- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags
by Tirui Yin 03 Dec '24

03 Dec '24

From: Alex Hung <alex.hung(a)amd.com> mainline inclusion from mainline-v6.12-rc1 commit 5559598742fb4538e4c51c48ef70563c49c2af23 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRD1 CVE: CVE-2024-49923 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [WHAT & HOW] "dcn20_validate_apply_pipe_split_flags" dereferences merge, and thus it cannot be a null pointer. Let's pass a valid pointer to avoid null dereference. This fixes 2 FORWARD_NULL issues reported by Coverity. Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> Signed-off-by: Jerry Zuo <jerry.zuo(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn21/dcn21_resource.c [Path changed and there is no logical conflict.] Signed-off-by: Tirui Yin <yintirui(a)huawei.com> Reviewed-by: Chen Jun <chenjun102(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 3 ++- drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c index 94bf438c7310..e0daa4e051ac 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c @@ -2026,6 +2026,7 @@ bool dcn20_fast_validate_bw( { bool out = false; int split[MAX_PIPES] = { 0 }; + bool merge[MAX_PIPES] = { false }; int pipe_cnt, i, pipe_idx, vlevel; ASSERT(pipes); @@ -2050,7 +2051,7 @@ bool dcn20_fast_validate_bw( if (vlevel > context->bw_ctx.dml.soc.num_states) goto validate_fail; - vlevel = dcn20_validate_apply_pipe_split_flags(dc, context, vlevel, split, NULL); + vlevel = dcn20_validate_apply_pipe_split_flags(dc, context, vlevel, split, merge); /*initialize pipe_just_split_from to invalid idx*/ for (i = 0; i < MAX_PIPES; i++) diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c index d1a25fe6c44f..c1a1ca755f26 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c @@ -800,6 +800,7 @@ bool dcn21_fast_validate_bw(struct dc *dc, { bool out = false; int split[MAX_PIPES] = { 0 }; + bool merge[MAX_PIPES] = { false }; int pipe_cnt, i, pipe_idx, vlevel; ASSERT(pipes); @@ -842,7 +843,7 @@ bool dcn21_fast_validate_bw(struct dc *dc, goto validate_fail; } - vlevel = dcn20_validate_apply_pipe_split_flags(dc, context, vlevel, split, NULL); + vlevel = dcn20_validate_apply_pipe_split_flags(dc, context, vlevel, split, merge); for (i = 0, pipe_idx = 0; i < dc->res_pool->pipe_count; i++) { struct pipe_ctx *pipe = &context->res_ctx.pipe_ctx[i]; -- 2.17.1

2 1

[PATCH OLK-6.6] ext4: show the default enabled prefetch_block_bitmaps option
by Baokun Li 03 Dec '24

03 Dec '24

mainline inclusion from mainline-v6.13-rc1 commit fdfa648ab9393de8c1be21cad17c17bdced3a68a category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB8IC8 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- After commit 21175ca434c5 ("ext4: make prefetch_block_bitmaps default"), we enable 'prefetch_block_bitmaps' by default, but this is not shown in the '/proc/fs/ext4/sdx/options' procfs interface. This makes it impossible to distinguish whether the feature is enabled by default or not, so 'prefetch_block_bitmaps' is shown in the 'options' procfs interface when prefetch_block_bitmaps is enabled by default. This makes it easy to notice changes to the default mount options between versions through the '/proc/fs/ext4/sdx/options' procfs interface. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://patch.msgid.link/20241008120134.3758097-1-libaokun@huaweicloud.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/ext4/super.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 5c52881160e5..84bee249657d 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -3155,6 +3155,9 @@ static int _ext4_show_options(struct seq_file *seq, struct super_block *sb, SEQ_OPTS_PUTS("mb_optimize_scan=1"); } + if (nodefs && !test_opt(sb, NO_PREFETCH_BLOCK_BITMAPS)) + SEQ_OPTS_PUTS("prefetch_block_bitmaps"); + ext4_show_quota_options(seq, sb); return 0; } -- 2.46.1

2 1

[PATCH OLK-5.10] iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count
by Tirui Yin 03 Dec '24

03 Dec '24

From: Sanjay K Kumar <sanjay.k.kumar(a)intel.com> stable inclusion from stable-v5.10.227 commit de9e7f68762585f7532de8a06de9485bf39dbd38 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRAV CVE: CVE-2024-49993 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3cf74230c139f208b7fb313ae0054386eee31a81 ] If qi_submit_sync() is invoked with 0 invalidation descriptors (for instance, for DMA draining purposes), we can run into a bug where a submitting thread fails to detect the completion of invalidation_wait. Subsequently, this led to a soft lockup. Currently, there is no impact by this bug on the existing users because no callers are submitting invalidations with 0 descriptors. This fix will enable future users (such as DMA drain) calling qi_submit_sync() with 0 count. Suppose thread T1 invokes qi_submit_sync() with non-zero descriptors, while concurrently, thread T2 calls qi_submit_sync() with zero descriptors. Both threads then enter a while loop, waiting for their respective descriptors to complete. T1 detects its completion (i.e., T1's invalidation_wait status changes to QI_DONE by HW) and proceeds to call reclaim_free_desc() to reclaim all descriptors, potentially including adjacent ones of other threads that are also marked as QI_DONE. During this time, while T2 is waiting to acquire the qi->q_lock, the IOMMU hardware may complete the invalidation for T2, setting its status to QI_DONE. However, if T1's execution of reclaim_free_desc() frees T2's invalidation_wait descriptor and changes its status to QI_FREE, T2 will not observe the QI_DONE status for its invalidation_wait and will indefinitely remain stuck. This soft lockup does not occur when only non-zero descriptors are submitted.In such cases, invalidation descriptors are interspersed among wait descriptors with the status QI_IN_USE, acting as barriers. These barriers prevent the reclaim code from mistakenly freeing descriptors belonging to other submitters. Considered the following example timeline: T1 T2 ======================================== ID1 WD1 while(WD1!=QI_DONE) unlock lock WD1=QI_DONE* WD2 while(WD2!=QI_DONE) unlock lock WD1==QI_DONE? ID1=QI_DONE WD2=DONE* reclaim() ID1=FREE WD1=FREE WD2=FREE unlock soft lockup! T2 never sees QI_DONE in WD2 Where: ID = invalidation descriptor WD = wait descriptor * Written by hardware The root of the problem is that the descriptor status QI_DONE flag is used for two conflicting purposes: 1. signal a descriptor is ready for reclaim (to be freed) 2. signal by the hardware that a wait descriptor is complete The solution (in this patch) is state separation by using QI_FREE flag for #1. Once a thread's invalidation descriptors are complete, their status would be set to QI_FREE. The reclaim_free_desc() function would then only free descriptors marked as QI_FREE instead of those marked as QI_DONE. This change ensures that T2 (from the previous example) will correctly observe the completion of its invalidation_wait (marked as QI_DONE). Signed-off-by: Sanjay K Kumar <sanjay.k.kumar(a)intel.com> Signed-off-by: Jacob Pan <jacob.jun.pan(a)linux.intel.com> Reviewed-by: Kevin Tian <kevin.tian(a)intel.com> Link: https://lore.kernel.org/r/20240728210059.1964602-1-jacob.jun.pan@linux.inte… Signed-off-by: Lu Baolu <baolu.lu(a)linux.intel.com> Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tirui Yin <yintirui(a)huawei.com> Reviewed-by: Chen Jun <chenjun102(a)huawei.com> --- drivers/iommu/intel/dmar.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/drivers/iommu/intel/dmar.c b/drivers/iommu/intel/dmar.c index 9e591594183e..fde7eb3d8103 100644 --- a/drivers/iommu/intel/dmar.c +++ b/drivers/iommu/intel/dmar.c @@ -1204,9 +1204,7 @@ static void free_iommu(struct intel_iommu *iommu) */ static inline void reclaim_free_desc(struct q_inval *qi) { - while (qi->desc_status[qi->free_tail] == QI_DONE || - qi->desc_status[qi->free_tail] == QI_ABORT) { - qi->desc_status[qi->free_tail] = QI_FREE; + while (qi->desc_status[qi->free_tail] == QI_FREE && qi->free_tail != qi->free_head) { qi->free_tail = (qi->free_tail + 1) % QI_LENGTH; qi->free_cnt++; } @@ -1361,8 +1359,16 @@ int qi_submit_sync(struct intel_iommu *iommu, struct qi_desc *desc, raw_spin_lock(&qi->q_lock); } - for (i = 0; i < count; i++) - qi->desc_status[(index + i) % QI_LENGTH] = QI_DONE; + /* + * The reclaim code can free descriptors from multiple submissions + * starting from the tail of the queue. When count == 0, the + * status of the standalone wait descriptor at the tail of the queue + * must be set to QI_FREE to allow the reclaim code to proceed. + * It is also possible that descriptors from one of the previous + * submissions has to be reclaimed by a subsequent submission. + */ + for (i = 0; i <= count; i++) + qi->desc_status[(index + i) % QI_LENGTH] = QI_FREE; reclaim_free_desc(qi); raw_spin_unlock_irqrestore(&qi->q_lock, flags); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count
by Tirui Yin 03 Dec '24

03 Dec '24

From: Sanjay K Kumar <sanjay.k.kumar(a)intel.com> stable inclusion from stable-v5.10.227 commit de9e7f68762585f7532de8a06de9485bf39dbd38 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRAV CVE: CVE-2024-49993 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3cf74230c139f208b7fb313ae0054386eee31a81 ] If qi_submit_sync() is invoked with 0 invalidation descriptors (for instance, for DMA draining purposes), we can run into a bug where a submitting thread fails to detect the completion of invalidation_wait. Subsequently, this led to a soft lockup. Currently, there is no impact by this bug on the existing users because no callers are submitting invalidations with 0 descriptors. This fix will enable future users (such as DMA drain) calling qi_submit_sync() with 0 count. Suppose thread T1 invokes qi_submit_sync() with non-zero descriptors, while concurrently, thread T2 calls qi_submit_sync() with zero descriptors. Both threads then enter a while loop, waiting for their respective descriptors to complete. T1 detects its completion (i.e., T1's invalidation_wait status changes to QI_DONE by HW) and proceeds to call reclaim_free_desc() to reclaim all descriptors, potentially including adjacent ones of other threads that are also marked as QI_DONE. During this time, while T2 is waiting to acquire the qi->q_lock, the IOMMU hardware may complete the invalidation for T2, setting its status to QI_DONE. However, if T1's execution of reclaim_free_desc() frees T2's invalidation_wait descriptor and changes its status to QI_FREE, T2 will not observe the QI_DONE status for its invalidation_wait and will indefinitely remain stuck. This soft lockup does not occur when only non-zero descriptors are submitted.In such cases, invalidation descriptors are interspersed among wait descriptors with the status QI_IN_USE, acting as barriers. These barriers prevent the reclaim code from mistakenly freeing descriptors belonging to other submitters. Considered the following example timeline: T1 T2 ======================================== ID1 WD1 while(WD1!=QI_DONE) unlock lock WD1=QI_DONE* WD2 while(WD2!=QI_DONE) unlock lock WD1==QI_DONE? ID1=QI_DONE WD2=DONE* reclaim() ID1=FREE WD1=FREE WD2=FREE unlock soft lockup! T2 never sees QI_DONE in WD2 Where: ID = invalidation descriptor WD = wait descriptor * Written by hardware The root of the problem is that the descriptor status QI_DONE flag is used for two conflicting purposes: 1. signal a descriptor is ready for reclaim (to be freed) 2. signal by the hardware that a wait descriptor is complete The solution (in this patch) is state separation by using QI_FREE flag for #1. Once a thread's invalidation descriptors are complete, their status would be set to QI_FREE. The reclaim_free_desc() function would then only free descriptors marked as QI_FREE instead of those marked as QI_DONE. This change ensures that T2 (from the previous example) will correctly observe the completion of its invalidation_wait (marked as QI_DONE). Signed-off-by: Sanjay K Kumar <sanjay.k.kumar(a)intel.com> Signed-off-by: Jacob Pan <jacob.jun.pan(a)linux.intel.com> Reviewed-by: Kevin Tian <kevin.tian(a)intel.com> Link: https://lore.kernel.org/r/20240728210059.1964602-1-jacob.jun.pan@linux.inte… Signed-off-by: Lu Baolu <baolu.lu(a)linux.intel.com> Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tirui Yin <yintirui(a)huawei.com> --- drivers/iommu/intel/dmar.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/drivers/iommu/intel/dmar.c b/drivers/iommu/intel/dmar.c index 067e16944a7e..c2af96eb633f 100644 --- a/drivers/iommu/intel/dmar.c +++ b/drivers/iommu/intel/dmar.c @@ -1203,9 +1203,7 @@ static void free_iommu(struct intel_iommu *iommu) */ static inline void reclaim_free_desc(struct q_inval *qi) { - while (qi->desc_status[qi->free_tail] == QI_DONE || - qi->desc_status[qi->free_tail] == QI_ABORT) { - qi->desc_status[qi->free_tail] = QI_FREE; + while (qi->desc_status[qi->free_tail] == QI_FREE && qi->free_tail != qi->free_head) { qi->free_tail = (qi->free_tail + 1) % QI_LENGTH; qi->free_cnt++; } @@ -1360,8 +1358,16 @@ int qi_submit_sync(struct intel_iommu *iommu, struct qi_desc *desc, raw_spin_lock(&qi->q_lock); } - for (i = 0; i < count; i++) - qi->desc_status[(index + i) % QI_LENGTH] = QI_DONE; + /* + * The reclaim code can free descriptors from multiple submissions + * starting from the tail of the queue. When count == 0, the + * status of the standalone wait descriptor at the tail of the queue + * must be set to QI_FREE to allow the reclaim code to proceed. + * It is also possible that descriptors from one of the previous + * submissions has to be reclaimed by a subsequent submission. + */ + for (i = 0; i <= count; i++) + qi->desc_status[(index + i) % QI_LENGTH] = QI_FREE; reclaim_free_desc(qi); raw_spin_unlock_irqrestore(&qi->q_lock, flags); -- 2.17.1

2 1

[openeuler:OLK-5.10 2516/2516] drivers/net/ethernet/yunsilicon/xsc/pci/main.c:613:19: error: no member named 'physfn' in 'struct pci_dev'
by kernel test robot 03 Dec '24

03 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 020e0507954f21291b7b3a0a280128270a0d8959 commit: 23b8024ef459f8b615c223df6175ea17c6b50c48 [2516/2516] drivers: update yunsilicon drivers to version 1.1.0.375 config: x86_64-randconfig-r063-20241203 (https://download.01.org/0day-ci/archive/20241203/202412031055.Ln9fvImq-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241203/202412031055.Ln9fvImq-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412031055.Ln9fvImq-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from drivers/net/ethernet/yunsilicon/xsc/pci/main.c:6: In file included from drivers/net/ethernet/yunsilicon/xsc/common/xsc_core.h:11: In file included from include/linux/pci.h:1499: In file included from include/linux/dmapool.h:14: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:1579: include/linux/vmstat.h:417:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 417 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 418 | item]; | ~~~~ include/linux/vmstat.h:424:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 424 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 425 | NR_VM_NUMA_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:436:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 436 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 437 | NR_VM_NUMA_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:445:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 445 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 446 | NR_VM_NUMA_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/net/ethernet/yunsilicon/xsc/pci/main.c:6: drivers/net/ethernet/yunsilicon/xsc/common/xsc_core.h:1752:32: warning: bitwise or with non-zero value always evaluates to true [-Wtautological-bitwise-compare] 1752 | if (dev->caps.hw_feature_flag | XSC_HW_RDMA_SUPPORT) | ~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~ In file included from drivers/net/ethernet/yunsilicon/xsc/pci/main.c:13: In file included from drivers/net/ethernet/yunsilicon/xsc/pci/devlink.h:9: include/net/devlink.h:28:19: warning: arithmetic between different enumeration types ('enum devlink_reload_limit' and 'enum devlink_reload_action') [-Wenum-enum-conversion] 28 | u32 reload_stats[DEVLINK_RELOAD_STATS_ARRAY_SIZE]; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/net/devlink.h:25:30: note: expanded from macro 'DEVLINK_RELOAD_STATS_ARRAY_SIZE' 25 | (__DEVLINK_RELOAD_LIMIT_MAX * __DEVLINK_RELOAD_ACTION_MAX) | ~~~~~~~~~~~~~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/net/devlink.h:29:26: warning: arithmetic between different enumeration types ('enum devlink_reload_limit' and 'enum devlink_reload_action') [-Wenum-enum-conversion] 29 | u32 remote_reload_stats[DEVLINK_RELOAD_STATS_ARRAY_SIZE]; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/net/devlink.h:25:30: note: expanded from macro 'DEVLINK_RELOAD_STATS_ARRAY_SIZE' 25 | (__DEVLINK_RELOAD_LIMIT_MAX * __DEVLINK_RELOAD_ACTION_MAX) | ~~~~~~~~~~~~~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:136:4: warning: no previous prototype for function 'xsc_devid_to_pcie_no' [-Wmissing-prototypes] 136 | u8 xsc_devid_to_pcie_no(int dev_id) | ^ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:136:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 136 | u8 xsc_devid_to_pcie_no(int dev_id) | ^ | static drivers/net/ethernet/yunsilicon/xsc/pci/main.c:288:5: warning: no previous prototype for function 'xsc_priv_init' [-Wmissing-prototypes] 288 | int xsc_priv_init(struct xsc_core_device *dev) | ^ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:288:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 288 | int xsc_priv_init(struct xsc_core_device *dev) | ^ | static drivers/net/ethernet/yunsilicon/xsc/pci/main.c:302:5: warning: no previous prototype for function 'xsc_dev_res_init' [-Wmissing-prototypes] 302 | int xsc_dev_res_init(struct xsc_core_device *dev) | ^ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:302:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 302 | int xsc_dev_res_init(struct xsc_core_device *dev) | ^ | static drivers/net/ethernet/yunsilicon/xsc/pci/main.c:321:6: warning: no previous prototype for function 'xsc_dev_res_cleanup' [-Wmissing-prototypes] 321 | void xsc_dev_res_cleanup(struct xsc_core_device *dev) | ^ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:321:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 321 | void xsc_dev_res_cleanup(struct xsc_core_device *dev) | ^ | static drivers/net/ethernet/yunsilicon/xsc/pci/main.c:327:6: warning: no previous prototype for function 'xsc_init_reg_addr' [-Wmissing-prototypes] 327 | void xsc_init_reg_addr(struct xsc_core_device *dev) | ^ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:327:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 327 | void xsc_init_reg_addr(struct xsc_core_device *dev) | ^ | static drivers/net/ethernet/yunsilicon/xsc/pci/main.c:519:5: warning: no previous prototype for function 'xsc_reset_function_resource' [-Wmissing-prototypes] 519 | int xsc_reset_function_resource(struct xsc_core_device *dev) | ^ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:519:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 519 | int xsc_reset_function_resource(struct xsc_core_device *dev) | ^ | static >> drivers/net/ethernet/yunsilicon/xsc/pci/main.c:613:19: error: no member named 'physfn' in 'struct pci_dev' 613 | if (!dev->pdev->physfn) { | ~~~~~~~~~ ^ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:719:5: warning: no previous prototype for function 'xsc_load_one' [-Wmissing-prototypes] 719 | int xsc_load_one(struct xsc_core_device *dev, bool boot) | ^ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:719:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 719 | int xsc_load_one(struct xsc_core_device *dev, bool boot) | ^ | static drivers/net/ethernet/yunsilicon/xsc/pci/main.c:801:5: warning: no previous prototype for function 'xsc_unload_one' [-Wmissing-prototypes] 801 | int xsc_unload_one(struct xsc_core_device *dev, bool cleanup) | ^ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:801:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 801 | int xsc_unload_one(struct xsc_core_device *dev, bool cleanup) | ^ | static 16 warnings and 1 error generated. -- In file included from drivers/net/ethernet/yunsilicon/xsc/pci/xsc_port_ctrl.c:10: In file included from include/linux/mm.h:1579: include/linux/vmstat.h:417:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 417 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 418 | item]; | ~~~~ include/linux/vmstat.h:424:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 424 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 425 | NR_VM_NUMA_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:436:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 436 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 437 | NR_VM_NUMA_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:445:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 445 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 446 | NR_VM_NUMA_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/net/ethernet/yunsilicon/xsc/pci/xsc_port_ctrl.c:12: drivers/net/ethernet/yunsilicon/xsc/common/xsc_core.h:1752:32: warning: bitwise or with non-zero value always evaluates to true [-Wtautological-bitwise-compare] 1752 | if (dev->caps.hw_feature_flag | XSC_HW_RDMA_SUPPORT) | ~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/yunsilicon/xsc/pci/xsc_port_ctrl.c:440:18: error: no member named 'physfn' in 'struct pci_dev' 440 | if (!dev->pdev->physfn) /*for vf passthrough vm*/ | ~~~~~~~~~ ^ drivers/net/ethernet/yunsilicon/xsc/pci/xsc_port_ctrl.c:443:38: error: no member named 'physfn' in 'struct pci_dev' 443 | pf_dev = pci_get_drvdata(dev->pdev->physfn); | ~~~~~~~~~ ^ 6 warnings and 2 errors generated. vim +613 drivers/net/ethernet/yunsilicon/xsc/pci/main.c 518 > 519 int xsc_reset_function_resource(struct xsc_core_device *dev) 520 { 521 struct xsc_function_reset_mbox_in in; 522 struct xsc_function_reset_mbox_out out; 523 int err; 524 525 memset(&in, 0, sizeof(in)); 526 in.hdr.opcode = cpu_to_be16(XSC_CMD_OP_FUNCTION_RESET); 527 in.glb_func_id = cpu_to_be16(dev->glb_func_id); 528 err = xsc_cmd_exec(dev, &in, sizeof(in), &out, sizeof(out)); 529 if (err || out.hdr.status) 530 return -EINVAL; 531 532 return 0; 533 } 534 535 static int xsc_fpga_not_supported(struct xsc_core_device *dev) 536 { 537 #define FPGA_VERSION_H 0x100 538 u32 ver_h; 539 540 if (!xsc_core_is_pf(dev)) 541 return 0; 542 543 ver_h = REG_RD32(dev, HIF_CPM_CHIP_VERSION_H_REG_ADDR); 544 if (ver_h != FPGA_VERSION_H) { 545 xsc_core_err(dev, "fpga version 0x%x not supported\n", ver_h); 546 return 1; 547 } 548 549 return 0; 550 } 551 552 static int xsc_init_once(struct xsc_core_device *dev) 553 { 554 int err; 555 556 #ifndef COSIM 557 err = xsc_cmd_init(dev); 558 if (err) { 559 xsc_core_err(dev, "Failed initializing command interface, aborting\n"); 560 goto err_cmd_init; 561 } 562 #endif 563 #ifdef RUN_WITH_PSV 564 err = xsc_cmd_query_psv_funcid(dev, &dev->caps); 565 if (err) { 566 xsc_core_err(dev, "Failed to query psv funcid, err=%d\n", err); 567 goto err_cmdq_ver_chk; 568 } 569 570 dev->glb_func_id = xsc_get_glb_func_id(dev); 571 #endif 572 573 err = xsc_check_cmdq_version(dev); 574 if (err) { 575 xsc_core_err(dev, "Failed to check cmdq version\n"); 576 goto err_cmdq_ver_chk; 577 } 578 579 err = xsc_cmd_query_hca_cap(dev, &dev->caps); 580 if (err) { 581 xsc_core_err(dev, "Failed to query hca, err=%d\n", err); 582 goto err_cmdq_ver_chk; 583 } 584 585 err = xsc_reset_function_resource(dev); 586 if (err) { 587 xsc_core_err(dev, "Failed to reset function resource\n"); 588 goto err_cmdq_ver_chk; 589 } 590 591 err = xsc_get_board_id(dev); 592 if (err) { 593 xsc_core_err(dev, "Failed to get board id, err=%d\n", err); 594 goto err_cmdq_ver_chk; 595 } 596 if (xsc_core_is_pf(dev)) { 597 err = xsc_pci_calc_pf_port(dev); 598 if (err) { 599 xsc_core_err(dev, "Failed to xsc_pci_calc_pf_port\n"); 600 goto err_cmdq_ver_chk; 601 } 602 err = xsc_create_res(dev); 603 if (err) { 604 xsc_core_err(dev, "Failed to create resource, err=%d\n", err); 605 goto err_cmdq_ver_chk; 606 } 607 } else { 608 err = xsc_pci_calc_vf_port(dev); 609 if (err) { 610 xsc_core_err(dev, "Failed to xsc_pci_calc_vf_port\n"); 611 goto err_cmdq_ver_chk; 612 } > 613 if (!dev->pdev->physfn) { 614 err = xsc_create_res(dev); 615 if (err) { 616 xsc_core_err(dev, "Failed to create resource, err=%d\n", err); 617 goto err_cmdq_ver_chk; 618 } 619 } 620 } 621 622 xsc_init_cq_table(dev); 623 xsc_init_qp_table(dev); 624 xsc_eq_init(dev); 625 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2439/2439] arch/arm64/kernel/cpufeature.c:1729:13: warning: no previous prototype for 'early_pbha_init'
by kernel test robot 03 Dec '24

03 Dec '24

Hi Ma, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 929a9df37c1b7dec73fd417d79a116d02a8f9380 commit: f43933b3f947a7f9314ec8d704c6ae01041dbbba [2439/2439] arm64: cpufeature: Enable PBHA for stage1 early via FDT config: arm64-randconfig-004-20241117 (https://download.01.org/0day-ci/archive/20241203/202412031005.m61DNVfj-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241203/202412031005.m61DNVfj-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412031005.m61DNVfj-lkp@intel.com/ Note: functions only called from assembly code should be annotated with the asmlinkage attribute All warnings (new ones prefixed by >>): arch/arm64/kernel/cpufeature.c:1627:6: warning: no previous prototype for 'update_pbha_perf_only_bit' [-Wmissing-prototypes] 1627 | void update_pbha_perf_only_bit(const u8 *bits, int cnt) | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> arch/arm64/kernel/cpufeature.c:1729:13: warning: no previous prototype for 'early_pbha_init' [-Wmissing-prototypes] 1729 | void __init early_pbha_init(void) | ^~~~~~~~~~~~~~~ vim +/early_pbha_init +1729 arch/arm64/kernel/cpufeature.c 1728 > 1729 void __init early_pbha_init(void) 1730 { 1731 void *fdt; 1732 int node; 1733 const u8 *prop; 1734 int size; 1735 1736 spin_lock(&pbha_dt_lock); 1737 1738 fdt = get_early_fdt_ptr(); 1739 if (!fdt) 1740 goto unlock; 1741 1742 node = fdt_path_offset(fdt, "/cpus"); 1743 if (node < 0) 1744 goto unlock; 1745 1746 prop = fdt_getprop(fdt, node, "arm,pbha-performance-only", &size); 1747 if (!prop) 1748 goto unlock; 1749 1750 if (!cpu_has_pbha()) 1751 goto unlock; 1752 1753 update_pbha_perf_only_bit(prop, size); 1754 enable_pbha_inner(); 1755 1756 pbha_enabled = true; 1757 1758 unlock: 1759 spin_unlock(&pbha_dt_lock); 1760 } 1761 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove
by Lin Ruifeng 03 Dec '24

03 Dec '24

From: Amelie Delaunay <amelie.delaunay(a)foss.st.com> stable inclusion from stable-v5.10.230 commit 3a977b554f668382dfba31fd62e4cce4fe5643db bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5AVR CVE: CVE-2024-50292 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9bb4af400c386374ab1047df44c508512c08c31f ] In case of error when requesting ctrl_chan DMA channel, ctrl_chan is not null. So the release of the dma channel leads to the following issue: [ 4.879000] st,stm32-spdifrx 500d0000.audio-controller: dma_request_slave_channel error -19 [ 4.888975] Unable to handle kernel NULL pointer dereference at virtual address 000000000000003d [...] [ 5.096577] Call trace: [ 5.099099] dma_release_channel+0x24/0x100 [ 5.103235] stm32_spdifrx_remove+0x24/0x60 [snd_soc_stm32_spdifrx] [ 5.109494] stm32_spdifrx_probe+0x320/0x4c4 [snd_soc_stm32_spdifrx] To avoid this issue, release channel only if the pointer is valid. Fixes: 794df9448edb ("ASoC: stm32: spdifrx: manage rebind issue") Signed-off-by: Amelie Delaunay <amelie.delaunay(a)foss.st.com> Signed-off-by: Olivier Moysan <olivier.moysan(a)foss.st.com> Link: https://patch.msgid.link/20241105140242.527279-1-olivier.moysan@foss.st.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- sound/soc/stm/stm32_spdifrx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/soc/stm/stm32_spdifrx.c b/sound/soc/stm/stm32_spdifrx.c index 1bfa3b2ba974..ef518cff84f2 100644 --- a/sound/soc/stm/stm32_spdifrx.c +++ b/sound/soc/stm/stm32_spdifrx.c @@ -948,7 +948,7 @@ static int stm32_spdifrx_remove(struct platform_device *pdev) { struct stm32_spdifrx_data *spdifrx = platform_get_drvdata(pdev); - if (spdifrx->ctrl_chan) + if (!IS_ERR(spdifrx->ctrl_chan)) dma_release_channel(spdifrx->ctrl_chan); if (spdifrx->dmab) -- 2.17.1

2 1

[PATCH OLK-6.6] afs: Fix lock recursion
by Yifan Qiao 03 Dec '24

03 Dec '24

From: David Howells <dhowells(a)redhat.com> mainline inclusion from mainline-v6.12-rc5 commit 610a79ffea02102899a1373fe226d949944a7ed6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB67YK CVE: CVE-2024-53090 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- afs_wake_up_async_call() can incur lock recursion. The problem is that it is called from AF_RXRPC whilst holding the ->notify_lock, but it tries to take a ref on the afs_call struct in order to pass it to a work queue - but if the afs_call is already queued, we then have an extraneous ref that must be put... calling afs_put_call() may call back down into AF_RXRPC through rxrpc_kernel_shutdown_call(), however, which might try taking the ->notify_lock again. This case isn't very common, however, so defer it to a workqueue. The oops looks something like: BUG: spinlock recursion on CPU#0, krxrpcio/7001/1646 lock: 0xffff888141399b30, .magic: dead4ead, .owner: krxrpcio/7001/1646, .owner_cpu: 0 CPU: 0 UID: 0 PID: 1646 Comm: krxrpcio/7001 Not tainted 6.12.0-rc2-build3+ #4351 Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014 Call Trace: <TASK> dump_stack_lvl+0x47/0x70 do_raw_spin_lock+0x3c/0x90 rxrpc_kernel_shutdown_call+0x83/0xb0 afs_put_call+0xd7/0x180 rxrpc_notify_socket+0xa0/0x190 rxrpc_input_split_jumbo+0x198/0x1d0 rxrpc_input_data+0x14b/0x1e0 ? rxrpc_input_call_packet+0xc2/0x1f0 rxrpc_input_call_event+0xad/0x6b0 rxrpc_input_packet_on_conn+0x1e1/0x210 rxrpc_input_packet+0x3f2/0x4d0 rxrpc_io_thread+0x243/0x410 ? __pfx_rxrpc_io_thread+0x10/0x10 kthread+0xcf/0xe0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x24/0x40 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Signed-off-by: David Howells <dhowells(a)redhat.com> Link: https://lore.kernel.org/r/1394602.1729162732@warthog.procyon.org.uk cc: Marc Dionne <marc.dionne(a)auristor.com> cc: linux-afs(a)lists.infradead.org cc: linux-fsdevel(a)vger.kernel.org Signed-off-by: Christian Brauner <brauner(a)kernel.org> Conflicts: fs/afs/internal.h fs/afs/rxrpc.c [Context differences and the patchset(afs: Fix probe handling, server rotation and RO volume callback handling) is not merged yet.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/afs/internal.h | 2 ++ fs/afs/rxrpc.c | 81 +++++++++++++++++++++++++++++++++-------------- 2 files changed, 60 insertions(+), 23 deletions(-) diff --git a/fs/afs/internal.h b/fs/afs/internal.h index 8dcc09cf0adb..89b5464ca8ef 100644 --- a/fs/afs/internal.h +++ b/fs/afs/internal.h @@ -100,6 +100,7 @@ struct afs_call { wait_queue_head_t waitq; /* processes awaiting completion */ struct work_struct async_work; /* async I/O processor */ struct work_struct work; /* actual work processor */ + struct work_struct free_work; /* Deferred free processor */ struct rxrpc_call *rxcall; /* RxRPC call handle */ struct key *key; /* security for this call */ struct afs_net *net; /* The network namespace */ @@ -1275,6 +1276,7 @@ extern int __net_init afs_open_socket(struct afs_net *); extern void __net_exit afs_close_socket(struct afs_net *); extern void afs_charge_preallocation(struct work_struct *); extern void afs_put_call(struct afs_call *); +void afs_deferred_put_call(struct afs_call *call); extern void afs_make_call(struct afs_addr_cursor *, struct afs_call *, gfp_t); extern long afs_wait_for_call_to_complete(struct afs_call *, struct afs_addr_cursor *); extern struct afs_call *afs_alloc_flat_call(struct afs_net *, diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c index d642d06a453b..0a68460fe9df 100644 --- a/fs/afs/rxrpc.c +++ b/fs/afs/rxrpc.c @@ -18,6 +18,7 @@ struct workqueue_struct *afs_async_calls; +static void afs_deferred_free_worker(struct work_struct *work); static void afs_wake_up_call_waiter(struct sock *, struct rxrpc_call *, unsigned long); static void afs_wake_up_async_call(struct sock *, struct rxrpc_call *, unsigned long); static void afs_process_async_call(struct work_struct *); @@ -149,6 +150,7 @@ static struct afs_call *afs_alloc_call(struct afs_net *net, call->debug_id = atomic_inc_return(&rxrpc_debug_id); refcount_set(&call->ref, 1); INIT_WORK(&call->async_work, afs_process_async_call); + INIT_WORK(&call->free_work, afs_deferred_free_worker); init_waitqueue_head(&call->waitq); spin_lock_init(&call->state_lock); call->iter = &call->def_iter; @@ -159,6 +161,35 @@ static struct afs_call *afs_alloc_call(struct afs_net *net, return call; } +static void afs_free_call(struct afs_call *call) +{ + struct afs_net *net = call->net; + int o; + + ASSERT(!work_pending(&call->async_work)); + + if (call->rxcall) { + rxrpc_kernel_shutdown_call(net->socket, call->rxcall); + rxrpc_kernel_put_call(net->socket, call->rxcall); + call->rxcall = NULL; + } + if (call->type->destructor) + call->type->destructor(call); + + afs_unuse_server_notime(call->net, call->server, afs_server_trace_put_call); + afs_put_addrlist(call->alist); + kfree(call->request); + + o = atomic_read(&net->nr_outstanding_calls); + trace_afs_call(call->debug_id, afs_call_trace_free, 0, o, + __builtin_return_address(0)); + kfree(call); + + o = atomic_dec_return(&net->nr_outstanding_calls); + if (o == 0) + wake_up_var(&net->nr_outstanding_calls); +} + /* * Dispose of a reference on a call. */ @@ -173,31 +204,34 @@ void afs_put_call(struct afs_call *call) o = atomic_read(&net->nr_outstanding_calls); trace_afs_call(debug_id, afs_call_trace_put, r - 1, o, __builtin_return_address(0)); + if (zero) + afs_free_call(call); +} - if (zero) { - ASSERT(!work_pending(&call->async_work)); - ASSERT(call->type->name != NULL); - - if (call->rxcall) { - rxrpc_kernel_shutdown_call(net->socket, call->rxcall); - rxrpc_kernel_put_call(net->socket, call->rxcall); - call->rxcall = NULL; - } - if (call->type->destructor) - call->type->destructor(call); +static void afs_deferred_free_worker(struct work_struct *work) +{ + struct afs_call *call = container_of(work, struct afs_call, free_work); - afs_unuse_server_notime(call->net, call->server, afs_server_trace_put_call); - afs_put_addrlist(call->alist); - kfree(call->request); + afs_free_call(call); +} - trace_afs_call(call->debug_id, afs_call_trace_free, 0, o, - __builtin_return_address(0)); - kfree(call); +/* + * Dispose of a reference on a call, deferring the cleanup to a workqueue + * to avoid lock recursion. + */ +void afs_deferred_put_call(struct afs_call *call) +{ + struct afs_net *net = call->net; + unsigned int debug_id = call->debug_id; + bool zero; + int r, o; - o = atomic_dec_return(&net->nr_outstanding_calls); - if (o == 0) - wake_up_var(&net->nr_outstanding_calls); - } + zero = __refcount_dec_and_test(&call->ref, &r); + o = atomic_read(&net->nr_outstanding_calls); + trace_afs_call(debug_id, afs_call_trace_put, r - 1, o, + __builtin_return_address(0)); + if (zero) + schedule_work(&call->free_work); } static struct afs_call *afs_get_call(struct afs_call *call, @@ -665,7 +699,8 @@ static void afs_wake_up_call_waiter(struct sock *sk, struct rxrpc_call *rxcall, } /* - * wake up an asynchronous call + * Wake up an asynchronous call. The caller is holding the call notify + * spinlock around this, so we can't call afs_put_call(). */ static void afs_wake_up_async_call(struct sock *sk, struct rxrpc_call *rxcall, unsigned long call_user_ID) @@ -682,7 +717,7 @@ static void afs_wake_up_async_call(struct sock *sk, struct rxrpc_call *rxcall, __builtin_return_address(0)); if (!queue_work(afs_async_calls, &call->async_work)) - afs_put_call(call); + afs_deferred_put_call(call); } } -- 2.39.2

2 1

[PATCH OLK-5.10] ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove
by Lin Ruifeng 03 Dec '24

03 Dec '24

From: Amelie Delaunay <amelie.delaunay(a)foss.st.com> stable inclusion from stable-v5.10.230 commit 3a977b554f668382dfba31fd62e4cce4fe5643db bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5AVR CVE: CVE-2024-50292 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9bb4af400c386374ab1047df44c508512c08c31f ] In case of error when requesting ctrl_chan DMA channel, ctrl_chan is not null. So the release of the dma channel leads to the following issue: [ 4.879000] st,stm32-spdifrx 500d0000.audio-controller: dma_request_slave_channel error -19 [ 4.888975] Unable to handle kernel NULL pointer dereference at virtual address 000000000000003d [...] [ 5.096577] Call trace: [ 5.099099] dma_release_channel+0x24/0x100 [ 5.103235] stm32_spdifrx_remove+0x24/0x60 [snd_soc_stm32_spdifrx] [ 5.109494] stm32_spdifrx_probe+0x320/0x4c4 [snd_soc_stm32_spdifrx] To avoid this issue, release channel only if the pointer is valid. Fixes: 794df9448edb ("ASoC: stm32: spdifrx: manage rebind issue") Signed-off-by: Amelie Delaunay <amelie.delaunay(a)foss.st.com> Signed-off-by: Olivier Moysan <olivier.moysan(a)foss.st.com> Link: https://patch.msgid.link/20241105140242.527279-1-olivier.moysan@foss.st.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- sound/soc/stm/stm32_spdifrx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/soc/stm/stm32_spdifrx.c b/sound/soc/stm/stm32_spdifrx.c index 1bfa3b2ba974..ef518cff84f2 100644 --- a/sound/soc/stm/stm32_spdifrx.c +++ b/sound/soc/stm/stm32_spdifrx.c @@ -948,7 +948,7 @@ static int stm32_spdifrx_remove(struct platform_device *pdev) { struct stm32_spdifrx_data *spdifrx = platform_get_drvdata(pdev); - if (spdifrx->ctrl_chan) + if (!IS_ERR(spdifrx->ctrl_chan)) dma_release_channel(spdifrx->ctrl_chan); if (spdifrx->dmab) -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1-50103] ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe()
by Lin Ruifeng 03 Dec '24

03 Dec '24

From: Zichen Xie <zichenxie0106(a)gmail.com> stable inclusion from stable-v5.15.170 commit a8e691fe1894c8bdf815a6171ee22ae7da8b18aa bugzilla: https://gitee.com/src-openeuler/kernel/issues/B2BX0 CVE: CVE-2024-50103 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 49da1463c9e3d2082276c3e0e2a8b65a88711cd2 upstream. A devm_kzalloc() in asoc_qcom_lpass_cpu_platform_probe() could possibly return NULL pointer. NULL Pointer Dereference may be triggerred without addtional check. Add a NULL check for the returned pointer. Fixes: b5022a36d28f ("ASoC: qcom: lpass: Use regmap_field for i2sctl and dmactl registers") Cc: stable(a)vger.kernel.org Signed-off-by: Zichen Xie <zichenxie0106(a)gmail.com> Link: https://patch.msgid.link/20241006205737.8829-1-zichenxie0106@gmail.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- sound/soc/qcom/lpass-cpu.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/soc/qcom/lpass-cpu.c b/sound/soc/qcom/lpass-cpu.c index 03abb3d719d0..c508cb4460f0 100644 --- a/sound/soc/qcom/lpass-cpu.c +++ b/sound/soc/qcom/lpass-cpu.c @@ -935,6 +935,8 @@ int asoc_qcom_lpass_cpu_platform_probe(struct platform_device *pdev) /* Allocation for i2sctl regmap fields */ drvdata->i2sctl = devm_kzalloc(&pdev->dev, sizeof(struct lpaif_i2sctl), GFP_KERNEL); + if (!drvdata->i2sctl) + return -ENOMEM; /* Initialize bitfields for dai I2SCTL register */ ret = lpass_cpu_init_i2sctl_bitfields(dev, drvdata->i2sctl, -- 2.17.1

1 0