- Kernel - mailweb.openeuler.org

[openeuler:OLK-5.10 2284/2284] include/linux/compiler_attributes.h:221:41: warning: attribute 'fallthrough' not preceding a case label or default label
by kernel test robot 04 Nov '24

04 Nov '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: f57c7b292bcdd58fd6816e9636768ef58adf9ff7 commit: 06fcc73ce3f691a693a5bfbca2ba3b490bd25b65 [2284/2284] driver/arm/spe: making mem_sampling and perf mutually exclusive with spe driver config: arm64-randconfig-003-20241029 (https://download.01.org/0day-ci/archive/20241104/202411041220.EBEmz3cz-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241104/202411041220.EBEmz3cz-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411041220.EBEmz3cz-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from include/linux/compiler_types.h:65, from <command-line>: drivers/arm/spe/spe.c: In function '__arm_spe_dev_probe': >> include/linux/compiler_attributes.h:221:41: warning: attribute 'fallthrough' not preceding a case label or default label 221 | # define fallthrough __attribute__((__fallthrough__)) | ^~~~~~~~~~~~~ drivers/arm/spe/spe.c:492:17: note: in expansion of macro 'fallthrough' 492 | fallthrough; | ^~~~~~~~~~~ >> include/linux/compiler_attributes.h:221:41: warning: attribute 'fallthrough' not preceding a case label or default label 221 | # define fallthrough __attribute__((__fallthrough__)) | ^~~~~~~~~~~~~ drivers/arm/spe/spe.c:514:17: note: in expansion of macro 'fallthrough' 514 | fallthrough; | ^~~~~~~~~~~ vim +/fallthrough +221 include/linux/compiler_attributes.h 294f69e662d157 Joe Perches 2019-10-05 209 294f69e662d157 Joe Perches 2019-10-05 210 /* 294f69e662d157 Joe Perches 2019-10-05 211 * Add the pseudo keyword 'fallthrough' so case statement blocks 294f69e662d157 Joe Perches 2019-10-05 212 * must end with any of these keywords: 294f69e662d157 Joe Perches 2019-10-05 213 * break; 294f69e662d157 Joe Perches 2019-10-05 214 * fallthrough; 294f69e662d157 Joe Perches 2019-10-05 215 * goto <label>; 294f69e662d157 Joe Perches 2019-10-05 216 * return [expression]; 294f69e662d157 Joe Perches 2019-10-05 217 * 294f69e662d157 Joe Perches 2019-10-05 218 * gcc: https://gcc.gnu.org/onlinedocs/gcc/Statement-Attributes.html#Statement-Attr… 294f69e662d157 Joe Perches 2019-10-05 219 */ 294f69e662d157 Joe Perches 2019-10-05 220 #if __has_attribute(__fallthrough__) 294f69e662d157 Joe Perches 2019-10-05 @221 # define fallthrough __attribute__((__fallthrough__)) 294f69e662d157 Joe Perches 2019-10-05 222 #else 294f69e662d157 Joe Perches 2019-10-05 223 # define fallthrough do {} while (0) /* fallthrough */ a3f8a30f3f0079 Miguel Ojeda 2018-08-30 224 #endif a3f8a30f3f0079 Miguel Ojeda 2018-08-30 225 :::::: The code at line 221 was first introduced by commit :::::: 294f69e662d1570703e9b56e95be37a9fd3afba5 compiler_attributes.h: Add 'fallthrough' pseudo keyword for switch/case use :::::: TO: Joe Perches <joe(a)perches.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] CVE-2024-49968
by Yongjian Sun 04 Nov '24

04 Nov '24

*** BLURB HERE *** Gabriel Krisman Bertazi (1): [Backport] ext4: fix error message when rejecting the default hash Lizhi Xu (1): [Backport] ext4: filesystems without casefold feature cannot be mounted with siphash fs/ext4/ext4.h | 1 + fs/ext4/super.c | 20 +++++++++++++++++--- 2 files changed, 18 insertions(+), 3 deletions(-) -- 2.39.2

2 3

[PATCH OLK-6.6] [Backport] exfat: fix memory leak in exfat_load_bitmap()
by Yongjian Sun 04 Nov '24

04 Nov '24

From: Yuezhang Mo <Yuezhang.Mo(a)sony.com> mainline inclusion from mainline-v6.12-rc1 commit d2b537b3e533f28e0d97293fe9293161fe8cd137 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRBG CVE: CVE-2024-50013 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If the first directory entry in the root directory is not a bitmap directory entry, 'bh' will not be released and reassigned, which will cause a memory leak. Fixes: 1e49a94cf707 ("exfat: add bitmap operations") Cc: stable(a)vger.kernel.org Signed-off-by: Yuezhang Mo <Yuezhang.Mo(a)sony.com> Reviewed-by: Aoyama Wataru <wataru.aoyama(a)sony.com> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/exfat/balloc.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/fs/exfat/balloc.c b/fs/exfat/balloc.c index e918decb3735..5b547a596380 100644 --- a/fs/exfat/balloc.c +++ b/fs/exfat/balloc.c @@ -110,11 +110,8 @@ int exfat_load_bitmap(struct super_block *sb) return -EIO; type = exfat_get_entry_type(ep); - if (type == TYPE_UNUSED) - break; - if (type != TYPE_BITMAP) - continue; - if (ep->dentry.bitmap.flags == 0x0) { + if (type == TYPE_BITMAP && + ep->dentry.bitmap.flags == 0x0) { int err; err = exfat_allocate_bitmap(sb, ep); @@ -122,6 +119,9 @@ int exfat_load_bitmap(struct super_block *sb) return err; } brelse(bh); + + if (type == TYPE_UNUSED) + return -EINVAL; } if (exfat_get_next_cluster(sb, &clu.dir)) -- 2.39.2

2 11

[PATCH OLK-5.10] [Backport] exfat: fix memory leak in exfat_load_bitmap()
by Yongjian Sun 04 Nov '24

04 Nov '24

From: Yuezhang Mo <Yuezhang.Mo(a)sony.com> mainline inclusion from mainline-v6.12-rc1 commit d2b537b3e533f28e0d97293fe9293161fe8cd137 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRBG CVE: CVE-2024-50013 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If the first directory entry in the root directory is not a bitmap directory entry, 'bh' will not be released and reassigned, which will cause a memory leak. Fixes: 1e49a94cf707 ("exfat: add bitmap operations") Cc: stable(a)vger.kernel.org Signed-off-by: Yuezhang Mo <Yuezhang.Mo(a)sony.com> Reviewed-by: Aoyama Wataru <wataru.aoyama(a)sony.com> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/exfat/balloc.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/fs/exfat/balloc.c b/fs/exfat/balloc.c index ab091440e8b9..0501b8c04d8d 100644 --- a/fs/exfat/balloc.c +++ b/fs/exfat/balloc.c @@ -110,11 +110,8 @@ int exfat_load_bitmap(struct super_block *sb) return -EIO; type = exfat_get_entry_type(ep); - if (type == TYPE_UNUSED) - break; - if (type != TYPE_BITMAP) - continue; - if (ep->dentry.bitmap.flags == 0x0) { + if (type == TYPE_BITMAP && + ep->dentry.bitmap.flags == 0x0) { int err; err = exfat_allocate_bitmap(sb, ep); @@ -122,6 +119,9 @@ int exfat_load_bitmap(struct super_block *sb) return err; } brelse(bh); + + if (type == TYPE_UNUSED) + return -EINVAL; } if (exfat_get_next_cluster(sb, &clu.dir)) -- 2.39.2

2 13

[PATCH OLK-6.6] bpf: Fail verification for sign-extension of packet data/data_end/data_meta
by Chen Zhongjin 04 Nov '24

04 Nov '24

From: Yonghong Song <yonghong.song(a)linux.dev> mainline inclusion from mainline-v6.12-rc1 commit 92de36080c93296ef9005690705cba260b9bd68a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYPJQ CVE: CVE-2024-47702 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot reported a kernel crash due to commit 1f1e864b6555 ("bpf: Handle sign-extenstin ctx member accesses"). The reason is due to sign-extension of 32-bit load for packet data/data_end/data_meta uapi field. The original code looks like: r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ r3 = *(u32 *)(r1 + 80) /* load __sk_buff->data_end */ r0 = r2 r0 += 8 if r3 > r0 goto +1 ... Note that __sk_buff->data load has 32-bit sign extension. After verification and convert_ctx_accesses(), the final asm code looks like: r2 = *(u64 *)(r1 +208) r2 = (s32)r2 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 ... Note that 'r2 = (s32)r2' may make the kernel __sk_buff->data address invalid which may cause runtime failure. Currently, in C code, typically we have void *data = (void *)(long)skb->data; void *data_end = (void *)(long)skb->data_end; ... and it will generate r2 = *(u64 *)(r1 +208) r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 If we allow sign-extension, void *data = (void *)(long)(int)skb->data; void *data_end = (void *)(long)skb->data_end; ... the generated code looks like r2 = *(u64 *)(r1 +208) r2 <<= 32 r2 s>>= 32 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 and this will cause verification failure since "r2 <<= 32" is not allowed as "r2" is a packet pointer. To fix this issue for case r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ this patch added additional checking in is_valid_access() callback function for packet data/data_end/data_meta access. If those accesses are with sign-extenstion, the verification will fail. [1] https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/ Reported-by: syzbot+ad9ec60c8eaf69e6f99c(a)syzkaller.appspotmail.com Fixes: 1f1e864b6555 ("bpf: Handle sign-extenstin ctx member accesses") Acked-by: Eduard Zingerman <eddyz87(a)gmail.com> Signed-off-by: Yonghong Song <yonghong.song(a)linux.dev> Link: https://lore.kernel.org/r/20240723153439.2429035-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Conflicts: kernel/bpf/verifier.c [patch set:("bpf, lsm: Add check for BPF LSM return value") was not merged] include/linux/bpf.h [fix struct bpf_insn_access_aux KABI breakage] Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- include/linux/bpf.h | 1 + kernel/bpf/verifier.c | 5 +++-- net/core/filter.c | 21 ++++++++++++++++----- 3 files changed, 20 insertions(+), 7 deletions(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 8c4c2c39a6c1..c9351ab31e05 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -920,6 +920,7 @@ struct bpf_insn_access_aux { }; }; struct bpf_verifier_log *log; /* for verbose logs */ + KABI_EXTEND(bool is_ldsx) }; static inline void diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index d1041517a984..82f2be2ddd06 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -5549,11 +5549,12 @@ static int check_packet_access(struct bpf_verifier_env *env, u32 regno, int off, /* check access to 'struct bpf_context' fields. Supports fixed offsets only */ static int check_ctx_access(struct bpf_verifier_env *env, int insn_idx, int off, int size, enum bpf_access_type t, enum bpf_reg_type *reg_type, - struct btf **btf, u32 *btf_id) + struct btf **btf, u32 *btf_id, bool is_ldsx) { struct bpf_insn_access_aux info = { .reg_type = *reg_type, .log = &env->log, + .is_ldsx = is_ldsx, }; if (env->ops->is_valid_access && @@ -6802,7 +6803,7 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn return err; err = check_ctx_access(env, insn_idx, off, size, t, &reg_type, &btf, - &btf_id); + &btf_id, is_ldsx); if (err) verbose_linfo(env, insn_idx, "; "); if (!err && t == BPF_READ && value_regno >= 0) { diff --git a/net/core/filter.c b/net/core/filter.c index e16d746c23da..e4f1dc9f222b 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -8601,13 +8601,16 @@ static bool bpf_skb_is_valid_access(int off, int size, enum bpf_access_type type if (off + size > offsetofend(struct __sk_buff, cb[4])) return false; break; + case bpf_ctx_range(struct __sk_buff, data): + case bpf_ctx_range(struct __sk_buff, data_meta): + case bpf_ctx_range(struct __sk_buff, data_end): + if (info->is_ldsx || size != size_default) + return false; + break; case bpf_ctx_range_till(struct __sk_buff, remote_ip6[0], remote_ip6[3]): case bpf_ctx_range_till(struct __sk_buff, local_ip6[0], local_ip6[3]): case bpf_ctx_range_till(struct __sk_buff, remote_ip4, remote_ip4): case bpf_ctx_range_till(struct __sk_buff, local_ip4, local_ip4): - case bpf_ctx_range(struct __sk_buff, data): - case bpf_ctx_range(struct __sk_buff, data_meta): - case bpf_ctx_range(struct __sk_buff, data_end): if (size != size_default) return false; break; @@ -9051,6 +9054,14 @@ static bool xdp_is_valid_access(int off, int size, } } return false; + } else { + switch (off) { + case offsetof(struct xdp_md, data_meta): + case offsetof(struct xdp_md, data): + case offsetof(struct xdp_md, data_end): + if (info->is_ldsx) + return false; + } } switch (off) { @@ -9381,12 +9392,12 @@ static bool flow_dissector_is_valid_access(int off, int size, switch (off) { case bpf_ctx_range(struct __sk_buff, data): - if (size != size_default) + if (info->is_ldsx || size != size_default) return false; info->reg_type = PTR_TO_PACKET; return true; case bpf_ctx_range(struct __sk_buff, data_end): - if (size != size_default) + if (info->is_ldsx || size != size_default) return false; info->reg_type = PTR_TO_PACKET_END; return true; -- 2.25.1

2 1

[PATCH OLK-6.6 v2] bpf: Fail verification for sign-extension of packet data/data_end/data_meta
by Chen Zhongjin 04 Nov '24

04 Nov '24

From: Yonghong Song <yonghong.song(a)linux.dev> mainline inclusion from mainline-v6.12-rc1 commit 92de36080c93296ef9005690705cba260b9bd68a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYPJQ CVE: CVE-2024-47702 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot reported a kernel crash due to commit 1f1e864b6555 ("bpf: Handle sign-extenstin ctx member accesses"). The reason is due to sign-extension of 32-bit load for packet data/data_end/data_meta uapi field. The original code looks like: r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ r3 = *(u32 *)(r1 + 80) /* load __sk_buff->data_end */ r0 = r2 r0 += 8 if r3 > r0 goto +1 ... Note that __sk_buff->data load has 32-bit sign extension. After verification and convert_ctx_accesses(), the final asm code looks like: r2 = *(u64 *)(r1 +208) r2 = (s32)r2 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 ... Note that 'r2 = (s32)r2' may make the kernel __sk_buff->data address invalid which may cause runtime failure. Currently, in C code, typically we have void *data = (void *)(long)skb->data; void *data_end = (void *)(long)skb->data_end; ... and it will generate r2 = *(u64 *)(r1 +208) r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 If we allow sign-extension, void *data = (void *)(long)(int)skb->data; void *data_end = (void *)(long)skb->data_end; ... the generated code looks like r2 = *(u64 *)(r1 +208) r2 <<= 32 r2 s>>= 32 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 and this will cause verification failure since "r2 <<= 32" is not allowed as "r2" is a packet pointer. To fix this issue for case r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ this patch added additional checking in is_valid_access() callback function for packet data/data_end/data_meta access. If those accesses are with sign-extenstion, the verification will fail. [1] https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/ Reported-by: syzbot+ad9ec60c8eaf69e6f99c(a)syzkaller.appspotmail.com Fixes: 1f1e864b6555 ("bpf: Handle sign-extenstin ctx member accesses") Acked-by: Eduard Zingerman <eddyz87(a)gmail.com> Signed-off-by: Yonghong Song <yonghong.song(a)linux.dev> Link: https://lore.kernel.org/r/20240723153439.2429035-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Conflicts: kernel/bpf/verifier.c [patch set:("bpf, lsm: Add check for BPF LSM return value") was not merged] include/linux/bpf.h [fix struct bpf_insn_access_aux KABI breakage] Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- include/linux/bpf.h | 1 + kernel/bpf/verifier.c | 5 +++-- net/core/filter.c | 21 ++++++++++++++++----- 3 files changed, 20 insertions(+), 7 deletions(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 8c4c2c39a6c1..c9351ab31e05 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -920,6 +920,7 @@ struct bpf_insn_access_aux { }; }; struct bpf_verifier_log *log; /* for verbose logs */ + KABI_EXTEND(bool is_ldsx) }; static inline void diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index d1041517a984..82f2be2ddd06 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -5549,11 +5549,12 @@ static int check_packet_access(struct bpf_verifier_env *env, u32 regno, int off, /* check access to 'struct bpf_context' fields. Supports fixed offsets only */ static int check_ctx_access(struct bpf_verifier_env *env, int insn_idx, int off, int size, enum bpf_access_type t, enum bpf_reg_type *reg_type, - struct btf **btf, u32 *btf_id) + struct btf **btf, u32 *btf_id, bool is_ldsx) { struct bpf_insn_access_aux info = { .reg_type = *reg_type, .log = &env->log, + .is_ldsx = is_ldsx, }; if (env->ops->is_valid_access && @@ -6802,7 +6803,7 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn return err; err = check_ctx_access(env, insn_idx, off, size, t, &reg_type, &btf, - &btf_id); + &btf_id, is_ldsx); if (err) verbose_linfo(env, insn_idx, "; "); if (!err && t == BPF_READ && value_regno >= 0) { diff --git a/net/core/filter.c b/net/core/filter.c index e16d746c23da..e4f1dc9f222b 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -8601,13 +8601,16 @@ static bool bpf_skb_is_valid_access(int off, int size, enum bpf_access_type type if (off + size > offsetofend(struct __sk_buff, cb[4])) return false; break; + case bpf_ctx_range(struct __sk_buff, data): + case bpf_ctx_range(struct __sk_buff, data_meta): + case bpf_ctx_range(struct __sk_buff, data_end): + if (info->is_ldsx || size != size_default) + return false; + break; case bpf_ctx_range_till(struct __sk_buff, remote_ip6[0], remote_ip6[3]): case bpf_ctx_range_till(struct __sk_buff, local_ip6[0], local_ip6[3]): case bpf_ctx_range_till(struct __sk_buff, remote_ip4, remote_ip4): case bpf_ctx_range_till(struct __sk_buff, local_ip4, local_ip4): - case bpf_ctx_range(struct __sk_buff, data): - case bpf_ctx_range(struct __sk_buff, data_meta): - case bpf_ctx_range(struct __sk_buff, data_end): if (size != size_default) return false; break; @@ -9051,6 +9054,14 @@ static bool xdp_is_valid_access(int off, int size, } } return false; + } else { + switch (off) { + case offsetof(struct xdp_md, data_meta): + case offsetof(struct xdp_md, data): + case offsetof(struct xdp_md, data_end): + if (info->is_ldsx) + return false; + } } switch (off) { @@ -9381,12 +9392,12 @@ static bool flow_dissector_is_valid_access(int off, int size, switch (off) { case bpf_ctx_range(struct __sk_buff, data): - if (size != size_default) + if (info->is_ldsx || size != size_default) return false; info->reg_type = PTR_TO_PACKET; return true; case bpf_ctx_range(struct __sk_buff, data_end): - if (size != size_default) + if (info->is_ldsx || size != size_default) return false; info->reg_type = PTR_TO_PACKET_END; return true; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] [Backport] exfat: fix memory leak in exfat_load_bitmap()
by Yongjian Sun 04 Nov '24

04 Nov '24

From: Yuezhang Mo <Yuezhang.Mo(a)sony.com> mainline inclusion from mainline-v6.12-rc1 commit d2b537b3e533f28e0d97293fe9293161fe8cd137 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRBG CVE: CVE-2024-50013 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If the first directory entry in the root directory is not a bitmap directory entry, 'bh' will not be released and reassigned, which will cause a memory leak. Fixes: 1e49a94cf707 ("exfat: add bitmap operations") Cc: stable(a)vger.kernel.org Signed-off-by: Yuezhang Mo <Yuezhang.Mo(a)sony.com> Reviewed-by: Aoyama Wataru <wataru.aoyama(a)sony.com> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/exfat/balloc.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/fs/exfat/balloc.c b/fs/exfat/balloc.c index 258b6bb5762a..702187cea05d 100644 --- a/fs/exfat/balloc.c +++ b/fs/exfat/balloc.c @@ -110,11 +110,8 @@ int exfat_load_bitmap(struct super_block *sb) return -EIO; type = exfat_get_entry_type(ep); - if (type == TYPE_UNUSED) - break; - if (type != TYPE_BITMAP) - continue; - if (ep->dentry.bitmap.flags == 0x0) { + if (type == TYPE_BITMAP && + ep->dentry.bitmap.flags == 0x0) { int err; err = exfat_allocate_bitmap(sb, ep); @@ -122,6 +119,9 @@ int exfat_load_bitmap(struct super_block *sb) return err; } brelse(bh); + + if (type == TYPE_UNUSED) + return -EINVAL; } if (exfat_get_next_cluster(sb, &clu.dir)) -- 2.39.2

2 13

[PATCH OLK-6.6] ext4: update orig_path in ext4_find_extent()
by Baokun Li 04 Nov '24

04 Nov '24

stable inclusion from stable-v6.6.55 commit f55ecc58d07a6c1f6d6d5b5af125c25f8da0bda2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAZ5OQ CVE: CVE-2024-49881 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5b4b2dcace35f618fe361a87bae6f0d13af31bc1 upstream. In ext4_find_extent(), if the path is not big enough, we free it and set *orig_path to NULL. But after reallocating and successfully initializing the path, we don't update *orig_path, in which case the caller gets a valid path but a NULL ppath, and this may cause a NULL pointer dereference or a path memory leak. For example: ext4_split_extent path = *ppath = 2000 ext4_find_extent if (depth > path[0].p_maxdepth) kfree(path = 2000); *orig_path = path = NULL; path = kcalloc() = 3000 ext4_split_extent_at(*ppath = NULL) path = *ppath; ex = path[depth].p_ext; // NULL pointer dereference! ================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000010 CPU: 6 UID: 0 PID: 576 Comm: fsstress Not tainted 6.11.0-rc2-dirty #847 RIP: 0010:ext4_split_extent_at+0x6d/0x560 Call Trace: <TASK> ext4_split_extent.isra.0+0xcb/0x1b0 ext4_ext_convert_to_initialized+0x168/0x6c0 ext4_ext_handle_unwritten_extents+0x325/0x4d0 ext4_ext_map_blocks+0x520/0xdb0 ext4_map_blocks+0x2b0/0x690 ext4_iomap_begin+0x20e/0x2c0 [...] ================================================================== Therefore, *orig_path is updated when the extent lookup succeeds, so that the caller can safely use path or *ppath. Fixes: 10809df84a4d ("ext4: teach ext4_ext_find_extent() to realloc path if necessary") Cc: stable(a)kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://patch.msgid.link/20240822023545.1994557-6-libaokun@huaweicloud.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/ext4/extents.c | 3 ++- fs/ext4/move_extent.c | 1 - 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index ef37cee9c27e..d9c51d42f21a 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -968,6 +968,8 @@ ext4_find_extent(struct inode *inode, ext4_lblk_t block, ext4_ext_show_path(inode, path); + if (orig_path) + *orig_path = path; return path; err: @@ -3260,7 +3262,6 @@ static int ext4_split_extent_at(handle_t *handle, } depth = ext_depth(inode); ex = path[depth].p_ext; - *ppath = path; if (EXT4_EXT_MAY_ZEROOUT & split_flag) { if (split_flag & (EXT4_EXT_DATA_VALID1|EXT4_EXT_DATA_VALID2)) { diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c index 2b6288c2df43..45191e01fbbc 100644 --- a/fs/ext4/move_extent.c +++ b/fs/ext4/move_extent.c @@ -36,7 +36,6 @@ get_ext_path(struct inode *inode, ext4_lblk_t lblock, *ppath = NULL; return -ENODATA; } - *ppath = path; return 0; } -- 2.46.1

2 1

[PATCH openEuler-1.0-LTS] ext4: update orig_path in ext4_find_extent()
by Baokun Li 04 Nov '24

04 Nov '24

stable inclusion from stable-v5.10.227 commit 6766937d0327000ac1b87c97bbecdd28b0dd6599 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAZ5OQ CVE: CVE-2024-49881 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5b4b2dcace35f618fe361a87bae6f0d13af31bc1 upstream. In ext4_find_extent(), if the path is not big enough, we free it and set *orig_path to NULL. But after reallocating and successfully initializing the path, we don't update *orig_path, in which case the caller gets a valid path but a NULL ppath, and this may cause a NULL pointer dereference or a path memory leak. For example: ext4_split_extent path = *ppath = 2000 ext4_find_extent if (depth > path[0].p_maxdepth) kfree(path = 2000); *orig_path = path = NULL; path = kcalloc() = 3000 ext4_split_extent_at(*ppath = NULL) path = *ppath; ex = path[depth].p_ext; // NULL pointer dereference! ================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000010 CPU: 6 UID: 0 PID: 576 Comm: fsstress Not tainted 6.11.0-rc2-dirty #847 RIP: 0010:ext4_split_extent_at+0x6d/0x560 Call Trace: <TASK> ext4_split_extent.isra.0+0xcb/0x1b0 ext4_ext_convert_to_initialized+0x168/0x6c0 ext4_ext_handle_unwritten_extents+0x325/0x4d0 ext4_ext_map_blocks+0x520/0xdb0 ext4_map_blocks+0x2b0/0x690 ext4_iomap_begin+0x20e/0x2c0 [...] ================================================================== Therefore, *orig_path is updated when the extent lookup succeeds, so that the caller can safely use path or *ppath. Fixes: 10809df84a4d ("ext4: teach ext4_ext_find_extent() to realloc path if necessary") Cc: stable(a)kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://patch.msgid.link/20240822023545.1994557-6-libaokun@huaweicloud.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/ext4/extents.c | 3 ++- fs/ext4/move_extent.c | 1 - 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index 19a77f4ef8bd..447c81f82788 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -1011,6 +1011,8 @@ ext4_find_extent(struct inode *inode, ext4_lblk_t block, ext4_ext_show_path(inode, path); + if (orig_path) + *orig_path = path; return path; err: @@ -3384,7 +3386,6 @@ static int ext4_split_extent_at(handle_t *handle, } depth = ext_depth(inode); ex = path[depth].p_ext; - *ppath = path; if (EXT4_EXT_MAY_ZEROOUT & split_flag) { if (split_flag & (EXT4_EXT_DATA_VALID1|EXT4_EXT_DATA_VALID2)) { diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c index 4616d41216f3..5a1faad7cf81 100644 --- a/fs/ext4/move_extent.c +++ b/fs/ext4/move_extent.c @@ -37,7 +37,6 @@ get_ext_path(struct inode *inode, ext4_lblk_t lblock, *ppath = NULL; return -ENODATA; } - *ppath = path; return 0; } -- 2.46.1

2 1

[PATCH OLK-5.10] ext4: update orig_path in ext4_find_extent()
by Baokun Li 04 Nov '24

04 Nov '24

stable inclusion from stable-v5.10.227 commit 6766937d0327000ac1b87c97bbecdd28b0dd6599 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAZ5OQ CVE: CVE-2024-49881 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5b4b2dcace35f618fe361a87bae6f0d13af31bc1 upstream. In ext4_find_extent(), if the path is not big enough, we free it and set *orig_path to NULL. But after reallocating and successfully initializing the path, we don't update *orig_path, in which case the caller gets a valid path but a NULL ppath, and this may cause a NULL pointer dereference or a path memory leak. For example: ext4_split_extent path = *ppath = 2000 ext4_find_extent if (depth > path[0].p_maxdepth) kfree(path = 2000); *orig_path = path = NULL; path = kcalloc() = 3000 ext4_split_extent_at(*ppath = NULL) path = *ppath; ex = path[depth].p_ext; // NULL pointer dereference! ================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000010 CPU: 6 UID: 0 PID: 576 Comm: fsstress Not tainted 6.11.0-rc2-dirty #847 RIP: 0010:ext4_split_extent_at+0x6d/0x560 Call Trace: <TASK> ext4_split_extent.isra.0+0xcb/0x1b0 ext4_ext_convert_to_initialized+0x168/0x6c0 ext4_ext_handle_unwritten_extents+0x325/0x4d0 ext4_ext_map_blocks+0x520/0xdb0 ext4_map_blocks+0x2b0/0x690 ext4_iomap_begin+0x20e/0x2c0 [...] ================================================================== Therefore, *orig_path is updated when the extent lookup succeeds, so that the caller can safely use path or *ppath. Fixes: 10809df84a4d ("ext4: teach ext4_ext_find_extent() to realloc path if necessary") Cc: stable(a)kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://patch.msgid.link/20240822023545.1994557-6-libaokun@huaweicloud.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/ext4/extents.c | 3 ++- fs/ext4/move_extent.c | 1 - 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index 4db1d47ccf0b..334e3d34b411 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -960,6 +960,8 @@ ext4_find_extent(struct inode *inode, ext4_lblk_t block, ext4_ext_show_path(inode, path); + if (orig_path) + *orig_path = path; return path; err: @@ -3261,7 +3263,6 @@ static int ext4_split_extent_at(handle_t *handle, } depth = ext_depth(inode); ex = path[depth].p_ext; - *ppath = path; if (EXT4_EXT_MAY_ZEROOUT & split_flag) { if (split_flag & (EXT4_EXT_DATA_VALID1|EXT4_EXT_DATA_VALID2)) { diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c index f3d06beb79b2..886d2b161c23 100644 --- a/fs/ext4/move_extent.c +++ b/fs/ext4/move_extent.c @@ -36,7 +36,6 @@ get_ext_path(struct inode *inode, ext4_lblk_t lblock, *ppath = NULL; return -ENODATA; } - *ppath = path; return 0; } -- 2.46.1

2 1

[PATCH OLK-6.6] rseq/mm_cid: change the mm_cid macro default status and keep KABI consistent
by He Yujie 04 Nov '24

04 Nov '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB1OJX -------------------------------- Changing the mm_cid macro to disable status by modifying Kconfig: def_bool n, and reserving the field for task_struct and mm_struct by using KABI_REPLACE to keep KABI consistent. Fixes: af7f588d8f73 ("sched: Introduce per-memory-map concurrency ID") Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 2 +- arch/x86/configs/openeuler_defconfig | 2 +- include/linux/mm_types.h | 6 ++++-- include/linux/sched.h | 7 +++++++ init/Kconfig | 2 +- 5 files changed, 14 insertions(+), 5 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 96ca8b990e22..67d02760f856 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -179,7 +179,7 @@ CONFIG_FAIR_GROUP_SCHED=y CONFIG_CFS_BANDWIDTH=y CONFIG_RT_GROUP_SCHED=y CONFIG_QOS_SCHED_DYNAMIC_AFFINITY=y -CONFIG_SCHED_MM_CID=y +# CONFIG_SCHED_MM_CID is not set CONFIG_QOS_SCHED_SMART_GRID=y CONFIG_CGROUP_PIDS=y CONFIG_CGROUP_RDMA=y diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index d95d966f7fb2..ea83b730a3be 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -197,7 +197,7 @@ CONFIG_FAIR_GROUP_SCHED=y CONFIG_CFS_BANDWIDTH=y CONFIG_RT_GROUP_SCHED=y CONFIG_QOS_SCHED_DYNAMIC_AFFINITY=y -CONFIG_SCHED_MM_CID=y +# CONFIG_SCHED_MM_CID is not set # CONFIG_QOS_SCHED_SMART_GRID is not set CONFIG_CGROUP_PIDS=y CONFIG_CGROUP_RDMA=y diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h index 793c16b99237..fdc047bdbc49 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -711,12 +711,10 @@ struct vm_area_struct { KABI_RESERVE(4) } __randomize_layout; -#ifdef CONFIG_SCHED_MM_CID struct mm_cid { u64 time; int cid; }; -#endif struct kioctx_table; struct iommu_mm_data; @@ -789,6 +787,10 @@ struct mm_struct { * When the next mm_cid scan is due (in jiffies). */ unsigned long mm_cid_next_scan; +#else + KABI_REPLACE(struct mm_cid __percpu *pcpu_cid, + struct mm_cid __percpu *pcpu_cid) + KABI_REPLACE(unsigned long mm_cid_next_scan, unsigned long mm_cid_next_scan) #endif #ifdef CONFIG_MMU atomic_long_t pgtables_bytes; /* size of all page tables */ diff --git a/include/linux/sched.h b/include/linux/sched.h index f40411aa7b70..7b1c53f71ee4 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -1355,6 +1355,13 @@ struct task_struct { int migrate_from_cpu; int mm_cid_active; /* Whether cid bitmap is active */ struct callback_head cid_work; +#else + KABI_REPLACE(int mm_cid, int mm_cid) + KABI_REPLACE(int last_mm_cid, int last_mm_cid) + KABI_REPLACE(int migrate_from_cpu, int migrate_from_cpu) + KABI_REPLACE(int mm_cid_active, int mm_cid_active) + KABI_REPLACE(struct callback_head cid_work, + struct callback_head cid_work) #endif struct tlbflush_unmap_batch tlb_ubc; diff --git a/init/Kconfig b/init/Kconfig index 6ea4eafecab1..2d6ae58a5bf7 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1137,7 +1137,7 @@ config QOS_SCHED_DYNAMIC_AFFINITY cpus allowed. config SCHED_MM_CID - def_bool y + def_bool n depends on SMP && RSEQ config UCLAMP_TASK_GROUP -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] wifi: cfg80211: fix buffer overflow in elem comparison
by Yi Yang 04 Nov '24

04 Nov '24

From: Johannes Berg <johannes.berg(a)intel.com> stable inclusion from stable-v5.10.158 commit 9e6b79a3cd17620d467311b30d56f2648f6880aa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYREV CVE: CVE-2022-49023 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9f16b5c82a025cd4c864737409234ddc44fb166a ] For vendor elements, the code here assumes that 5 octets are present without checking. Since the element itself is already checked to fit, we only need to check the length. Reported-and-tested-by: Sönke Huster <shuster(a)seemoo.tu-darmstadt.de> Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning") Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- net/wireless/scan.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/wireless/scan.c b/net/wireless/scan.c index 729d8e089db1..944bddabfceb 100644 --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -330,7 +330,8 @@ static size_t cfg80211_gen_new_ie(const u8 *ie, size_t ielen, * determine if they are the same ie. */ if (tmp_old[0] == WLAN_EID_VENDOR_SPECIFIC) { - if (!memcmp(tmp_old + 2, tmp + 2, 5)) { + if (tmp_old[1] >= 5 && tmp[1] >= 5 && + !memcmp(tmp_old + 2, tmp + 2, 5)) { /* same vendor ie, copy from * subelement */ -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] memcg_write_event_control(): fix a user-triggerable oops
by Jinjiang Tu 04 Nov '24

04 Nov '24

From: Al Viro <viro(a)zeniv.linux.org.uk> stable inclusion from stable-v5.10.225 commit ad149f5585345e383baa65f1539d816cd715fd3b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAQOJK CVE: CVE-2024-45021 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 046667c4d3196938e992fba0dfcde570aa85cd0e upstream. we are *not* guaranteed that anything past the terminating NUL is mapped (let alone initialized with anything sane). Fixes: 0dea116876ee ("cgroup: implement eventfd-based generic API for notifications") Cc: stable(a)vger.kernel.org Cc: Andrew Morton <akpm(a)linux-foundation.org> Acked-by: Michal Hocko <mhocko(a)suse.com> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/memcontrol.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index aefaa33147b1..ac365005f7a1 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -5436,9 +5436,12 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of, buf = endp + 1; cfd = simple_strtoul(buf, &endp, 10); - if ((*endp != ' ') && (*endp != '\0')) + if (*endp == '\0') + buf = endp; + else if (*endp == ' ') + buf = endp + 1; + else return -EINVAL; - buf = endp + 1; event = kzalloc(sizeof(*event), GFP_KERNEL); if (!event) -- 2.34.1

2 1

[PATCH OLK-5.10] memcg_write_event_control(): fix a user-triggerable oops
by Jinjiang Tu 04 Nov '24

04 Nov '24

From: Al Viro <viro(a)zeniv.linux.org.uk> stable inclusion from stable-v5.10.225 commit ad149f5585345e383baa65f1539d816cd715fd3b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAQOJK CVE: CVE-2024-45021 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 046667c4d3196938e992fba0dfcde570aa85cd0e upstream. we are *not* guaranteed that anything past the terminating NUL is mapped (let alone initialized with anything sane). Fixes: 0dea116876ee ("cgroup: implement eventfd-based generic API for notifications") Cc: stable(a)vger.kernel.org Cc: Andrew Morton <akpm(a)linux-foundation.org> Acked-by: Michal Hocko <mhocko(a)suse.com> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/memcontrol.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index aefaa33147b1..ac365005f7a1 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -5436,9 +5436,12 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of, buf = endp + 1; cfd = simple_strtoul(buf, &endp, 10); - if ((*endp != ' ') && (*endp != '\0')) + if (*endp == '\0') + buf = endp; + else if (*endp == ' ') + buf = endp + 1; + else return -EINVAL; - buf = endp + 1; event = kzalloc(sizeof(*event), GFP_KERNEL); if (!event) -- 2.34.1

2 1

[PATCH OLK-6.6] mm: gup: stop abusing try_grab_folio
by Jinjiang Tu 04 Nov '24

04 Nov '24

From: Yang Shi <yang(a)os.amperecomputing.com> stable inclusion from stable-v6.6.47 commit 26273f5f4cf68b29414e403837093408a9c98e1f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAN4MO CVE: CVE-2024-44943 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f442fa6141379a20b48ae3efabee827a3d260787 upstream. A kernel warning was reported when pinning folio in CMA memory when launching SEV virtual machine. The splat looks like: [ 464.325306] WARNING: CPU: 13 PID: 6734 at mm/gup.c:1313 __get_user_pages+0x423/0x520 [ 464.325464] CPU: 13 PID: 6734 Comm: qemu-kvm Kdump: loaded Not tainted 6.6.33+ #6 [ 464.325477] RIP: 0010:__get_user_pages+0x423/0x520 [ 464.325515] Call Trace: [ 464.325520] <TASK> [ 464.325523] ? __get_user_pages+0x423/0x520 [ 464.325528] ? __warn+0x81/0x130 [ 464.325536] ? __get_user_pages+0x423/0x520 [ 464.325541] ? report_bug+0x171/0x1a0 [ 464.325549] ? handle_bug+0x3c/0x70 [ 464.325554] ? exc_invalid_op+0x17/0x70 [ 464.325558] ? asm_exc_invalid_op+0x1a/0x20 [ 464.325567] ? __get_user_pages+0x423/0x520 [ 464.325575] __gup_longterm_locked+0x212/0x7a0 [ 464.325583] internal_get_user_pages_fast+0xfb/0x190 [ 464.325590] pin_user_pages_fast+0x47/0x60 [ 464.325598] sev_pin_memory+0xca/0x170 [kvm_amd] [ 464.325616] sev_mem_enc_register_region+0x81/0x130 [kvm_amd] Per the analysis done by yangge, when starting the SEV virtual machine, it will call pin_user_pages_fast(..., FOLL_LONGTERM, ...) to pin the memory. But the page is in CMA area, so fast GUP will fail then fallback to the slow path due to the longterm pinnalbe check in try_grab_folio(). The slow path will try to pin the pages then migrate them out of CMA area. But the slow path also uses try_grab_folio() to pin the page, it will also fail due to the same check then the above warning is triggered. In addition, the try_grab_folio() is supposed to be used in fast path and it elevates folio refcount by using add ref unless zero. We are guaranteed to have at least one stable reference in slow path, so the simple atomic add could be used. The performance difference should be trivial, but the misuse may be confusing and misleading. Redefined try_grab_folio() to try_grab_folio_fast(), and try_grab_page() to try_grab_folio(), and use them in the proper paths. This solves both the abuse and the kernel warning. The proper naming makes their usecase more clear and should prevent from abusing in the future. peterx said: : The user will see the pin fails, for gpu-slow it further triggers the WARN : right below that failure (as in the original report): : : folio = try_grab_folio(page, page_increm - 1, : foll_flags); : if (WARN_ON_ONCE(!folio)) { <------------------------ here : /* : * Release the 1st page ref if the : * folio is problematic, fail hard. : */ : gup_put_folio(page_folio(page), 1, : foll_flags); : ret = -EFAULT; : goto out; : } [1] https://lore.kernel.org/linux-mm/1719478388-31917-1-git-send-email-yangge11… [shy828301(a)gmail.com: fix implicit declaration of function try_grab_folio_fast] Link: https://lkml.kernel.org/r/CAHbLzkowMSso-4Nufc9hcMehQsK9PNz3OSu-+eniU-2Mm-xj… Link: https://lkml.kernel.org/r/20240628191458.2605553-1-yang@os.amperecomputing.… Fixes: 57edfcfd3419 ("mm/gup: accelerate thp gup even for "pages != NULL"") Signed-off-by: Yang Shi <yang(a)os.amperecomputing.com> Reported-by: yangge <yangge1116(a)126.com> Cc: Christoph Hellwig <hch(a)infradead.org> Cc: David Hildenbrand <david(a)redhat.com> Cc: Peter Xu <peterx(a)redhat.com> Cc: <stable(a)vger.kernel.org> [6.6+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: mm/gup.c [Context conflicts when removing old try_grab_folio().] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/gup.c | 251 ++++++++++++++++++++++++----------------------- mm/huge_memory.c | 6 +- mm/hugetlb.c | 2 +- mm/internal.h | 4 +- 4 files changed, 135 insertions(+), 128 deletions(-) diff --git a/mm/gup.c b/mm/gup.c index 16f029cd8544..33e8e66b3a77 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -97,95 +97,6 @@ static inline struct folio *try_get_folio(struct page *page, int refs) return folio; } -/** - * try_grab_folio() - Attempt to get or pin a folio. - * @page: pointer to page to be grabbed - * @refs: the value to (effectively) add to the folio's refcount - * @flags: gup flags: these are the FOLL_* flag values. - * - * "grab" names in this file mean, "look at flags to decide whether to use - * FOLL_PIN or FOLL_GET behavior, when incrementing the folio's refcount. - * - * Either FOLL_PIN or FOLL_GET (or neither) must be set, but not both at the - * same time. (That's true throughout the get_user_pages*() and - * pin_user_pages*() APIs.) Cases: - * - * FOLL_GET: folio's refcount will be incremented by @refs. - * - * FOLL_PIN on large folios: folio's refcount will be incremented by - * @refs, and its pincount will be incremented by @refs. - * - * FOLL_PIN on single-page folios: folio's refcount will be incremented by - * @refs * GUP_PIN_COUNTING_BIAS. - * - * Return: The folio containing @page (with refcount appropriately - * incremented) for success, or NULL upon failure. If neither FOLL_GET - * nor FOLL_PIN was set, that's considered failure, and furthermore, - * a likely bug in the caller, so a warning is also emitted. - */ -struct folio *try_grab_folio(struct page *page, int refs, unsigned int flags) -{ - struct folio *folio; - - if (WARN_ON_ONCE((flags & (FOLL_GET | FOLL_PIN)) == 0)) - return NULL; - - if (unlikely(!(flags & FOLL_PCI_P2PDMA) && is_pci_p2pdma_page(page))) - return NULL; - - if (flags & FOLL_GET) - return try_get_folio(page, refs); - - /* FOLL_PIN is set */ - - /* - * Don't take a pin on the zero page - it's not going anywhere - * and it is used in a *lot* of places. - */ - if (is_zero_page(page)) - return page_folio(page); - - folio = try_get_folio(page, refs); - if (!folio) - return NULL; - - /* - * Can't do FOLL_LONGTERM + FOLL_PIN gup fast path if not in a - * right zone, so fail and let the caller fall back to the slow - * path. - */ - if (unlikely((flags & FOLL_LONGTERM) && - !folio_is_longterm_pinnable(folio))) { - if (!put_devmap_managed_page_refs(&folio->page, refs)) - folio_put_refs(folio, refs); - return NULL; - } - - /* - * When pinning a large folio, use an exact count to track it. - * - * However, be sure to *also* increment the normal folio - * refcount field at least once, so that the folio really - * is pinned. That's why the refcount from the earlier - * try_get_folio() is left intact. - */ - if (folio_test_large(folio)) - atomic_add(refs, &folio->_pincount); - else - folio_ref_add(folio, - refs * (GUP_PIN_COUNTING_BIAS - 1)); - /* - * Adjust the pincount before re-checking the PTE for changes. - * This is essentially a smp_mb() and is paired with a memory - * barrier in folio_try_share_anon_rmap_*(). - */ - smp_mb__after_atomic(); - - node_stat_mod_folio(folio, NR_FOLL_PIN_ACQUIRED, refs); - - return folio; -} - static void gup_put_folio(struct folio *folio, int refs, unsigned int flags) { if (flags & FOLL_PIN) { @@ -203,58 +114,59 @@ static void gup_put_folio(struct folio *folio, int refs, unsigned int flags) } /** - * try_grab_page() - elevate a page's refcount by a flag-dependent amount - * @page: pointer to page to be grabbed - * @flags: gup flags: these are the FOLL_* flag values. + * try_grab_folio() - add a folio's refcount by a flag-dependent amount + * @folio: pointer to folio to be grabbed + * @refs: the value to (effectively) add to the folio's refcount + * @flags: gup flags: these are the FOLL_* flag values * * This might not do anything at all, depending on the flags argument. * * "grab" names in this file mean, "look at flags to decide whether to use - * FOLL_PIN or FOLL_GET behavior, when incrementing the page's refcount. + * FOLL_PIN or FOLL_GET behavior, when incrementing the folio's refcount. * * Either FOLL_PIN or FOLL_GET (or neither) may be set, but not both at the same - * time. Cases: please see the try_grab_folio() documentation, with - * "refs=1". + * time. * * Return: 0 for success, or if no action was required (if neither FOLL_PIN * nor FOLL_GET was set, nothing is done). A negative error code for failure: * - * -ENOMEM FOLL_GET or FOLL_PIN was set, but the page could not + * -ENOMEM FOLL_GET or FOLL_PIN was set, but the folio could not * be grabbed. + * + * It is called when we have a stable reference for the folio, typically in + * GUP slow path. */ -int __must_check try_grab_page(struct page *page, unsigned int flags) +int __must_check try_grab_folio(struct folio *folio, int refs, + unsigned int flags) { - struct folio *folio = page_folio(page); - if (WARN_ON_ONCE(folio_ref_count(folio) <= 0)) return -ENOMEM; - if (unlikely(!(flags & FOLL_PCI_P2PDMA) && is_pci_p2pdma_page(page))) + if (unlikely(!(flags & FOLL_PCI_P2PDMA) && is_pci_p2pdma_page(&folio->page))) return -EREMOTEIO; if (flags & FOLL_GET) - folio_ref_inc(folio); + folio_ref_add(folio, refs); else if (flags & FOLL_PIN) { /* * Don't take a pin on the zero page - it's not going anywhere * and it is used in a *lot* of places. */ - if (is_zero_page(page)) + if (is_zero_folio(folio)) return 0; /* - * Similar to try_grab_folio(): be sure to *also* - * increment the normal page refcount field at least once, + * Increment the normal page refcount field at least once, * so that the page really is pinned. */ if (folio_test_large(folio)) { - folio_ref_add(folio, 1); - atomic_add(1, &folio->_pincount); + folio_ref_add(folio, refs); + atomic_add(refs, &folio->_pincount); } else { - folio_ref_add(folio, GUP_PIN_COUNTING_BIAS); + folio_ref_add(folio, refs * GUP_PIN_COUNTING_BIAS); } - node_stat_mod_folio(folio, NR_FOLL_PIN_ACQUIRED, 1); + node_stat_mod_folio(folio, NR_FOLL_PIN_ACQUIRED, refs); } return 0; @@ -647,8 +559,8 @@ static struct page *follow_page_pte(struct vm_area_struct *vma, VM_BUG_ON_PAGE((flags & FOLL_PIN) && PageAnon(page) && !PageAnonExclusive(page), page); - /* try_grab_page() does nothing unless FOLL_GET or FOLL_PIN is set. */ - ret = try_grab_page(page, flags); + /* try_grab_folio() does nothing unless FOLL_GET or FOLL_PIN is set. */ + ret = try_grab_folio(page_folio(page), 1, flags); if (unlikely(ret)) { page = ERR_PTR(ret); goto out; @@ -899,7 +811,7 @@ static int get_gate_page(struct mm_struct *mm, unsigned long address, goto unmap; *page = pte_page(entry); } - ret = try_grab_page(*page, gup_flags); + ret = try_grab_folio(page_folio(*page), 1, gup_flags); if (unlikely(ret)) goto unmap; out: @@ -1302,20 +1214,19 @@ static long __get_user_pages(struct mm_struct *mm, * pages. */ if (page_increm > 1) { - struct folio *folio; + struct folio *folio = page_folio(page); /* * Since we already hold refcount on the * large folio, this should never fail. */ - folio = try_grab_folio(page, page_increm - 1, - foll_flags); - if (WARN_ON_ONCE(!folio)) { + if (try_grab_folio(folio, page_increm - 1, + foll_flags)) { /* * Release the 1st page ref if the * folio is problematic, fail hard. */ - gup_put_folio(page_folio(page), 1, + gup_put_folio(folio, 1, foll_flags); ret = -EFAULT; goto out; @@ -2546,6 +2457,102 @@ static void __maybe_unused undo_dev_pagemap(int *nr, int nr_start, } } +/** + * try_grab_folio_fast() - Attempt to get or pin a folio in fast path. + * @page: pointer to page to be grabbed + * @refs: the value to (effectively) add to the folio's refcount + * @flags: gup flags: these are the FOLL_* flag values. + * + * "grab" names in this file mean, "look at flags to decide whether to use + * FOLL_PIN or FOLL_GET behavior, when incrementing the folio's refcount. + * + * Either FOLL_PIN or FOLL_GET (or neither) must be set, but not both at the + * same time. (That's true throughout the get_user_pages*() and + * pin_user_pages*() APIs.) Cases: + * + * FOLL_GET: folio's refcount will be incremented by @refs. + * + * FOLL_PIN on large folios: folio's refcount will be incremented by + * @refs, and its pincount will be incremented by @refs. + * + * FOLL_PIN on single-page folios: folio's refcount will be incremented by + * @refs * GUP_PIN_COUNTING_BIAS. + * + * Return: The folio containing @page (with refcount appropriately + * incremented) for success, or NULL upon failure. If neither FOLL_GET + * nor FOLL_PIN was set, that's considered failure, and furthermore, + * a likely bug in the caller, so a warning is also emitted. + * + * It uses add ref unless zero to elevate the folio refcount and must be called + * in fast path only. + */ +static struct folio *try_grab_folio_fast(struct page *page, int refs, + unsigned int flags) +{ + struct folio *folio; + + /* Raise warn if it is not called in fast GUP */ + VM_WARN_ON_ONCE(!irqs_disabled()); + + if (WARN_ON_ONCE((flags & (FOLL_GET | FOLL_PIN)) == 0)) + return NULL; + + if (unlikely(!(flags & FOLL_PCI_P2PDMA) && is_pci_p2pdma_page(page))) + return NULL; + + if (flags & FOLL_GET) + return try_get_folio(page, refs); + + /* FOLL_PIN is set */ + + /* + * Don't take a pin on the zero page - it's not going anywhere + * and it is used in a *lot* of places. + */ + if (is_zero_page(page)) + return page_folio(page); + + folio = try_get_folio(page, refs); + if (!folio) + return NULL; + + /* + * Can't do FOLL_LONGTERM + FOLL_PIN gup fast path if not in a + * right zone, so fail and let the caller fall back to the slow + * path. + */ + if (unlikely((flags & FOLL_LONGTERM) && + !folio_is_longterm_pinnable(folio))) { + if (!put_devmap_managed_page_refs(&folio->page, refs)) + folio_put_refs(folio, refs); + return NULL; + } + + /* + * When pinning a large folio, use an exact count to track it. + * + * However, be sure to *also* increment the normal folio + * refcount field at least once, so that the folio really + * is pinned. That's why the refcount from the earlier + * try_get_folio() is left intact. + */ + if (folio_test_large(folio)) + atomic_add(refs, &folio->_pincount); + else + folio_ref_add(folio, + refs * (GUP_PIN_COUNTING_BIAS - 1)); + /* + * Adjust the pincount before re-checking the PTE for changes. + * This is essentially a smp_mb() and is paired with a memory + * barrier in folio_try_share_anon_rmap_*(). + */ + smp_mb__after_atomic(); + + node_stat_mod_folio(folio, NR_FOLL_PIN_ACQUIRED, refs); + + return folio; +} + #ifdef CONFIG_ARCH_HAS_PTE_SPECIAL /* * Fast-gup relies on pte change detection to avoid concurrent pgtable @@ -2610,7 +2617,7 @@ static int gup_pte_range(pmd_t pmd, pmd_t *pmdp, unsigned long addr, VM_BUG_ON(!pfn_valid(pte_pfn(pte))); page = pte_page(pte); - folio = try_grab_folio(page, 1, flags); + folio = try_grab_folio_fast(page, 1, flags); if (!folio) goto pte_unmap; @@ -2704,7 +2711,7 @@ static int __gup_device_huge(unsigned long pfn, unsigned long addr, SetPageReferenced(page); pages[*nr] = page; - if (unlikely(try_grab_page(page, flags))) { + if (unlikely(try_grab_folio(page_folio(page), 1, flags))) { undo_dev_pagemap(nr, nr_start, flags, pages); break; } @@ -2813,7 +2820,7 @@ static int gup_hugepte(pte_t *ptep, unsigned long sz, unsigned long addr, page = nth_page(pte_page(pte), (addr & (sz - 1)) >> PAGE_SHIFT); refs = record_subpages(page, addr, end, pages + *nr); - folio = try_grab_folio(page, refs, flags); + folio = try_grab_folio_fast(page, refs, flags); if (!folio) return 0; @@ -2884,7 +2891,7 @@ static int gup_huge_pmd(pmd_t orig, pmd_t *pmdp, unsigned long addr, page = nth_page(pmd_page(orig), (addr & ~PMD_MASK) >> PAGE_SHIFT); refs = record_subpages(page, addr, end, pages + *nr); - folio = try_grab_folio(page, refs, flags); + folio = try_grab_folio_fast(page, refs, flags); if (!folio) return 0; @@ -2928,7 +2935,7 @@ static int gup_huge_pud(pud_t orig, pud_t *pudp, unsigned long addr, page = nth_page(pud_page(orig), (addr & ~PUD_MASK) >> PAGE_SHIFT); refs = record_subpages(page, addr, end, pages + *nr); - folio = try_grab_folio(page, refs, flags); + folio = try_grab_folio_fast(page, refs, flags); if (!folio) return 0; @@ -2968,7 +2975,7 @@ static int gup_huge_pgd(pgd_t orig, pgd_t *pgdp, unsigned long addr, page = nth_page(pgd_page(orig), (addr & ~PGDIR_MASK) >> PAGE_SHIFT); refs = record_subpages(page, addr, end, pages + *nr); - folio = try_grab_folio(page, refs, flags); + folio = try_grab_folio_fast(page, refs, flags); if (!folio) return 0; diff --git a/mm/huge_memory.c b/mm/huge_memory.c index ea560ea7b39e..eafe846739f4 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -1553,7 +1553,7 @@ struct page *follow_devmap_pmd(struct vm_area_struct *vma, unsigned long addr, if (!*pgmap) return ERR_PTR(-EFAULT); page = pfn_to_page(pfn); - ret = try_grab_page(page, flags); + ret = try_grab_folio(page_folio(page), 1, flags); if (ret) page = ERR_PTR(ret); @@ -1714,7 +1714,7 @@ struct page *follow_devmap_pud(struct vm_area_struct *vma, unsigned long addr, return ERR_PTR(-EFAULT); page = pfn_to_page(pfn); - ret = try_grab_page(page, flags); + ret = try_grab_folio(page_folio(page), 1, flags); if (ret) page = ERR_PTR(ret); @@ -1976,7 +1976,7 @@ struct page *follow_trans_huge_pmd(struct vm_area_struct *vma, VM_BUG_ON_PAGE((flags & FOLL_PIN) && PageAnon(page) && !PageAnonExclusive(page), page); - ret = try_grab_page(page, flags); + ret = try_grab_folio(page_folio(page), 1, flags); if (ret) return ERR_PTR(ret); diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 89e142c6b897..6d53d52652f3 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -6749,7 +6749,7 @@ struct page *hugetlb_follow_page_mask(struct vm_area_struct *vma, * try_grab_page() should always be able to get the page here, * because we hold the ptl lock and have verified pte_present(). */ - ret = try_grab_page(page, flags); + ret = try_grab_folio(page_folio(page), 1, flags); if (WARN_ON_ONCE(ret)) { page = ERR_PTR(ret); diff --git a/mm/internal.h b/mm/internal.h index 08e32fe3d481..37c17f921dae 100644 --- a/mm/internal.h +++ b/mm/internal.h @@ -1231,8 +1231,8 @@ int migrate_device_coherent_page(struct page *page); /* * mm/gup.c */ -struct folio *try_grab_folio(struct page *page, int refs, unsigned int flags); -int __must_check try_grab_page(struct page *page, unsigned int flags); +int __must_check try_grab_folio(struct folio *folio, int refs, + unsigned int flags); /* * mm/huge_memory.c -- 2.34.1

2 1

[PATCH OLK-6.6] drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream
by Jinjiang Tu 04 Nov '24

04 Nov '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> stable inclusion from stable-v6.6.55 commit e47e563c6f0db7d792a559301862c19ead0dfc2f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRAE CVE: CVE-2024-49913 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 66d71a72539e173a9b00ca0b1852cbaa5f5bf1ad ] This commit addresses a null pointer dereference issue in the `commit_planes_for_stream` function at line 4140. The issue could occur when `top_pipe_to_program` is null. The fix adds a check to ensure `top_pipe_to_program` is not null before accessing its stream_res. This prevents a null pointer dereference. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc.c:4140 commit_planes_for_stream() error: we previously assumed 'top_pipe_to_program' could be null (see line 3906) Cc: Tom Chung <chiahsuan.chung(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Roman Li <roman.li(a)amd.com> Cc: Alex Hung <alex.hung(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Cc: Harry Wentland <harry.wentland(a)amd.com> Cc: Hamza Mahfooz <hamza.mahfooz(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c index 50e643bfdfba..0b2eb2a6c8e1 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc.c @@ -3797,7 +3797,8 @@ static void commit_planes_for_stream(struct dc *dc, } if ((update_type != UPDATE_TYPE_FAST) && stream->update_flags.bits.dsc_changed) - if (top_pipe_to_program->stream_res.tg->funcs->lock_doublebuffer_enable) { + if (top_pipe_to_program && + top_pipe_to_program->stream_res.tg->funcs->lock_doublebuffer_enable) { top_pipe_to_program->stream_res.tg->funcs->wait_for_state( top_pipe_to_program->stream_res.tg, CRTC_STATE_VACTIVE); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream
by Jinjiang Tu 04 Nov '24

04 Nov '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> stable inclusion from stable-v5.10.227 commit 1ebfa6663807c144be8c8b6727375012409d2356 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRAE CVE: CVE-2024-49913 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 66d71a72539e173a9b00ca0b1852cbaa5f5bf1ad ] This commit addresses a null pointer dereference issue in the `commit_planes_for_stream` function at line 4140. The issue could occur when `top_pipe_to_program` is null. The fix adds a check to ensure `top_pipe_to_program` is not null before accessing its stream_res. This prevents a null pointer dereference. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc.c:4140 commit_planes_for_stream() error: we previously assumed 'top_pipe_to_program' could be null (see line 3906) Cc: Tom Chung <chiahsuan.chung(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Roman Li <roman.li(a)amd.com> Cc: Alex Hung <alex.hung(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Cc: Harry Wentland <harry.wentland(a)amd.com> Cc: Hamza Mahfooz <hamza.mahfooz(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c index adcf5ba83703..5adf00326212 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc.c @@ -2608,7 +2608,8 @@ static void commit_planes_for_stream(struct dc *dc, dc->hwss.pipe_control_lock(dc, top_pipe_to_program, false); if ((update_type != UPDATE_TYPE_FAST) && stream->update_flags.bits.dsc_changed) - if (top_pipe_to_program->stream_res.tg->funcs->lock_doublebuffer_enable) { + if (top_pipe_to_program && + top_pipe_to_program->stream_res.tg->funcs->lock_doublebuffer_enable) { top_pipe_to_program->stream_res.tg->funcs->wait_for_state( top_pipe_to_program->stream_res.tg, CRTC_STATE_VACTIVE); -- 2.34.1

2 1

[PATCH OLK-5.10] drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream
by Jinjiang Tu 04 Nov '24

04 Nov '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> stable inclusion from stable-v5.10.227 commit 1ebfa6663807c144be8c8b6727375012409d2356 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRAE CVE: CVE-2024-49913 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 66d71a72539e173a9b00ca0b1852cbaa5f5bf1ad ] This commit addresses a null pointer dereference issue in the `commit_planes_for_stream` function at line 4140. The issue could occur when `top_pipe_to_program` is null. The fix adds a check to ensure `top_pipe_to_program` is not null before accessing its stream_res. This prevents a null pointer dereference. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc.c:4140 commit_planes_for_stream() error: we previously assumed 'top_pipe_to_program' could be null (see line 3906) Cc: Tom Chung <chiahsuan.chung(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Roman Li <roman.li(a)amd.com> Cc: Alex Hung <alex.hung(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Cc: Harry Wentland <harry.wentland(a)amd.com> Cc: Hamza Mahfooz <hamza.mahfooz(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c index adcf5ba83703..5adf00326212 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc.c @@ -2608,7 +2608,8 @@ static void commit_planes_for_stream(struct dc *dc, dc->hwss.pipe_control_lock(dc, top_pipe_to_program, false); if ((update_type != UPDATE_TYPE_FAST) && stream->update_flags.bits.dsc_changed) - if (top_pipe_to_program->stream_res.tg->funcs->lock_doublebuffer_enable) { + if (top_pipe_to_program && + top_pipe_to_program->stream_res.tg->funcs->lock_doublebuffer_enable) { top_pipe_to_program->stream_res.tg->funcs->wait_for_state( top_pipe_to_program->stream_res.tg, CRTC_STATE_VACTIVE); -- 2.34.1

2 1

[PATCH OLK-5.10] drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]
by Zheng Zucheng 04 Nov '24

04 Nov '24

From: Alex Hung <alex.hung(a)amd.com> mainline inclusion from mainline-v6.11-rc1 commit b38a4815f79b87efb196cd5121579fc51e29a7fb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAUA64 CVE: CVE-2024-46815 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [WHY & HOW] num_valid_sets needs to be checked to avoid a negative index when accessing reader_wm_sets[num_valid_sets - 1]. This fixes an OVERRUN issue reported by Coverity. Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c index 0eba391e597f..40d03f8cde2c 100644 --- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c +++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c @@ -455,7 +455,8 @@ static void build_watermark_ranges(struct clk_bw_params *bw_params, struct pp_sm ranges->reader_wm_sets[num_valid_sets].max_fill_clk_mhz = PP_SMU_WM_SET_RANGE_CLK_UNCONSTRAINED_MAX; /* Modify previous watermark range to cover up to max */ - ranges->reader_wm_sets[num_valid_sets - 1].max_fill_clk_mhz = PP_SMU_WM_SET_RANGE_CLK_UNCONSTRAINED_MAX; + if (num_valid_sets > 0) + ranges->reader_wm_sets[num_valid_sets - 1].max_fill_clk_mhz = PP_SMU_WM_SET_RANGE_CLK_UNCONSTRAINED_MAX; } num_valid_sets++; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]
by Zheng Zucheng 04 Nov '24

04 Nov '24

From: Alex Hung <alex.hung(a)amd.com> mainline inclusion from mainline-v6.11-rc1 commit b38a4815f79b87efb196cd5121579fc51e29a7fb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAUA64 CVE: CVE-2024-46815 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [WHY & HOW] num_valid_sets needs to be checked to avoid a negative index when accessing reader_wm_sets[num_valid_sets - 1]. This fixes an OVERRUN issue reported by Coverity. Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c index 0eba391e597f..40d03f8cde2c 100644 --- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c +++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c @@ -455,7 +455,8 @@ static void build_watermark_ranges(struct clk_bw_params *bw_params, struct pp_sm ranges->reader_wm_sets[num_valid_sets].max_fill_clk_mhz = PP_SMU_WM_SET_RANGE_CLK_UNCONSTRAINED_MAX; /* Modify previous watermark range to cover up to max */ - ranges->reader_wm_sets[num_valid_sets - 1].max_fill_clk_mhz = PP_SMU_WM_SET_RANGE_CLK_UNCONSTRAINED_MAX; + if (num_valid_sets > 0) + ranges->reader_wm_sets[num_valid_sets - 1].max_fill_clk_mhz = PP_SMU_WM_SET_RANGE_CLK_UNCONSTRAINED_MAX; } num_valid_sets++; } -- 2.34.1

2 1

[PATCH OLK-5.10] drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]
by Zheng Zucheng 04 Nov '24

04 Nov '24

From: Alex Hung <alex.hung(a)amd.com> mainline inclusion from mainline-v6.11-rc1 commit b38a4815f79b87efb196cd5121579fc51e29a7fb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAUA64 CVE: CVE-2024-46815 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [WHY & HOW] num_valid_sets needs to be checked to avoid a negative index when accessing reader_wm_sets[num_valid_sets - 1]. This fixes an OVERRUN issue reported by Coverity. Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c index 0eba391e597f..40d03f8cde2c 100644 --- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c +++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c @@ -455,7 +455,8 @@ static void build_watermark_ranges(struct clk_bw_params *bw_params, struct pp_sm ranges->reader_wm_sets[num_valid_sets].max_fill_clk_mhz = PP_SMU_WM_SET_RANGE_CLK_UNCONSTRAINED_MAX; /* Modify previous watermark range to cover up to max */ - ranges->reader_wm_sets[num_valid_sets - 1].max_fill_clk_mhz = PP_SMU_WM_SET_RANGE_CLK_UNCONSTRAINED_MAX; + if (num_valid_sets > 0) + ranges->reader_wm_sets[num_valid_sets - 1].max_fill_clk_mhz = PP_SMU_WM_SET_RANGE_CLK_UNCONSTRAINED_MAX; } num_valid_sets++; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]
by Zheng Zucheng 04 Nov '24

04 Nov '24

From: Alex Hung <alex.hung(a)amd.com> mainline inclusion from mainline-v6.11-rc1 commit b38a4815f79b87efb196cd5121579fc51e29a7fb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAUA64 CVE: CVE-2024-46815 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [WHY & HOW] num_valid_sets needs to be checked to avoid a negative index when accessing reader_wm_sets[num_valid_sets - 1]. This fixes an OVERRUN issue reported by Coverity. Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c index 0eba391e597f..40d03f8cde2c 100644 --- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c +++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c @@ -455,7 +455,8 @@ static void build_watermark_ranges(struct clk_bw_params *bw_params, struct pp_sm ranges->reader_wm_sets[num_valid_sets].max_fill_clk_mhz = PP_SMU_WM_SET_RANGE_CLK_UNCONSTRAINED_MAX; /* Modify previous watermark range to cover up to max */ - ranges->reader_wm_sets[num_valid_sets - 1].max_fill_clk_mhz = PP_SMU_WM_SET_RANGE_CLK_UNCONSTRAINED_MAX; + if (num_valid_sets > 0) + ranges->reader_wm_sets[num_valid_sets - 1].max_fill_clk_mhz = PP_SMU_WM_SET_RANGE_CLK_UNCONSTRAINED_MAX; } num_valid_sets++; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/2] fix CVE-2024-47723
by Jinjiang Tu 04 Nov '24

04 Nov '24

Dave Kleikamp (1): jfs: Fix sanity check in dbMount Jeongjun Park (1): jfs: fix out-of-bounds in dbNextAG() and diAlloc() fs/jfs/jfs_dmap.c | 4 ++-- fs/jfs/jfs_imap.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] fix CVE-2024-47723
by Jinjiang Tu 04 Nov '24

04 Nov '24

Dave Kleikamp (1): jfs: Fix sanity check in dbMount Jeongjun Park (1): jfs: fix out-of-bounds in dbNextAG() and diAlloc() fs/jfs/jfs_dmap.c | 4 ++-- fs/jfs/jfs_imap.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) -- 2.34.1

2 3

[openeuler:openEuler-1.0-LTS 1225/1225] drivers/fpga/dfl.o: warning: objtool: build_info_commit_dev()+0x75: unreachable instruction
by kernel test robot 04 Nov '24

04 Nov '24

Hi Scott, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e833cceaa63f729c44be494d90d6ee3bfaf22faf commit: 99e28159a079ea6af5a5b789e83b68240d67f9ff [1225/1225] fpga: dfl: Add lockdep classes for pdata->lock config: x86_64-buildonly-randconfig-002-20241028 (https://download.01.org/0day-ci/archive/20241104/202411040906.Y94avIn6-lkp@…) compiler: clang version 19.1.2 (https://github.com/llvm/llvm-project 7ba7d8e2f7b6445b60679da826210cdde29eaf8b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241104/202411040906.Y94avIn6-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411040906.Y94avIn6-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/fpga/dfl.c:57: warning: cannot understand function prototype: 'struct dfl_dev_info ' drivers/fpga/dfl.c:77: warning: cannot understand function prototype: 'struct dfl_chardev_info ' >> drivers/fpga/dfl.o: warning: objtool: build_info_commit_dev()+0x75: unreachable instruction drivers/fpga/dfl.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] bpf: Fix a sdiv overflow issue
by Xiaomeng Zhang 04 Nov '24

04 Nov '24

From: Yonghong Song <yonghong.song(a)linux.dev> mainline inclusion from mainline-v6.12-rc1 commit 7dd34d7b7dcf9309fc6224caf4dd5b35bedddcb7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCO CVE: CVE-2024-49888 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Zac Ecob reported a problem where a bpf program may cause kernel crash due to the following error: Oops: divide error: 0000 [#1] PREEMPT SMP KASAN PTI The failure is due to the below signed divide: LLONG_MIN/-1 where LLONG_MIN equals to -9,223,372,036,854,775,808. LLONG_MIN/-1 is supposed to give a positive number 9,223,372,036,854,775,808, but it is impossible since for 64-bit system, the maximum positive number is 9,223,372,036,854,775,807. On x86_64, LLONG_MIN/-1 will cause a kernel exception. On arm64, the result for LLONG_MIN/-1 is LLONG_MIN. Further investigation found all the following sdiv/smod cases may trigger an exception when bpf program is running on x86_64 platform: - LLONG_MIN/-1 for 64bit operation - INT_MIN/-1 for 32bit operation - LLONG_MIN%-1 for 64bit operation - INT_MIN%-1 for 32bit operation where -1 can be an immediate or in a register. On arm64, there are no exceptions: - LLONG_MIN/-1 = LLONG_MIN - INT_MIN/-1 = INT_MIN - LLONG_MIN%-1 = 0 - INT_MIN%-1 = 0 where -1 can be an immediate or in a register. Insn patching is needed to handle the above cases and the patched codes produced results aligned with above arm64 result. The below are pseudo codes to handle sdiv/smod exceptions including both divisor -1 and divisor 0 and the divisor is stored in a register. sdiv: tmp = rX tmp += 1 /* [-1, 0] -> [0, 1] if tmp >(unsigned) 1 goto L2 if tmp == 0 goto L1 rY = 0 L1: rY = -rY; goto L3 L2: rY /= rX L3: smod: tmp = rX tmp += 1 /* [-1, 0] -> [0, 1] if tmp >(unsigned) 1 goto L1 if tmp == 1 (is64 ? goto L2 : goto L3) rY = 0; goto L2 L1: rY %= rX L2: goto L4 // only when !is64 L3: wY = wY // only when !is64 L4: [1] https://lore.kernel.org/bpf/tPJLTEh7S_DxFEqAI2Ji5MBSoZVg7_G-Py2iaZpAaWtM961… Reported-by: Zac Ecob <zacecob(a)protonmail.com> Closes: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… Signed-off-by: Yonghong Song <yonghong.song(a)linux.dev> Acked-by: Andrii Nakryiko <andrii(a)kernel.org> Link: https://lore.kernel.org/r/20240913150326.1187788-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: kernel/bpf/verifier.c [The conflicts were due to not merge the commits 74a7e76f8335e, c3a02b0607fda] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- kernel/bpf/verifier.c | 93 +++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 89 insertions(+), 4 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index d1041517a984..723edf37aa5a 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -18903,13 +18903,46 @@ static int do_misc_fixups(struct bpf_verifier_env *env) int i, ret, cnt, delta = 0; for (i = 0; i < insn_cnt; i++, insn++) { - /* Make divide-by-zero exceptions impossible. */ + /* Make sdiv/smod divide-by-minus-one exceptions impossible. */ + if ((insn->code == (BPF_ALU64 | BPF_MOD | BPF_K) || + insn->code == (BPF_ALU64 | BPF_DIV | BPF_K) || + insn->code == (BPF_ALU | BPF_MOD | BPF_K) || + insn->code == (BPF_ALU | BPF_DIV | BPF_K)) && + insn->off == 1 && insn->imm == -1) { + bool is64 = BPF_CLASS(insn->code) == BPF_ALU64; + bool isdiv = BPF_OP(insn->code) == BPF_DIV; + struct bpf_insn *patchlet; + struct bpf_insn chk_and_sdiv[] = { + BPF_RAW_INSN((is64 ? BPF_ALU64 : BPF_ALU) | + BPF_NEG | BPF_K, insn->dst_reg, + 0, 0, 0), + }; + struct bpf_insn chk_and_smod[] = { + BPF_MOV32_IMM(insn->dst_reg, 0), + }; + + patchlet = isdiv ? chk_and_sdiv : chk_and_smod; + cnt = isdiv ? ARRAY_SIZE(chk_and_sdiv) : ARRAY_SIZE(chk_and_smod); + + new_prog = bpf_patch_insn_data(env, i + delta, patchlet, cnt); + if (!new_prog) + return -ENOMEM; + + delta += cnt - 1; + env->prog = prog = new_prog; + insn = new_prog->insnsi + i + delta; + continue; + } + + /* Make divide-by-zero and divide-by-minus-one exceptions impossible. */ if (insn->code == (BPF_ALU64 | BPF_MOD | BPF_X) || insn->code == (BPF_ALU64 | BPF_DIV | BPF_X) || insn->code == (BPF_ALU | BPF_MOD | BPF_X) || insn->code == (BPF_ALU | BPF_DIV | BPF_X)) { bool is64 = BPF_CLASS(insn->code) == BPF_ALU64; bool isdiv = BPF_OP(insn->code) == BPF_DIV; + bool is_sdiv = isdiv && insn->off == 1; + bool is_smod = !isdiv && insn->off == 1; struct bpf_insn *patchlet; struct bpf_insn chk_and_div[] = { /* [R,W]x div 0 -> 0 */ @@ -18929,10 +18962,62 @@ static int do_misc_fixups(struct bpf_verifier_env *env) BPF_JMP_IMM(BPF_JA, 0, 0, 1), BPF_MOV32_REG(insn->dst_reg, insn->dst_reg), }; + struct bpf_insn chk_and_sdiv[] = { + /* [R,W]x sdiv 0 -> 0 + * LLONG_MIN sdiv -1 -> LLONG_MIN + * INT_MIN sdiv -1 -> INT_MIN + */ + BPF_MOV64_REG(BPF_REG_AX, insn->src_reg), + BPF_RAW_INSN((is64 ? BPF_ALU64 : BPF_ALU) | + BPF_ADD | BPF_K, BPF_REG_AX, + 0, 0, 1), + BPF_RAW_INSN((is64 ? BPF_JMP : BPF_JMP32) | + BPF_JGT | BPF_K, BPF_REG_AX, + 0, 4, 1), + BPF_RAW_INSN((is64 ? BPF_JMP : BPF_JMP32) | + BPF_JEQ | BPF_K, BPF_REG_AX, + 0, 1, 0), + BPF_RAW_INSN((is64 ? BPF_ALU64 : BPF_ALU) | + BPF_MOV | BPF_K, insn->dst_reg, + 0, 0, 0), + /* BPF_NEG(LLONG_MIN) == -LLONG_MIN == LLONG_MIN */ + BPF_RAW_INSN((is64 ? BPF_ALU64 : BPF_ALU) | + BPF_NEG | BPF_K, insn->dst_reg, + 0, 0, 0), + BPF_JMP_IMM(BPF_JA, 0, 0, 1), + *insn, + }; + struct bpf_insn chk_and_smod[] = { + /* [R,W]x mod 0 -> [R,W]x */ + /* [R,W]x mod -1 -> 0 */ + BPF_MOV64_REG(BPF_REG_AX, insn->src_reg), + BPF_RAW_INSN((is64 ? BPF_ALU64 : BPF_ALU) | + BPF_ADD | BPF_K, BPF_REG_AX, + 0, 0, 1), + BPF_RAW_INSN((is64 ? BPF_JMP : BPF_JMP32) | + BPF_JGT | BPF_K, BPF_REG_AX, + 0, 3, 1), + BPF_RAW_INSN((is64 ? BPF_JMP : BPF_JMP32) | + BPF_JEQ | BPF_K, BPF_REG_AX, + 0, 3 + (is64 ? 0 : 1), 1), + BPF_MOV32_IMM(insn->dst_reg, 0), + BPF_JMP_IMM(BPF_JA, 0, 0, 1), + *insn, + BPF_JMP_IMM(BPF_JA, 0, 0, 1), + BPF_MOV32_REG(insn->dst_reg, insn->dst_reg), + }; - patchlet = isdiv ? chk_and_div : chk_and_mod; - cnt = isdiv ? ARRAY_SIZE(chk_and_div) : - ARRAY_SIZE(chk_and_mod) - (is64 ? 2 : 0); + if (is_sdiv) { + patchlet = chk_and_sdiv; + cnt = ARRAY_SIZE(chk_and_sdiv); + } else if (is_smod) { + patchlet = chk_and_smod; + cnt = ARRAY_SIZE(chk_and_smod) - (is64 ? 2 : 0); + } else { + patchlet = isdiv ? chk_and_div : chk_and_mod; + cnt = isdiv ? ARRAY_SIZE(chk_and_div) : + ARRAY_SIZE(chk_and_mod) - (is64 ? 2 : 0); + } new_prog = bpf_patch_insn_data(env, i + delta, patchlet, cnt); if (!new_prog) -- 2.34.1

2 1

[PATCH] [Backport] drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]
by Zheng Zucheng 04 Nov '24

04 Nov '24

From: Alex Hung <alex.hung(a)amd.com> stable inclusion from stable-v6.6.50 commit 21f9cb44f8c60bf6c26487d428b1a09ad3e8aebf category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAP55A Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b38a4815f79b87efb196cd5121579fc51e29a7fb ] [WHY & HOW] num_valid_sets needs to be checked to avoid a negative index when accessing reader_wm_sets[num_valid_sets - 1]. This fixes an OVERRUN issue reported by Coverity. Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c index 0c6a4ab72b1d..97cdc24cef9a 100644 --- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c +++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c @@ -484,7 +484,8 @@ static void build_watermark_ranges(struct clk_bw_params *bw_params, struct pp_sm ranges->reader_wm_sets[num_valid_sets].max_fill_clk_mhz = PP_SMU_WM_SET_RANGE_CLK_UNCONSTRAINED_MAX; /* Modify previous watermark range to cover up to max */ - ranges->reader_wm_sets[num_valid_sets - 1].max_fill_clk_mhz = PP_SMU_WM_SET_RANGE_CLK_UNCONSTRAINED_MAX; + if (num_valid_sets > 0) + ranges->reader_wm_sets[num_valid_sets - 1].max_fill_clk_mhz = PP_SMU_WM_SET_RANGE_CLK_UNCONSTRAINED_MAX; } num_valid_sets++; } -- 2.34.1

1 0

[PATCH OLK-6.6 0/2] fix CVE-2024-47704
by Jinjiang Tu 04 Nov '24

04 Nov '24

Alex Hung (2): drm/amd/display: Check link_res->hpo_dp_link_enc before using it drm/amd/display: Check link_res->hpo_dp_link_enc before using it .../drm/amd/display/dc/link/hwss/link_hwss_hpo_dp.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) -- 2.34.1

2 3

[openeuler:OLK-5.10 2284/2284] drivers/ub/urma/uburma/uburma_mmap.c:29:6: warning: no previous prototype for 'uburma_umap_priv_init'
by kernel test robot 04 Nov '24

04 Nov '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 170b758d064664f953e8f6de41dd4a3ef122443a commit: 5d130e2cfa3d2aaee4d10e18c075f6c3750600c5 [2284/2284] urma: upload kernel patch for 20240511_mig config: arm64-randconfig-003-20241029 (https://download.01.org/0day-ci/archive/20241104/202411040843.b0ebMozw-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241104/202411040843.b0ebMozw-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411040843.b0ebMozw-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/urma/uburma/uburma_mmap.c:29:6: warning: no previous prototype for 'uburma_umap_priv_init' [-Wmissing-prototypes] 29 | void uburma_umap_priv_init(struct uburma_umap_priv *priv, | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/uburma/uburma_mmap.c:42:6: warning: no previous prototype for 'uburma_unmap_vma_pages' [-Wmissing-prototypes] 42 | void uburma_unmap_vma_pages(struct uburma_file *ufile) | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/uburma/uburma_mmap.c:157:36: warning: no previous prototype for 'uburma_get_umap_ops' [-Wmissing-prototypes] 157 | const struct vm_operations_struct *uburma_get_umap_ops(void) | ^~~~~~~~~~~~~~~~~~~ -- >> drivers/ub/urma/ubcore/ubcore_tpg.c:85:6: warning: no previous prototype for 'ubcore_tpg_kref_get' [-Wmissing-prototypes] 85 | void ubcore_tpg_kref_get(struct ubcore_tpg *tpg) | ^~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_tpg.c: In function 'ubcore_find_remove_tpg': drivers/ub/urma/ubcore/ubcore_tpg.c:100:42: warning: the comparison will always evaluate as 'false' for the address of 'head' will never be NULL [-Waddress] 100 | if (&dev->ht[UBCORE_HT_TPG].head == NULL) { | ^~ In file included from drivers/ub/urma/ubcore/ubcore_hash_table.h:24, from drivers/ub/urma/ubcore/ubcore_tpg.c:23: include/urma/ubcore_types.h:178:28: note: 'head' declared here 178 | struct hlist_head *head; | ^~~~ drivers/ub/urma/ubcore/ubcore_tpg.c: In function 'ubcore_find_remove_tp_node': drivers/ub/urma/ubcore/ubcore_tpg.c:131:41: warning: the comparison will always evaluate as 'false' for the address of 'head' will never be NULL [-Waddress] 131 | if (&dev->ht[UBCORE_HT_TP].head == NULL) { | ^~ include/urma/ubcore_types.h:178:28: note: 'head' declared here 178 | struct hlist_head *head; | ^~~~ -- drivers/ub/urma/ubcore/ubcore_netlink.c:192:5: warning: no previous prototype for 'ubcore_genl_unicast' [-Wmissing-prototypes] 192 | int ubcore_genl_unicast(struct ubcore_nlmsg *req, uint32_t len) | ^~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netlink.c: In function 'ubcore_create_nl_session': >> drivers/ub/urma/ubcore/ubcore_netlink.c:89:15: warning: 'strncpy' output may be truncated copying 63 bytes from a string of length 63 [-Wstringop-truncation] 89 | (void)strncpy(s->dev_name, dev->dev_name, UBCORE_MAX_DEV_NAME - 1); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- drivers/ub/urma/ubcore/ubcore_msg.c:519:28: warning: no previous prototype for 'ubcore_asyn_send_fe2tpf_msg' [-Wmissing-prototypes] 519 | struct ubcore_msg_session *ubcore_asyn_send_fe2tpf_msg(struct ubcore_device *dev, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ In function 'ubcore_migrate_req', inlined from 'ubcore_recv_req' at drivers/ub/urma/ubcore/ubcore_msg.c:368:16: >> drivers/ub/urma/ubcore/ubcore_msg.c:264:15: warning: 'strncpy' output may be truncated copying 63 bytes from a string of length 63 [-Wstringop-truncation] 264 | (void)strncpy(mig_resp->dev_name, dev->dev_name, UBCORE_MAX_DEV_NAME - 1); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- drivers/ub/urma/ubcore/ubcore_device.c:413:6: warning: no previous prototype for 'ubcore_destroy_upi_list' [-Wmissing-prototypes] 413 | void ubcore_destroy_upi_list(struct ubcore_device *dev) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_device.c:1666:5: warning: no previous prototype for 'ubcore_dispatch_event' [-Wmissing-prototypes] 1666 | int ubcore_dispatch_event(struct ubcore_event *event) | ^~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/printk.h:7, from include/linux/kernel.h:17, from include/asm-generic/bug.h:20, from arch/arm64/include/asm/bug.h:26, from include/linux/bug.h:5, from include/linux/refcount.h:96, from include/net/net_namespace.h:9, from drivers/ub/urma/ubcore/ubcore_device.c:21: drivers/ub/urma/ubcore/ubcore_device.c: In function 'ubcore_add_ueid': include/linux/kern_levels.h:5:25: warning: too many arguments for format [-Wformat-extra-args] 5 | #define KERN_SOH "\001" /* ASCII Start Of Header */ | ^~~~~~ include/linux/kern_levels.h:11:25: note: in expansion of macro 'KERN_SOH' 11 | #define KERN_ERR KERN_SOH "3" /* error conditions */ | ^~~~~~~~ include/linux/printk.h:392:16: note: in expansion of macro 'KERN_ERR' 392 | printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__) | ^~~~~~~~ drivers/ub/urma/ubcore/ubcore_log.h:46:16: note: in expansion of macro 'pr_err' 46 | ((void)pr_##l("%s|%s:[%d]|" format, UBCORE_LOG_TAG, __func__, __LINE__, ##args)) | ^~~ drivers/ub/urma/ubcore/ubcore_log.h:57:17: note: in expansion of macro 'ubcore_default_log' 57 | ubcore_default_log(err, __VA_ARGS__); \ | ^~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_device.c:1874:17: note: in expansion of macro 'ubcore_log_err' 1874 | ubcore_log_err("failed to add ueid, ret:%d\n", | ^~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_device.c: In function 'ubcore_delete_ueid': include/linux/kern_levels.h:5:25: warning: too many arguments for format [-Wformat-extra-args] 5 | #define KERN_SOH "\001" /* ASCII Start Of Header */ | ^~~~~~ include/linux/kern_levels.h:11:25: note: in expansion of macro 'KERN_SOH' 11 | #define KERN_ERR KERN_SOH "3" /* error conditions */ | ^~~~~~~~ include/linux/printk.h:392:16: note: in expansion of macro 'KERN_ERR' 392 | printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__) | ^~~~~~~~ drivers/ub/urma/ubcore/ubcore_log.h:46:16: note: in expansion of macro 'pr_err' 46 | ((void)pr_##l("%s|%s:[%d]|" format, UBCORE_LOG_TAG, __func__, __LINE__, ##args)) | ^~~ drivers/ub/urma/ubcore/ubcore_log.h:57:17: note: in expansion of macro 'ubcore_default_log' 57 | ubcore_default_log(err, __VA_ARGS__); \ | ^~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_device.c:1896:17: note: in expansion of macro 'ubcore_log_err' 1896 | ubcore_log_err("failed to add ueid, ret:%d\n", | ^~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_device.c: At top level: drivers/ub/urma/ubcore/ubcore_device.c:2372:6: warning: no previous prototype for 'ubcore_net_exit' [-Wmissing-prototypes] 2372 | void ubcore_net_exit(struct net *net) | ^~~~~~~~~~~~~~~ In function 'ubcore_send_remove_tpf_dev_info', inlined from 'uninit_ubcore_device' at drivers/ub/urma/ubcore/ubcore_device.c:1057:37: >> drivers/ub/urma/ubcore/ubcore_device.c:823:15: warning: 'strncpy' output may be truncated copying 63 bytes from a string of length 63 [-Wstringop-truncation] 823 | (void)strncpy(data->dev_name, dev->dev_name, UBCORE_MAX_DEV_NAME - 1); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_device.c: In function 'ubcore_new_tpf_dev_msg': drivers/ub/urma/ubcore/ubcore_device.c:888:15: warning: 'strncpy' output may be truncated copying 63 bytes from a string of length 63 [-Wstringop-truncation] 888 | (void)strncpy(data->dev_name, dev->dev_name, UBCORE_MAX_DEV_NAME - 1); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_device.c:892:17: warning: 'strnlen' specified bound 64 exceeds source size 16 [-Wstringop-overread] 892 | strnlen(dev->netdev->name, UBCORE_MAX_DEV_NAME) < UBCORE_MAX_DEV_NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/ub/urma/ubcore/ubcore_device.c:32: include/linux/netdevice.h:1957:33: note: source object allocated here 1957 | char name[IFNAMSIZ]; | ^~~~ -- drivers/ub/urma/ubcore/ubcore_tp.c:70:17: warning: no previous prototype for 'ubcore_get_mtu' [-Wmissing-prototypes] 70 | enum ubcore_mtu ubcore_get_mtu(int mtu) | ^~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_tp.c:341:5: warning: no previous prototype for 'ubcore_modify_tp_state' [-Wmissing-prototypes] 341 | int ubcore_modify_tp_state(struct ubcore_device *dev, struct ubcore_tp *tp, | ^~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_tp.c: In function 'ubcore_init_create_tp_req': >> drivers/ub/urma/ubcore/ubcore_tp.c:581:15: warning: 'strncpy' output may be truncated copying 63 bytes from a string of length 63 [-Wstringop-truncation] 581 | (void)strncpy(data->dev_name, dev->dev_name, UBCORE_MAX_DEV_NAME - 1); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_tp.c: In function 'ubcore_send_del_tp_req.isra': drivers/ub/urma/ubcore/ubcore_tp.c:687:15: warning: 'strncpy' output may be truncated copying 63 bytes from a string of length 63 [-Wstringop-truncation] 687 | (void)strncpy(data->dev_name, dev->dev_name, UBCORE_MAX_DEV_NAME - 1); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- drivers/ub/urma/ubcore/ubcore_umem.c:242:21: warning: no previous prototype for 'ubcore_umem_get' [-Wmissing-prototypes] 242 | struct ubcore_umem *ubcore_umem_get(struct ubcore_device *dev, uint64_t va, | ^~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_umem.c:260:6: warning: no previous prototype for 'ubcore_umem_release' [-Wmissing-prototypes] 260 | void ubcore_umem_release(struct ubcore_umem *umem) | ^~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_umem.c:284:10: warning: no previous prototype for 'ubcore_umem_find_best_page_size' [-Wmissing-prototypes] 284 | uint64_t ubcore_umem_find_best_page_size(struct ubcore_umem *umem, uint64_t page_size_bitmap, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- drivers/ub/urma/ubcore/ubcore_netdev.c:41:25: warning: no previous prototype for 'ubcore_lookup_sip_info_without_lock' [-Wmissing-prototypes] 41 | struct ubcore_sip_info *ubcore_lookup_sip_info_without_lock( | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:75:5: warning: no previous prototype for 'ubcore_notify_uvs_del_sip' [-Wmissing-prototypes] 75 | int ubcore_notify_uvs_del_sip(struct ubcore_device *dev, | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:113:22: warning: no previous prototype for 'ubcore_new_sip_req_msg' [-Wmissing-prototypes] 113 | struct ubcore_nlmsg *ubcore_new_sip_req_msg(struct ubcore_device *dev, | ^~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:145:5: warning: no previous prototype for 'ubcore_notify_uvs_add_sip' [-Wmissing-prototypes] 145 | int ubcore_notify_uvs_add_sip(struct ubcore_device *dev, | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:177:5: warning: no previous prototype for 'ubcore_check_port_state' [-Wmissing-prototypes] 177 | int ubcore_check_port_state(struct ubcore_device *dev) | ^~~~~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_netdev.c:204:6: warning: no previous prototype for 'ubcore_fill_port_netdev' [-Wmissing-prototypes] 204 | void ubcore_fill_port_netdev(struct ubcore_device *dev, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:268:5: warning: no previous prototype for 'ubcore_set_port_netdev' [-Wmissing-prototypes] 268 | int ubcore_set_port_netdev(struct ubcore_device *dev, struct net_device *ndev, | ^~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:353:5: warning: no previous prototype for 'ubcore_unset_port_netdev' [-Wmissing-prototypes] 353 | int ubcore_unset_port_netdev(struct ubcore_device *dev, struct net_device *ndev, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:385:6: warning: no previous prototype for 'ubcore_put_port_netdev' [-Wmissing-prototypes] 385 | void ubcore_put_port_netdev(struct ubcore_device *dev) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:412:5: warning: no previous prototype for 'ubcore_sip_table_init' [-Wmissing-prototypes] 412 | int ubcore_sip_table_init(struct ubcore_sip_table *sip_table, uint32_t size) | ^~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:431:6: warning: no previous prototype for 'ubcore_sip_table_uninit' [-Wmissing-prototypes] 431 | void ubcore_sip_table_uninit(struct ubcore_sip_table *sip_table) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:442:5: warning: no previous prototype for 'ubcore_sip_idx_alloc' [-Wmissing-prototypes] 442 | int ubcore_sip_idx_alloc(struct ubcore_sip_table *sip_table) | ^~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:458:5: warning: no previous prototype for 'ubcore_sip_idx_free' [-Wmissing-prototypes] 458 | int ubcore_sip_idx_free(struct ubcore_sip_table *sip_table, uint32_t idx) | ^~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:471:5: warning: no previous prototype for 'ubcore_add_sip_entry' [-Wmissing-prototypes] 471 | int ubcore_add_sip_entry(struct ubcore_sip_table *sip_table, const struct ubcore_sip_info *sip, | ^~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:489:5: warning: no previous prototype for 'ubcore_del_sip_entry' [-Wmissing-prototypes] 489 | int ubcore_del_sip_entry(struct ubcore_sip_table *sip_table, uint32_t idx) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_netdev.c:519:5: warning: no previous prototype for 'ubcore_update_sip_entry' [-Wmissing-prototypes] 519 | int ubcore_update_sip_entry(struct ubcore_sip_table *sip_table, struct ubcore_sip_info *new_sip, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:548:5: warning: no previous prototype for 'ubcore_lookup_sip_idx' [-Wmissing-prototypes] 548 | int ubcore_lookup_sip_idx(struct ubcore_sip_table *sip_table, struct ubcore_sip_info *sip, | ^~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c: In function 'ubcore_set_port_netdev': drivers/ub/urma/ubcore/ubcore_netdev.c:275:17: warning: 'strnlen' specified bound 64 exceeds source size 21 [-Wstringop-overread] 275 | strnlen(netdev_name(ndev), UBCORE_MAX_DEV_NAME) >= UBCORE_MAX_DEV_NAME) { | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c: In function 'ubcore_unset_port_netdev': drivers/ub/urma/ubcore/ubcore_netdev.c:360:17: warning: 'strnlen' specified bound 64 exceeds source size 21 [-Wstringop-overread] 360 | strnlen(netdev_name(ndev), UBCORE_MAX_DEV_NAME) >= UBCORE_MAX_DEV_NAME) { | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- drivers/ub/urma/ubcore/ubcore_vtp.c:337:6: warning: no previous prototype for 'ubcore_hash_table_rmv_vtpn' [-Wmissing-prototypes] 337 | void ubcore_hash_table_rmv_vtpn(struct ubcore_device *dev, struct ubcore_vtpn *vtpn, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ In function 'ubcore_send_create_vtp_req', inlined from 'ubcore_connect_vtp' at drivers/ub/urma/ubcore/ubcore_vtp.c:419:8: >> drivers/ub/urma/ubcore/ubcore_vtp.c:93:15: warning: 'strncpy' output may be truncated copying 63 bytes from a string of length 63 [-Wstringop-truncation] 93 | (void)strncpy(create->dev_name, dev->dev_name, UBCORE_MAX_DEV_NAME - 1); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/uburma_umap_priv_init +29 drivers/ub/urma/uburma/uburma_mmap.c 28 > 29 void uburma_umap_priv_init(struct uburma_umap_priv *priv, 30 struct vm_area_struct *vma) 31 { 32 struct uburma_file *ufile = vma->vm_file->private_data; 33 34 priv->vma = vma; 35 vma->vm_private_data = priv; 36 37 mutex_lock(&ufile->umap_mutex); 38 list_add(&priv->node, &ufile->umaps_list); 39 mutex_unlock(&ufile->umap_mutex); 40 } 41 > 42 void uburma_unmap_vma_pages(struct uburma_file *ufile) 43 { 44 struct uburma_umap_priv *priv, *next_priv; 45 struct mm_struct *mm = NULL; 46 struct vm_area_struct *vma; 47 int ret; 48 49 lockdep_assert_held(&ufile->cleanup_rwsem); 50 51 while (1) { 52 mutex_lock(&ufile->umap_mutex); 53 list_for_each_entry_safe(priv, next_priv, &ufile->umaps_list, node) { 54 mm = priv->vma->vm_mm; 55 ret = mmget_not_zero(mm); 56 if (ret != 0) { 57 list_del_init(&priv->node); 58 mm = NULL; 59 continue; 60 } 61 break; 62 } 63 mutex_unlock(&ufile->umap_mutex); 64 if (!mm) 65 return; 66 67 mmap_read_lock(mm); 68 mutex_lock(&ufile->umap_mutex); 69 list_for_each_entry_safe(priv, next_priv, &ufile->umaps_list, node) { 70 vma = priv->vma; 71 if (vma->vm_mm != mm) 72 continue; 73 list_del_init(&priv->node); 74 zap_vma_ptes(vma, vma->vm_start, vma->vm_end - vma->vm_start); 75 } 76 mutex_unlock(&ufile->umap_mutex); 77 mmap_read_unlock(mm); 78 mmput(mm); 79 } 80 } 81 82 static void uburma_umap_open(struct vm_area_struct *vma) 83 { 84 struct uburma_file *ufile = vma->vm_file->private_data; 85 struct uburma_umap_priv *priv; 86 87 if (!down_read_trylock(&ufile->cleanup_rwsem)) 88 goto out_zap; 89 90 priv = kzalloc(sizeof(*priv), GFP_KERNEL); 91 if (!priv) 92 goto out_unlock; 93 94 uburma_umap_priv_init(priv, vma); 95 96 up_read(&ufile->cleanup_rwsem); 97 return; 98 99 out_unlock: 100 up_read(&ufile->cleanup_rwsem); 101 out_zap: 102 vma->vm_private_data = NULL; 103 zap_vma_ptes(vma, vma->vm_start, vma->vm_end - vma->vm_start); 104 } 105 106 static void uburma_umap_close(struct vm_area_struct *vma) 107 { 108 struct uburma_file *ufile = vma->vm_file->private_data; 109 struct uburma_umap_priv *priv = vma->vm_private_data; 110 111 if (!priv) 112 return; 113 114 mutex_lock(&ufile->umap_mutex); 115 list_del(&priv->node); 116 mutex_unlock(&ufile->umap_mutex); 117 kfree(priv); 118 vma->vm_private_data = NULL; 119 } 120 121 static vm_fault_t uburma_umap_fault(struct vm_fault *vmf) 122 { 123 struct uburma_file *ufile = vmf->vma->vm_file->private_data; 124 struct uburma_umap_priv *priv = vmf->vma->vm_private_data; 125 vm_fault_t ret = 0; 126 127 if (!priv) 128 return VM_FAULT_SIGBUS; 129 130 if (!(vmf->vma->vm_flags & (VM_WRITE | VM_MAYWRITE))) { 131 vmf->page = ZERO_PAGE(0); 132 get_page(vmf->page); 133 return 0; 134 } 135 136 mutex_lock(&ufile->umap_mutex); 137 if (!ufile->fault_page) 138 ufile->fault_page = alloc_pages(vmf->gfp_mask | __GFP_ZERO, 0); 139 140 if (ufile->fault_page) { 141 vmf->page = ufile->fault_page; 142 get_page(vmf->page); 143 } else { 144 ret = VM_FAULT_SIGBUS; 145 } 146 mutex_unlock(&ufile->umap_mutex); 147 148 return ret; 149 } 150 151 static const struct vm_operations_struct g_urma_umap_ops = { 152 .open = uburma_umap_open, 153 .close = uburma_umap_close, 154 .fault = uburma_umap_fault, 155 }; 156 > 157 const struct vm_operations_struct *uburma_get_umap_ops(void) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1231/1231] drivers/mailbox/.tmp_imx-mailbox.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 04 Nov '24

04 Nov '24

Hi Oleksij, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e833cceaa63f729c44be494d90d6ee3bfaf22faf commit: 2bb7005696e2246baa88772341ca032ff09a63cb [1231/1231] mailbox: Add support for i.MX messaging unit config: x86_64-buildonly-randconfig-003-20241029 (https://download.01.org/0day-ci/archive/20241104/202411040741.i4aXeK6b-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241104/202411040741.i4aXeK6b-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411040741.i4aXeK6b-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/mailbox/imx-mailbox.c:11: include/linux/module.h:138:14: warning: 'cleanup_module' specifies less restrictive attribute than its target 'imx_mu_driver_exit': 'cold' [-Wmissing-attributes] 138 | void cleanup_module(void) __attribute__((alias(#exitfn))); | ^~~~~~~~~~~~~~ include/linux/device.h:1558:1: note: in expansion of macro 'module_exit' 1558 | module_exit(__driver##_exit); | ^~~~~~~~~~~ include/linux/platform_device.h:228:9: note: in expansion of macro 'module_driver' 228 | module_driver(__platform_driver, platform_driver_register, \ | ^~~~~~~~~~~~~ drivers/mailbox/imx-mailbox.c:354:1: note: in expansion of macro 'module_platform_driver' 354 | module_platform_driver(imx_mu_driver); | ^~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/mailbox_controller.h:13, from drivers/mailbox/imx-mailbox.c:10: drivers/mailbox/imx-mailbox.c:354:24: note: 'cleanup_module' target declared here 354 | module_platform_driver(imx_mu_driver); | ^~~~~~~~~~~~~ include/linux/device.h:1554:20: note: in definition of macro 'module_driver' 1554 | static void __exit __driver##_exit(void) \ | ^~~~~~~~ drivers/mailbox/imx-mailbox.c:354:1: note: in expansion of macro 'module_platform_driver' 354 | module_platform_driver(imx_mu_driver); | ^~~~~~~~~~~~~~~~~~~~~~ include/linux/module.h:132:13: warning: 'init_module' specifies less restrictive attribute than its target 'imx_mu_driver_init': 'cold' [-Wmissing-attributes] 132 | int init_module(void) __attribute__((alias(#initfn))); | ^~~~~~~~~~~ include/linux/device.h:1553:1: note: in expansion of macro 'module_init' 1553 | module_init(__driver##_init); \ | ^~~~~~~~~~~ include/linux/platform_device.h:228:9: note: in expansion of macro 'module_driver' 228 | module_driver(__platform_driver, platform_driver_register, \ | ^~~~~~~~~~~~~ drivers/mailbox/imx-mailbox.c:354:1: note: in expansion of macro 'module_platform_driver' 354 | module_platform_driver(imx_mu_driver); | ^~~~~~~~~~~~~~~~~~~~~~ drivers/mailbox/imx-mailbox.c:354:24: note: 'init_module' target declared here 354 | module_platform_driver(imx_mu_driver); | ^~~~~~~~~~~~~ include/linux/device.h:1549:19: note: in definition of macro 'module_driver' 1549 | static int __init __driver##_init(void) \ | ^~~~~~~~ drivers/mailbox/imx-mailbox.c:354:1: note: in expansion of macro 'module_platform_driver' 354 | module_platform_driver(imx_mu_driver); | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/mailbox/.tmp_imx-mailbox.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1223/1223] fs/ubifs/lpt_commit.o: warning: objtool: missing symbol for section .text.unlikely
by kernel test robot 04 Nov '24

04 Nov '24

Hi Richard, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e833cceaa63f729c44be494d90d6ee3bfaf22faf commit: 2e52eb74463f15c745d64948cedfaee722d6268c [1223/1223] ubifs: Rework ubifs_assert() config: x86_64-buildonly-randconfig-006-20241027 (https://download.01.org/0day-ci/archive/20241104/202411040610.HRP3j0oX-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241104/202411040610.HRP3j0oX-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411040610.HRP3j0oX-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/ubifs/lpt_commit.o: warning: objtool: missing symbol for section .text.unlikely -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1245/1245] drivers/powercap/intel_rapl_msr.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 04 Nov '24

04 Nov '24

Hi Zhang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e833cceaa63f729c44be494d90d6ee3bfaf22faf commit: 0ea5d304521b68fb459c57e55f3f1bd853127bc7 [1245/1245] intel_rapl: abstract RAPL common code config: x86_64-buildonly-randconfig-005-20241031 (https://download.01.org/0day-ci/archive/20241104/202411040437.gAyBpy1E-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241104/202411040437.gAyBpy1E-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411040437.gAyBpy1E-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/powercap/intel_rapl_msr.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2284/2284] drivers/ub/urma/ubcore/ubcore_tpg.c:113:42: warning: the comparison will always evaluate as 'false' for the address of 'head' will never be NULL
by kernel test robot 04 Nov '24

04 Nov '24

Hi WenChen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 170b758d064664f953e8f6de41dd4a3ef122443a commit: 6d14be01fcb032c478cd4669b32526fda0393195 [2284/2284] urma: upload kernel patch for 20240318_happy_birthday config: arm64-randconfig-003-20241029 (https://download.01.org/0day-ci/archive/20241104/202411040331.VqatFZsL-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241104/202411040331.VqatFZsL-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411040331.VqatFZsL-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/ub/urma/ubcore/ubcore_tpg.c: In function 'ubcore_find_remove_tpg': >> drivers/ub/urma/ubcore/ubcore_tpg.c:113:42: warning: the comparison will always evaluate as 'false' for the address of 'head' will never be NULL [-Waddress] 113 | if (&dev->ht[UBCORE_HT_TPG].head == NULL) { | ^~ In file included from drivers/ub/urma/ubcore/ubcore_hash_table.h:24, from drivers/ub/urma/ubcore/ubcore_tpg.c:23: include/urma/ubcore_types.h:162:28: note: 'head' declared here 162 | struct hlist_head *head; | ^~~~ drivers/ub/urma/ubcore/ubcore_tpg.c: In function 'ubcore_find_remove_tp_node': drivers/ub/urma/ubcore/ubcore_tpg.c:149:44: warning: the comparison will always evaluate as 'false' for the address of 'head' will never be NULL [-Waddress] 149 | if (&dev->ht[UBCORE_HT_UB_TP].head == NULL) { | ^~ include/urma/ubcore_types.h:162:28: note: 'head' declared here 162 | struct hlist_head *head; | ^~~~ -- >> drivers/ub/urma/ubcore/ubcore_netlink.c:185:5: warning: no previous prototype for 'ubcore_genl_unicast' [-Wmissing-prototypes] 185 | int ubcore_genl_unicast(struct ubcore_nlmsg *req, uint32_t len) | ^~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netlink.c: In function 'ubcore_create_nl_session': drivers/ub/urma/ubcore/ubcore_netlink.c:87:15: warning: 'strncpy' specified bound depends on the length of the source argument [-Wstringop-truncation] 87 | (void)strncpy(s->dev_name, dev->dev_name, strlen(dev->dev_name)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netlink.c:87:15: note: length computed here 87 | (void)strncpy(s->dev_name, dev->dev_name, strlen(dev->dev_name)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/ub/urma/ubcore/ubcore_msg.c:433:28: warning: no previous prototype for 'ubcore_asyn_send_fe2tpf_msg' [-Wmissing-prototypes] 433 | struct ubcore_msg_session *ubcore_asyn_send_fe2tpf_msg(struct ubcore_device *dev, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ In function 'ubcore_migrate_req', inlined from 'ubcore_recv_req' at drivers/ub/urma/ubcore/ubcore_msg.c:282:16: drivers/ub/urma/ubcore/ubcore_msg.c:261:15: warning: 'strncpy' specified bound depends on the length of the source argument [-Wstringop-truncation] 261 | (void)strncpy(mig_resp->dev_name, dev->dev_name, strlen(dev->dev_name)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_msg.c:261:15: note: length computed here 261 | (void)strncpy(mig_resp->dev_name, dev->dev_name, strlen(dev->dev_name)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- drivers/ub/urma/ubcore/ubcore_utp.c: In function 'ubcore_find_remove_utp': >> drivers/ub/urma/ubcore/ubcore_utp.c:139:42: warning: the comparison will always evaluate as 'false' for the address of 'head' will never be NULL [-Waddress] 139 | if (&dev->ht[UBCORE_HT_UTP].head == NULL) { | ^~ In file included from drivers/ub/urma/ubcore/ubcore_hash_table.h:24, from drivers/ub/urma/ubcore/ubcore_utp.c:23: include/urma/ubcore_types.h:162:28: note: 'head' declared here 162 | struct hlist_head *head; | ^~~~ -- drivers/ub/urma/ubcore/ubcore_ctp.c: In function 'ubcore_find_remove_ctp': >> drivers/ub/urma/ubcore/ubcore_ctp.c:114:42: warning: the comparison will always evaluate as 'false' for the address of 'head' will never be NULL [-Waddress] 114 | if (&dev->ht[UBCORE_HT_CTP].head == NULL) { | ^~ In file included from drivers/ub/urma/ubcore/ubcore_hash_table.h:24, from drivers/ub/urma/ubcore/ubcore_ctp.c:23: include/urma/ubcore_types.h:162:28: note: 'head' declared here 162 | struct hlist_head *head; | ^~~~ -- drivers/ub/urma/ubcore/ubcore_device.c:409:6: warning: no previous prototype for 'ubcore_destroy_upi_list' [-Wmissing-prototypes] 409 | void ubcore_destroy_upi_list(struct ubcore_device *dev) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_device.c:504:23: warning: no previous prototype for 'ubcore_find_tpf_device_legacy' [-Wmissing-prototypes] 504 | struct ubcore_device *ubcore_find_tpf_device_legacy(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_device.c:1637:5: warning: no previous prototype for 'ubcore_dispatch_event' [-Wmissing-prototypes] 1637 | int ubcore_dispatch_event(struct ubcore_event *event) | ^~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/printk.h:7, from include/linux/kernel.h:17, from include/asm-generic/bug.h:20, from arch/arm64/include/asm/bug.h:26, from include/linux/bug.h:5, from include/linux/refcount.h:96, from include/net/net_namespace.h:9, from drivers/ub/urma/ubcore/ubcore_device.c:21: drivers/ub/urma/ubcore/ubcore_device.c: In function 'ubcore_add_ueid': include/linux/kern_levels.h:5:25: warning: too many arguments for format [-Wformat-extra-args] 5 | #define KERN_SOH "\001" /* ASCII Start Of Header */ | ^~~~~~ include/linux/kern_levels.h:11:25: note: in expansion of macro 'KERN_SOH' 11 | #define KERN_ERR KERN_SOH "3" /* error conditions */ | ^~~~~~~~ include/linux/printk.h:392:16: note: in expansion of macro 'KERN_ERR' 392 | printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__) | ^~~~~~~~ drivers/ub/urma/ubcore/ubcore_log.h:46:16: note: in expansion of macro 'pr_err' 46 | ((void)pr_##l("%s|%s:[%d]|" format, UBCORE_LOG_TAG, __func__, __LINE__, ##args)) | ^~~ drivers/ub/urma/ubcore/ubcore_log.h:57:17: note: in expansion of macro 'ubcore_default_log' 57 | ubcore_default_log(err, __VA_ARGS__); \ | ^~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_device.c:1857:17: note: in expansion of macro 'ubcore_log_err' 1857 | ubcore_log_err("failed to add ueid, ret:%d\n", | ^~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_device.c: In function 'ubcore_delete_ueid': include/linux/kern_levels.h:5:25: warning: too many arguments for format [-Wformat-extra-args] 5 | #define KERN_SOH "\001" /* ASCII Start Of Header */ | ^~~~~~ include/linux/kern_levels.h:11:25: note: in expansion of macro 'KERN_SOH' 11 | #define KERN_ERR KERN_SOH "3" /* error conditions */ | ^~~~~~~~ include/linux/printk.h:392:16: note: in expansion of macro 'KERN_ERR' 392 | printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__) | ^~~~~~~~ drivers/ub/urma/ubcore/ubcore_log.h:46:16: note: in expansion of macro 'pr_err' 46 | ((void)pr_##l("%s|%s:[%d]|" format, UBCORE_LOG_TAG, __func__, __LINE__, ##args)) | ^~~ drivers/ub/urma/ubcore/ubcore_log.h:57:17: note: in expansion of macro 'ubcore_default_log' 57 | ubcore_default_log(err, __VA_ARGS__); \ | ^~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_device.c:1885:17: note: in expansion of macro 'ubcore_log_err' 1885 | ubcore_log_err("failed to add ueid, ret:%d\n", | ^~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_device.c: At top level: drivers/ub/urma/ubcore/ubcore_device.c:2389:6: warning: no previous prototype for 'ubcore_net_exit' [-Wmissing-prototypes] 2389 | void ubcore_net_exit(struct net *net) | ^~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_device.c: In function 'ubcore_new_tpf_dev_msg': >> drivers/ub/urma/ubcore/ubcore_device.c:913:21: warning: 'strnlen' specified bound 64 exceeds source size 16 [-Wstringop-overread] 913 | if (strnlen(dev->netdev->name, UBCORE_MAX_DEV_NAME) >= UBCORE_MAX_DEV_NAME) { | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/ub/urma/ubcore/ubcore_device.c:32: include/linux/netdevice.h:1957:33: note: source object allocated here 1957 | char name[IFNAMSIZ]; | ^~~~ -- >> drivers/ub/urma/ubcore/ubcore_netdev.c:40:25: warning: no previous prototype for 'ubcore_lookup_sip_info_without_lock' [-Wmissing-prototypes] 40 | struct ubcore_sip_info *ubcore_lookup_sip_info_without_lock( | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:74:5: warning: no previous prototype for 'ubcore_notify_uvs_del_sip' [-Wmissing-prototypes] 74 | int ubcore_notify_uvs_del_sip(struct ubcore_device *dev, | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_netdev.c:112:22: warning: no previous prototype for 'ubcore_new_sip_req_msg' [-Wmissing-prototypes] 112 | struct ubcore_nlmsg *ubcore_new_sip_req_msg(struct ubcore_device *dev, | ^~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:144:5: warning: no previous prototype for 'ubcore_notify_uvs_add_sip' [-Wmissing-prototypes] 144 | int ubcore_notify_uvs_add_sip(struct ubcore_device *dev, | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:176:5: warning: no previous prototype for 'ubcore_check_port_state' [-Wmissing-prototypes] 176 | int ubcore_check_port_state(struct ubcore_device *dev, uint8_t port_idx) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:200:6: warning: no previous prototype for 'ubcore_find_port_netdev' [-Wmissing-prototypes] 200 | void ubcore_find_port_netdev(struct ubcore_device *dev, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:291:5: warning: no previous prototype for 'ubcore_set_port_netdev' [-Wmissing-prototypes] 291 | int ubcore_set_port_netdev(struct ubcore_device *dev, struct net_device *ndev, | ^~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:377:5: warning: no previous prototype for 'ubcore_unset_port_netdev' [-Wmissing-prototypes] 377 | int ubcore_unset_port_netdev(struct ubcore_device *dev, struct net_device *ndev, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:408:6: warning: no previous prototype for 'ubcore_put_port_netdev' [-Wmissing-prototypes] 408 | void ubcore_put_port_netdev(struct ubcore_device *dev) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:435:5: warning: no previous prototype for 'ubcore_sip_table_init' [-Wmissing-prototypes] 435 | int ubcore_sip_table_init(struct ubcore_sip_table *sip_table, uint32_t size) | ^~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:454:6: warning: no previous prototype for 'ubcore_sip_table_uninit' [-Wmissing-prototypes] 454 | void ubcore_sip_table_uninit(struct ubcore_sip_table *sip_table) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:465:5: warning: no previous prototype for 'ubcore_sip_idx_alloc' [-Wmissing-prototypes] 465 | int ubcore_sip_idx_alloc(struct ubcore_sip_table *sip_table) | ^~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:481:5: warning: no previous prototype for 'ubcore_sip_idx_free' [-Wmissing-prototypes] 481 | int ubcore_sip_idx_free(struct ubcore_sip_table *sip_table, uint32_t idx) | ^~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:494:5: warning: no previous prototype for 'ubcore_add_sip_entry' [-Wmissing-prototypes] 494 | int ubcore_add_sip_entry(struct ubcore_sip_table *sip_table, const struct ubcore_sip_info *sip, | ^~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:512:5: warning: no previous prototype for 'ubcore_del_sip_entry' [-Wmissing-prototypes] 512 | int ubcore_del_sip_entry(struct ubcore_sip_table *sip_table, uint32_t idx) | ^~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:542:5: warning: no previous prototype for 'ubcore_lookup_sip_idx' [-Wmissing-prototypes] 542 | int ubcore_lookup_sip_idx(struct ubcore_sip_table *sip_table, struct ubcore_sip_info *sip, | ^~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c: In function 'ubcore_set_port_netdev': >> drivers/ub/urma/ubcore/ubcore_netdev.c:298:17: warning: 'strnlen' specified bound 64 exceeds source size 21 [-Wstringop-overread] 298 | strnlen(netdev_name(ndev), UBCORE_MAX_DEV_NAME) >= UBCORE_MAX_DEV_NAME) { | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c: In function 'ubcore_unset_port_netdev': drivers/ub/urma/ubcore/ubcore_netdev.c:384:17: warning: 'strnlen' specified bound 64 exceeds source size 21 [-Wstringop-overread] 384 | strnlen(netdev_name(ndev), UBCORE_MAX_DEV_NAME) >= UBCORE_MAX_DEV_NAME) { | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +113 drivers/ub/urma/ubcore/ubcore_tpg.c 107 108 struct ubcore_tpg *ubcore_find_remove_tpg(struct ubcore_device *dev, uint32_t tpgn) 109 { 110 struct ubcore_tpg *tpg; 111 112 spin_lock(&dev->ht[UBCORE_HT_TPG].lock); > 113 if (&dev->ht[UBCORE_HT_TPG].head == NULL) { 114 spin_unlock(&dev->ht[UBCORE_HT_TPG].lock); 115 return NULL; 116 } 117 tpg = ubcore_hash_table_lookup_nolock(&dev->ht[UBCORE_HT_TPG], tpgn, &tpgn); 118 if (tpg == NULL) { 119 spin_unlock(&dev->ht[UBCORE_HT_TPG].lock); 120 return NULL; 121 } 122 if (atomic_read(&tpg->use_cnt) > 0) { 123 spin_unlock(&dev->ht[UBCORE_HT_TPG].lock); 124 ubcore_log_err("Failed to remove tpg"); 125 return NULL; 126 } 127 ubcore_hash_table_remove_nolock(&dev->ht[UBCORE_HT_TPG], &tpg->hnode); 128 spin_unlock(&dev->ht[UBCORE_HT_TPG].lock); 129 130 return tpg; 131 } 132 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1231/1231] arch/arm64/kernel/mpam/mpam_ctrlmon.c:203:38: warning: variable 'rr' set but not used
by kernel test robot 04 Nov '24

04 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e833cceaa63f729c44be494d90d6ee3bfaf22faf commit: 344e656b7d90e2c612b1d28b38031f478b6ec6a7 [1231/1231] arm64/mpam: resctrl: Rebuild configuration and monitoring pipeline config: arm64-randconfig-001-20241029 (https://download.01.org/0day-ci/archive/20241104/202411040244.T5Iwab5V-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241104/202411040244.T5Iwab5V-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411040244.T5Iwab5V-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/arm64/kernel/mpam/mpam_ctrlmon.c: In function 'resctrl_group_parse_resource': >> arch/arm64/kernel/mpam/mpam_ctrlmon.c:203:38: warning: variable 'rr' set but not used [-Wunused-but-set-variable] 203 | struct raw_resctrl_resource *rr; | ^~ arch/arm64/kernel/mpam/mpam_ctrlmon.c: In function 'resctrl_group_schemata_show': arch/arm64/kernel/mpam/mpam_ctrlmon.c:307:38: warning: variable 'rr' set but not used [-Wunused-but-set-variable] 307 | struct raw_resctrl_resource *rr; | ^~ vim +/rr +203 arch/arm64/kernel/mpam/mpam_ctrlmon.c 19cab98fba25040 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 198 19cab98fba25040 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 199 static int resctrl_group_parse_resource(char *resname, char *tok, int closid) 19cab98fba25040 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 200 { 344e656b7d90e2c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 201 struct mpam_resctrl_res *res; 19cab98fba25040 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 202 struct resctrl_resource *r; 19cab98fba25040 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 @203 struct raw_resctrl_resource *rr; 19cab98fba25040 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 204 344e656b7d90e2c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 205 for_each_supported_resctrl_exports(res) { 344e656b7d90e2c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 206 r = &res->resctrl_res; 344e656b7d90e2c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 207 19cab98fba25040 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 208 if (r->alloc_enabled) { 19cab98fba25040 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 209 rr = (struct raw_resctrl_resource *)r->res; 344e656b7d90e2c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 210 if (!strcmp(resname, r->name) && closid < 344e656b7d90e2c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 211 mpam_sysprops_num_partid()) 19cab98fba25040 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 212 return parse_line(tok, r); 19cab98fba25040 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 213 } 19cab98fba25040 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 214 } 19cab98fba25040 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 215 rdt_last_cmd_printf("unknown/unsupported resource name '%s'\n", resname); 19cab98fba25040 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 216 return -EINVAL; 19cab98fba25040 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 217 } 1abcabe9dab59ec arch/arm64/kernel/mpam_ctrlmon.c Yang Yingliang 2019-01-30 218 :::::: The code at line 203 was first introduced by commit :::::: 19cab98fba25040817f1a6b9b6b70c6b458a169a arm64/mpam: use mpam_{read/write}_sysreg_s for debug :::::: TO: Xie XiuQi <xiexiuqi(a)huawei.com> :::::: CC: Xie XiuQi <xiexiuqi(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2284/2284] drivers/ub/urma/ubcore/ubcore_vtp.c:261:6: warning: no previous prototype for 'ubcore_hash_table_rmv_vtpn'
by kernel test robot 04 Nov '24

04 Nov '24

Hi WenChen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 170b758d064664f953e8f6de41dd4a3ef122443a commit: 013280dfab06d20e73de842e8d2fc2a200055455 [2284/2284] urma: upload kernel patch for 20240224_rain config: arm64-randconfig-003-20241029 (https://download.01.org/0day-ci/archive/20241104/202411040149.WTznzl9v-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241104/202411040149.WTznzl9v-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411040149.WTznzl9v-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/urma/ubcore/ubcore_vtp.c:261:6: warning: no previous prototype for 'ubcore_hash_table_rmv_vtpn' [-Wmissing-prototypes] 261 | void ubcore_hash_table_rmv_vtpn(struct ubcore_device *dev, struct ubcore_vtpn *vtpn) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/ubcore_hash_table_rmv_vtpn +261 drivers/ub/urma/ubcore/ubcore_vtp.c 260 > 261 void ubcore_hash_table_rmv_vtpn(struct ubcore_device *dev, struct ubcore_vtpn *vtpn) 262 { 263 struct ubcore_hash_table *ht; 264 265 ht = ubcore_get_vtpn_ht(dev, vtpn->trans_mode); 266 if (ht == NULL) 267 return; 268 ubcore_hash_table_remove(ht, &vtpn->hnode); 269 } 270 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION 170b758d064664f953e8f6de41dd4a3ef122443a
by kernel test robot 04 Nov '24

04 Nov '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 170b758d064664f953e8f6de41dd4a3ef122443a !12812 serial: protect uart_port_dtr_rts() in uart_shutdown() too Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202411031516.C5nPknta-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202411031836.4wU640gU-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202411032055.ZoDSmsZX-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202411032215.Rd41GUGS-lkp@intel.com drivers/ub/urma/ubcore/ubcore_cdev_file.c:690:5: warning: no previous prototype for 'ubcore_create_port_attr_files' [-Wmissing-prototypes] drivers/ub/urma/ubcore/ubcore_cdev_file.c:797:5: warning: no previous prototype for 'ubcore_create_dev_attr_files' [-Wmissing-prototypes] drivers/ub/urma/ubcore/ubcore_cdev_file.c:810:6: warning: no previous prototype for 'ubcore_remove_port_attr_files' [-Wmissing-prototypes] drivers/ub/urma/ubcore/ubcore_cdev_file.c:820:6: warning: no previous prototype for 'ubcore_remove_dev_attr_files' [-Wmissing-prototypes] drivers/ub/urma/ubcore/ubcore_device.c:1329:5: warning: no previous prototype for 'ubcore_dispatch_event' [-Wmissing-prototypes] drivers/ub/urma/ubcore/ubcore_device.c:2015:6: warning: no previous prototype for 'ubcore_net_exit' [-Wmissing-prototypes] drivers/ub/urma/ubcore/ubcore_netdev.c:213:5: warning: no previous prototype for 'ubcore_unset_port_netdev' [-Wmissing-prototypes] drivers/ub/urma/ubcore/ubcore_tp.c:392:5: warning: no previous prototype for 'ubcore_modify_tp_state' [-Wmissing-prototypes] fs/proc/base.c:1454:6: warning: no previous prototype for 'pbha_bit0_hide_file' [-Wmissing-prototypes] Unverified Error/Warning (likely false positive, kindly check if interested): arch/x86/boot/compressed/sev-es.c:134 do_boot_stage2_vc() error: we previously assumed 'boot_ghcb' could be null (see line 131) Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_enter | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-BPF_NET_GLOBAL_PROG-when-selected-by-SCHED_TASK_RELATIONSHIP | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-PCI_IOV-when-selected-by-CRYPTO_DEV_HISI_MIGRATION | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-TASK_PLACEMENT_BY_CPU_RANGE-when-selected-by-BPF_SCHED |-- arm64-defconfig | |-- arch-arm64-kvm-cvm.c:warning:no-previous-prototype-for-kvm_cvm_create_ttt_levels | |-- arch-arm64-kvm-cvm.c:warning:no-previous-prototype-for-kvm_cvm_get_num_brps | |-- arch-arm64-kvm-cvm.c:warning:no-previous-prototype-for-kvm_cvm_get_num_wrps | |-- arch-arm64-kvm-cvm.c:warning:no-previous-prototype-for-kvm_cvm_ipa_limit | |-- arch-arm64-kvm-cvm.c:warning:no-previous-prototype-for-kvm_cvm_populate_par_region | |-- arch-arm64-kvm-cvm.c:warning:no-previous-prototype-for-kvm_cvm_supports_pmu | |-- arch-arm64-kvm-cvm.c:warning:no-previous-prototype-for-kvm_cvm_supports_sve | |-- drivers-crypto-hisilicon-qm.c:warning:strncpy-specified-bound-depends-on-the-length-of-the-source-argument | |-- drivers-net-ethernet-hisilicon-hns3-hns3_enet.c:warning:label-err_init_guid_fail-defined-but-not-used | |-- drivers-net-ethernet-hisilicon-hns3-hns3_enet.c:warning:label-out_dbg_init-defined-but-not-used | |-- drivers-net-ethernet-hisilicon-hns3-hns3_ethtool.c:warning:hns3_unic_ethtool_ops-defined-but-not-used | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_ext.c:warning:implicit-conversion-from-enum-hclge_ext_opcode_type-to-enum-hclge_opcode_type | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_main.c:warning:implicit-conversion-from-enum-hclge_ext_opcode_type-to-enum-hclge_opcode_type | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_main.c:warning:implicit-conversion-from-enum-hnae3_reset_type-to-enum-hnae3_event_type_custom | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_main.c:warning:unused-variable-ae_dev | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_mbx.c:warning:unused-variable-hdev | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_tm.c:warning:no-previous-prototype-for-hclge_mbx_set_vf_multi_tc | `-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_tm.c:warning:no-previous-prototype-for-hclge_tm_vf_tc_dwrr_cfg |-- arm64-randconfig-001-20241103 | |-- drivers-irqchip-irq-mbigen.c:warning:is_mbigen_vtimer_bypass_enabled-defined-but-not-used | |-- drivers-irqchip-irq-mbigen.c:warning:vtimer_mbigen_chip_match_cpu-defined-but-not-used | |-- drivers-irqchip-irq-mbigen.c:warning:vtimer_mbigen_chip_read_aff3-defined-but-not-used | |-- drivers-irqchip-irq-mbigen.c:warning:vtimer_mbigen_set_kvm_info-defined-but-not-used | |-- drivers-irqchip-irq-mbigen.c:warning:vtimer_mbigen_set_regs-defined-but-not-used | |-- drivers-irqchip-irq-mbigen.c:warning:vtimer_mbigen_set_type-defined-but-not-used | |-- drivers-irqchip-irq-mbigen.c:warning:vtimer_mbigen_should_probe-defined-but-not-used | `-- kernel-sched-topology.c:error:implicit-declaration-of-function-register_sysctl_init |-- arm64-randconfig-003-20241029 | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-ubcore_create_dev_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-ubcore_create_port_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-ubcore_remove_dev_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-ubcore_remove_port_attr_files | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-ubcore_dispatch_event | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-ubcore_net_exit | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_unset_port_netdev | |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:no-previous-prototype-for-ubcore_modify_tp_state | `-- fs-proc-base.c:warning:no-previous-prototype-for-pbha_bit0_hide_file |-- arm64-randconfig-003-20241103 | |-- drivers-irqchip-irq-mbigen.c:warning:is_mbigen_vtimer_bypass_enabled-defined-but-not-used | |-- drivers-irqchip-irq-mbigen.c:warning:vtimer_mbigen_chip_match_cpu-defined-but-not-used | |-- drivers-irqchip-irq-mbigen.c:warning:vtimer_mbigen_chip_read_aff3-defined-but-not-used | |-- drivers-irqchip-irq-mbigen.c:warning:vtimer_mbigen_set_kvm_info-defined-but-not-used | |-- drivers-irqchip-irq-mbigen.c:warning:vtimer_mbigen_set_regs-defined-but-not-used | |-- drivers-irqchip-irq-mbigen.c:warning:vtimer_mbigen_set_type-defined-but-not-used | `-- drivers-irqchip-irq-mbigen.c:warning:vtimer_mbigen_should_probe-defined-but-not-used |-- arm64-randconfig-004-20241103 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | `-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm |-- x86_64-allnoconfig | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-BPF_NET_GLOBAL_PROG-when-selected-by-SCHED_TASK_RELATIONSHIP | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-TASK_PLACEMENT_BY_CPU_RANGE-when-selected-by-BPF_SCHED |-- x86_64-allyesconfig | `-- drivers-net-ipvlan-ipvlan_main.c:warning:variable-old_prog-set-but-not-used |-- x86_64-buildonly-randconfig-001-20241103 | |-- kernel-sched-topology.c:error:implicit-declaration-of-function-register_sysctl_init | `-- mm-memcontrol.c:error:implicit-declaration-of-function-ksm_process_profit |-- x86_64-buildonly-randconfig-002-20241028 | `-- arch-x86-entry-vdso-vma.o:warning:objtool:find_timens_vvar_page:unreachable-instruction |-- x86_64-buildonly-randconfig-003-20241103 | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-004-20241103 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_OPCODE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn | `-- drivers-net-ipvlan-ipvlan_main.c:warning:variable-old_prog-set-but-not-used |-- x86_64-buildonly-randconfig-006-20241103 | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn-Werror-Wimplicit-function-declaration | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_OPCODE | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_SIZE | `-- drivers-gpu-drm-loongson-lsdc_plane.o:warning:objtool:lsdc_plane_init-falls-through-to-next-function-lsdc_plane_reset() |-- x86_64-kexec | `-- kernel-trace-trace_uprobe.o:warning:objtool:__uprobe_perf_func:unreachable-instruction |-- x86_64-randconfig-103-20241103 | `-- fs-ntfs3-frecord.o:warning:objtool:ni_read_frame-falls-through-to-next-function-ni_readpage_cmprcold() `-- x86_64-randconfig-161-20241029 `-- arch-x86-boot-compressed-sev-es.c-do_boot_stage2_vc()-error:we-previously-assumed-boot_ghcb-could-be-null-(see-line-) elapsed time: 726m configs tested: 24 configs skipped: 139 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20241103 gcc-14.1.0 arm64 randconfig-002-20241103 clang-20 arm64 randconfig-003-20241103 gcc-14.1.0 arm64 randconfig-004-20241103 clang-17 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241103 gcc-12 x86_64 buildonly-randconfig-002-20241103 clang-19 x86_64 buildonly-randconfig-003-20241103 clang-19 x86_64 buildonly-randconfig-004-20241103 gcc-12 x86_64 buildonly-randconfig-005-20241103 gcc-12 x86_64 buildonly-randconfig-006-20241103 clang-19 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 randconfig-001-20241103 gcc-12 x86_64 randconfig-002-20241103 clang-19 x86_64 randconfig-003-20241103 clang-19 x86_64 randconfig-004-20241103 clang-19 x86_64 randconfig-005-20241103 gcc-12 x86_64 randconfig-011-20241103 gcc-12 x86_64 rhel-8.3 gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2284/2284] drivers/ub/urma/ubcore/ubcore_device.c:1329:5: warning: no previous prototype for 'ubcore_dispatch_event'
by kernel test robot 03 Nov '24

03 Nov '24

Hi WenChen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 170b758d064664f953e8f6de41dd4a3ef122443a commit: f1753f8b17480bdb750cbd33fbaa358aef5dbb23 [2284/2284] urma: upload kernel patch for 20240219_Spring config: arm64-randconfig-003-20241029 (https://download.01.org/0day-ci/archive/20241103/202411032215.Rd41GUGS-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241103/202411032215.Rd41GUGS-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411032215.Rd41GUGS-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/ub/urma/ubcore/ubcore_device.c:352:6: warning: no previous prototype for 'ubcore_destroy_upi_list' [-Wmissing-prototypes] 352 | void ubcore_destroy_upi_list(struct ubcore_device *dev) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_device.c:440:23: warning: no previous prototype for 'ubcore_find_tpf_device_legacy' [-Wmissing-prototypes] 440 | struct ubcore_device *ubcore_find_tpf_device_legacy(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_device.c:1329:5: warning: no previous prototype for 'ubcore_dispatch_event' [-Wmissing-prototypes] 1329 | int ubcore_dispatch_event(struct ubcore_event *event) | ^~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_device.c:1454:6: warning: no previous prototype for 'ubcore_dev_accessible' [-Wmissing-prototypes] 1454 | bool ubcore_dev_accessible(struct ubcore_device *dev) | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_device.c:2015:6: warning: no previous prototype for 'ubcore_net_exit' [-Wmissing-prototypes] 2015 | void ubcore_net_exit(struct net *net) | ^~~~~~~~~~~~~~~ -- >> drivers/ub/urma/ubcore/ubcore_cdev_file.c:690:5: warning: no previous prototype for 'ubcore_create_port_attr_files' [-Wmissing-prototypes] 690 | int ubcore_create_port_attr_files(struct ubcore_logic_device *ldev, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_cdev_file.c:785:5: warning: no previous prototype for 'ubcore_create_eid_attr_files' [-Wmissing-prototypes] 785 | int ubcore_create_eid_attr_files(struct ubcore_logic_device *ldev, uint32_t eid_num) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_cdev_file.c:797:5: warning: no previous prototype for 'ubcore_create_dev_attr_files' [-Wmissing-prototypes] 797 | int ubcore_create_dev_attr_files(struct ubcore_logic_device *ldev) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_cdev_file.c:810:6: warning: no previous prototype for 'ubcore_remove_port_attr_files' [-Wmissing-prototypes] 810 | void ubcore_remove_port_attr_files(struct ubcore_logic_device *ldev, uint8_t port_id) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_cdev_file.c:815:6: warning: no previous prototype for 'ubcore_remove_eid_attr_files' [-Wmissing-prototypes] 815 | void ubcore_remove_eid_attr_files(struct ubcore_logic_device *ldev, uint32_t eid_num) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_cdev_file.c:820:6: warning: no previous prototype for 'ubcore_remove_dev_attr_files' [-Wmissing-prototypes] 820 | void ubcore_remove_dev_attr_files(struct ubcore_logic_device *ldev) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/ubcore_dispatch_event +1329 drivers/ub/urma/ubcore/ubcore_device.c 1328 > 1329 int ubcore_dispatch_event(struct ubcore_event *event) 1330 { 1331 struct ubcore_event_work *l_ubcore_event; 1332 1333 l_ubcore_event = kzalloc(sizeof(*l_ubcore_event), GFP_ATOMIC); 1334 if (!l_ubcore_event) 1335 return -ENOMEM; 1336 1337 INIT_WORK(&l_ubcore_event->work, ubcore_dispatch_event_task); 1338 l_ubcore_event->event = *event; 1339 1340 if (ubcore_queue_work((int)UBCORE_DISPATCH_EVENT_WQ, &l_ubcore_event->work) != 0) { 1341 kfree(l_ubcore_event); 1342 ubcore_log_err("Queue work failed"); 1343 } 1344 1345 return 0; 1346 } 1347 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2284/2284] fs/proc/base.c:1454:6: warning: no previous prototype for 'pbha_bit0_hide_file'
by kernel test robot 03 Nov '24

03 Nov '24

Hi Ma, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 170b758d064664f953e8f6de41dd4a3ef122443a commit: bea38841945a52bd03004240eb0da6a5115bae21 [2284/2284] arm64: mm: Hide pbha_bit0 in procfs if pbha is not enabled config: arm64-randconfig-003-20241029 (https://download.01.org/0day-ci/archive/20241103/202411032055.ZoDSmsZX-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241103/202411032055.ZoDSmsZX-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411032055.ZoDSmsZX-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/proc/base.c:1454:6: warning: no previous prototype for 'pbha_bit0_hide_file' [-Wmissing-prototypes] 1454 | bool pbha_bit0_hide_file(const char *name) | ^~~~~~~~~~~~~~~~~~~ vim +/pbha_bit0_hide_file +1454 fs/proc/base.c 1453 > 1454 bool pbha_bit0_hide_file(const char *name) 1455 { 1456 if (!system_support_pbha_bit0() && !strncmp("pbha_bit0", name, 9)) 1457 return true; 1458 1459 return false; 1460 } 1461 #else 1462 static bool pbha_bit0_hide_file(const char *name) { return false; } 1463 #endif 1464 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1245/1245] kernel/time/.tmp_hrtimer.o: warning: objtool: hrtimer_start_range_ns()+0x2b3: unreachable instruction
by kernel test robot 03 Nov '24

03 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e833cceaa63f729c44be494d90d6ee3bfaf22faf commit: 40ecfb28732cefd0c5658f7c10543bbc4cd41cb8 [1245/1245] hrtimer: Prevent queuing of hrtimer without a function callback config: x86_64-buildonly-randconfig-003-20241031 (https://download.01.org/0day-ci/archive/20241103/202411031810.7yoZknlT-lkp@…) compiler: clang version 19.1.2 (https://github.com/llvm/llvm-project 7ba7d8e2f7b6445b60679da826210cdde29eaf8b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241103/202411031810.7yoZknlT-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411031810.7yoZknlT-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/time/hrtimer.c:130:21: warning: initializer overrides prior initialization of this subobject [-Winitializer-overrides] 130 | [CLOCK_REALTIME] = HRTIMER_BASE_REALTIME, | ^~~~~~~~~~~~~~~~~~~~~ kernel/time/hrtimer.c:128:27: note: previous initialization is here 128 | [0 ... MAX_CLOCKS - 1] = HRTIMER_MAX_CLOCK_BASES, | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/time/hrtimer.c:131:22: warning: initializer overrides prior initialization of this subobject [-Winitializer-overrides] 131 | [CLOCK_MONOTONIC] = HRTIMER_BASE_MONOTONIC, | ^~~~~~~~~~~~~~~~~~~~~~ kernel/time/hrtimer.c:128:27: note: previous initialization is here 128 | [0 ... MAX_CLOCKS - 1] = HRTIMER_MAX_CLOCK_BASES, | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/time/hrtimer.c:132:21: warning: initializer overrides prior initialization of this subobject [-Winitializer-overrides] 132 | [CLOCK_BOOTTIME] = HRTIMER_BASE_BOOTTIME, | ^~~~~~~~~~~~~~~~~~~~~ kernel/time/hrtimer.c:128:27: note: previous initialization is here 128 | [0 ... MAX_CLOCKS - 1] = HRTIMER_MAX_CLOCK_BASES, | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/time/hrtimer.c:133:17: warning: initializer overrides prior initialization of this subobject [-Winitializer-overrides] 133 | [CLOCK_TAI] = HRTIMER_BASE_TAI, | ^~~~~~~~~~~~~~~~ kernel/time/hrtimer.c:128:27: note: previous initialization is here 128 | [0 ... MAX_CLOCKS - 1] = HRTIMER_MAX_CLOCK_BASES, | ^~~~~~~~~~~~~~~~~~~~~~~ 4 warnings generated. >> kernel/time/.tmp_hrtimer.o: warning: objtool: hrtimer_start_range_ns()+0x2b3: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2284/2284] drivers/ub/urma/ubcore/ubcore_tp.c:392:5: warning: no previous prototype for 'ubcore_modify_tp_state'
by kernel test robot 03 Nov '24

03 Nov '24

Hi WenChen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 170b758d064664f953e8f6de41dd4a3ef122443a commit: 329bf7f331286ee5d571d374e31ed50d2877b110 [2284/2284] ubcore: fix the bug of tp negotiation concurrency config: arm64-randconfig-003-20241029 (https://download.01.org/0day-ci/archive/20241103/202411031836.4wU640gU-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241103/202411031836.4wU640gU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411031836.4wU640gU-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/ub/urma/ubcore/ubcore_tp.c:66:17: warning: no previous prototype for 'ubcore_get_mtu' [-Wmissing-prototypes] 66 | enum ubcore_mtu ubcore_get_mtu(int mtu) | ^~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_tp.c:392:5: warning: no previous prototype for 'ubcore_modify_tp_state' [-Wmissing-prototypes] 392 | int ubcore_modify_tp_state(struct ubcore_device *dev, struct ubcore_tp *tp, | ^~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_tp.c:894:19: warning: no previous prototype for 'ubcore_create_vtp' [-Wmissing-prototypes] 894 | struct ubcore_tp *ubcore_create_vtp(struct ubcore_device *dev, union ubcore_eid *remote_eid, | ^~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_tp.c:920:5: warning: no previous prototype for 'ubcore_destroy_vtp' [-Wmissing-prototypes] 920 | int ubcore_destroy_vtp(struct ubcore_tp *vtp) | ^~~~~~~~~~~~~~~~~~ vim +/ubcore_modify_tp_state +392 drivers/ub/urma/ubcore/ubcore_tp.c 391 > 392 int ubcore_modify_tp_state(struct ubcore_device *dev, struct ubcore_tp *tp, 393 enum ubcore_tp_state new_state, struct ubcore_tp_attr *attr, union ubcore_tp_attr_mask mask) 394 { 395 if (ubcore_modify_tp_state_check(tp, new_state) != 0) 396 return -1; 397 398 if (tp->state == UBCORE_TP_STATE_ERR && new_state == UBCORE_TP_STATE_ERR) { 399 ubcore_log_info("tp is already in ERR state and tpn = %u", 400 tp->tpn); 401 return 0; 402 } 403 404 if (dev->ops->modify_tp(tp, attr, mask) != 0) { 405 /* tp->peer_ext.addr will be freed when called ubcore_destroy_tp */ 406 ubcore_log_err("Failed to modify tp to %u from state %u and tpn = %u", 407 (uint32_t)new_state, (uint32_t)tp->state, tp->tpn); 408 return -1; 409 } 410 tp->state = new_state; 411 ubcore_log_info("tp state:(%u to %u) with tpn %u, peer_tpn %u", 412 (uint32_t)tp->state, (uint32_t)new_state, tp->tpn, tp->peer_tpn); 413 return 0; 414 } 415 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] rseq/mm_cid: change the mm_cid macro default status and keep KABI consistent
by He Yujie 03 Nov '24

03 Nov '24

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB1OJX -------------------------------- Changing the mm_cid macro to disable status by modifying Kconfig: def_bool n, and reserving the field for task_struct and mm_struct by using KABI_REPLACE to keep KABI consistent. Fixes: af7f588d8f73 ("sched: Introduce per-memory-map concurrency ID") Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 2 +- arch/x86/configs/openeuler_defconfig | 2 +- include/linux/mm_types.h | 6 ++++-- include/linux/sched.h | 7 +++++++ init/Kconfig | 2 +- 5 files changed, 14 insertions(+), 5 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 96ca8b990e22..67d02760f856 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -179,7 +179,7 @@ CONFIG_FAIR_GROUP_SCHED=y CONFIG_CFS_BANDWIDTH=y CONFIG_RT_GROUP_SCHED=y CONFIG_QOS_SCHED_DYNAMIC_AFFINITY=y -CONFIG_SCHED_MM_CID=y +# CONFIG_SCHED_MM_CID is not set CONFIG_QOS_SCHED_SMART_GRID=y CONFIG_CGROUP_PIDS=y CONFIG_CGROUP_RDMA=y diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index d95d966f7fb2..ea83b730a3be 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -197,7 +197,7 @@ CONFIG_FAIR_GROUP_SCHED=y CONFIG_CFS_BANDWIDTH=y CONFIG_RT_GROUP_SCHED=y CONFIG_QOS_SCHED_DYNAMIC_AFFINITY=y -CONFIG_SCHED_MM_CID=y +# CONFIG_SCHED_MM_CID is not set # CONFIG_QOS_SCHED_SMART_GRID is not set CONFIG_CGROUP_PIDS=y CONFIG_CGROUP_RDMA=y diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h index 793c16b99237..fdc047bdbc49 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -711,12 +711,10 @@ struct vm_area_struct { KABI_RESERVE(4) } __randomize_layout; -#ifdef CONFIG_SCHED_MM_CID struct mm_cid { u64 time; int cid; }; -#endif struct kioctx_table; struct iommu_mm_data; @@ -789,6 +787,10 @@ struct mm_struct { * When the next mm_cid scan is due (in jiffies). */ unsigned long mm_cid_next_scan; +#else + KABI_REPLACE(struct mm_cid __percpu *pcpu_cid, + struct mm_cid __percpu *pcpu_cid) + KABI_REPLACE(unsigned long mm_cid_next_scan, unsigned long mm_cid_next_scan) #endif #ifdef CONFIG_MMU atomic_long_t pgtables_bytes; /* size of all page tables */ diff --git a/include/linux/sched.h b/include/linux/sched.h index f40411aa7b70..7b1c53f71ee4 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -1355,6 +1355,13 @@ struct task_struct { int migrate_from_cpu; int mm_cid_active; /* Whether cid bitmap is active */ struct callback_head cid_work; +#else + KABI_REPLACE(int mm_cid, int mm_cid) + KABI_REPLACE(int last_mm_cid, int last_mm_cid) + KABI_REPLACE(int migrate_from_cpu, int migrate_from_cpu) + KABI_REPLACE(int mm_cid_active, int mm_cid_active) + KABI_REPLACE(struct callback_head cid_work, + struct callback_head cid_work) #endif struct tlbflush_unmap_batch tlb_ubc; diff --git a/init/Kconfig b/init/Kconfig index 6ea4eafecab1..2d6ae58a5bf7 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1137,7 +1137,7 @@ config QOS_SCHED_DYNAMIC_AFFINITY cpus allowed. config SCHED_MM_CID - def_bool y + def_bool n depends on SMP && RSEQ config UCLAMP_TASK_GROUP -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1257/1257] drivers/edac/skx_base.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 03 Nov '24

03 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e833cceaa63f729c44be494d90d6ee3bfaf22faf commit: e34047f6dc606c123911c6db8fa424bb4a035262 [1257/1257] EDAC, skx_edac: Delete duplicated code config: x86_64-buildonly-randconfig-003-20241102 (https://download.01.org/0day-ci/archive/20241103/202411031540.xYeDxC2Y-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241103/202411031540.xYeDxC2Y-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411031540.xYeDxC2Y-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/edac/skx_base.o: warning: objtool: missing symbol for section .init.text -- drivers/edac/skx_common.c:470:8: warning: variable 'type' set but not used [-Wunused-but-set-variable] 470 | char *type, *optype; | ^ 1 warning generated. >> drivers/edac/skx_common.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2284/2284] drivers/ub/urma/ubcore/ubcore_netdev.c:213:5: warning: no previous prototype for 'ubcore_unset_port_netdev'
by kernel test robot 03 Nov '24

03 Nov '24

Hi Yizhen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 170b758d064664f953e8f6de41dd4a3ef122443a commit: 37c6170f742ef3a18a3131a2a157dd7b7aa08103 [2284/2284] ub: Fix bugs in urma kernel and user lib config: arm64-randconfig-003-20241029 (https://download.01.org/0day-ci/archive/20241103/202411031516.C5nPknta-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241103/202411031516.C5nPknta-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411031516.C5nPknta-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/ub/urma/ubcore/ubcore_netdev.c:51:5: warning: no previous prototype for 'ubcore_check_port_state' [-Wmissing-prototypes] 51 | int ubcore_check_port_state(struct ubcore_device *dev, uint8_t port_idx) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:75:6: warning: no previous prototype for 'ubcore_find_port_netdev' [-Wmissing-prototypes] 75 | void ubcore_find_port_netdev(struct ubcore_device *dev, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:133:5: warning: no previous prototype for 'ubcore_set_port_netdev' [-Wmissing-prototypes] 133 | int ubcore_set_port_netdev(struct ubcore_device *dev, struct net_device *ndev, | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_netdev.c:213:5: warning: no previous prototype for 'ubcore_unset_port_netdev' [-Wmissing-prototypes] 213 | int ubcore_unset_port_netdev(struct ubcore_device *dev, struct net_device *ndev, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:242:6: warning: no previous prototype for 'ubcore_put_port_netdev' [-Wmissing-prototypes] 242 | void ubcore_put_port_netdev(struct ubcore_device *dev) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:262:10: warning: no previous prototype for 'ubcore_sip_idx_alloc' [-Wmissing-prototypes] 262 | uint32_t ubcore_sip_idx_alloc(uint32_t idx) | ^~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:290:5: warning: no previous prototype for 'ubcore_sip_idx_free' [-Wmissing-prototypes] 290 | int ubcore_sip_idx_free(uint32_t idx) | ^~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:303:6: warning: no previous prototype for 'ubcore_sip_table_init' [-Wmissing-prototypes] 303 | void ubcore_sip_table_init(void) | ^~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:309:6: warning: no previous prototype for 'ubcore_sip_table_uninit' [-Wmissing-prototypes] 309 | void ubcore_sip_table_uninit(void) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:324:5: warning: no previous prototype for 'ubcore_add_sip_entry' [-Wmissing-prototypes] 324 | int ubcore_add_sip_entry(const struct ubcore_sip_info *sip, uint32_t idx) | ^~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:344:5: warning: no previous prototype for 'ubcore_del_sip_entry' [-Wmissing-prototypes] 344 | int ubcore_del_sip_entry(uint32_t idx) | ^~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:358:5: warning: no previous prototype for 'ubcore_lookup_sip_idx' [-Wmissing-prototypes] 358 | int ubcore_lookup_sip_idx(struct ubcore_sip_info *sip, uint32_t *idx) | ^~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:379:10: warning: no previous prototype for 'ubcore_get_sip_max_cnt' [-Wmissing-prototypes] 379 | uint32_t ubcore_get_sip_max_cnt(void) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:384:25: warning: no previous prototype for 'ubcore_lookup_sip_info' [-Wmissing-prototypes] 384 | struct ubcore_sip_info *ubcore_lookup_sip_info(uint32_t idx) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:395:5: warning: no previous prototype for 'ubcore_notify_uvs_del_sip' [-Wmissing-prototypes] 395 | int ubcore_notify_uvs_del_sip(struct ubcore_device *dev, | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_netdev.c:437:5: warning: no previous prototype for 'ubcore_notify_uvs_add_sip' [-Wmissing-prototypes] 437 | int ubcore_notify_uvs_add_sip(struct ubcore_device *dev, | ^~~~~~~~~~~~~~~~~~~~~~~~~ vim +/ubcore_unset_port_netdev +213 drivers/ub/urma/ubcore/ubcore_netdev.c 212 > 213 int ubcore_unset_port_netdev(struct ubcore_device *dev, struct net_device *ndev, 214 unsigned int port_id) 215 { 216 struct ubcore_ndev_port *port_info; 217 218 if (dev == NULL || ndev == NULL) { 219 ubcore_log_err("invalid input parameter.\n"); 220 return -1; 221 } 222 down_write(&g_port_list_lock); 223 list_for_each_entry(port_info, &dev->port_list, node) { 224 if (port_info->ndev == ndev) { 225 if (ubcore_del_port(port_info, (uint8_t)port_id, dev, ndev) != 0) { 226 up_write(&g_port_list_lock); 227 ubcore_log_err("Failed to do ubcore_del_port"); 228 return -1; 229 } 230 up_write(&g_port_list_lock); 231 return 0; 232 } 233 } 234 up_write(&g_port_list_lock); 235 236 ubcore_log_err("Failed to find and remove ndev:%s dev_name: %s bound port: %u\n", 237 netdev_name(ndev), dev->dev_name, port_id); 238 return -1; 239 } 240 EXPORT_SYMBOL(ubcore_unset_port_netdev); 241 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] ASoC: soc-pcm: Add NULL check in BE reparenting
by He Yujie 03 Nov '24

03 Nov '24

From: Srinivasa Rao Mandadapu <quic_srivasam(a)quicinc.com> stable inclusion from stable-v4.19.269 commit e7166d6821c15f3516bcac8ae3f155924da1908c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRF7 CVE: CVE-2022-48992 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit db8f91d424fe0ea6db337aca8bc05908bbce1498 ] Add NULL check in dpcm_be_reparent API, to handle kernel NULL pointer dereference error. The issue occurred in fuzzing test. Signed-off-by: Srinivasa Rao Mandadapu <quic_srivasam(a)quicinc.com> Link: https://lore.kernel.org/r/1669098673-29703-1-git-send-email-quic_srivasam@q… Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- sound/soc/soc-pcm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c index 551bfc581fc1..99426075d148 100644 --- a/sound/soc/soc-pcm.c +++ b/sound/soc/soc-pcm.c @@ -1263,6 +1263,8 @@ static void dpcm_be_reparent(struct snd_soc_pcm_runtime *fe, return; be_substream = snd_soc_dpcm_get_substream(be, stream); + if (!be_substream) + return; list_for_each_entry(dpcm, &be->dpcm[stream].fe_clients, list_fe) { if (dpcm->fe == fe) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ASoC: soc-pcm: Add NULL check in BE reparenting
by He Yujie 03 Nov '24

03 Nov '24

From: Srinivasa Rao Mandadapu <quic_srivasam(a)quicinc.com> stable inclusion from stable-v4.19 commit e7166d6821c15f3516bcac8ae3f155924da1908c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRF7 CVE: CVE-2022-48992 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit db8f91d424fe0ea6db337aca8bc05908bbce1498 ] Add NULL check in dpcm_be_reparent API, to handle kernel NULL pointer dereference error. The issue occurred in fuzzing test. Signed-off-by: Srinivasa Rao Mandadapu <quic_srivasam(a)quicinc.com> Link: https://lore.kernel.org/r/1669098673-29703-1-git-send-email-quic_srivasam@q… Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- sound/soc/soc-pcm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c index 551bfc581fc1..99426075d148 100644 --- a/sound/soc/soc-pcm.c +++ b/sound/soc/soc-pcm.c @@ -1263,6 +1263,8 @@ static void dpcm_be_reparent(struct snd_soc_pcm_runtime *fe, return; be_substream = snd_soc_dpcm_get_substream(be, stream); + if (!be_substream) + return; list_for_each_entry(dpcm, &be->dpcm[stream].fe_clients, list_fe) { if (dpcm->fe == fe) -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ASoC: soc-pcm: Add NULL check in BE reparenting
by He Yujie 03 Nov '24

03 Nov '24

From: Srinivasa Rao Mandadapu <quic_srivasam(a)quicinc.com> stable inclusion from stable-v5.10.159 commit f6f45e538328df9ce66aa61bafee1a5717c4b700 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7NTXH Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit db8f91d424fe0ea6db337aca8bc05908bbce1498 ] Add NULL check in dpcm_be_reparent API, to handle kernel NULL pointer dereference error. The issue occurred in fuzzing test. Signed-off-by: Srinivasa Rao Mandadapu <quic_srivasam(a)quicinc.com> Link: https://lore.kernel.org/r/1669098673-29703-1-git-send-email-quic_srivasam@q… Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- sound/soc/soc-pcm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c index 8b8a9aca2912..9a60d62f12fe 100644 --- a/sound/soc/soc-pcm.c +++ b/sound/soc/soc-pcm.c @@ -1159,6 +1159,8 @@ static void dpcm_be_reparent(struct snd_soc_pcm_runtime *fe, return; be_substream = snd_soc_dpcm_get_substream(be, stream); + if (!be_substream) + return; for_each_dpcm_fe(be, stream, dpcm) { if (dpcm->fe == fe) -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] gpiolib: fix memory leak in gpiochip_setup_dev()
by He Yujie 03 Nov '24

03 Nov '24

From: Zeng Heng <zengheng4(a)huawei.com> mainline inclusion from mainline-v6.1 commit ec851b23084b3a0af8bf0f5e51d33a8d678bdc49 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRIL CVE: CVE-2022-48975 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Here is a backtrace report about memory leak detected in gpiochip_setup_dev(): unreferenced object 0xffff88810b406400 (size 512): comm "python3", pid 1682, jiffies 4295346908 (age 24.090s) backtrace: kmalloc_trace device_add device_private_init at drivers/base/core.c:3361 (inlined by) device_add at drivers/base/core.c:3411 cdev_device_add gpiolib_cdev_register gpiochip_setup_dev gpiochip_add_data_with_key gcdev_register() & gcdev_unregister() would call device_add() & device_del() (no matter CONFIG_GPIO_CDEV is enabled or not) to register/unregister device. However, if device_add() succeeds, some resource (like struct device_private allocated by device_private_init()) is not released by device_del(). Therefore, after device_add() succeeds by gcdev_register(), it needs to call put_device() to release resource in the error handle path. Here we move forward the register of release function, and let it release every piece of resource by put_device() instead of kfree(). While at it, fix another subtle issue, i.e. when gc->ngpio is equal to 0, we still call kcalloc() and, in case of further error, kfree() on the ZERO_PTR pointer, which is not NULL. It's not a bug per se, but rather waste of the resources and potentially wrong expectation about contents of the gdev->descs variable. Fixes: 159f3cd92f17 ("gpiolib: Defer gpio device setup until after gpiolib initialization") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> Co-developed-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Conflicts: drivers/gpio/gpiolib.c [ 3cc1fb73993905b598da3802f87ac59411c52516(gpiolib: do not print err message for EPROBE_DEFER). 990f6756bb64756d2d1033118cded6333b43397d(gpiolib: allow to specify the firmware node in struct gpio_chip). 9dbd1ab20509e85cd3fac9479a00c59e83c08196(gpiolib: check the 'ngpios' property in core gpiolib code). context conflicts because the preceding three commit commands are not merge] Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/gpio/gpiolib.c | 35 ++++++++++++++++++++++------------- 1 file changed, 22 insertions(+), 13 deletions(-) diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c index 59d8affad343..3fc011d4b4aa 100644 --- a/drivers/gpio/gpiolib.c +++ b/drivers/gpio/gpiolib.c @@ -500,12 +500,13 @@ static int gpiochip_setup_dev(struct gpio_device *gdev) if (ret) return ret; + /* From this point, the .release() function cleans up gpio_device */ + gdev->dev.release = gpiodevice_release; + ret = gpiochip_sysfs_register(gdev); if (ret) goto err_remove_device; - /* From this point, the .release() function cleans up gpio_device */ - gdev->dev.release = gpiodevice_release; dev_dbg(&gdev->dev, "registered GPIOs %d to %d on %s\n", gdev->base, gdev->base + gdev->ngpio - 1, gdev->chip->label ? : "generic"); @@ -572,7 +573,7 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data, unsigned long flags; int ret = 0; unsigned i; - int base = gc->base; + int base = 0; struct gpio_device *gdev; /* @@ -624,22 +625,22 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data, else gdev->owner = THIS_MODULE; - gdev->descs = kcalloc(gc->ngpio, sizeof(gdev->descs[0]), GFP_KERNEL); - if (!gdev->descs) { - ret = -ENOMEM; - goto err_free_dev_name; - } - if (gc->ngpio == 0) { chip_err(gc, "tried to insert a GPIO chip with zero lines\n"); ret = -EINVAL; - goto err_free_descs; + goto err_free_dev_name; } if (gc->ngpio > FASTPATH_NGPIO) chip_warn(gc, "line cnt %u is greater than fast path cnt %u\n", gc->ngpio, FASTPATH_NGPIO); + gdev->descs = kcalloc(gc->ngpio, sizeof(*gdev->descs), GFP_KERNEL); + if (!gdev->descs) { + ret = -ENOMEM; + goto err_free_dev_name; + } + gdev->label = kstrdup_const(gc->label ?: "unknown", GFP_KERNEL); if (!gdev->label) { ret = -ENOMEM; @@ -658,11 +659,13 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data, * it may be a pipe dream. It will not happen before we get rid * of the sysfs interface anyways. */ + base = gc->base; if (base < 0) { base = gpiochip_find_base(gc->ngpio); if (base < 0) { - ret = base; spin_unlock_irqrestore(&gpio_lock, flags); + ret = base; + base = 0; goto err_free_label; } /* @@ -770,6 +773,11 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data, err_free_gpiochip_mask: gpiochip_remove_pin_ranges(gc); gpiochip_free_valid_mask(gc); + if (gdev->dev.release) { + /* release() has been registered by gpiochip_setup_dev() */ + put_device(&gdev->dev); + goto err_print_message; + } err_remove_from_list: spin_lock_irqsave(&gpio_lock, flags); list_del(&gdev->list); @@ -783,11 +791,12 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data, err_free_ida: ida_free(&gpio_ida, gdev->id); err_free_gdev: + kfree(gdev); +err_print_message: /* failures here can mean systems won't boot... */ pr_err("%s: GPIOs %d..%d (%s) failed to register, %d\n", __func__, - gdev->base, gdev->base + gdev->ngpio - 1, + base, base + gdev->ngpio - 1, gc->label ? : "generic", ret); - kfree(gdev); return ret; } EXPORT_SYMBOL_GPL(gpiochip_add_data_with_key); -- 2.34.1

2 1

[PATCH OLK-5.10] gpiolib: fix memory leak in gpiochip_setup_dev()
by He Yujie 03 Nov '24

03 Nov '24

From: Zeng Heng <zengheng4(a)huawei.com> mainline inclusion from mainline-v6.1 commit ec851b23084b3a0af8bf0f5e51d33a8d678bdc49 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRIL CVE: CVE-2022-48975 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Here is a backtrace report about memory leak detected in gpiochip_setup_dev(): unreferenced object 0xffff88810b406400 (size 512): comm "python3", pid 1682, jiffies 4295346908 (age 24.090s) backtrace: kmalloc_trace device_add device_private_init at drivers/base/core.c:3361 (inlined by) device_add at drivers/base/core.c:3411 cdev_device_add gpiolib_cdev_register gpiochip_setup_dev gpiochip_add_data_with_key gcdev_register() & gcdev_unregister() would call device_add() & device_del() (no matter CONFIG_GPIO_CDEV is enabled or not) to register/unregister device. However, if device_add() succeeds, some resource (like struct device_private allocated by device_private_init()) is not released by device_del(). Therefore, after device_add() succeeds by gcdev_register(), it needs to call put_device() to release resource in the error handle path. Here we move forward the register of release function, and let it release every piece of resource by put_device() instead of kfree(). While at it, fix another subtle issue, i.e. when gc->ngpio is equal to 0, we still call kcalloc() and, in case of further error, kfree() on the ZERO_PTR pointer, which is not NULL. It's not a bug per se, but rather waste of the resources and potentially wrong expectation about contents of the gdev->descs variable. Fixes: 159f3cd92f17 ("gpiolib: Defer gpio device setup until after gpiolib initialization") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> Co-developed-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Conflicts: drivers/gpio/gpiolib.c [ 3cc1fb73993905b598da3802f87ac59411c52516(gpiolib: do not print err message for EPROBE_DEFER). 990f6756bb64756d2d1033118cded6333b43397d(gpiolib: allow to specify the firmware node in struct gpio_chip). 9dbd1ab20509e85cd3fac9479a00c59e83c08196(gpiolib: check the 'ngpios' property in core gpiolib code). context conflicts because the preceding three commit commands are not merge] Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/gpio/gpiolib.c | 35 ++++++++++++++++++++++------------- 1 file changed, 22 insertions(+), 13 deletions(-) diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c index a8e63d8f0e36..ae000b513bc1 100644 --- a/drivers/gpio/gpiolib.c +++ b/drivers/gpio/gpiolib.c @@ -500,12 +500,13 @@ static int gpiochip_setup_dev(struct gpio_device *gdev) if (ret) return ret; + /* From this point, the .release() function cleans up gpio_device */ + gdev->dev.release = gpiodevice_release; + ret = gpiochip_sysfs_register(gdev); if (ret) goto err_remove_device; - /* From this point, the .release() function cleans up gpio_device */ - gdev->dev.release = gpiodevice_release; dev_dbg(&gdev->dev, "registered GPIOs %d to %d on %s\n", gdev->base, gdev->base + gdev->ngpio - 1, gdev->chip->label ? : "generic"); @@ -572,7 +573,7 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data, unsigned long flags; int ret = 0; unsigned i; - int base = gc->base; + int base = 0; struct gpio_device *gdev; /* @@ -624,22 +625,22 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data, else gdev->owner = THIS_MODULE; - gdev->descs = kcalloc(gc->ngpio, sizeof(gdev->descs[0]), GFP_KERNEL); - if (!gdev->descs) { - ret = -ENOMEM; - goto err_free_dev_name; - } - if (gc->ngpio == 0) { chip_err(gc, "tried to insert a GPIO chip with zero lines\n"); ret = -EINVAL; - goto err_free_descs; + goto err_free_dev_name; } if (gc->ngpio > FASTPATH_NGPIO) chip_warn(gc, "line cnt %u is greater than fast path cnt %u\n", gc->ngpio, FASTPATH_NGPIO); + gdev->descs = kcalloc(gc->ngpio, sizeof(*gdev->descs), GFP_KERNEL); + if (!gdev->descs) { + ret = -ENOMEM; + goto err_free_dev_name; + } + gdev->label = kstrdup_const(gc->label ?: "unknown", GFP_KERNEL); if (!gdev->label) { ret = -ENOMEM; @@ -658,11 +659,13 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data, * it may be a pipe dream. It will not happen before we get rid * of the sysfs interface anyways. */ + base = gc->base; if (base < 0) { base = gpiochip_find_base(gc->ngpio); if (base < 0) { - ret = base; spin_unlock_irqrestore(&gpio_lock, flags); + ret = base; + base = 0; goto err_free_label; } /* @@ -770,6 +773,11 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data, of_gpiochip_remove(gc); err_free_gpiochip_mask: gpiochip_free_valid_mask(gc); + if (gdev->dev.release) { + /* release() has been registered by gpiochip_setup_dev() */ + put_device(&gdev->dev); + goto err_print_message; + } err_remove_from_list: spin_lock_irqsave(&gpio_lock, flags); list_del(&gdev->list); @@ -783,11 +791,12 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data, err_free_ida: ida_free(&gpio_ida, gdev->id); err_free_gdev: + kfree(gdev); +err_print_message: /* failures here can mean systems won't boot... */ pr_err("%s: GPIOs %d..%d (%s) failed to register, %d\n", __func__, - gdev->base, gdev->base + gdev->ngpio - 1, + base, base + gdev->ngpio - 1, gc->label ? : "generic", ret); - kfree(gdev); return ret; } EXPORT_SYMBOL_GPL(gpiochip_add_data_with_key); -- 2.34.1

2 1

[PATCH OLK-6.6] gso: fix udp gso fraglist segmentation after pull from frag_list
by Liu Jian 03 Nov '24

03 Nov '24

From: Willem de Bruijn <willemb(a)google.com> stable inclusion from stable-v6.6.55 commit af3122f5fdc0d00581d6e598a668df6bf54c9daa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRAJ CVE: CVE-2024-49978 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- commit a1e40ac5b5e9077fe1f7ae0eb88034db0f9ae1ab upstream. Detect gso fraglist skbs with corrupted geometry (see below) and pass these to skb_segment instead of skb_segment_list, as the first can segment them correctly. Valid SKB_GSO_FRAGLIST skbs - consist of two or more segments - the head_skb holds the protocol headers plus first gso_size - one or more frag_list skbs hold exactly one segment - all but the last must be gso_size Optional datapath hooks such as NAT and BPF (bpf_skb_pull_data) can modify these skbs, breaking these invariants. In extreme cases they pull all data into skb linear. For UDP, this causes a NULL ptr deref in __udpv4_gso_segment_list_csum at udp_hdr(seg->next)->dest. Detect invalid geometry due to pull, by checking head_skb size. Don't just drop, as this may blackhole a destination. Convert to be able to pass to regular skb_segment. Link: https://lore.kernel.org/netdev/20240428142913.18666-1-shiming.cheng@mediate… Fixes: 9fd1ff5d2ac7 ("udp: Support UDP fraglist GRO/GSO.") Signed-off-by: Willem de Bruijn <willemb(a)google.com> Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20241001171752.107580-1-willemdebruijn.kernel@gmai… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/ipv4/udp_offload.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c index f544016e6eb3..a727eeafd0a9 100644 --- a/net/ipv4/udp_offload.c +++ b/net/ipv4/udp_offload.c @@ -290,8 +290,26 @@ struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb, return NULL; } - if (skb_shinfo(gso_skb)->gso_type & SKB_GSO_FRAGLIST) - return __udp_gso_segment_list(gso_skb, features, is_ipv6); + if (skb_shinfo(gso_skb)->gso_type & SKB_GSO_FRAGLIST) { + /* Detect modified geometry and pass those to skb_segment. */ + if (skb_pagelen(gso_skb) - sizeof(*uh) == skb_shinfo(gso_skb)->gso_size) + return __udp_gso_segment_list(gso_skb, features, is_ipv6); + + /* Setup csum, as fraglist skips this in udp4_gro_receive. */ + gso_skb->csum_start = skb_transport_header(gso_skb) - gso_skb->head; + gso_skb->csum_offset = offsetof(struct udphdr, check); + gso_skb->ip_summed = CHECKSUM_PARTIAL; + + uh = udp_hdr(gso_skb); + if (is_ipv6) + uh->check = ~udp_v6_check(gso_skb->len, + &ipv6_hdr(gso_skb)->saddr, + &ipv6_hdr(gso_skb)->daddr, 0); + else + uh->check = ~udp_v4_check(gso_skb->len, + ip_hdr(gso_skb)->saddr, + ip_hdr(gso_skb)->daddr, 0); + } skb_pull(gso_skb, sizeof(*uh)); -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1] gso: fix udp gso fraglist segmentation after pull from frag_list
by Liu Jian 03 Nov '24

03 Nov '24

From: Willem de Bruijn <willemb(a)google.com> mainline inclusion from mainline-v6.12-rc2 commit a1e40ac5b5e9077fe1f7ae0eb88034db0f9ae1ab category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRAJ CVE: CVE-2024-49978 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- Detect gso fraglist skbs with corrupted geometry (see below) and pass these to skb_segment instead of skb_segment_list, as the first can segment them correctly. Valid SKB_GSO_FRAGLIST skbs - consist of two or more segments - the head_skb holds the protocol headers plus first gso_size - one or more frag_list skbs hold exactly one segment - all but the last must be gso_size Optional datapath hooks such as NAT and BPF (bpf_skb_pull_data) can modify these skbs, breaking these invariants. In extreme cases they pull all data into skb linear. For UDP, this causes a NULL ptr deref in __udpv4_gso_segment_list_csum at udp_hdr(seg->next)->dest. Detect invalid geometry due to pull, by checking head_skb size. Don't just drop, as this may blackhole a destination. Convert to be able to pass to regular skb_segment. Link: https://lore.kernel.org/netdev/20240428142913.18666-1-shiming.cheng@mediate… Fixes: 9fd1ff5d2ac7 ("udp: Support UDP fraglist GRO/GSO.") Signed-off-by: Willem de Bruijn <willemb(a)google.com> Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20241001171752.107580-1-willemdebruijn.kernel@gmai… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/udp_offload.c [Did not backport 9840036786d9, 10154dbded6d, 89add40066f9, 30b03f2a0592, b128ed5ab273, 4721031c3559d.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/ipv4/udp_offload.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c index ed50a5f33302..afe032b3fc38 100644 --- a/net/ipv4/udp_offload.c +++ b/net/ipv4/udp_offload.c @@ -10,6 +10,7 @@ #include <net/udp.h> #include <net/protocol.h> #include <net/inet_common.h> +#include <net/ip6_checksum.h> static struct sk_buff *__skb_udp_tunnel_segment(struct sk_buff *skb, netdev_features_t features, @@ -269,8 +270,26 @@ struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb, __sum16 check; __be16 newlen; - if (skb_shinfo(gso_skb)->gso_type & SKB_GSO_FRAGLIST) - return __udp_gso_segment_list(gso_skb, features, is_ipv6); + if (skb_shinfo(gso_skb)->gso_type & SKB_GSO_FRAGLIST) { + /* Detect modified geometry and pass those to skb_segment. */ + if (skb_pagelen(gso_skb) - sizeof(*uh) == skb_shinfo(gso_skb)->gso_size) + return __udp_gso_segment_list(gso_skb, features, is_ipv6); + + /* Setup csum, as fraglist skips this in udp4_gro_receive. */ + gso_skb->csum_start = skb_transport_header(gso_skb) - gso_skb->head; + gso_skb->csum_offset = offsetof(struct udphdr, check); + gso_skb->ip_summed = CHECKSUM_PARTIAL; + + uh = udp_hdr(gso_skb); + if (is_ipv6) + uh->check = ~udp_v6_check(gso_skb->len, + &ipv6_hdr(gso_skb)->saddr, + &ipv6_hdr(gso_skb)->daddr, 0); + else + uh->check = ~udp_v4_check(gso_skb->len, + ip_hdr(gso_skb)->saddr, + ip_hdr(gso_skb)->daddr, 0); + } mss = skb_shinfo(gso_skb)->gso_size; if (gso_skb->len <= sizeof(*uh) + mss) -- 2.34.1

2 5

[PATCH OLK-5.10] gso: fix udp gso fraglist segmentation after pull from frag_list
by Liu Jian 03 Nov '24

03 Nov '24

From: Willem de Bruijn <willemb(a)google.com> mainline inclusion from mainline-v6.12-rc2 commit a1e40ac5b5e9077fe1f7ae0eb88034db0f9ae1ab category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRAJ CVE: CVE-2024-49978 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- Detect gso fraglist skbs with corrupted geometry (see below) and pass these to skb_segment instead of skb_segment_list, as the first can segment them correctly. Valid SKB_GSO_FRAGLIST skbs - consist of two or more segments - the head_skb holds the protocol headers plus first gso_size - one or more frag_list skbs hold exactly one segment - all but the last must be gso_size Optional datapath hooks such as NAT and BPF (bpf_skb_pull_data) can modify these skbs, breaking these invariants. In extreme cases they pull all data into skb linear. For UDP, this causes a NULL ptr deref in __udpv4_gso_segment_list_csum at udp_hdr(seg->next)->dest. Detect invalid geometry due to pull, by checking head_skb size. Don't just drop, as this may blackhole a destination. Convert to be able to pass to regular skb_segment. Link: https://lore.kernel.org/netdev/20240428142913.18666-1-shiming.cheng@mediate… Fixes: 9fd1ff5d2ac7 ("udp: Support UDP fraglist GRO/GSO.") Signed-off-by: Willem de Bruijn <willemb(a)google.com> Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20241001171752.107580-1-willemdebruijn.kernel@gmai… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/udp_offload.c [Did not backport 9840036786d9, 10154dbded6d, 89add40066f9, 30b03f2a0592, b128ed5ab273, 4721031c3559d.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/ipv4/udp_offload.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c index 4f5a78a6a265..d6ab7afc0802 100644 --- a/net/ipv4/udp_offload.c +++ b/net/ipv4/udp_offload.c @@ -10,6 +10,7 @@ #include <net/udp.h> #include <net/protocol.h> #include <net/inet_common.h> +#include <net/ip6_checksum.h> static struct sk_buff *__skb_udp_tunnel_segment(struct sk_buff *skb, netdev_features_t features, @@ -269,8 +270,26 @@ struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb, __sum16 check; __be16 newlen; - if (skb_shinfo(gso_skb)->gso_type & SKB_GSO_FRAGLIST) - return __udp_gso_segment_list(gso_skb, features, is_ipv6); + if (skb_shinfo(gso_skb)->gso_type & SKB_GSO_FRAGLIST) { + /* Detect modified geometry and pass those to skb_segment. */ + if (skb_pagelen(gso_skb) - sizeof(*uh) == skb_shinfo(gso_skb)->gso_size) + return __udp_gso_segment_list(gso_skb, features, is_ipv6); + + /* Setup csum, as fraglist skips this in udp4_gro_receive. */ + gso_skb->csum_start = skb_transport_header(gso_skb) - gso_skb->head; + gso_skb->csum_offset = offsetof(struct udphdr, check); + gso_skb->ip_summed = CHECKSUM_PARTIAL; + + uh = udp_hdr(gso_skb); + if (is_ipv6) + uh->check = ~udp_v6_check(gso_skb->len, + &ipv6_hdr(gso_skb)->saddr, + &ipv6_hdr(gso_skb)->daddr, 0); + else + uh->check = ~udp_v4_check(gso_skb->len, + ip_hdr(gso_skb)->saddr, + ip_hdr(gso_skb)->daddr, 0); + } mss = skb_shinfo(gso_skb)->gso_size; if (gso_skb->len <= sizeof(*uh) + mss) -- 2.34.1

2 5

[PATCH openEuler-1.0-LTS] RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
by Liu Jian 03 Nov '24

03 Nov '24

From: Zhu Yanjun <yanjun.zhu(a)linux.dev> mainline inclusion from mainline-v6.12-rc1 commit 86dfdd8288907f03c18b7fb462e0e232c4f98d89 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYPK5 CVE: CVE-2024-47696 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- In the commit aee2424246f9 ("RDMA/iwcm: Fix a use-after-free related to destroying CM IDs"), the function flush_workqueue is invoked to flush the work queue iwcm_wq. But at that time, the work queue iwcm_wq was created via the function alloc_ordered_workqueue without the flag WQ_MEM_RECLAIM. Because the current process is trying to flush the whole iwcm_wq, if iwcm_wq doesn't have the flag WQ_MEM_RECLAIM, verify that the current process is not reclaiming memory or running on a workqueue which doesn't have the flag WQ_MEM_RECLAIM as that can break forward-progress guarantee leading to a deadlock. The call trace is as below: [ 125.350876][ T1430] Call Trace: [ 125.356281][ T1430] <TASK> [ 125.361285][ T1430] ? __warn (kernel/panic.c:693) [ 125.367640][ T1430] ? check_flush_dependency (kernel/workqueue.c:3706 (discriminator 9)) [ 125.375689][ T1430] ? report_bug (lib/bug.c:180 lib/bug.c:219) [ 125.382505][ T1430] ? handle_bug (arch/x86/kernel/traps.c:239) [ 125.388987][ T1430] ? exc_invalid_op (arch/x86/kernel/traps.c:260 (discriminator 1)) [ 125.395831][ T1430] ? asm_exc_invalid_op (arch/x86/include/asm/idtentry.h:621) [ 125.403125][ T1430] ? check_flush_dependency (kernel/workqueue.c:3706 (discriminator 9)) [ 125.410984][ T1430] ? check_flush_dependency (kernel/workqueue.c:3706 (discriminator 9)) [ 125.418764][ T1430] __flush_workqueue (kernel/workqueue.c:3970) [ 125.426021][ T1430] ? __pfx___might_resched (kernel/sched/core.c:10151) [ 125.433431][ T1430] ? destroy_cm_id (drivers/infiniband/core/iwcm.c:375) iw_cm [ 125.441209][ T1430] ? __pfx___flush_workqueue (kernel/workqueue.c:3910) [ 125.473900][ T1430] ? _raw_spin_lock_irqsave (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:111 kernel/locking/spinlock.c:162) [ 125.473909][ T1430] ? __pfx__raw_spin_lock_irqsave (kernel/locking/spinlock.c:161) [ 125.482537][ T1430] _destroy_id (drivers/infiniband/core/cma.c:2044) rdma_cm [ 125.495072][ T1430] nvme_rdma_free_queue (drivers/nvme/host/rdma.c:656 drivers/nvme/host/rdma.c:650) nvme_rdma [ 125.505827][ T1430] nvme_rdma_reset_ctrl_work (drivers/nvme/host/rdma.c:2180) nvme_rdma [ 125.505831][ T1430] process_one_work (kernel/workqueue.c:3231) [ 125.515122][ T1430] worker_thread (kernel/workqueue.c:3306 kernel/workqueue.c:3393) [ 125.515127][ T1430] ? __pfx_worker_thread (kernel/workqueue.c:3339) [ 125.531837][ T1430] kthread (kernel/kthread.c:389) [ 125.539864][ T1430] ? __pfx_kthread (kernel/kthread.c:342) [ 125.550628][ T1430] ret_from_fork (arch/x86/kernel/process.c:147) [ 125.558840][ T1430] ? __pfx_kthread (kernel/kthread.c:342) [ 125.558844][ T1430] ret_from_fork_asm (arch/x86/entry/entry_64.S:257) [ 125.566487][ T1430] </TASK> [ 125.566488][ T1430] ---[ end trace 0000000000000000 ]--- Fixes: aee2424246f9 ("RDMA/iwcm: Fix a use-after-free related to destroying CM IDs") Link: https://patch.msgid.link/r/20240820113336.19860-1-yanjun.zhu@linux.dev Reported-by: kernel test robot <oliver.sang(a)intel.com> Closes: https://lore.kernel.org/oe-lkp/202408151633.fc01893c-oliver.sang@intel.com Tested-by: kernel test robot <oliver.sang(a)intel.com> Signed-off-by: Zhu Yanjun <yanjun.zhu(a)linux.dev> Reviewed-by: Bart Van Assche <bvanassche(a)acm.org> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Conflicts: drivers/infiniband/core/iwcm.c [Did not backport e677b72a0647.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/infiniband/core/iwcm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c index 720e1a5b34ad..2573efba1877 100644 --- a/drivers/infiniband/core/iwcm.c +++ b/drivers/infiniband/core/iwcm.c @@ -1177,7 +1177,7 @@ static int __init iw_cm_init(void) pr_err("iw_cm: couldn't init iwpm\n"); else rdma_nl_register(RDMA_NL_IWCM, iwcm_nl_cb_table); - iwcm_wq = alloc_ordered_workqueue("iw_cm_wq", 0); + iwcm_wq = alloc_ordered_workqueue("iw_cm_wq", WQ_MEM_RECLAIM); if (!iwcm_wq) return -ENOMEM; -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION e833cceaa63f729c44be494d90d6ee3bfaf22faf
by kernel test robot 03 Nov '24

03 Nov '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: e833cceaa63f729c44be494d90d6ee3bfaf22faf !12804 ext4: fix CVE-2024-49884 Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202411030628.JUVdQYlZ-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202411030841.5zDkiwtI-lkp@intel.com arch/arm64/kernel/mpam/mpam_resctrl.c:358:1: warning: conflicting types for 'mpam_get_raw_resctrl_resource' due to enum/integer mismatch; have 'struct raw_resctrl_resource *(enum resctrl_resource_level)' [-Wenum-int-mismatch] drivers/net/ethernet/3snic/sssnic/hw/sss_pci_sriov.c:18:12: warning: 'sss_init_vf_hw' defined but not used [-Wunused-function] drivers/net/ethernet/3snic/sssnic/hw/sss_pci_sriov.c:40:13: warning: 'sss_deinit_vf_hw' defined but not used [-Wunused-function] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:165:28: error: implicit declaration of function 'vlan_dev_priv'; did you mean 'netdev_priv'? [-Werror=implicit-function-declaration] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:165:51: error: invalid type argument of '->' (have 'int') include/linux/uaccess.h:112:17: warning: 'pid' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'pmas' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:114:17: warning: 'key' may be used uninitialized [-Wmaybe-uninitialized] Unverified Error/Warning (likely false positive, kindly check if interested): drivers/clocksource/timer-mediatek.o: warning: objtool: missing symbol for section .text drivers/fpga/.tmp_machxo2-spi.o: warning: objtool: missing symbol for section .init.text drivers/gnss/ubx.o: warning: objtool: missing symbol for section .init.text drivers/mux/adgs1408.o: warning: objtool: missing symbol for section .init.text drivers/scsi/ufs/ufs-hisi.o: warning: objtool: missing symbol for section .init.text include/linux/uaccess.h:115:17: warning: 'port_pr' may be used uninitialized [-Wmaybe-uninitialized] kernel/dma/.tmp_contiguous.o: warning: objtool: missing symbol for section .text Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- arm64-allnoconfig | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- arm64-defconfig | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- arm64-randconfig-001-20241029 | `-- arch-arm64-kernel-mpam-mpam_resctrl.c:warning:conflicting-types-for-mpam_get_raw_resctrl_resource-due-to-enum-integer-mismatch-have-struct-raw_resctrl_resource-(enum-resctrl_resource_level) |-- arm64-randconfig-001-20241103 | |-- arch-arm64-kernel-smp.c:error:pmu_nmi_enable-undeclared-(first-use-in-this-function) | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- arm64-randconfig-002-20241103 | |-- drivers-nvme-host-core.c:error:compat_uptr_t-undeclared-(first-use-in-this-function) | |-- drivers-nvme-host-core.c:error:expected-before-ptrval | |-- fs-ext4-inode.c:warning:unused-variable-sbi | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- arm64-randconfig-003-20241103 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- fs-ext4-inode.c:warning:unused-variable-sbi | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- arm64-randconfig-004-20241029 | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_sriov.c:warning:sss_deinit_vf_hw-defined-but-not-used | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_sriov.c:warning:sss_init_vf_hw-defined-but-not-used | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_main.c:error:implicit-declaration-of-function-vlan_dev_priv | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_main.c:error:invalid-type-argument-of-(have-int-) | |-- include-linux-uaccess.h:warning:pid-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:pmas-may-be-used-uninitialized | `-- include-linux-uaccess.h:warning:port_pr-may-be-used-uninitialized |-- arm64-randconfig-004-20241103 | |-- fs-ext4-inode.c:warning:unused-variable-sbi | |-- include-linux-uaccess.h:warning:accm-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:args32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ces32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:key-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:mqstat-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:n-may-be-used-uninitialized | `-- include-linux-uaccess.h:warning:user_desc-may-be-used-uninitialized |-- x86_64-buildonly-randconfig-001-20241025 | |-- arch-x86-kernel-irq_work.o:warning:objtool:missing-symbol-for-section-.irqentry.text | `-- drivers-clocksource-timer-mediatek.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-001-20241030 | `-- crypto-.tmp_zstd.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-001-20241102 | |-- drivers-fpga-.tmp_machxo2-spi.o:warning:objtool:missing-symbol-for-section-.init.text | `-- sound-soc-codecs-.tmp_tscs454.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-001-20241103 | |-- arch-x86-events-zhaoxin-core.c:error:redefinition-of-zhaoxin_pmu_init | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-buildonly-randconfig-002-20241029 | `-- sound-soc-codecs-rt1305.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-002-20241102 | |-- kernel-dma-.tmp_contiguous.o:warning:objtool:missing-symbol-for-section-.text | `-- sound-core-seq-.tmp_seq_info.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-002-20241103 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-buildonly-randconfig-003-20241029 | |-- drivers-net-can-usb-.tmp_ucan.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-net-can-usb-kvaser_usb-.tmp_kvaser_usb_core.o:warning:objtool:missing-symbol-for-section-.init.text | `-- net-sched-.tmp_sch_cake.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-003-20241031 | |-- block-.tmp_blk-mq-debugfs-zoned.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-iio-chemical-.tmp_bme680_i2c.o:warning:objtool:missing-symbol-for-section-.init.text | `-- drivers-iio-chemical-.tmp_bme680_spi.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-003-20241102 | |-- drivers-bcma-driver_chipcommon_nflash.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-bcma-driver_chipcommon_pflash.o:warning:objtool:missing-symbol-for-section-.exit.text | `-- drivers-mux-adgs1408.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-003-20241103 | |-- drivers-pci-controller-dwc-pci-exynos.o:warning:objtool:missing-symbol-for-section-.exit.text | `-- fs-xfs-libxfs-xfs_types.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-004-20241103 | |-- drivers-hid-.tmp_hid-steam.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-chemical-.tmp_bme680_i2c.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-dac-.tmp_ad5696-i2c.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-rc-.tmp_ite-cir.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-net-phy-.tmp_microchip_t1.o:warning:objtool:missing-symbol-for-section-.init.text | |-- fs-ext4-inode.c:warning:unused-variable-sbi | |-- fs-nilfs2-btree.c:warning:bh-may-be-used-uninitialized | |-- include-asm-generic-atomic-instrumented.h:warning:wait_req-may-be-used-uninitialized | |-- net-sched-.tmp_sch_cake.o:warning:objtool:missing-symbol-for-section-.init.text | `-- sound-soc-codecs-.tmp_tscs454.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-005-20241031 | |-- drivers-media-i2c-rj54n1cb0c.o:warning:objtool:missing-symbol-for-section-.init.text | `-- net-netfilter-xt_socket.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-005-20241102 | |-- drivers-gnss-ubx.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-scsi-ufs-ufs-hisi.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-staging-erofs-inode.o:warning:objtool:missing-symbol-for-section-.text | `-- drivers-staging-erofs-unzip_vle_lz4.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-005-20241103 | |-- drivers-bcma-driver_chipcommon_nflash.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- fs-ext4-inode.c:warning:unused-variable-sbi | |-- fs-nilfs2-btree.c:warning:bh-may-be-used-uninitialized | |-- include-asm-generic-atomic-instrumented.h:warning:wait_req-may-be-used-uninitialized | `-- include-asm-generic-bug.h:warning:mcu_ctrl-may-be-used-uninitialized |-- x86_64-buildonly-randconfig-006-20241024 | |-- drivers-media-dvb-frontends-helene.o:warning:objtool:missing-symbol-for-section-.init.text | `-- drivers-net-dsa-vitesse-vsc73xx.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-006-20241027 | `-- drivers-usb-dwc3-dwc3-haps.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-006-20241103 | |-- fs-ext4-inode.c:warning:unused-variable-sbi | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity-Werror-Wimplicit-function-declaration | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains-Werror-Wimplicit-function-declaration | `-- kernel-sched-core.c:error:use-of-undeclared-identifier-root_task_group |-- x86_64-defconfig | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-kexec | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-003-20241103 | |-- drivers-md-md.o:warning:objtool:md_seq_show:unreachable-instruction | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-004-20241103 | |-- fs-ext4-inode.c:warning:unused-variable-sbi | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity-Werror-Wimplicit-function-declaration | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains-Werror-Wimplicit-function-declaration | `-- kernel-sched-core.c:error:use-of-undeclared-identifier-root_task_group |-- x86_64-randconfig-005-20241103 | |-- fs-ext4-inode.c:warning:unused-variable-sbi | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- x86_64-randconfig-006-20241103 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-012-20241103 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-013-20241103 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-014-20241103 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-015-20241103 | |-- fs-ext4-inode.c:warning:unused-variable-sbi | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- x86_64-randconfig-016-20241103 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-102-20241103 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-103-20241103 | `-- arch-x86-events-zhaoxin-core.c:error:redefinition-of-zhaoxin_pmu_init |-- x86_64-randconfig-104-20241103 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-161-20241103 | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- x86_64-randconfig-r054-20241103 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-r064-20241103 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-rhel-8.3 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-rhel-8.3-func | `-- fs-ext4-inode.c:warning:unused-variable-sbi `-- x86_64-rhel-8.3-kselftests `-- fs-ext4-inode.c:warning:unused-variable-sbi elapsed time: 1052m configs tested: 29 configs skipped: 139 tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20241103 gcc-14.1.0 arm64 randconfig-002-20241103 gcc-14.1.0 arm64 randconfig-003-20241103 gcc-14.1.0 arm64 randconfig-004-20241103 gcc-14.1.0 x86_64 allnoconfig clang-19 x86_64 buildonly-randconfig-001-20241103 gcc-12 x86_64 buildonly-randconfig-002-20241103 clang-19 x86_64 buildonly-randconfig-003-20241103 clang-19 x86_64 buildonly-randconfig-004-20241103 gcc-12 x86_64 buildonly-randconfig-005-20241103 gcc-12 x86_64 buildonly-randconfig-006-20241103 clang-19 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 randconfig-001-20241103 gcc-12 x86_64 randconfig-002-20241103 clang-19 x86_64 randconfig-003-20241103 clang-19 x86_64 randconfig-004-20241103 clang-19 x86_64 randconfig-005-20241103 gcc-12 x86_64 randconfig-006-20241103 clang-19 x86_64 randconfig-011-20241103 gcc-12 x86_64 randconfig-012-20241103 gcc-12 x86_64 randconfig-013-20241103 clang-19 x86_64 randconfig-014-20241103 clang-19 x86_64 randconfig-015-20241103 gcc-12 x86_64 randconfig-016-20241103 gcc-12 x86_64 rhel-8.3 gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1257/1257] sound/core/seq/.tmp_seq_info.o: warning: objtool: missing symbol for section .text
by kernel test robot 03 Nov '24

03 Nov '24

Hi Takashi, FYI, the error/warning was bisected to this commit, please ignore it if it's irrelevant. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e833cceaa63f729c44be494d90d6ee3bfaf22faf commit: 00976ad5271999ba06d24319fd1031b178aff832 [1257/1257] ALSA: seq: Fix leftovers at probe error path config: x86_64-buildonly-randconfig-002-20241102 (https://download.01.org/0day-ci/archive/20241103/202411030841.5zDkiwtI-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241103/202411030841.5zDkiwtI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411030841.5zDkiwtI-lkp@intel.com/ All warnings (new ones prefixed by >>): >> sound/core/seq/.tmp_seq_info.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 2ff12244e232d6f1d5cfce8210d3dd8e5136efbf
by kernel test robot 03 Nov '24

03 Nov '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 2ff12244e232d6f1d5cfce8210d3dd8e5136efbf !12805 ext4: fix slab-use-after-free in ext4_split_extent_at() Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_export | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_include | |-- drivers-infiniband-hw-xsc-main.c:warning:no-previous-prototype-for-function-xsc_ib_reboot_event_handler | |-- drivers-infiniband-hw-xsc-mr.c:warning:no-previous-prototype-for-function-xsc_get_mr_page_mode | |-- drivers-infiniband-hw-xsc-private_dev.c:warning:variable-char_dev-set-but-not-used | |-- drivers-infiniband-hw-xsc-qp.c:warning:variable-xsc_state-is-uninitialized-when-used-here | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:a-randomized-struct-can-only-be-initialized-with-a-designated-initializer | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h-file-not-found | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h-file-not-found | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h-file-not-found | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-set_feature_vlan_offload | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_net_reboot_event_handler | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_set_vf_link_state | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-anlt_fec_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-fpga_type_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-hps_ddr_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-ma_xbar_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-onchip_ft_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-pct_exp_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-pp_tbl_dma_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-rdma_icrc_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_hw_comm.c:warning:no-previous-prototype-for-function-xsc_hw_kernel_call | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_hw_comm.c:warning:variable-err-set-but-not-used | |-- drivers-net-ethernet-yunsilicon-xsc-pci-main.c:warning:no-previous-prototype-for-function-xsc_pci_reboot_event_handler | |-- drivers-net-ethernet-yunsilicon-xsc-pci-mr.c:warning:no-previous-prototype-for-function-xsc_dereg_mr_via_cmdq | |-- drivers-net-ethernet-yunsilicon-xsc-pci-mr.c:warning:no-previous-prototype-for-function-xsc_reg_mr_via_cmdq | |-- drivers-net-ethernet-yunsilicon-xsc-pci-mr.c:warning:no-previous-prototype-for-function-xsc_set_mpt_via_cmdq | |-- drivers-net-ethernet-yunsilicon-xsc-pci-mr.c:warning:no-previous-prototype-for-function-xsc_set_mtt_via_cmdq | |-- drivers-net-ethernet-yunsilicon-xsc-pci-vport.c:warning:variable-i-is-uninitialized-when-used-here | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_add_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_create | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_destroy | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_remove_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_update_hash_type | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_update_member_status | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_add_lag_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_board_lag_reset | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_board_lag_set | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_cmd_add_lag_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_cmd_remove_lag_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_cmd_update_lag_hash_type | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_cmd_update_lag_member_status | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_create_lag | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_destroy_lag | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_remove_lag_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_update_lag_hash_type | `-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_update_lag_member_status |-- arm64-randconfig-001-20241103 | `-- mm-kasan-shadow.c:(.text):undefined-reference-to-__memcpy_mc |-- loongarch-allmodconfig | |-- arch-loongarch-include-asm-irq.h:error:NR_VECTORS-undeclared-(first-use-in-this-function) | `-- arch-loongarch-include-asm-irq.h:error:NR_VECTORS-undeclared-here-(not-in-a-function) |-- loongarch-allnoconfig | |-- arch-loongarch-include-asm-irq.h:error:NR_VECTORS-undeclared-here-(not-in-a-function) | |-- arch-loongarch-kernel-efi.c:error:incompatible-types-when-assigning-to-type-pmd_t-from-type-int | `-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) |-- x86_64-allnoconfig | |-- Warning:drivers-net-ethernet-nebula-matrix-Kconfig-references-a-file-that-doesn-t-exist:file:Documentation-networking-device_drivers-ethernet-nebula-matrix-m18110.rst | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_include-nbl_include.h:linux-pci.h-is-included-more-than-once. |-- x86_64-allyesconfig | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_export | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_include | |-- drivers-gpu-drm-amd-amdgpu-..-display-dc-dml-calcs-dcn_calc_auto.c:warning:stack-frame-size-()-exceeds-limit-()-in-mode_support_and_system_configuration | |-- drivers-infiniband-hw-xsc-main.c:warning:no-previous-prototype-for-function-xsc_ib_reboot_event_handler | |-- drivers-infiniband-hw-xsc-mr.c:warning:no-previous-prototype-for-function-xsc_get_mr_page_mode | |-- drivers-infiniband-hw-xsc-private_dev.c:warning:variable-char_dev-set-but-not-used | |-- drivers-infiniband-hw-xsc-qp.c:warning:variable-xsc_state-is-uninitialized-when-used-here | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:a-randomized-struct-can-only-be-initialized-with-a-designated-initializer | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h-file-not-found | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h-file-not-found | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h-file-not-found | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-set_feature_vlan_offload | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_net_reboot_event_handler | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_set_vf_link_state | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-anlt_fec_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-fpga_type_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-hps_ddr_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-ma_xbar_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-onchip_ft_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-pct_exp_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-pp_tbl_dma_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-rdma_icrc_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_hw_comm.c:warning:no-previous-prototype-for-function-xsc_hw_kernel_call | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_hw_comm.c:warning:variable-err-set-but-not-used | |-- drivers-net-ethernet-yunsilicon-xsc-pci-main.c:warning:no-previous-prototype-for-function-xsc_pci_reboot_event_handler | |-- drivers-net-ethernet-yunsilicon-xsc-pci-mr.c:warning:no-previous-prototype-for-function-xsc_dereg_mr_via_cmdq | |-- drivers-net-ethernet-yunsilicon-xsc-pci-mr.c:warning:no-previous-prototype-for-function-xsc_reg_mr_via_cmdq | |-- drivers-net-ethernet-yunsilicon-xsc-pci-mr.c:warning:no-previous-prototype-for-function-xsc_set_mpt_via_cmdq | |-- drivers-net-ethernet-yunsilicon-xsc-pci-mr.c:warning:no-previous-prototype-for-function-xsc_set_mtt_via_cmdq | |-- drivers-net-ethernet-yunsilicon-xsc-pci-vport.c:warning:variable-i-is-uninitialized-when-used-here | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_add_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_create | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_destroy | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_remove_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_update_hash_type | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_update_member_status | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_add_lag_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_board_lag_reset | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_board_lag_set | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_cmd_add_lag_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_cmd_remove_lag_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_cmd_update_lag_hash_type | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_cmd_update_lag_member_status | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_create_lag | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_destroy_lag | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_remove_lag_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_update_lag_hash_type | `-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_update_lag_member_status |-- x86_64-buildonly-randconfig-001-20241102 | `-- vmlinux.o:warning:objtool:leaf_cut_from_buffer:stack-state-mismatch:cfa1-cfa2 |-- x86_64-rhel-8.3 | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_export:No-such-file-or-directory | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_include:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory |-- x86_64-rhel-8.3-func | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_export:No-such-file-or-directory | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_include:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory `-- x86_64-rhel-8.3-kselftests |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_export:No-such-file-or-directory |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_include:No-such-file-or-directory |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h:No-such-file-or-directory |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory elapsed time: 844m configs tested: 12 configs skipped: 76 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20241103 gcc-14.1.0 arm64 randconfig-002-20241103 clang-20 arm64 randconfig-003-20241103 gcc-14.1.0 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 rhel-8.3 gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1257/1257] drivers/staging/erofs/inode.o: warning: objtool: missing symbol for section .text
by kernel test robot 03 Nov '24

03 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e833cceaa63f729c44be494d90d6ee3bfaf22faf commit: db0d48554fbadd40a4b6e5e3fbbeae94ff546e53 [1257/1257] staging: erofs: {dir,inode,super}.c: rectify BUG_ONs config: x86_64-buildonly-randconfig-005-20241102 (https://download.01.org/0day-ci/archive/20241103/202411030628.JUVdQYlZ-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241103/202411030628.JUVdQYlZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411030628.JUVdQYlZ-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/staging/erofs/inode.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-48966
by Zeng Heng 02 Nov '24

02 Nov '24

Dan Carpenter (2): net: mvneta: Prevent out of bounds read in mvneta_config_rss() net: mvneta: Fix an out of bounds check drivers/net/ethernet/marvell/mvneta.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] net: mvneta: Prevent out of bounds read in mvneta_config_rss()
by Zeng Heng 02 Nov '24

02 Nov '24

From: Dan Carpenter <error27(a)gmail.com> stable inclusion from stable-4.19.269 commit 5a142486a0db6b0b85031f22d69acd0cdcf8f72b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRDU CVE: CVE-2022-48966 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e8b4fc13900b8e8be48debffd0dfd391772501f7 ] The pp->indir[0] value comes from the user. It is passed to: if (cpu_online(pp->rxq_def)) inside the mvneta_percpu_elect() function. It needs bounds checkeding to ensure that it is not beyond the end of the cpu bitmap. Fixes: cad5d847a093 ("net: mvneta: Fix the CPU choice in mvneta_percpu_elect") Signed-off-by: Dan Carpenter <error27(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/net/ethernet/marvell/mvneta.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c index 4313bbb2396f..355eaedcaea5 100644 --- a/drivers/net/ethernet/marvell/mvneta.c +++ b/drivers/net/ethernet/marvell/mvneta.c @@ -4120,6 +4120,9 @@ static int mvneta_config_rss(struct mvneta_port *pp) napi_disable(&pp->napi); } + if (pp->indir[0] >= nr_cpu_ids) + return -EINVAL; + pp->rxq_def = pp->indir[0]; /* Update unicast mapping */ -- 2.25.1

2 1

[PATCH OLK-6.6] ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
by Zeng Heng 02 Nov '24

02 Nov '24

From: Lizhi Xu <lizhi.xu(a)windriver.com> stable inclusion from stable-v6.6.55 commit d52c5652e7dcb7a0648bbb8642cc3e617070ab49 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRA8 CVE: CVE-2024-49877 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 33b525cef4cff49e216e4133cc48452e11c0391e upstream. When doing cleanup, if flags without OCFS2_BH_READAHEAD, it may trigger NULL pointer dereference in the following ocfs2_set_buffer_uptodate() if bh is NULL. Link: https://lkml.kernel.org/r/20240902023636.1843422-3-joseph.qi@linux.alibaba.… Fixes: cf76c78595ca ("ocfs2: don't put and assigning null to bh allocated outside") Signed-off-by: Lizhi Xu <lizhi.xu(a)windriver.com> Signed-off-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Reported-by: Heming Zhao <heming.zhao(a)suse.com> Suggested-by: Heming Zhao <heming.zhao(a)suse.com> Cc: <stable(a)vger.kernel.org> [4.20+] Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Gang He <ghe(a)suse.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Jun Piao <piaojun(a)huawei.com> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Mark Fasheh <mark(a)fasheh.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- fs/ocfs2/buffer_head_io.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c index a71b40065e8b..45ca3cb7c097 100644 --- a/fs/ocfs2/buffer_head_io.c +++ b/fs/ocfs2/buffer_head_io.c @@ -388,7 +388,8 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr, /* Always set the buffer in the cache, even if it was * a forced read, or read-ahead which hasn't yet * completed. */ - ocfs2_set_buffer_uptodate(ci, bh); + if (bh) + ocfs2_set_buffer_uptodate(ci, bh); } ocfs2_metadata_cache_io_unlock(ci); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
by Zeng Heng 02 Nov '24

02 Nov '24

From: Lizhi Xu <lizhi.xu(a)windriver.com> stable inclusion from stable-v6.6.55 commit d52c5652e7dcb7a0648bbb8642cc3e617070ab49 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRA8 CVE: CVE-2024-49877 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 33b525cef4cff49e216e4133cc48452e11c0391e upstream. When doing cleanup, if flags without OCFS2_BH_READAHEAD, it may trigger NULL pointer dereference in the following ocfs2_set_buffer_uptodate() if bh is NULL. Link: https://lkml.kernel.org/r/20240902023636.1843422-3-joseph.qi@linux.alibaba.… Fixes: cf76c78595ca ("ocfs2: don't put and assigning null to bh allocated outside") Signed-off-by: Lizhi Xu <lizhi.xu(a)windriver.com> Signed-off-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Reported-by: Heming Zhao <heming.zhao(a)suse.com> Suggested-by: Heming Zhao <heming.zhao(a)suse.com> Cc: <stable(a)vger.kernel.org> [4.20+] Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Gang He <ghe(a)suse.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Jun Piao <piaojun(a)huawei.com> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Mark Fasheh <mark(a)fasheh.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- fs/ocfs2/buffer_head_io.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c index da24e8449f24..c8a6e3480be1 100644 --- a/fs/ocfs2/buffer_head_io.c +++ b/fs/ocfs2/buffer_head_io.c @@ -390,7 +390,8 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr, /* Always set the buffer in the cache, even if it was * a forced read, or read-ahead which hasn't yet * completed. */ - ocfs2_set_buffer_uptodate(ci, bh); + if (bh) + ocfs2_set_buffer_uptodate(ci, bh); } ocfs2_metadata_cache_io_unlock(ci); -- 2.25.1

2 1

[PATCH OLK-5.10] ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
by Zeng Heng 02 Nov '24

02 Nov '24

From: Lizhi Xu <lizhi.xu(a)windriver.com> stable inclusion from stable-v6.6.55 commit d52c5652e7dcb7a0648bbb8642cc3e617070ab49 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRA8 CVE: CVE-2024-49877 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 33b525cef4cff49e216e4133cc48452e11c0391e upstream. When doing cleanup, if flags without OCFS2_BH_READAHEAD, it may trigger NULL pointer dereference in the following ocfs2_set_buffer_uptodate() if bh is NULL. Link: https://lkml.kernel.org/r/20240902023636.1843422-3-joseph.qi@linux.alibaba.… Fixes: cf76c78595ca ("ocfs2: don't put and assigning null to bh allocated outside") Signed-off-by: Lizhi Xu <lizhi.xu(a)windriver.com> Signed-off-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Reported-by: Heming Zhao <heming.zhao(a)suse.com> Suggested-by: Heming Zhao <heming.zhao(a)suse.com> Cc: <stable(a)vger.kernel.org> [4.20+] Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Gang He <ghe(a)suse.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Jun Piao <piaojun(a)huawei.com> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Mark Fasheh <mark(a)fasheh.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- fs/ocfs2/buffer_head_io.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c index da24e8449f24..c8a6e3480be1 100644 --- a/fs/ocfs2/buffer_head_io.c +++ b/fs/ocfs2/buffer_head_io.c @@ -390,7 +390,8 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr, /* Always set the buffer in the cache, even if it was * a forced read, or read-ahead which hasn't yet * completed. */ - ocfs2_set_buffer_uptodate(ci, bh); + if (bh) + ocfs2_set_buffer_uptodate(ci, bh); } ocfs2_metadata_cache_io_unlock(ci); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
by Zeng Heng 02 Nov '24

02 Nov '24

From: Lizhi Xu <lizhi.xu(a)windriver.com> stable inclusion from stable-v6.6.55 commit d52c5652e7dcb7a0648bbb8642cc3e617070ab49 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRA8 CVE: CVE-2024-49877 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 33b525cef4cff49e216e4133cc48452e11c0391e upstream. When doing cleanup, if flags without OCFS2_BH_READAHEAD, it may trigger NULL pointer dereference in the following ocfs2_set_buffer_uptodate() if bh is NULL. Link: https://lkml.kernel.org/r/20240902023636.1843422-3-joseph.qi@linux.alibaba.… Fixes: cf76c78595ca ("ocfs2: don't put and assigning null to bh allocated outside") Signed-off-by: Lizhi Xu <lizhi.xu(a)windriver.com> Signed-off-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Reported-by: Heming Zhao <heming.zhao(a)suse.com> Suggested-by: Heming Zhao <heming.zhao(a)suse.com> Cc: <stable(a)vger.kernel.org> [4.20+] Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Gang He <ghe(a)suse.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Jun Piao <piaojun(a)huawei.com> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Mark Fasheh <mark(a)fasheh.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- fs/ocfs2/buffer_head_io.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c index f9b84f7a3e4b..9f4a2771dfa6 100644 --- a/fs/ocfs2/buffer_head_io.c +++ b/fs/ocfs2/buffer_head_io.c @@ -405,7 +405,8 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr, /* Always set the buffer in the cache, even if it was * a forced read, or read-ahead which hasn't yet * completed. */ - ocfs2_set_buffer_uptodate(ci, bh); + if (bh) + ocfs2_set_buffer_uptodate(ci, bh); } ocfs2_metadata_cache_io_unlock(ci); -- 2.25.1

2 1

[PATCH OLK-6.6] Input: adp5589-keys - fix NULL pointer dereference
by Yi Yang 02 Nov '24

02 Nov '24

From: Nuno Sa <nuno.sa(a)analog.com> stable inclusion from stable-v6.6.55 commit 7c3f04223aaf82489472d614c6decee5a1ce8d7f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR9T CVE: CVE-2024-49871 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fb5cc65f973661241e4a2b7390b429aa7b330c69 upstream. We register a devm action to call adp5589_clear_config() and then pass the i2c client as argument so that we can call i2c_get_clientdata() in order to get our device object. However, i2c_set_clientdata() is only being set at the end of the probe function which means that we'll get a NULL pointer dereference in case the probe function fails early. Fixes: 30df385e35a4 ("Input: adp5589-keys - use devm_add_action_or_reset() for register clear") Signed-off-by: Nuno Sa <nuno.sa(a)analog.com> Link: https://lore.kernel.org/r/20241001-b4-dev-adp5589-fw-conversion-v1-1-fca014… Cc: stable(a)vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/input/keyboard/adp5589-keys.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/drivers/input/keyboard/adp5589-keys.c b/drivers/input/keyboard/adp5589-keys.c index 8996e00cd63a..68a29d67be57 100644 --- a/drivers/input/keyboard/adp5589-keys.c +++ b/drivers/input/keyboard/adp5589-keys.c @@ -936,10 +936,9 @@ static int adp5589_keypad_add(struct adp5589_kpad *kpad, unsigned int revid) static void adp5589_clear_config(void *data) { - struct i2c_client *client = data; - struct adp5589_kpad *kpad = i2c_get_clientdata(client); + struct adp5589_kpad *kpad = data; - adp5589_write(client, kpad->var->reg(ADP5589_GENERAL_CFG), 0); + adp5589_write(kpad->client, kpad->var->reg(ADP5589_GENERAL_CFG), 0); } static int adp5589_probe(struct i2c_client *client) @@ -983,7 +982,7 @@ static int adp5589_probe(struct i2c_client *client) } error = devm_add_action_or_reset(&client->dev, adp5589_clear_config, - client); + kpad); if (error) return error; @@ -1010,8 +1009,6 @@ static int adp5589_probe(struct i2c_client *client) if (error) return error; - i2c_set_clientdata(client, kpad); - dev_info(&client->dev, "Rev.%d keypad, irq %d\n", revid, client->irq); return 0; } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] tipc: re-fetch skb cb after tipc_msg_validate
by Zhang Changzhong 02 Nov '24

02 Nov '24

From: Xin Long <lucien.xin(a)gmail.com> stable inclusion from stable-v5.10.158 commit a1ba595e35aa3afbe417ff0af353afb9f65559c0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRFB CVE: CVE-2022-49017 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3067bc61fcfe3081bf4807ce65560f499e895e77 ] As the call trace shows, the original skb was freed in tipc_msg_validate(), and dereferencing the old skb cb would cause an use-after-free crash. BUG: KASAN: use-after-free in tipc_crypto_rcv_complete+0x1835/0x2240 [tipc] Call Trace: <IRQ> tipc_crypto_rcv_complete+0x1835/0x2240 [tipc] tipc_crypto_rcv+0xd32/0x1ec0 [tipc] tipc_rcv+0x744/0x1150 [tipc] ... Allocated by task 47078: kmem_cache_alloc_node+0x158/0x4d0 __alloc_skb+0x1c1/0x270 tipc_buf_acquire+0x1e/0xe0 [tipc] tipc_msg_create+0x33/0x1c0 [tipc] tipc_link_build_proto_msg+0x38a/0x2100 [tipc] tipc_link_timeout+0x8b8/0xef0 [tipc] tipc_node_timeout+0x2a1/0x960 [tipc] call_timer_fn+0x2d/0x1c0 ... Freed by task 47078: tipc_msg_validate+0x7b/0x440 [tipc] tipc_crypto_rcv_complete+0x4b5/0x2240 [tipc] tipc_crypto_rcv+0xd32/0x1ec0 [tipc] tipc_rcv+0x744/0x1150 [tipc] This patch fixes it by re-fetching the skb cb from the new allocated skb after calling tipc_msg_validate(). Fixes: fc1b6d6de220 ("tipc: introduce TIPC encryption & authentication") Reported-by: Shuang Li <shuali(a)redhat.com> Signed-off-by: Xin Long <lucien.xin(a)gmail.com> Link: https://lore.kernel.org/r/1b1cdba762915325bd8ef9a98d0276eb673df2a5.16693984… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/tipc/crypto.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c index ce2636d..7d26d0c 100644 --- a/net/tipc/crypto.c +++ b/net/tipc/crypto.c @@ -1975,6 +1975,9 @@ static void tipc_crypto_rcv_complete(struct net *net, struct tipc_aead *aead, /* Ok, everything's fine, try to synch own keys according to peers' */ tipc_crypto_key_synch(rx, *skb); + /* Re-fetch skb cb as skb might be changed in tipc_msg_validate */ + skb_cb = TIPC_SKB_CB(*skb); + /* Mark skb decrypted */ skb_cb->decrypted = 1; -- 2.9.5

2 1

[PATCH OLK-6.6] serial: protect uart_port_dtr_rts() in uart_shutdown() too
by Yi Yang 02 Nov '24

02 Nov '24

From: "Jiri Slaby (SUSE)" <jirislaby(a)kernel.org> stable inclusion from stable-v6.6.57 commit e418d91195d29d5f9c9685ff309b92b04b41dc40 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYREU CVE: CVE-2024-50058 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 602babaa84d627923713acaf5f7e9a4369e77473 ] Commit af224ca2df29 (serial: core: Prevent unsafe uart port access, part 3) added few uport == NULL checks. It added one to uart_shutdown(), so the commit assumes, uport can be NULL in there. But right after that protection, there is an unprotected "uart_port_dtr_rts(uport, false);" call. That is invoked only if HUPCL is set, so I assume that is the reason why we do not see lots of these reports. Or it cannot be NULL at this point at all for some reason :P. Until the above is investigated, stay on the safe side and move this dereference to the if too. I got this inconsistency from Coverity under CID 1585130. Thanks. Signed-off-by: Jiri Slaby (SUSE) <jirislaby(a)kernel.org> Cc: Peter Hurley <peter(a)hurleysoftware.com> Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Link: https://lore.kernel.org/r/20240805102046.307511-3-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/serial/serial_core.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c index 5d5570bebfeb..8ff0efac6aa0 100644 --- a/drivers/tty/serial/serial_core.c +++ b/drivers/tty/serial/serial_core.c @@ -374,14 +374,16 @@ static void uart_shutdown(struct tty_struct *tty, struct uart_state *state) /* * Turn off DTR and RTS early. */ - if (uport && uart_console(uport) && tty) { - uport->cons->cflag = tty->termios.c_cflag; - uport->cons->ispeed = tty->termios.c_ispeed; - uport->cons->ospeed = tty->termios.c_ospeed; - } + if (uport) { + if (uart_console(uport) && tty) { + uport->cons->cflag = tty->termios.c_cflag; + uport->cons->ispeed = tty->termios.c_ispeed; + uport->cons->ospeed = tty->termios.c_ospeed; + } - if (!tty || C_HUPCL(tty)) - uart_port_dtr_rts(uport, false); + if (!tty || C_HUPCL(tty)) + uart_port_dtr_rts(uport, false); + } uart_port_shutdown(port); } -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] CVE-2022-48961
by Zhang Changzhong 02 Nov '24

02 Nov '24

Ioana Ciornei (1): net: mdio: use device_set_node() to setup both fwnode and of Zeng Heng (1): net: mdio: fix unbalanced fwnode reference count in mdio_device_release() drivers/net/mdio/of_mdio.c | 12 ++++++------ drivers/net/phy/mdio_bus.c | 3 +-- drivers/net/phy/mdio_device.c | 2 ++ 3 files changed, 9 insertions(+), 8 deletions(-) -- 2.9.5

2 3

[PATCH openEuler-22.03-LTS-SP1 0/3] CVE-2022-48961
by Zhang Changzhong 02 Nov '24

02 Nov '24

Ioana Ciornei (2): driver core: add a helper to setup both the of_node and fwnode of a device net: mdio: use device_set_node() to setup both fwnode and of Zeng Heng (1): net: mdio: fix unbalanced fwnode reference count in mdio_device_release() drivers/base/core.c | 7 +++++++ drivers/net/mdio/of_mdio.c | 12 ++++++------ drivers/net/phy/mdio_bus.c | 3 +-- drivers/net/phy/mdio_device.c | 2 ++ include/linux/device.h | 1 + 5 files changed, 17 insertions(+), 8 deletions(-) -- 2.9.5

2 4

[PATCH OLK-6.6] drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs
by Zeng Heng 02 Nov '24

02 Nov '24

From: Konrad Dybcio <konrad.dybcio(a)linaro.org> stable inclusion from stable-v6.6.55 commit 9288a9676c529ad9c856096db68fad812499bc4a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB1MDC CVE: CVE-2024-49901 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 16007768551d5bfe53426645401435ca8d2ef54f ] There are some cases, such as the one uncovered by Commit 46d4efcccc68 ("drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails") where msm_gpu_cleanup() : platform_set_drvdata(gpu->pdev, NULL); is called on gpu->pdev == NULL, as the GPU device has not been fully initialized yet. Turns out that there's more than just the aforementioned path that causes this to happen (e.g. the case when there's speedbin data in the catalog, but opp-supported-hw is missing in DT). Assigning msm_gpu->pdev earlier seems like the least painful solution to this, therefore do so. Signed-off-by: Konrad Dybcio <konrad.dybcio(a)linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/602742/ Signed-off-by: Rob Clark <robdclark(a)chromium.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/gpu/drm/msm/adreno/adreno_gpu.c | 1 + drivers/gpu/drm/msm/msm_gpu.c | 1 - 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c index 4127e2762dcd..a2df8bd7aa94 100644 --- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c +++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c @@ -1071,6 +1071,7 @@ int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev, adreno_gpu->chip_id = config->chip_id; gpu->allow_relocs = config->info->family < ADRENO_6XX_GEN1; + gpu->pdev = pdev; /* Only handle the core clock when GMU is not in use (or is absent). */ if (adreno_has_gmu_wrapper(adreno_gpu) || diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c index 5c10b559a595..5a7541597d0c 100644 --- a/drivers/gpu/drm/msm/msm_gpu.c +++ b/drivers/gpu/drm/msm/msm_gpu.c @@ -927,7 +927,6 @@ int msm_gpu_init(struct drm_device *drm, struct platform_device *pdev, if (IS_ERR(gpu->gpu_cx)) gpu->gpu_cx = NULL; - gpu->pdev = pdev; platform_set_drvdata(pdev, &gpu->adreno_smmu); msm_devfreq_init(gpu); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ethernet: aeroflex: fix potential skb leak in greth_init_rings()
by Zhang Changzhong 02 Nov '24

02 Nov '24

stable inclusion from stable-v5.10.159 commit 87277bdf2c370ab2d07cfe77dfa9b37f82bbe1e5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRFG CVE: CVE-2022-48958 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 063a932b64db3317ec020c94466fe52923a15f60 ] The greth_init_rings() function won't free the newly allocated skb when dma_mapping_error() returns error, so add dev_kfree_skb() to fix it. Compile tested only. Fixes: d4c41139df6e ("net: Add Aeroflex Gaisler 10/100/1G Ethernet MAC driver") Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> Reviewed-by: Leon Romanovsky <leonro(a)nvidia.com> Link: https://lore.kernel.org/r/1670134149-29516-1-git-send-email-zhangchangzhong… Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/ethernet/aeroflex/greth.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/aeroflex/greth.c b/drivers/net/ethernet/aeroflex/greth.c index f4f50b3..0d56cb4f 100644 --- a/drivers/net/ethernet/aeroflex/greth.c +++ b/drivers/net/ethernet/aeroflex/greth.c @@ -258,6 +258,7 @@ static int greth_init_rings(struct greth_private *greth) if (dma_mapping_error(greth->dev, dma_addr)) { if (netif_msg_ifup(greth)) dev_err(greth->dev, "Could not create initial DMA mapping\n"); + dev_kfree_skb(skb); goto cleanup; } greth->rx_skbuff[i] = skb; -- 2.9.5

2 1

[PATCH OLK-5.10 0/3] fsnotify: fix CVE-2024-47660
by Baokun Li 02 Nov '24

02 Nov '24

Amir Goldstein (1): fsnotify: clear PARENT_WATCHED flags lazily Gaosheng Cui (1): fsnotify: remove unused declaration Xin Gao (1): fsnotify: Fix comment typo fs/notify/fsnotify.c | 33 +++++++++++++++++++++----------- fs/notify/fsnotify.h | 6 +----- fs/notify/mark.c | 32 ++++++++++++++++++++++++++++--- include/linux/fsnotify_backend.h | 8 +++++--- 4 files changed, 57 insertions(+), 22 deletions(-) -- 2.46.1

2 4

[PATCH openEuler-22.03-LTS-SP1 0/3] fsnotify: fix CVE-2024-47660
by Baokun Li 02 Nov '24

02 Nov '24

Amir Goldstein (1): fsnotify: clear PARENT_WATCHED flags lazily Gaosheng Cui (1): fsnotify: remove unused declaration Xin Gao (1): fsnotify: Fix comment typo fs/notify/fsnotify.c | 33 +++++++++++++++++++++----------- fs/notify/fsnotify.h | 6 +----- fs/notify/mark.c | 32 ++++++++++++++++++++++++++++--- include/linux/fsnotify_backend.h | 8 +++++--- 4 files changed, 57 insertions(+), 22 deletions(-) -- 2.46.1

2 4

[PATCH OLK-6.6] btrfs: fix uninitialized pointer free on read_alloc_one_name() error
by Baokun Li 02 Nov '24

02 Nov '24

From: Roi Martin <jroi.martin(a)gmail.com> stable inclusion from stable-v6.6.58 commit 7fc7c47b9ba0cf2d192f2117a64b24881b0b577f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB0EN2 CVE: CVE-2024-50087 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2ab5e243c2266c841e0f6904fad1514b18eaf510 upstream. The function read_alloc_one_name() does not initialize the name field of the passed fscrypt_str struct if kmalloc fails to allocate the corresponding buffer. Thus, it is not guaranteed that fscrypt_str.name is initialized when freeing it. This is a follow-up to the linked patch that fixes the remaining instances of the bug introduced by commit e43eec81c516 ("btrfs: use struct qstr instead of name and namelen pairs"). Link: https://lore.kernel.org/linux-btrfs/20241009080833.1355894-1-jroi.martin@gm… Fixes: e43eec81c516 ("btrfs: use struct qstr instead of name and namelen pairs") CC: stable(a)vger.kernel.org # 6.1+ Reviewed-by: Anand Jain <anand.jain(a)oracle.com> Signed-off-by: Roi Martin <jroi.martin(a)gmail.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/btrfs/tree-log.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c index e0037665aa92..d5ae0e75a52f 100644 --- a/fs/btrfs/tree-log.c +++ b/fs/btrfs/tree-log.c @@ -1846,7 +1846,7 @@ static noinline int replay_one_name(struct btrfs_trans_handle *trans, struct btrfs_dir_item *di, struct btrfs_key *key) { - struct fscrypt_str name; + struct fscrypt_str name = { 0 }; struct btrfs_dir_item *dir_dst_di; struct btrfs_dir_item *index_dst_di; bool dir_dst_matches = false; @@ -2126,7 +2126,7 @@ static noinline int check_item_in_log(struct btrfs_trans_handle *trans, struct extent_buffer *eb; int slot; struct btrfs_dir_item *di; - struct fscrypt_str name; + struct fscrypt_str name = { 0 }; struct inode *inode = NULL; struct btrfs_key location; -- 2.46.1

2 1

[PATCH OLK-5.10 0/2] io_uring: fix CVE-2024-50060
by Baokun Li 02 Nov '24

02 Nov '24

Jens Axboe (1): io_uring: check if we need to reschedule during overflow flush Pavel Begunkov (1): io_uring: always lock __io_cqring_overflow_flush io_uring/io_uring.c | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-) -- 2.46.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/2] io_uring: fix CVE-2024-50060
by Baokun Li 02 Nov '24

02 Nov '24

Jens Axboe (1): io_uring: check if we need to reschedule during overflow flush Pavel Begunkov (1): io_uring: always lock __io_cqring_overflow_flush io_uring/io_uring.c | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-) -- 2.46.1

2 3

[PATCH OLK-6.6 0/2] io_uring: fix CVE-2024-50060
by Baokun Li 02 Nov '24

02 Nov '24

Jens Axboe (1): io_uring: check if we need to reschedule during overflow flush Pavel Begunkov (1): io_uring: always lock __io_cqring_overflow_flush io_uring/io_uring.c | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) -- 2.46.1

2 3

[PATCH OLK-5.10 0/2] ext4: fix CVE-2024-47701
by Baokun Li 02 Nov '24

02 Nov '24

Thadeu Lima de Souza Cascardo (2): ext4: return error on ext4_find_inline_entry ext4: avoid OOB when system.data xattr changes underneath the filesystem fs/ext4/inline.c | 35 +++++++++++++++++++++++++---------- 1 file changed, 25 insertions(+), 10 deletions(-) -- 2.46.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/2] ext4: fix CVE-2024-47701
by Baokun Li 02 Nov '24

02 Nov '24

Thadeu Lima de Souza Cascardo (2): ext4: return error on ext4_find_inline_entry ext4: avoid OOB when system.data xattr changes underneath the filesystem fs/ext4/inline.c | 35 +++++++++++++++++++++++++---------- 1 file changed, 25 insertions(+), 10 deletions(-) -- 2.46.1

2 3

[PATCH openEuler-1.0-LTS 0/2] ext4: fix CVE-2024-47701
by Baokun Li 02 Nov '24

02 Nov '24

Thadeu Lima de Souza Cascardo (2): ext4: return error on ext4_find_inline_entry ext4: avoid OOB when system.data xattr changes underneath the filesystem fs/ext4/inline.c | 35 +++++++++++++++++++++++++---------- 1 file changed, 25 insertions(+), 10 deletions(-) -- 2.46.1

2 3

[PATCH openEuler-22.03-LTS-SP1] ext4: fix double brelse() the buffer of the extents path
by Baokun Li 02 Nov '24

02 Nov '24

stable inclusion from stable-v5.10.227 commit b6c29c8f3d7cb67b505f3b2f6c242d52298d1f2e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR8Z CVE: CVE-2024-49882 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit dcaa6c31134c0f515600111c38ed7750003e1b9c upstream. In ext4_ext_try_to_merge_up(), set path[1].p_bh to NULL after it has been released, otherwise it may be released twice. An example of what triggers this is as follows: split2 map split1 |--------|-------|--------| ext4_ext_map_blocks ext4_ext_handle_unwritten_extents ext4_split_convert_extents // path->p_depth == 0 ext4_split_extent // 1. do split1 ext4_split_extent_at |ext4_ext_insert_extent | ext4_ext_create_new_leaf | ext4_ext_grow_indepth | le16_add_cpu(&neh->eh_depth, 1) | ext4_find_extent | // return -ENOMEM |// get error and try zeroout |path = ext4_find_extent | path->p_depth = 1 |ext4_ext_try_to_merge | ext4_ext_try_to_merge_up | path->p_depth = 0 | brelse(path[1].p_bh) ---> not set to NULL here |// zeroout success // 2. update path ext4_find_extent // 3. do split2 ext4_split_extent_at ext4_ext_insert_extent ext4_ext_create_new_leaf ext4_ext_grow_indepth le16_add_cpu(&neh->eh_depth, 1) ext4_find_extent path[0].p_bh = NULL; path->p_depth = 1 read_extent_tree_block ---> return err // path[1].p_bh is still the old value ext4_free_ext_path ext4_ext_drop_refs // path->p_depth == 1 brelse(path[1].p_bh) ---> brelse a buffer twice Finally got the following WARRNING when removing the buffer from lru: ============================================ VFS: brelse: Trying to free free buffer WARNING: CPU: 2 PID: 72 at fs/buffer.c:1241 __brelse+0x58/0x90 CPU: 2 PID: 72 Comm: kworker/u19:1 Not tainted 6.9.0-dirty #716 RIP: 0010:__brelse+0x58/0x90 Call Trace: <TASK> __find_get_block+0x6e7/0x810 bdev_getblk+0x2b/0x480 __ext4_get_inode_loc+0x48a/0x1240 ext4_get_inode_loc+0xb2/0x150 ext4_reserve_inode_write+0xb7/0x230 __ext4_mark_inode_dirty+0x144/0x6a0 ext4_ext_insert_extent+0x9c8/0x3230 ext4_ext_map_blocks+0xf45/0x2dc0 ext4_map_blocks+0x724/0x1700 ext4_do_writepages+0x12d6/0x2a70 [...] ============================================ Fixes: ecb94f5fdf4b ("ext4: collapse a single extent tree block into the inode if possible") Cc: stable(a)kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Tested-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Link: https://patch.msgid.link/20240822023545.1994557-9-libaokun@huaweicloud.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/ext4/extents.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index 04b0346599c5..d7be8b8ed3da 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -1878,6 +1878,7 @@ static void ext4_ext_try_to_merge_up(handle_t *handle, path[0].p_hdr->eh_max = cpu_to_le16(max_root); brelse(path[1].p_bh); + path[1].p_bh = NULL; ext4_free_blocks(handle, inode, NULL, blk, 1, EXT4_FREE_BLOCKS_METADATA | EXT4_FREE_BLOCKS_FORGET); } -- 2.46.1

2 1

[PATCH OLK-5.10] ext4: fix double brelse() the buffer of the extents path
by Baokun Li 02 Nov '24

02 Nov '24

stable inclusion from stable-v5.10.227 commit b6c29c8f3d7cb67b505f3b2f6c242d52298d1f2e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR8Z CVE: CVE-2024-49882 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit dcaa6c31134c0f515600111c38ed7750003e1b9c upstream. In ext4_ext_try_to_merge_up(), set path[1].p_bh to NULL after it has been released, otherwise it may be released twice. An example of what triggers this is as follows: split2 map split1 |--------|-------|--------| ext4_ext_map_blocks ext4_ext_handle_unwritten_extents ext4_split_convert_extents // path->p_depth == 0 ext4_split_extent // 1. do split1 ext4_split_extent_at |ext4_ext_insert_extent | ext4_ext_create_new_leaf | ext4_ext_grow_indepth | le16_add_cpu(&neh->eh_depth, 1) | ext4_find_extent | // return -ENOMEM |// get error and try zeroout |path = ext4_find_extent | path->p_depth = 1 |ext4_ext_try_to_merge | ext4_ext_try_to_merge_up | path->p_depth = 0 | brelse(path[1].p_bh) ---> not set to NULL here |// zeroout success // 2. update path ext4_find_extent // 3. do split2 ext4_split_extent_at ext4_ext_insert_extent ext4_ext_create_new_leaf ext4_ext_grow_indepth le16_add_cpu(&neh->eh_depth, 1) ext4_find_extent path[0].p_bh = NULL; path->p_depth = 1 read_extent_tree_block ---> return err // path[1].p_bh is still the old value ext4_free_ext_path ext4_ext_drop_refs // path->p_depth == 1 brelse(path[1].p_bh) ---> brelse a buffer twice Finally got the following WARRNING when removing the buffer from lru: ============================================ VFS: brelse: Trying to free free buffer WARNING: CPU: 2 PID: 72 at fs/buffer.c:1241 __brelse+0x58/0x90 CPU: 2 PID: 72 Comm: kworker/u19:1 Not tainted 6.9.0-dirty #716 RIP: 0010:__brelse+0x58/0x90 Call Trace: <TASK> __find_get_block+0x6e7/0x810 bdev_getblk+0x2b/0x480 __ext4_get_inode_loc+0x48a/0x1240 ext4_get_inode_loc+0xb2/0x150 ext4_reserve_inode_write+0xb7/0x230 __ext4_mark_inode_dirty+0x144/0x6a0 ext4_ext_insert_extent+0x9c8/0x3230 ext4_ext_map_blocks+0xf45/0x2dc0 ext4_map_blocks+0x724/0x1700 ext4_do_writepages+0x12d6/0x2a70 [...] ============================================ Fixes: ecb94f5fdf4b ("ext4: collapse a single extent tree block into the inode if possible") Cc: stable(a)kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Tested-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Link: https://patch.msgid.link/20240822023545.1994557-9-libaokun@huaweicloud.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/ext4/extents.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index d191aa400c35..4db1d47ccf0b 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -1878,6 +1878,7 @@ static void ext4_ext_try_to_merge_up(handle_t *handle, path[0].p_hdr->eh_max = cpu_to_le16(max_root); brelse(path[1].p_bh); + path[1].p_bh = NULL; ext4_free_blocks(handle, inode, NULL, blk, 1, EXT4_FREE_BLOCKS_METADATA | EXT4_FREE_BLOCKS_FORGET); } -- 2.46.1

2 1

[PATCH OLK-6.6] ext4: fix double brelse() the buffer of the extents path
by Baokun Li 02 Nov '24

02 Nov '24

stable inclusion from stable-v6.6.55 commit 68a69cf60660c73990c1875f94a5551600b04775 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR8Z CVE: CVE-2024-49882 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit dcaa6c31134c0f515600111c38ed7750003e1b9c upstream. In ext4_ext_try_to_merge_up(), set path[1].p_bh to NULL after it has been released, otherwise it may be released twice. An example of what triggers this is as follows: split2 map split1 |--------|-------|--------| ext4_ext_map_blocks ext4_ext_handle_unwritten_extents ext4_split_convert_extents // path->p_depth == 0 ext4_split_extent // 1. do split1 ext4_split_extent_at |ext4_ext_insert_extent | ext4_ext_create_new_leaf | ext4_ext_grow_indepth | le16_add_cpu(&neh->eh_depth, 1) | ext4_find_extent | // return -ENOMEM |// get error and try zeroout |path = ext4_find_extent | path->p_depth = 1 |ext4_ext_try_to_merge | ext4_ext_try_to_merge_up | path->p_depth = 0 | brelse(path[1].p_bh) ---> not set to NULL here |// zeroout success // 2. update path ext4_find_extent // 3. do split2 ext4_split_extent_at ext4_ext_insert_extent ext4_ext_create_new_leaf ext4_ext_grow_indepth le16_add_cpu(&neh->eh_depth, 1) ext4_find_extent path[0].p_bh = NULL; path->p_depth = 1 read_extent_tree_block ---> return err // path[1].p_bh is still the old value ext4_free_ext_path ext4_ext_drop_refs // path->p_depth == 1 brelse(path[1].p_bh) ---> brelse a buffer twice Finally got the following WARRNING when removing the buffer from lru: ============================================ VFS: brelse: Trying to free free buffer WARNING: CPU: 2 PID: 72 at fs/buffer.c:1241 __brelse+0x58/0x90 CPU: 2 PID: 72 Comm: kworker/u19:1 Not tainted 6.9.0-dirty #716 RIP: 0010:__brelse+0x58/0x90 Call Trace: <TASK> __find_get_block+0x6e7/0x810 bdev_getblk+0x2b/0x480 __ext4_get_inode_loc+0x48a/0x1240 ext4_get_inode_loc+0xb2/0x150 ext4_reserve_inode_write+0xb7/0x230 __ext4_mark_inode_dirty+0x144/0x6a0 ext4_ext_insert_extent+0x9c8/0x3230 ext4_ext_map_blocks+0xf45/0x2dc0 ext4_map_blocks+0x724/0x1700 ext4_do_writepages+0x12d6/0x2a70 [...] ============================================ Fixes: ecb94f5fdf4b ("ext4: collapse a single extent tree block into the inode if possible") Cc: stable(a)kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Tested-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Link: https://patch.msgid.link/20240822023545.1994557-9-libaokun@huaweicloud.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/ext4/extents.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index 922718422ba6..25e077682aff 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -1888,6 +1888,7 @@ static void ext4_ext_try_to_merge_up(handle_t *handle, path[0].p_hdr->eh_max = cpu_to_le16(max_root); brelse(path[1].p_bh); + path[1].p_bh = NULL; ext4_free_blocks(handle, inode, NULL, blk, 1, EXT4_FREE_BLOCKS_METADATA | EXT4_FREE_BLOCKS_FORGET); } -- 2.46.1

2 1

[PATCH openEuler-1.0-LTS] ext4: fix double brelse() the buffer of the extents path
by Baokun Li 02 Nov '24

02 Nov '24

stable inclusion from stable-v5.10.227 commit b6c29c8f3d7cb67b505f3b2f6c242d52298d1f2e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR8Z CVE: CVE-2024-49882 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit dcaa6c31134c0f515600111c38ed7750003e1b9c upstream. In ext4_ext_try_to_merge_up(), set path[1].p_bh to NULL after it has been released, otherwise it may be released twice. An example of what triggers this is as follows: split2 map split1 |--------|-------|--------| ext4_ext_map_blocks ext4_ext_handle_unwritten_extents ext4_split_convert_extents // path->p_depth == 0 ext4_split_extent // 1. do split1 ext4_split_extent_at |ext4_ext_insert_extent | ext4_ext_create_new_leaf | ext4_ext_grow_indepth | le16_add_cpu(&neh->eh_depth, 1) | ext4_find_extent | // return -ENOMEM |// get error and try zeroout |path = ext4_find_extent | path->p_depth = 1 |ext4_ext_try_to_merge | ext4_ext_try_to_merge_up | path->p_depth = 0 | brelse(path[1].p_bh) ---> not set to NULL here |// zeroout success // 2. update path ext4_find_extent // 3. do split2 ext4_split_extent_at ext4_ext_insert_extent ext4_ext_create_new_leaf ext4_ext_grow_indepth le16_add_cpu(&neh->eh_depth, 1) ext4_find_extent path[0].p_bh = NULL; path->p_depth = 1 read_extent_tree_block ---> return err // path[1].p_bh is still the old value ext4_free_ext_path ext4_ext_drop_refs // path->p_depth == 1 brelse(path[1].p_bh) ---> brelse a buffer twice Finally got the following WARRNING when removing the buffer from lru: ============================================ VFS: brelse: Trying to free free buffer WARNING: CPU: 2 PID: 72 at fs/buffer.c:1241 __brelse+0x58/0x90 CPU: 2 PID: 72 Comm: kworker/u19:1 Not tainted 6.9.0-dirty #716 RIP: 0010:__brelse+0x58/0x90 Call Trace: <TASK> __find_get_block+0x6e7/0x810 bdev_getblk+0x2b/0x480 __ext4_get_inode_loc+0x48a/0x1240 ext4_get_inode_loc+0xb2/0x150 ext4_reserve_inode_write+0xb7/0x230 __ext4_mark_inode_dirty+0x144/0x6a0 ext4_ext_insert_extent+0x9c8/0x3230 ext4_ext_map_blocks+0xf45/0x2dc0 ext4_map_blocks+0x724/0x1700 ext4_do_writepages+0x12d6/0x2a70 [...] ============================================ Fixes: ecb94f5fdf4b ("ext4: collapse a single extent tree block into the inode if possible") Cc: stable(a)kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Tested-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Link: https://patch.msgid.link/20240822023545.1994557-9-libaokun@huaweicloud.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/ext4/extents.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index 257e0b2b0e64..7d506187cc79 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -1925,6 +1925,7 @@ static void ext4_ext_try_to_merge_up(handle_t *handle, path[0].p_hdr->eh_max = cpu_to_le16(max_root); brelse(path[1].p_bh); + path[1].p_bh = NULL; ext4_free_blocks(handle, inode, NULL, blk, 1, EXT4_FREE_BLOCKS_METADATA | EXT4_FREE_BLOCKS_FORGET); } -- 2.46.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ext4: aovid use-after-free in ext4_ext_insert_extent()
by Baokun Li 02 Nov '24

02 Nov '24

stable inclusion from stable-v5.10.227 commit 5e811066c5ab709b070659197dccfb80ab650ddd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCP CVE: CVE-2024-49883 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a164f3a432aae62ca23d03e6d926b122ee5b860d upstream. As Ojaswin mentioned in Link, in ext4_ext_insert_extent(), if the path is reallocated in ext4_ext_create_new_leaf(), we'll use the stale path and cause UAF. Below is a sample trace with dummy values: ext4_ext_insert_extent path = *ppath = 2000 ext4_ext_create_new_leaf(ppath) ext4_find_extent(ppath) path = *ppath = 2000 if (depth > path[0].p_maxdepth) kfree(path = 2000); *ppath = path = NULL; path = kcalloc() = 3000 *ppath = 3000; return path; /* here path is still 2000, UAF! */ eh = path[depth].p_hdr ================================================================== BUG: KASAN: slab-use-after-free in ext4_ext_insert_extent+0x26d4/0x3330 Read of size 8 at addr ffff8881027bf7d0 by task kworker/u36:1/179 CPU: 3 UID: 0 PID: 179 Comm: kworker/u6:1 Not tainted 6.11.0-rc2-dirty #866 Call Trace: <TASK> ext4_ext_insert_extent+0x26d4/0x3330 ext4_ext_map_blocks+0xe22/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 [...] Allocated by task 179: ext4_find_extent+0x81c/0x1f70 ext4_ext_map_blocks+0x146/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 ext4_writepages+0x26d/0x4e0 do_writepages+0x175/0x700 [...] Freed by task 179: kfree+0xcb/0x240 ext4_find_extent+0x7c0/0x1f70 ext4_ext_insert_extent+0xa26/0x3330 ext4_ext_map_blocks+0xe22/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 ext4_writepages+0x26d/0x4e0 do_writepages+0x175/0x700 [...] ================================================================== So use *ppath to update the path to avoid the above problem. Reported-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Closes: https://lore.kernel.org/r/ZqyL6rmtwl6N4MWR@li-bb2b2a4c-3307-11b2-a85c-8fa5c… Fixes: 10809df84a4d ("ext4: teach ext4_ext_find_extent() to realloc path if necessary") Cc: stable(a)kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://patch.msgid.link/20240822023545.1994557-7-libaokun@huaweicloud.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/ext4/extents.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index af7b253dfe86..04b0346599c5 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -2106,6 +2106,7 @@ int ext4_ext_insert_extent(handle_t *handle, struct inode *inode, ppath, newext); if (err) goto cleanup; + path = *ppath; depth = ext_depth(inode); eh = path[depth].p_hdr; -- 2.46.1

2 1

[PATCH OLK-5.10] ext4: aovid use-after-free in ext4_ext_insert_extent()
by Baokun Li 02 Nov '24

02 Nov '24

stable inclusion from stable-v5.10.227 commit 5e811066c5ab709b070659197dccfb80ab650ddd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCP CVE: CVE-2024-49883 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a164f3a432aae62ca23d03e6d926b122ee5b860d upstream. As Ojaswin mentioned in Link, in ext4_ext_insert_extent(), if the path is reallocated in ext4_ext_create_new_leaf(), we'll use the stale path and cause UAF. Below is a sample trace with dummy values: ext4_ext_insert_extent path = *ppath = 2000 ext4_ext_create_new_leaf(ppath) ext4_find_extent(ppath) path = *ppath = 2000 if (depth > path[0].p_maxdepth) kfree(path = 2000); *ppath = path = NULL; path = kcalloc() = 3000 *ppath = 3000; return path; /* here path is still 2000, UAF! */ eh = path[depth].p_hdr ================================================================== BUG: KASAN: slab-use-after-free in ext4_ext_insert_extent+0x26d4/0x3330 Read of size 8 at addr ffff8881027bf7d0 by task kworker/u36:1/179 CPU: 3 UID: 0 PID: 179 Comm: kworker/u6:1 Not tainted 6.11.0-rc2-dirty #866 Call Trace: <TASK> ext4_ext_insert_extent+0x26d4/0x3330 ext4_ext_map_blocks+0xe22/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 [...] Allocated by task 179: ext4_find_extent+0x81c/0x1f70 ext4_ext_map_blocks+0x146/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 ext4_writepages+0x26d/0x4e0 do_writepages+0x175/0x700 [...] Freed by task 179: kfree+0xcb/0x240 ext4_find_extent+0x7c0/0x1f70 ext4_ext_insert_extent+0xa26/0x3330 ext4_ext_map_blocks+0xe22/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 ext4_writepages+0x26d/0x4e0 do_writepages+0x175/0x700 [...] ================================================================== So use *ppath to update the path to avoid the above problem. Reported-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Closes: https://lore.kernel.org/r/ZqyL6rmtwl6N4MWR@li-bb2b2a4c-3307-11b2-a85c-8fa5c… Fixes: 10809df84a4d ("ext4: teach ext4_ext_find_extent() to realloc path if necessary") Cc: stable(a)kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://patch.msgid.link/20240822023545.1994557-7-libaokun@huaweicloud.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/ext4/extents.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index 1c70f48238b0..d191aa400c35 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -2106,6 +2106,7 @@ int ext4_ext_insert_extent(handle_t *handle, struct inode *inode, ppath, newext); if (err) goto cleanup; + path = *ppath; depth = ext_depth(inode); eh = path[depth].p_hdr; -- 2.46.1

2 1

[PATCH OLK-6.6] ext4: aovid use-after-free in ext4_ext_insert_extent()
by Baokun Li 02 Nov '24

02 Nov '24

stable inclusion from stable-v6.6.55 commit 8162ee5d94b8c0351be0a9321be134872a7654a1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCP CVE: CVE-2024-49883 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a164f3a432aae62ca23d03e6d926b122ee5b860d upstream. As Ojaswin mentioned in Link, in ext4_ext_insert_extent(), if the path is reallocated in ext4_ext_create_new_leaf(), we'll use the stale path and cause UAF. Below is a sample trace with dummy values: ext4_ext_insert_extent path = *ppath = 2000 ext4_ext_create_new_leaf(ppath) ext4_find_extent(ppath) path = *ppath = 2000 if (depth > path[0].p_maxdepth) kfree(path = 2000); *ppath = path = NULL; path = kcalloc() = 3000 *ppath = 3000; return path; /* here path is still 2000, UAF! */ eh = path[depth].p_hdr ================================================================== BUG: KASAN: slab-use-after-free in ext4_ext_insert_extent+0x26d4/0x3330 Read of size 8 at addr ffff8881027bf7d0 by task kworker/u36:1/179 CPU: 3 UID: 0 PID: 179 Comm: kworker/u6:1 Not tainted 6.11.0-rc2-dirty #866 Call Trace: <TASK> ext4_ext_insert_extent+0x26d4/0x3330 ext4_ext_map_blocks+0xe22/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 [...] Allocated by task 179: ext4_find_extent+0x81c/0x1f70 ext4_ext_map_blocks+0x146/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 ext4_writepages+0x26d/0x4e0 do_writepages+0x175/0x700 [...] Freed by task 179: kfree+0xcb/0x240 ext4_find_extent+0x7c0/0x1f70 ext4_ext_insert_extent+0xa26/0x3330 ext4_ext_map_blocks+0xe22/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 ext4_writepages+0x26d/0x4e0 do_writepages+0x175/0x700 [...] ================================================================== So use *ppath to update the path to avoid the above problem. Reported-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Closes: https://lore.kernel.org/r/ZqyL6rmtwl6N4MWR@li-bb2b2a4c-3307-11b2-a85c-8fa5c… Fixes: 10809df84a4d ("ext4: teach ext4_ext_find_extent() to realloc path if necessary") Cc: stable(a)kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://patch.msgid.link/20240822023545.1994557-7-libaokun@huaweicloud.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/ext4/extents.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index 25e077682aff..ef37cee9c27e 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -2115,6 +2115,7 @@ int ext4_ext_insert_extent(handle_t *handle, struct inode *inode, ppath, newext); if (err) goto cleanup; + path = *ppath; depth = ext_depth(inode); eh = path[depth].p_hdr; -- 2.46.1

2 1

[PATCH openEuler-1.0-LTS] ext4: aovid use-after-free in ext4_ext_insert_extent()
by Baokun Li 02 Nov '24

02 Nov '24

stable inclusion from stable-v5.10.227 commit 5e811066c5ab709b070659197dccfb80ab650ddd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCP CVE: CVE-2024-49883 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a164f3a432aae62ca23d03e6d926b122ee5b860d upstream. As Ojaswin mentioned in Link, in ext4_ext_insert_extent(), if the path is reallocated in ext4_ext_create_new_leaf(), we'll use the stale path and cause UAF. Below is a sample trace with dummy values: ext4_ext_insert_extent path = *ppath = 2000 ext4_ext_create_new_leaf(ppath) ext4_find_extent(ppath) path = *ppath = 2000 if (depth > path[0].p_maxdepth) kfree(path = 2000); *ppath = path = NULL; path = kcalloc() = 3000 *ppath = 3000; return path; /* here path is still 2000, UAF! */ eh = path[depth].p_hdr ================================================================== BUG: KASAN: slab-use-after-free in ext4_ext_insert_extent+0x26d4/0x3330 Read of size 8 at addr ffff8881027bf7d0 by task kworker/u36:1/179 CPU: 3 UID: 0 PID: 179 Comm: kworker/u6:1 Not tainted 6.11.0-rc2-dirty #866 Call Trace: <TASK> ext4_ext_insert_extent+0x26d4/0x3330 ext4_ext_map_blocks+0xe22/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 [...] Allocated by task 179: ext4_find_extent+0x81c/0x1f70 ext4_ext_map_blocks+0x146/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 ext4_writepages+0x26d/0x4e0 do_writepages+0x175/0x700 [...] Freed by task 179: kfree+0xcb/0x240 ext4_find_extent+0x7c0/0x1f70 ext4_ext_insert_extent+0xa26/0x3330 ext4_ext_map_blocks+0xe22/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 ext4_writepages+0x26d/0x4e0 do_writepages+0x175/0x700 [...] ================================================================== So use *ppath to update the path to avoid the above problem. Reported-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Closes: https://lore.kernel.org/r/ZqyL6rmtwl6N4MWR@li-bb2b2a4c-3307-11b2-a85c-8fa5c… Fixes: 10809df84a4d ("ext4: teach ext4_ext_find_extent() to realloc path if necessary") Cc: stable(a)kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://patch.msgid.link/20240822023545.1994557-7-libaokun@huaweicloud.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/ext4/extents.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index e29b55991e8f..257e0b2b0e64 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -2152,6 +2152,7 @@ int ext4_ext_insert_extent(handle_t *handle, struct inode *inode, ppath, newext); if (err) goto cleanup; + path = *ppath; depth = ext_depth(inode); eh = path[depth].p_hdr; -- 2.46.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ext4: avoid use-after-free in ext4_ext_show_leaf()
by Baokun Li 02 Nov '24

02 Nov '24

stable inclusion from stable-v5.10.227 commit b0cb4561fc4284d04e69c8a66c8504928ab2484e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR98 CVE: CVE-2024-49889 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4e2524ba2ca5f54bdbb9e5153bea00421ef653f5 ] In ext4_find_extent(), path may be freed by error or be reallocated, so using a previously saved *ppath may have been freed and thus may trigger use-after-free, as follows: ext4_split_extent path = *ppath; ext4_split_extent_at(ppath) path = ext4_find_extent(ppath) ext4_split_extent_at(ppath) // ext4_find_extent fails to free path // but zeroout succeeds ext4_ext_show_leaf(inode, path) eh = path[depth].p_hdr // path use-after-free !!! Similar to ext4_split_extent_at(), we use *ppath directly as an input to ext4_ext_show_leaf(). Fix a spelling error by the way. Same problem in ext4_ext_handle_unwritten_extents(). Since 'path' is only used in ext4_ext_show_leaf(), remove 'path' and use *ppath directly. This issue is triggered only when EXT_DEBUG is defined and therefore does not affect functionality. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Tested-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Link: https://patch.msgid.link/20240822023545.1994557-5-libaokun@huaweicloud.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/ext4/extents.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index db3ed0fb7bdb..af7b253dfe86 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -3341,7 +3341,7 @@ static int ext4_split_extent_at(handle_t *handle, } /* - * ext4_split_extents() splits an extent and mark extent which is covered + * ext4_split_extent() splits an extent and mark extent which is covered * by @map as split_flags indicates * * It may result in splitting the extent into multiple extents (up to three) @@ -3418,7 +3418,7 @@ static int ext4_split_extent(handle_t *handle, goto out; } - ext4_ext_show_leaf(inode, path); + ext4_ext_show_leaf(inode, *ppath); out: return err ? err : allocated; } @@ -3883,14 +3883,13 @@ ext4_ext_handle_unwritten_extents(handle_t *handle, struct inode *inode, struct ext4_ext_path **ppath, int flags, unsigned int allocated, ext4_fsblk_t newblock) { - struct ext4_ext_path __maybe_unused *path = *ppath; int ret = 0; int err = 0; ext_debug(inode, "logical block %llu, max_blocks %u, flags 0x%x, allocated %u\n", (unsigned long long)map->m_lblk, map->m_len, flags, allocated); - ext4_ext_show_leaf(inode, path); + ext4_ext_show_leaf(inode, *ppath); /* * When writing into unwritten space, we should not fail to @@ -3987,7 +3986,7 @@ ext4_ext_handle_unwritten_extents(handle_t *handle, struct inode *inode, if (allocated > map->m_len) allocated = map->m_len; map->m_len = allocated; - ext4_ext_show_leaf(inode, path); + ext4_ext_show_leaf(inode, *ppath); out2: return err ? err : allocated; } -- 2.46.1

2 1

[PATCH OLK-5.10] ext4: avoid use-after-free in ext4_ext_show_leaf()
by Baokun Li 02 Nov '24

02 Nov '24

stable inclusion from stable-v5.10.227 commit b0cb4561fc4284d04e69c8a66c8504928ab2484e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR98 CVE: CVE-2024-49889 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4e2524ba2ca5f54bdbb9e5153bea00421ef653f5 ] In ext4_find_extent(), path may be freed by error or be reallocated, so using a previously saved *ppath may have been freed and thus may trigger use-after-free, as follows: ext4_split_extent path = *ppath; ext4_split_extent_at(ppath) path = ext4_find_extent(ppath) ext4_split_extent_at(ppath) // ext4_find_extent fails to free path // but zeroout succeeds ext4_ext_show_leaf(inode, path) eh = path[depth].p_hdr // path use-after-free !!! Similar to ext4_split_extent_at(), we use *ppath directly as an input to ext4_ext_show_leaf(). Fix a spelling error by the way. Same problem in ext4_ext_handle_unwritten_extents(). Since 'path' is only used in ext4_ext_show_leaf(), remove 'path' and use *ppath directly. This issue is triggered only when EXT_DEBUG is defined and therefore does not affect functionality. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Tested-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Link: https://patch.msgid.link/20240822023545.1994557-5-libaokun@huaweicloud.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/ext4/extents.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index 32746616faf7..1c70f48238b0 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -3318,7 +3318,7 @@ static int ext4_split_extent_at(handle_t *handle, } /* - * ext4_split_extents() splits an extent and mark extent which is covered + * ext4_split_extent() splits an extent and mark extent which is covered * by @map as split_flags indicates * * It may result in splitting the extent into multiple extents (up to three) @@ -3395,7 +3395,7 @@ static int ext4_split_extent(handle_t *handle, goto out; } - ext4_ext_show_leaf(inode, path); + ext4_ext_show_leaf(inode, *ppath); out: return err ? err : allocated; } @@ -3860,14 +3860,13 @@ ext4_ext_handle_unwritten_extents(handle_t *handle, struct inode *inode, struct ext4_ext_path **ppath, int flags, unsigned int allocated, ext4_fsblk_t newblock) { - struct ext4_ext_path __maybe_unused *path = *ppath; int ret = 0; int err = 0; ext_debug(inode, "logical block %llu, max_blocks %u, flags 0x%x, allocated %u\n", (unsigned long long)map->m_lblk, map->m_len, flags, allocated); - ext4_ext_show_leaf(inode, path); + ext4_ext_show_leaf(inode, *ppath); /* * When writing into unwritten space, we should not fail to @@ -3964,7 +3963,7 @@ ext4_ext_handle_unwritten_extents(handle_t *handle, struct inode *inode, if (allocated > map->m_len) allocated = map->m_len; map->m_len = allocated; - ext4_ext_show_leaf(inode, path); + ext4_ext_show_leaf(inode, *ppath); out2: return err ? err : allocated; } -- 2.46.1

2 1

[PATCH OLK-6.6] ext4: avoid use-after-free in ext4_ext_show_leaf()
by Baokun Li 02 Nov '24

02 Nov '24

stable inclusion from stable-v6.6.55 commit 34b2096380ba475771971a778a478661a791aa15 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR98 CVE: CVE-2024-49889 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4e2524ba2ca5f54bdbb9e5153bea00421ef653f5 ] In ext4_find_extent(), path may be freed by error or be reallocated, so using a previously saved *ppath may have been freed and thus may trigger use-after-free, as follows: ext4_split_extent path = *ppath; ext4_split_extent_at(ppath) path = ext4_find_extent(ppath) ext4_split_extent_at(ppath) // ext4_find_extent fails to free path // but zeroout succeeds ext4_ext_show_leaf(inode, path) eh = path[depth].p_hdr // path use-after-free !!! Similar to ext4_split_extent_at(), we use *ppath directly as an input to ext4_ext_show_leaf(). Fix a spelling error by the way. Same problem in ext4_ext_handle_unwritten_extents(). Since 'path' is only used in ext4_ext_show_leaf(), remove 'path' and use *ppath directly. This issue is triggered only when EXT_DEBUG is defined and therefore does not affect functionality. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Tested-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Link: https://patch.msgid.link/20240822023545.1994557-5-libaokun@huaweicloud.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/ext4/extents.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index f5052f99b2f8..922718422ba6 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -3317,7 +3317,7 @@ static int ext4_split_extent_at(handle_t *handle, } /* - * ext4_split_extents() splits an extent and mark extent which is covered + * ext4_split_extent() splits an extent and mark extent which is covered * by @map as split_flags indicates * * It may result in splitting the extent into multiple extents (up to three) @@ -3393,7 +3393,7 @@ static int ext4_split_extent(handle_t *handle, goto out; } - ext4_ext_show_leaf(inode, path); + ext4_ext_show_leaf(inode, *ppath); out: return err ? err : allocated; } @@ -3864,14 +3864,13 @@ ext4_ext_handle_unwritten_extents(handle_t *handle, struct inode *inode, struct ext4_ext_path **ppath, int flags, unsigned int allocated, ext4_fsblk_t newblock) { - struct ext4_ext_path __maybe_unused *path = *ppath; int ret = 0; int err = 0; ext_debug(inode, "logical block %llu, max_blocks %u, flags 0x%x, allocated %u\n", (unsigned long long)map->m_lblk, map->m_len, flags, allocated); - ext4_ext_show_leaf(inode, path); + ext4_ext_show_leaf(inode, *ppath); /* * When writing into unwritten space, we should not fail to @@ -3968,7 +3967,7 @@ ext4_ext_handle_unwritten_extents(handle_t *handle, struct inode *inode, if (allocated > map->m_len) allocated = map->m_len; map->m_len = allocated; - ext4_ext_show_leaf(inode, path); + ext4_ext_show_leaf(inode, *ppath); out2: return err ? err : allocated; } -- 2.46.1

2 1

[PATCH openEuler-1.0-LTS] ext4: avoid use-after-free in ext4_ext_show_leaf()
by Baokun Li 02 Nov '24

02 Nov '24

stable inclusion from stable-v5.10.227 commit b0cb4561fc4284d04e69c8a66c8504928ab2484e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR98 CVE: CVE-2024-49889 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4e2524ba2ca5f54bdbb9e5153bea00421ef653f5 ] In ext4_find_extent(), path may be freed by error or be reallocated, so using a previously saved *ppath may have been freed and thus may trigger use-after-free, as follows: ext4_split_extent path = *ppath; ext4_split_extent_at(ppath) path = ext4_find_extent(ppath) ext4_split_extent_at(ppath) // ext4_find_extent fails to free path // but zeroout succeeds ext4_ext_show_leaf(inode, path) eh = path[depth].p_hdr // path use-after-free !!! Similar to ext4_split_extent_at(), we use *ppath directly as an input to ext4_ext_show_leaf(). Fix a spelling error by the way. Same problem in ext4_ext_handle_unwritten_extents(). Since 'path' is only used in ext4_ext_show_leaf(), remove 'path' and use *ppath directly. This issue is triggered only when EXT_DEBUG is defined and therefore does not affect functionality. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Tested-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Link: https://patch.msgid.link/20240822023545.1994557-5-libaokun@huaweicloud.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/ext4/extents.c [Context differences because there is no commit 4337ecd1fe99 ("ext4: remove EXT4_EOFBLOCKS_FL and associated code")] Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/ext4/extents.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index e29b55991e8f..b4a0ed5dad9f 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -3402,7 +3402,7 @@ static int ext4_split_extent_at(handle_t *handle, } /* - * ext4_split_extents() splits an extent and mark extent which is covered + * ext4_split_extent() splits an extent and mark extent which is covered * by @map as split_flags indicates * * It may result in splitting the extent into multiple extents (up to three) @@ -3479,7 +3479,7 @@ static int ext4_split_extent(handle_t *handle, goto out; } - ext4_ext_show_leaf(inode, path); + ext4_ext_show_leaf(inode, *ppath); out: return err ? err : allocated; } @@ -4114,7 +4114,6 @@ ext4_ext_handle_unwritten_extents(handle_t *handle, struct inode *inode, struct ext4_ext_path **ppath, int flags, unsigned int allocated, ext4_fsblk_t newblock) { - struct ext4_ext_path *path = *ppath; int ret = 0; int err = 0; @@ -4122,7 +4121,7 @@ ext4_ext_handle_unwritten_extents(handle_t *handle, struct inode *inode, "block %llu, max_blocks %u, flags %x, allocated %u\n", inode->i_ino, (unsigned long long)map->m_lblk, map->m_len, flags, allocated); - ext4_ext_show_leaf(inode, path); + ext4_ext_show_leaf(inode, *ppath); /* * When writing into unwritten space, we should not fail to @@ -4157,7 +4156,7 @@ ext4_ext_handle_unwritten_extents(handle_t *handle, struct inode *inode, if (ret >= 0) { ext4_update_inode_fsync_trans(handle, inode, 1); err = check_eofblocks_fl(handle, inode, map->m_lblk, - path, map->m_len); + *ppath, map->m_len); } else err = ret; map->m_flags |= EXT4_MAP_MAPPED; @@ -4235,7 +4234,7 @@ ext4_ext_handle_unwritten_extents(handle_t *handle, struct inode *inode, map_out: map->m_flags |= EXT4_MAP_MAPPED; if ((flags & EXT4_GET_BLOCKS_KEEP_SIZE) == 0) { - err = check_eofblocks_fl(handle, inode, map->m_lblk, path, + err = check_eofblocks_fl(handle, inode, map->m_lblk, *ppath, map->m_len); if (err < 0) goto out2; @@ -4243,7 +4242,7 @@ ext4_ext_handle_unwritten_extents(handle_t *handle, struct inode *inode, out1: if (allocated > map->m_len) allocated = map->m_len; - ext4_ext_show_leaf(inode, path); + ext4_ext_show_leaf(inode, *ppath); map->m_pblk = newblock; map->m_len = allocated; out2: -- 2.46.1

2 1

[PATCH OLK-5.10] drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw
by Zeng Heng 02 Nov '24

02 Nov '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> mainline inclusion from mainline-v6.12-rc1 commit cba7fec864172dadd953daefdd26e01742b71a6a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR9I CVE: CVE-2024-49917 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This commit addresses a potential null pointer dereference issue in the `dcn30_init_hw` function. The issue could occur when `dc->clk_mgr` or `dc->clk_mgr->funcs` is null. The fix adds a check to ensure `dc->clk_mgr` and `dc->clk_mgr->funcs` is not null before accessing its functions. This prevents a potential null pointer dereference. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:789 dcn30_init_hw() error: we previously assumed 'dc->clk_mgr' could be null (see line 628) Cc: Tom Chung <chiahsuan.chung(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Roman Li <roman.li(a)amd.com> Cc: Alex Hung <alex.hung(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Cc: Harry Wentland <harry.wentland(a)amd.com> Cc: Hamza Mahfooz <hamza.mahfooz(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Alex Hung <alex.hung(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c [The target file path has changed, and necessary adaptations should be made based on the context.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c index 45731644e959..57ec5d4bf13d 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c +++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c @@ -442,7 +442,7 @@ void dcn30_init_hw(struct dc *dc) struct resource_pool *res_pool = dc->res_pool; uint32_t backlight = MAX_BACKLIGHT_LEVEL; - if (dc->clk_mgr && dc->clk_mgr->funcs->init_clocks) + if (dc->clk_mgr && dc->clk_mgr->funcs && dc->clk_mgr->funcs->init_clocks) dc->clk_mgr->funcs->init_clocks(dc->clk_mgr); // Initialize the dccg @@ -633,10 +633,10 @@ void dcn30_init_hw(struct dc *dc) if (hws->funcs.enable_power_gating_plane) hws->funcs.enable_power_gating_plane(dc->hwseq, true); - if (dc->clk_mgr->funcs->notify_wm_ranges) + if (dc->clk_mgr && dc->clk_mgr->funcs && dc->clk_mgr->funcs->notify_wm_ranges) dc->clk_mgr->funcs->notify_wm_ranges(dc->clk_mgr); - if (dc->clk_mgr->funcs->set_hard_max_memclk) + if (dc->clk_mgr && dc->clk_mgr->funcs && dc->clk_mgr->funcs->set_hard_max_memclk) dc->clk_mgr->funcs->set_hard_max_memclk(dc->clk_mgr); } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw
by Zeng Heng 02 Nov '24

02 Nov '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> mainline inclusion from mainline-v6.12-rc1 commit cba7fec864172dadd953daefdd26e01742b71a6a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR9I CVE: CVE-2024-49917 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This commit addresses a potential null pointer dereference issue in the `dcn30_init_hw` function. The issue could occur when `dc->clk_mgr` or `dc->clk_mgr->funcs` is null. The fix adds a check to ensure `dc->clk_mgr` and `dc->clk_mgr->funcs` is not null before accessing its functions. This prevents a potential null pointer dereference. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:789 dcn30_init_hw() error: we previously assumed 'dc->clk_mgr' could be null (see line 628) Cc: Tom Chung <chiahsuan.chung(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Roman Li <roman.li(a)amd.com> Cc: Alex Hung <alex.hung(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Cc: Harry Wentland <harry.wentland(a)amd.com> Cc: Hamza Mahfooz <hamza.mahfooz(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Alex Hung <alex.hung(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c [The target file path has changed, and necessary adaptations should be made based on the context.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c index 45731644e959..57ec5d4bf13d 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c +++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c @@ -442,7 +442,7 @@ void dcn30_init_hw(struct dc *dc) struct resource_pool *res_pool = dc->res_pool; uint32_t backlight = MAX_BACKLIGHT_LEVEL; - if (dc->clk_mgr && dc->clk_mgr->funcs->init_clocks) + if (dc->clk_mgr && dc->clk_mgr->funcs && dc->clk_mgr->funcs->init_clocks) dc->clk_mgr->funcs->init_clocks(dc->clk_mgr); // Initialize the dccg @@ -633,10 +633,10 @@ void dcn30_init_hw(struct dc *dc) if (hws->funcs.enable_power_gating_plane) hws->funcs.enable_power_gating_plane(dc->hwseq, true); - if (dc->clk_mgr->funcs->notify_wm_ranges) + if (dc->clk_mgr && dc->clk_mgr->funcs && dc->clk_mgr->funcs->notify_wm_ranges) dc->clk_mgr->funcs->notify_wm_ranges(dc->clk_mgr); - if (dc->clk_mgr->funcs->set_hard_max_memclk) + if (dc->clk_mgr && dc->clk_mgr->funcs && dc->clk_mgr->funcs->set_hard_max_memclk) dc->clk_mgr->funcs->set_hard_max_memclk(dc->clk_mgr); } -- 2.25.1

2 1

[PATCH OLK-6.6] drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw
by Zeng Heng 02 Nov '24

02 Nov '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> mainline inclusion from mainline-v6.12-rc1 commit cba7fec864172dadd953daefdd26e01742b71a6a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR9I CVE: CVE-2024-49917 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This commit addresses a potential null pointer dereference issue in the `dcn30_init_hw` function. The issue could occur when `dc->clk_mgr` or `dc->clk_mgr->funcs` is null. The fix adds a check to ensure `dc->clk_mgr` and `dc->clk_mgr->funcs` is not null before accessing its functions. This prevents a potential null pointer dereference. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:789 dcn30_init_hw() error: we previously assumed 'dc->clk_mgr' could be null (see line 628) Cc: Tom Chung <chiahsuan.chung(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Roman Li <roman.li(a)amd.com> Cc: Alex Hung <alex.hung(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Cc: Harry Wentland <harry.wentland(a)amd.com> Cc: Hamza Mahfooz <hamza.mahfooz(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Alex Hung <alex.hung(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c [Only the target file path has simply changed.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c index ba4a1e7f196d..a7e78062c5e1 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c +++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c @@ -440,7 +440,7 @@ void dcn30_init_hw(struct dc *dc) int edp_num; uint32_t backlight = MAX_BACKLIGHT_LEVEL; - if (dc->clk_mgr && dc->clk_mgr->funcs->init_clocks) + if (dc->clk_mgr && dc->clk_mgr->funcs && dc->clk_mgr->funcs->init_clocks) dc->clk_mgr->funcs->init_clocks(dc->clk_mgr); // Initialize the dccg @@ -599,11 +599,12 @@ void dcn30_init_hw(struct dc *dc) if (!dcb->funcs->is_accelerated_mode(dcb) && dc->res_pool->hubbub->funcs->init_watermarks) dc->res_pool->hubbub->funcs->init_watermarks(dc->res_pool->hubbub); - if (dc->clk_mgr->funcs->notify_wm_ranges) + if (dc->clk_mgr && dc->clk_mgr->funcs && dc->clk_mgr->funcs->notify_wm_ranges) dc->clk_mgr->funcs->notify_wm_ranges(dc->clk_mgr); //if softmax is enabled then hardmax will be set by a different call - if (dc->clk_mgr->funcs->set_hard_max_memclk && !dc->clk_mgr->dc_mode_softmax_enabled) + if (dc->clk_mgr && dc->clk_mgr->funcs && dc->clk_mgr->funcs->set_hard_max_memclk && + !dc->clk_mgr->dc_mode_softmax_enabled) dc->clk_mgr->funcs->set_hard_max_memclk(dc->clk_mgr); if (dc->res_pool->hubbub->funcs->force_pstate_change_control) -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/2] nfs: fix memory lead and nfs_server uaf
by Li Lingfeng 02 Nov '24

02 Nov '24

Li Lingfeng (1): nfs: fix memory leak in error path of nfs4_do_reclaim Yang Erkun (1): nfs: maintain nfs_server in the reclaim process fs/nfs/nfs4state.c | 9 +++++++++ 1 file changed, 9 insertions(+) -- 2.31.1

2 3

[openeuler:OLK-5.10] BUILD REGRESSION cc5e1415473b95a8a68887dbb9c459ed50de9f1e
by kernel test robot 02 Nov '24

02 Nov '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: cc5e1415473b95a8a68887dbb9c459ed50de9f1e !12525 powercap: intel_rapl: Fix off by one in get_rpi() Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202411011918.G4zrdL90-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202411012238.VsICkiep-lkp@intel.com drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2340: multiple definition of `fmgr_cmd_op'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2854: first defined here drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2361: multiple definition of `fmgr_usr_cmd_op'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2875: first defined here drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2371: multiple definition of `flash_erase_chip'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2885: first defined here drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2377: multiple definition of `flash_erase_sector'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2891: first defined here drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2393: multiple definition of `flash_write_dword'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2908: first defined here drivers/ptp/ptp_hisi.c:731:36: warning: 'hisi_ptp_acpi_match' defined but not used [-Wunused-const-variable=] drivers/ub/urma/ubcore/ubcore_main.c:61:5: warning: no previous prototype for 'ubcore_open' [-Wmissing-prototypes] drivers/ub/urma/ubcore/ubcore_umem.c:227:21: warning: no previous prototype for 'ubcore_umem_get' [-Wmissing-prototypes] drivers/ub/urma/ubcore/ubcore_umem.c:245:6: warning: no previous prototype for 'ubcore_umem_release' [-Wmissing-prototypes] drivers/ub/urma/uburma/uburma_dev_ops.c:102:5: warning: no previous prototype for 'uburma_close' [-Wmissing-prototypes] drivers/ub/urma/uburma/uburma_dev_ops.c:32:5: warning: no previous prototype for 'uburma_mmap' [-Wmissing-prototypes] drivers/ub/urma/uburma/uburma_dev_ops.c:32:6: warning: no previous prototype for 'uburma_release_file' [-Wmissing-prototypes] drivers/ub/urma/uburma/uburma_dev_ops.c:49:5: warning: no previous prototype for 'uburma_open' [-Wmissing-prototypes] drivers/ub/urma/uburma/uburma_dev_ops.c:66:50: warning: the comparison will always evaluate as 'false' for the address of 'dev_name' will never be NULL [-Waddress] Unverified Error/Warning (likely false positive, kindly check if interested): drivers/firmware/efi/libstub/efi-stub-helper.c:373 efi_load_initrd_dev_path() error: uninitialized symbol 'initrd_size'. drivers/gpu/drm/mcde/mcde_display.o: warning: objtool: mcde_display_enable() falls through to next function mcde_display_disable() Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_enter | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- arm64-randconfig-003-20241029 | |-- drivers-ptp-ptp_hisi.c:warning:hisi_ptp_acpi_match-defined-but-not-used | |-- drivers-ub-urma-ubcore-ubcore_main.c:warning:no-previous-prototype-for-ubcore_open | |-- drivers-ub-urma-ubcore-ubcore_umem.c:warning:no-previous-prototype-for-ubcore_umem_get | |-- drivers-ub-urma-ubcore-ubcore_umem.c:warning:no-previous-prototype-for-ubcore_umem_release | |-- drivers-ub-urma-uburma-uburma_dev_ops.c:warning:no-previous-prototype-for-uburma_close | |-- drivers-ub-urma-uburma-uburma_dev_ops.c:warning:no-previous-prototype-for-uburma_mmap | |-- drivers-ub-urma-uburma-uburma_dev_ops.c:warning:no-previous-prototype-for-uburma_open | |-- drivers-ub-urma-uburma-uburma_dev_ops.c:warning:no-previous-prototype-for-uburma_release_file | `-- drivers-ub-urma-uburma-uburma_dev_ops.c:warning:the-comparison-will-always-evaluate-as-false-for-the-address-of-dev_name-will-never-be-NULL |-- arm64-randconfig-004-20241102 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | `-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm |-- x86_64-allnoconfig | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- drivers-net-ipvlan-ipvlan_main.c:warning:variable-old_prog-set-but-not-used | `-- ld.lld:error:duplicate-symbol:debug |-- x86_64-buildonly-randconfig-002-20241101 | `-- drivers-gpu-drm-mcde-mcde_display.o:warning:objtool:mcde_display_enable-falls-through-to-next-function-mcde_display_disable() |-- x86_64-buildonly-randconfig-004-20241102 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_OPCODE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) | `-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn |-- x86_64-buildonly-randconfig-006-20241102 | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn-Werror-Wimplicit-function-declaration | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_OPCODE | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_SIZE | `-- drivers-gpu-drm-loongson-lsdc_plane.o:warning:objtool:lsdc_plane_init-falls-through-to-next-function-lsdc_plane_reset() |-- x86_64-kexec | `-- kernel-trace-trace_uprobe.o:warning:objtool:__uprobe_perf_func:unreachable-instruction |-- x86_64-randconfig-001-20241102 | |-- fs-buffer.o:warning:objtool:__breadahead_gfp:unreachable-instruction | `-- kernel-trace-trace_uprobe.o:warning:objtool:__uprobe_perf_func:unreachable-instruction |-- x86_64-randconfig-003-20241102 | `-- drivers-usb-cdns3-debug.h:warning:sprintf-argument-may-overlap-destination-object-field |-- x86_64-randconfig-004-20241102 | `-- drivers-net-ipvlan-ipvlan_main.c:warning:variable-old_prog-set-but-not-used |-- x86_64-randconfig-005-20241101 | |-- fs-buffer.o:warning:objtool:__breadahead_gfp:unreachable-instruction | `-- kernel-rcu-tree.o:warning:objtool:__call_rcu_nocb_wake:unreachable-instruction |-- x86_64-randconfig-014-20241101 | |-- multiple-definition-of-flash_erase_chip-drivers-net-ethernet-netswift-txgbe-txgbe_hw.o:drivers-net-ethernet-netswift-txgbe-txgbe_hw.c:first-defined-here | |-- multiple-definition-of-flash_erase_sector-drivers-net-ethernet-netswift-txgbe-txgbe_hw.o:drivers-net-ethernet-netswift-txgbe-txgbe_hw.c:first-defined-here | |-- multiple-definition-of-flash_write_dword-drivers-net-ethernet-netswift-txgbe-txgbe_hw.o:drivers-net-ethernet-netswift-txgbe-txgbe_hw.c:first-defined-here | |-- multiple-definition-of-fmgr_cmd_op-drivers-net-ethernet-netswift-txgbe-txgbe_hw.o:drivers-net-ethernet-netswift-txgbe-txgbe_hw.c:first-defined-here | `-- multiple-definition-of-fmgr_usr_cmd_op-drivers-net-ethernet-netswift-txgbe-txgbe_hw.o:drivers-net-ethernet-netswift-txgbe-txgbe_hw.c:first-defined-here `-- x86_64-randconfig-161-20241029 `-- drivers-firmware-efi-libstub-efi-stub-helper.c-efi_load_initrd_dev_path()-error:uninitialized-symbol-initrd_size-. elapsed time: 999m configs tested: 21 configs skipped: 117 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20241102 clang-20 arm64 randconfig-002-20241102 clang-20 arm64 randconfig-003-20241102 clang-20 arm64 randconfig-004-20241102 clang-17 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241102 clang-19 x86_64 buildonly-randconfig-002-20241102 gcc-12 x86_64 buildonly-randconfig-003-20241102 clang-19 x86_64 buildonly-randconfig-004-20241102 gcc-12 x86_64 buildonly-randconfig-005-20241102 gcc-12 x86_64 buildonly-randconfig-006-20241102 clang-19 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 randconfig-001-20241102 clang-19 x86_64 randconfig-002-20241102 gcc-12 x86_64 randconfig-003-20241102 gcc-12 x86_64 randconfig-004-20241102 clang-19 x86_64 rhel-8.3 gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] LoongArch: disable cpufreq driver
by Hongchen Zhang 02 Nov '24

02 Nov '24

Hongchen Zhang (1): LoongArch: disable cpufreq driver Ming Wang (1): cpufreq: loongson3-acpi: Initialize scaling_cur_freq correctly arch/loongarch/configs/loongson3_defconfig | 1 - drivers/cpufreq/loongson3-acpi-cpufreq.c | 2 ++ 2 files changed, 2 insertions(+), 1 deletion(-) -- 2.43.0

2 3

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-50016
by Yuntao Liu 02 Nov '24

02 Nov '24

CVE-2024-50016 Alex Hung (1): drm/amd/display: Avoid overflow assignment in link_dp_cts drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 3 ++- drivers/gpu/drm/amd/display/dc/dc_dp_types.h | 2 +- drivers/gpu/drm/amd/display/include/dpcd_defs.h | 1 + 3 files changed, 4 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] CVE-2024-50016
by Yuntao Liu 02 Nov '24

02 Nov '24

CVE-2024-50016 Alex Hung (1): drm/amd/display: Avoid overflow assignment in link_dp_cts drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 3 ++- drivers/gpu/drm/amd/display/dc/dc_dp_types.h | 2 +- drivers/gpu/drm/amd/display/include/dpcd_defs.h | 1 + 3 files changed, 4 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] CVE-2024-50016
by Yuntao Liu 02 Nov '24

02 Nov '24

CVE-2024-50016 Alex Hung (1): drm/amd/display: Avoid overflow assignment in link_dp_cts drivers/gpu/drm/amd/display/dc/dc_dp_types.h | 2 +- drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c | 3 ++- drivers/gpu/drm/amd/display/include/dpcd_defs.h | 1 + 3 files changed, 4 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] Bluetooth: Fix not cleanup led when bt_init fails
by Wang Liang 02 Nov '24

02 Nov '24

From: Chen Zhongjin <chenzhongjin(a)huawei.com> stable inclusion from stable-v4.19.269 commit 8a66c3a94285552f6a8e45d73b34ebbad11d388b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRIP CVE: CVE-2022-48971 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2f3957c7eb4e07df944169a3e50a4d6790e1c744 ] bt_init() calls bt_leds_init() to register led, but if it fails later, bt_leds_cleanup() is not called to unregister it. This can cause panic if the argument "bluetooth-power" in text is freed and then another led_trigger_register() tries to access it: BUG: unable to handle page fault for address: ffffffffc06d3bc0 RIP: 0010:strcmp+0xc/0x30 Call Trace: <TASK> led_trigger_register+0x10d/0x4f0 led_trigger_register_simple+0x7d/0x100 bt_init+0x39/0xf7 [bluetooth] do_one_initcall+0xd0/0x4e0 Fixes: e64c97b53bc6 ("Bluetooth: Add combined LED trigger for controller power") Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/bluetooth/af_bluetooth.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c index 0bd7ad4e72dc..4f839e4fb2c0 100644 --- a/net/bluetooth/af_bluetooth.c +++ b/net/bluetooth/af_bluetooth.c @@ -744,7 +744,7 @@ static int __init bt_init(void) err = bt_sysfs_init(); if (err < 0) - return err; + goto cleanup_led; err = sock_register(&bt_sock_family_ops); if (err) @@ -780,6 +780,8 @@ static int __init bt_init(void) sock_unregister(PF_BLUETOOTH); cleanup_sysfs: bt_sysfs_cleanup(); +cleanup_led: + bt_leds_cleanup(); return err; } -- 2.34.1

2 1