stop_gc_thread+0x6c/0x110 f2fs_do_shutdown+0x309/0x3a0 f2fs_ioc_shutdown+0x150/0x1c0 __f2fs_ioctl+0xffd/0x2ac0 f2fs_ioctl+0x76/0xe0 vfs_ioctl+0x23/0x60 __x64_sys_ioctl+0xce/0xf0 x64_sys_call+0x2b1b/0x4540 do_syscall_64+0xa7/0x240 entry_SYSCALL_64_after_hwframe+0x76/0x7e The root cause is a race condition in f2fs_stop_gc_thread() called from different f2fs shutdown paths: [CPU0] [CPU1] ---------------------- ----------------------- f2fs_stop_gc_thread f2fs_stop_gc_thread gc_th = sbi->gc_thread gc_th = sbi->gc_thread kfree(gc_th) sbi->gc_thread = NULL < gc_th != NULL > kthread_stop(gc_th->f2fs_gc_task) //UAF The commit c7f114d864ac ("f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()") attempted to fix this issue by using a read semaphore to prevent races between shutdown and remount threads, but it fails to prevent all race conditions. Fix it by converting to write lock of s_umount in f2fs_do_shutdown(). Fixes: 7950e9ac638e ("f2fs: stop gc/discard thread after fs shutdown") Signed-off-by: Long Li <leo.lilong(a)huawei.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- fs/f2fs/file.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c index 60e72320e80f..877a1109ed76 100644 --- a/fs/f2fs/file.c +++ b/fs/f2fs/file.c @@ -2321,9 +2321,12 @@ int f2fs_do_shutdown(struct f2fs_sb_info *sbi, unsigned int flag, if (readonly) goto out; - /* grab sb->s_umount to avoid racing w/ remount() */ + /* + * grab sb->s_umount to avoid racing w/ remount() and other shutdown + * paths. + */ if (need_lock) - down_read(&sbi->sb->s_umount); + down_write(&sbi->sb->s_umount); f2fs_stop_gc_thread(sbi); f2fs_stop_discard_thread(sbi); @@ -2332,7 +2335,7 @@ int f2fs_do_shutdown(struct f2fs_sb_info *sbi, unsigned int flag, clear_opt(sbi, DISCARD); if (need_lock) - up_read(&sbi->sb->s_umount); + up_write(&sbi->sb->s_umount); f2fs_update_time(sbi, REQ_TIME); out: -- 2.34.1

2 1

[PATCH OLK-6.6] drm/vc4: hdmi: Avoid hang with debug registers when suspended
by Liu Chuang 02 Jan '25

02 Jan '25

From: Dom Cobley <popcornmix(a)gmail.com> stable inclusion from stable-v6.6.64 commit c7d474974954d9af7e0092021223d58f2de128df category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDP5 CVE: CVE-2024-56683 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 223ee2567a55e4f80315c768d2969e6a3b9fb23d ] Trying to read /sys/kernel/debug/dri/1/hdmi1_regs when the hdmi is disconnected results in a fatal system hang. This is due to the pm suspend code disabling the dvp clock. That is just a gate of the 108MHz clock in DVP_HT_RPI_MISC_CONFIG, which results in accesses hanging AXI bus. Protect against this. Fixes: 25eb441d55d4 ("drm/vc4: hdmi: Add all the vc5 HDMI registers into the debugfs dumps") Signed-off-by: Dom Cobley <popcornmix(a)gmail.com> Reviewed-by: Maxime Ripard <mripard(a)kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-17-dav… Signed-off-by: Dave Stevenson <dave.stevenson(a)raspberrypi.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/vc4/vc4_hdmi.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c index c6e986f71a26..d4487f4cb303 100644 --- a/drivers/gpu/drm/vc4/vc4_hdmi.c +++ b/drivers/gpu/drm/vc4/vc4_hdmi.c @@ -179,6 +179,8 @@ static int vc4_hdmi_debugfs_regs(struct seq_file *m, void *unused) if (!drm_dev_enter(drm, &idx)) return -ENODEV; + WARN_ON(pm_runtime_resume_and_get(&vc4_hdmi->pdev->dev)); + drm_print_regset32(&p, &vc4_hdmi->hdmi_regset); drm_print_regset32(&p, &vc4_hdmi->hd_regset); drm_print_regset32(&p, &vc4_hdmi->cec_regset); @@ -188,6 +190,8 @@ static int vc4_hdmi_debugfs_regs(struct seq_file *m, void *unused) drm_print_regset32(&p, &vc4_hdmi->ram_regset); drm_print_regset32(&p, &vc4_hdmi->rm_regset); + pm_runtime_put(&vc4_hdmi->pdev->dev); + drm_dev_exit(idx); return 0; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] RDMA/hns: Fix cpu stuck caused by printings during reset
by Tengda Wu 02 Jan '25

02 Jan '25

From: wenglianfa <wenglianfa(a)huawei.com> mainline inclusion from mainline-v6.13-rc1 commit 323275ac2ff15b2b7b3eac391ae5d8c5a3c3a999 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEGGK CVE: CVE-2024-56722 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- During reset, cmd to destroy resources such as qp, cq, and mr may fail, and error logs will be printed. When a large number of resources are destroyed, there will be lots of printings, and it may lead to a cpu stuck. Delete some unnecessary printings and replace other printing functions in these paths with the ratelimited version. Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver") Fixes: c7bcb13442e1 ("RDMA/hns: Add SRQ support for hip08 kernel mode") Fixes: 70f92521584f ("RDMA/hns: Use the reserved loopback QPs to free MR before destroying MPT") Fixes: 926a01dc000d ("RDMA/hns: Add QP operations support for hip08 SoC") Signed-off-by: wenglianfa <wenglianfa(a)huawei.com> Signed-off-by: Junxian Huang <huangjunxian6(a)hisilicon.com> Link: https://patch.msgid.link/20241024124000.2931869-6-huangjunxian6@hisilicon.c… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Conflicts: drivers/infiniband/hw/hns/hns_roce_hw_v2.c [This is due to we did not backport the cleanup patch b9989ab3f61e ("RDMA/hns: Remove unnecessary QP type checks")] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- drivers/infiniband/hw/hns/hns_roce_cq.c | 4 +- drivers/infiniband/hw/hns/hns_roce_hem.c | 4 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 74 +++++++++++----------- drivers/infiniband/hw/hns/hns_roce_mr.c | 4 +- drivers/infiniband/hw/hns/hns_roce_srq.c | 4 +- 5 files changed, 46 insertions(+), 44 deletions(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_cq.c b/drivers/infiniband/hw/hns/hns_roce_cq.c index 01a18fbc5525..2045bd3db831 100644 --- a/drivers/infiniband/hw/hns/hns_roce_cq.c +++ b/drivers/infiniband/hw/hns/hns_roce_cq.c @@ -180,8 +180,8 @@ static void free_cqc(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq) ret = hns_roce_destroy_hw_ctx(hr_dev, HNS_ROCE_CMD_DESTROY_CQC, hr_cq->cqn); if (ret) - dev_err(dev, "DESTROY_CQ failed (%d) for CQN %06lx\n", ret, - hr_cq->cqn); + dev_err_ratelimited(dev, "DESTROY_CQ failed (%d) for CQN %06lx\n", + ret, hr_cq->cqn); xa_erase_irq(&cq_table->array, hr_cq->cqn); diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c index f21358515bf9..9a24a3a68e8e 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hem.c +++ b/drivers/infiniband/hw/hns/hns_roce_hem.c @@ -713,8 +713,8 @@ void hns_roce_table_put(struct hns_roce_dev *hr_dev, ret = hr_dev->hw->clear_hem(hr_dev, table, obj, HEM_HOP_STEP_DIRECT); if (ret) - dev_warn(dev, "failed to clear HEM base address, ret = %d.\n", - ret); + dev_warn_ratelimited(dev, "failed to clear HEM base address, ret = %d.\n", + ret); hns_roce_free_hem(hr_dev, table->hem[i]); table->hem[i] = NULL; diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c index fa958ea9c569..21ff5ccde4ae 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c @@ -451,19 +451,21 @@ static int check_send_valid(struct hns_roce_dev *hr_dev, } else if (unlikely(hr_qp->state == IB_QPS_RESET || hr_qp->state == IB_QPS_INIT || hr_qp->state == IB_QPS_RTR)) { - ibdev_err(ibdev, "failed to post WQE, QP state %u!\n", - hr_qp->state); + ibdev_err_ratelimited(ibdev, + "failed to post WQE, QP state %u!\n", + hr_qp->state); return -EINVAL; } else if (unlikely(hr_dev->state >= HNS_ROCE_DEVICE_STATE_RST_DOWN)) { - ibdev_err(ibdev, "failed to post WQE, dev state %d!\n", - hr_dev->state); + ibdev_err_ratelimited(ibdev, + "failed to post WQE, dev state %d!\n", + hr_dev->state); return -EIO; } if (check_dca_attach_enable(hr_qp)) { ret = dca_attach_qp_buf(hr_dev, hr_qp); if (unlikely(ret)) { - ibdev_err(&hr_dev->ib_dev, + ibdev_err_ratelimited(&hr_dev->ib_dev, "failed to attach DCA for QP-%ld send!\n", hr_qp->qpn); return ret; @@ -3027,8 +3029,8 @@ static int free_mr_modify_rsv_qp(struct hns_roce_dev *hr_dev, ret = hr_dev->hw->modify_qp(&hr_qp->ibqp, attr, mask, IB_QPS_INIT, IB_QPS_INIT, NULL); if (ret) { - ibdev_err(ibdev, "failed to modify qp to init, ret = %d.\n", - ret); + ibdev_err_ratelimited(ibdev, "failed to modify qp to init, ret = %d.\n", + ret); return ret; } @@ -3716,8 +3718,8 @@ static int free_mr_post_send_lp_wqe(struct hns_roce_qp *hr_qp) ret = hns_roce_v2_post_send(&hr_qp->ibqp, send_wr, &bad_wr); if (ret) { - ibdev_err(ibdev, "failed to post wqe for free mr, ret = %d.\n", - ret); + ibdev_err_ratelimited(ibdev, "failed to post wqe for free mr, ret = %d.\n", + ret); return ret; } @@ -3756,9 +3758,9 @@ static void free_mr_send_cmd_to_hw(struct hns_roce_dev *hr_dev) ret = free_mr_post_send_lp_wqe(hr_qp); if (ret) { - ibdev_err(ibdev, - "failed to send wqe (qp:0x%lx) for free mr, ret = %d.\n", - hr_qp->qpn, ret); + ibdev_err_ratelimited(ibdev, + "failed to send wqe (qp:0x%lx) for free mr, ret = %d.\n", + hr_qp->qpn, ret); break; } @@ -3769,16 +3771,16 @@ static void free_mr_send_cmd_to_hw(struct hns_roce_dev *hr_dev) while (cqe_cnt) { npolled = hns_roce_v2_poll_cq(&free_mr->rsv_cq->ib_cq, cqe_cnt, wc); if (npolled < 0) { - ibdev_err(ibdev, - "failed to poll cqe for free mr, remain %d cqe.\n", - cqe_cnt); + ibdev_err_ratelimited(ibdev, + "failed to poll cqe for free mr, remain %d cqe.\n", + cqe_cnt); goto out; } if (time_after(jiffies, end)) { - ibdev_err(ibdev, - "failed to poll cqe for free mr and timeout, remain %d cqe.\n", - cqe_cnt); + ibdev_err_ratelimited(ibdev, + "failed to poll cqe for free mr and timeout, remain %d cqe.\n", + cqe_cnt); goto out; } cqe_cnt -= npolled; @@ -5387,10 +5389,8 @@ static int hns_roce_v2_set_abs_fields(struct ib_qp *ibqp, struct hns_roce_dev *hr_dev = to_hr_dev(ibqp->device); int ret = 0; - if (!check_qp_state(cur_state, new_state)) { - ibdev_err(&hr_dev->ib_dev, "Illegal state for QP!\n"); + if (!check_qp_state(cur_state, new_state)) return -EINVAL; - } if (cur_state == IB_QPS_RESET && new_state == IB_QPS_INIT) { memset(qpc_mask, 0, hr_dev->caps.qpc_sz); @@ -5652,7 +5652,7 @@ static int hns_roce_v2_modify_qp(struct ib_qp *ibqp, /* SW pass context to HW */ ret = hns_roce_v2_qp_modify(hr_dev, context, qpc_mask, hr_qp); if (ret) { - ibdev_err(ibdev, "failed to modify QP, ret = %d.\n", ret); + ibdev_err_ratelimited(ibdev, "failed to modify QP, ret = %d.\n", ret); goto out; } @@ -5777,7 +5777,9 @@ static int hns_roce_v2_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr, ret = hns_roce_v2_query_qpc(hr_dev, hr_qp->qpn, &context); if (ret) { - ibdev_err(ibdev, "failed to query QPC, ret = %d.\n", ret); + ibdev_err_ratelimited(ibdev, + "failed to query QPC, ret = %d.\n", + ret); ret = -EINVAL; goto out; } @@ -5785,7 +5787,7 @@ static int hns_roce_v2_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr, state = hr_reg_read(&context, QPC_QP_ST); tmp_qp_state = to_ib_qp_st((enum hns_roce_v2_qp_state)state); if (tmp_qp_state == -1) { - ibdev_err(ibdev, "Illegal ib_qp_state\n"); + ibdev_err_ratelimited(ibdev, "Illegal ib_qp_state\n"); ret = -EINVAL; goto out; } @@ -5911,9 +5913,9 @@ int hns_roce_v2_destroy_qp_common(struct hns_roce_dev *hr_dev, ret = hns_roce_v2_modify_qp(&hr_qp->ibqp, NULL, 0, hr_qp->state, IB_QPS_RESET, udata); if (ret) - ibdev_err(ibdev, - "failed to modify QP to RST, ret = %d.\n", - ret); + ibdev_err_ratelimited(ibdev, + "failed to modify QP to RST, ret = %d.\n", + ret); } send_cq = hr_qp->ibqp.send_cq ? to_hr_cq(hr_qp->ibqp.send_cq) : NULL; @@ -5949,9 +5951,9 @@ int hns_roce_v2_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata) ret = hns_roce_v2_destroy_qp_common(hr_dev, hr_qp, udata); if (ret) - ibdev_err(&hr_dev->ib_dev, - "failed to destroy QP, QPN = 0x%06lx, ret = %d.\n", - hr_qp->qpn, ret); + ibdev_err_ratelimited(&hr_dev->ib_dev, + "failed to destroy QP, QPN = 0x%06lx, ret = %d.\n", + hr_qp->qpn, ret); hns_roce_qp_destroy(hr_dev, hr_qp, udata); @@ -6224,9 +6226,9 @@ static int hns_roce_v2_modify_cq(struct ib_cq *cq, u16 cq_count, u16 cq_period) HNS_ROCE_CMD_MODIFY_CQC, hr_cq->cqn); hns_roce_free_cmd_mailbox(hr_dev, mailbox); if (ret) - ibdev_err(&hr_dev->ib_dev, - "failed to process cmd when modifying CQ, ret = %d.\n", - ret); + ibdev_err_ratelimited(&hr_dev->ib_dev, + "failed to process cmd when modifying CQ, ret = %d.\n", + ret); return ret; } @@ -6246,9 +6248,9 @@ static int hns_roce_v2_query_cqc(struct hns_roce_dev *hr_dev, u32 cqn, ret = hns_roce_cmd_mbox(hr_dev, 0, mailbox->dma, HNS_ROCE_CMD_QUERY_CQC, cqn); if (ret) { - ibdev_err(&hr_dev->ib_dev, - "failed to process cmd when querying CQ, ret = %d.\n", - ret); + ibdev_err_ratelimited(&hr_dev->ib_dev, + "failed to process cmd when querying CQ, ret = %d.\n", + ret); goto err_mailbox; } diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c index 5c11bb22facc..09ef095524da 100644 --- a/drivers/infiniband/hw/hns/hns_roce_mr.c +++ b/drivers/infiniband/hw/hns/hns_roce_mr.c @@ -136,8 +136,8 @@ static void hns_roce_mr_free(struct hns_roce_dev *hr_dev, struct hns_roce_mr *mr key_to_hw_index(mr->key) & (hr_dev->caps.num_mtpts - 1)); if (ret) - ibdev_warn(ibdev, "failed to destroy mpt, ret = %d.\n", - ret); + ibdev_warn_ratelimited(ibdev, "failed to destroy mpt, ret = %d.\n", + ret); } free_mr_pbl(hr_dev, mr); diff --git a/drivers/infiniband/hw/hns/hns_roce_srq.c b/drivers/infiniband/hw/hns/hns_roce_srq.c index a3999fc69719..b004df101e9d 100644 --- a/drivers/infiniband/hw/hns/hns_roce_srq.c +++ b/drivers/infiniband/hw/hns/hns_roce_srq.c @@ -150,8 +150,8 @@ static void free_srqc(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq) ret = hns_roce_destroy_hw_ctx(hr_dev, HNS_ROCE_CMD_DESTROY_SRQ, srq->srqn); if (ret) - dev_err(hr_dev->dev, "DESTROY_SRQ failed (%d) for SRQN %06lx\n", - ret, srq->srqn); + dev_err_ratelimited(hr_dev->dev, "DESTROY_SRQ failed (%d) for SRQN %06lx\n", + ret, srq->srqn); xa_erase_irq(&srq_table->xa, srq->srqn); -- 2.34.1

2 2