- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback
by Qi Xi 15 Apr '25

15 Apr '25

From: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> mainline inclusion from mainline-v6.14-rc1 commit 301c26a018acb94dd537a4418cefa0f654500c6f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBRED3 CVE: CVE-2024-58077 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit 1f5664351410 ("ASoC: lower "no backend DAIs enabled for ... Port" log severity") ignores -EINVAL error message on common soc_pcm_ret(). It is used from many functions, ignoring -EINVAL is over-kill. The reason why -EINVAL was ignored was it really should only be used upon invalid parameters coming from userspace and in that case we don't want to log an error since we do not want to give userspace a way to do a denial-of-service attack on the syslog / diskspace. So don't use soc_pcm_ret() on .prepare callback is better idea. Link: https://lore.kernel.org/r/87v7vptzap.wl-kuninori.morimoto.gx@renesas.com Cc: Hans de Goede <hdegoede(a)redhat.com> Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> Link: https://patch.msgid.link/87bjxg8jju.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- sound/soc/soc-pcm.c | 32 ++++++++++++++++++++++++++++---- 1 file changed, 28 insertions(+), 4 deletions(-) diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c index 511446a30c05..60248a6820aa 100644 --- a/sound/soc/soc-pcm.c +++ b/sound/soc/soc-pcm.c @@ -38,7 +38,6 @@ static inline int _soc_pcm_ret(struct snd_soc_pcm_runtime *rtd, switch (ret) { case -EPROBE_DEFER: case -ENOTSUPP: - case -EINVAL: break; default: dev_err(rtd->dev, @@ -902,7 +901,13 @@ static int __soc_pcm_prepare(struct snd_soc_pcm_runtime *rtd, } out: - return soc_pcm_ret(rtd, ret); + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ + return ret; } /* PCM prepare ops for non-DPCM streams */ @@ -914,6 +919,13 @@ static int soc_pcm_prepare(struct snd_pcm_substream *substream) snd_soc_dpcm_mutex_lock(rtd); ret = __soc_pcm_prepare(rtd, substream); snd_soc_dpcm_mutex_unlock(rtd); + + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ return ret; } @@ -2461,7 +2473,13 @@ int dpcm_be_dai_prepare(struct snd_soc_pcm_runtime *fe, int stream) be->dpcm[stream].state = SND_SOC_DPCM_STATE_PREPARE; } - return soc_pcm_ret(fe, ret); + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ + return ret; } static int dpcm_fe_dai_prepare(struct snd_pcm_substream *substream) @@ -2501,7 +2519,13 @@ static int dpcm_fe_dai_prepare(struct snd_pcm_substream *substream) dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_NO); snd_soc_dpcm_mutex_unlock(fe); - return soc_pcm_ret(fe, ret); + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ + return ret; } static int dpcm_run_update_shutdown(struct snd_soc_pcm_runtime *fe, int stream) -- 2.33.0

2 1

[PATCH OLK-6.6] PCI: AER: fix deadlock in do_recovery
by Qi Xi 15 Apr '25

15 Apr '25

From: Govindarajulu Varadarajan <gvaradar(a)cisco.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC1ERL -------------------------------- CPU0 CPU1 --------------------------------------------------------------------- __driver_attach() device_lock(&dev->mutex) <--- device mutex lock here driver_probe_device() pci_enable_sriov() pci_iov_add_virtfn() pci_device_add() aer_isr() <--- pci aer error do_recovery() broadcast_error_message() pci_walk_bus() down_read(&pci_bus_sem) <--- rd sem down_write(&pci_bus_sem) <-- stuck on wr sem report_error_detected() device_lock(&dev->mutex)<--- DEAD LOCK This can also happen when aer error occurs while pci_dev->sriov_config() is called. This patch does a pci_bus_walk and adds all the devices to a list. After unlocking (up_read) &pci_bus_sem, we go through the list and call err_handler of the devices with devic_lock() held. This way, we dont try to hold both locks at same time. v2: * Drop patch 1, 2 & 4. * Instead of locking 50+ devices, do get_device() and add them to a list. After unlocking &pci_bus_sem, go through the list call err_handler. v1: * Previous discussion here: https://lkml.org/lkml/2017/9/27/720 [ 70.984091] pcieport 0000:00:02.0: AER: Uncorrected (Non-Fatal) error received: id=0010 [ 70.984112] pcieport 0000:00:02.0: PCIe Bus Error: severity=Uncorrected (Non-Fatal), type=Transaction Layer, id=0010(Requester ID) [ 70.984116] pcieport 0000:00:02.0: device [8086:3c04] error status/mask=00004000/00100000 [ 70.984120] pcieport 0000:00:02.0: [14] Completion Timeout (First) ... [ 107.484190] INFO: task kworker/0:1:76 blocked for more than 30 seconds. [ 107.563619] Not tainted 4.13.0+ #28 [ 107.611618] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 107.705368] kworker/0:1 D 0 76 2 0x80000000 [ 107.771050] Workqueue: events aer_isr [ 107.814895] Call Trace: [ 107.844181] __schedule+0x312/0xa40 [ 107.885928] schedule+0x3d/0x90 [ 107.923506] schedule_preempt_disabled+0x15/0x20 [ 107.978773] __mutex_lock+0x304/0xa30 [ 108.022594] ? dev_printk_emit+0x3b/0x50 [ 108.069534] ? report_error_detected+0xa6/0x210 [ 108.123770] mutex_lock_nested+0x1b/0x20 [ 108.170713] ? mutex_lock_nested+0x1b/0x20 [ 108.219730] report_error_detected+0xa6/0x210 [ 108.271881] ? aer_recover_queue+0xe0/0xe0 [ 108.320904] pci_walk_bus+0x46/0x90 [ 108.362645] ? aer_recover_queue+0xe0/0xe0 [ 108.411658] broadcast_error_message+0xc3/0xf0 [ 108.464835] do_recovery+0x34/0x220 [ 108.506569] ? get_device_error_info+0x92/0x130 [ 108.560785] aer_isr+0x28f/0x3b0 [ 108.599410] process_one_work+0x277/0x6c0 [ 108.647399] worker_thread+0x4d/0x3b0 [ 108.691218] kthread+0x171/0x190 [ 108.729830] ? process_one_work+0x6c0/0x6c0 [ 108.779888] ? kthread_create_on_node+0x40/0x40 [ 108.834110] ret_from_fork+0x2a/0x40 [ 108.876916] INFO: task kworker/0:2:205 blocked for more than 30 seconds. [ 108.957129] Not tainted 4.13.0+ #28 [ 109.005114] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 109.098873] kworker/0:2 D 0 205 2 0x80000000 [ 109.164544] Workqueue: events work_for_cpu_fn [ 109.216681] Call Trace: [ 109.245943] __schedule+0x312/0xa40 [ 109.287687] ? rwsem_down_write_failed+0x308/0x4f0 [ 109.345021] schedule+0x3d/0x90 [ 109.382603] rwsem_down_write_failed+0x30d/0x4f0 [ 109.437869] ? __lock_acquire+0x75c/0x1410 [ 109.486910] call_rwsem_down_write_failed+0x17/0x30 [ 109.545287] ? call_rwsem_down_write_failed+0x17/0x30 [ 109.605752] down_write+0x88/0xb0 [ 109.645410] pci_device_add+0x158/0x240 [ 109.691313] pci_iov_add_virtfn+0x24f/0x340 [ 109.741375] pci_enable_sriov+0x32b/0x420 [ 109.789466] ? pci_read+0x2c/0x30 [ 109.829142] enic_probe+0x5d4/0xff0 [enic] [ 109.878184] ? trace_hardirqs_on+0xd/0x10 [ 109.926180] local_pci_probe+0x42/0xa0 [ 109.971037] work_for_cpu_fn+0x14/0x20 [ 110.015898] process_one_work+0x277/0x6c0 [ 110.063884] worker_thread+0x1d6/0x3b0 [ 110.108750] kthread+0x171/0x190 [ 110.147363] ? process_one_work+0x6c0/0x6c0 [ 110.197426] ? kthread_create_on_node+0x40/0x40 [ 110.251642] ret_from_fork+0x2a/0x40 [ 110.294448] INFO: task systemd-udevd:492 blocked for more than 30 seconds. [ 110.376742] Not tainted 4.13.0+ #28 [ 110.424715] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 110.518457] systemd-udevd D 0 492 444 0x80000180 [ 110.584116] Call Trace: [ 110.613382] __schedule+0x312/0xa40 [ 110.655127] ? wait_for_completion+0x14a/0x1d0 [ 110.708302] schedule+0x3d/0x90 [ 110.745875] schedule_timeout+0x26e/0x5b0 [ 110.793887] ? wait_for_completion+0x14a/0x1d0 [ 110.847068] wait_for_completion+0x169/0x1d0 [ 110.898165] ? wait_for_completion+0x169/0x1d0 [ 110.951354] ? wake_up_q+0x80/0x80 [ 110.992060] flush_work+0x237/0x300 [ 111.033795] ? flush_workqueue_prep_pwqs+0x1b0/0x1b0 [ 111.093224] ? wait_for_completion+0x5a/0x1d0 [ 111.145363] ? flush_work+0x237/0x300 [ 111.189189] work_on_cpu+0x94/0xb0 [ 111.229894] ? work_is_static_object+0x20/0x20 [ 111.283070] ? pci_device_shutdown+0x60/0x60 [ 111.334173] pci_device_probe+0x17a/0x190 [ 111.382163] driver_probe_device+0x2ff/0x450 [ 111.433260] __driver_attach+0x103/0x140 [ 111.480195] ? driver_probe_device+0x450/0x450 [ 111.533381] bus_for_each_dev+0x74/0xb0 [ 111.579276] driver_attach+0x1e/0x20 [ 111.622056] bus_add_driver+0x1ca/0x270 [ 111.667955] ? 0xffffffffc039c000 [ 111.707616] driver_register+0x60/0xe0 [ 111.752472] ? 0xffffffffc039c000 [ 111.792126] __pci_register_driver+0x6b/0x70 [ 111.843275] enic_init_module+0x38/0x1000 [enic] [ 111.898533] do_one_initcall+0x50/0x192 [ 111.944428] ? trace_hardirqs_on+0xd/0x10 [ 111.992408] do_init_module+0x5f/0x1f2 [ 112.037274] load_module+0x1740/0x1f70 [ 112.082148] SYSC_finit_module+0xd7/0xf0 [ 112.129083] ? SYSC_finit_module+0xd7/0xf0 [ 112.178106] SyS_finit_module+0xe/0x10 [ 112.222972] do_syscall_64+0x69/0x180 [ 112.266793] entry_SYSCALL64_slow_path+0x25/0x25 [ 112.322047] RIP: 0033:0x7f3da098b559 [ 112.364826] RSP: 002b:00007ffeb3306a38 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 112.455447] RAX: ffffffffffffffda RBX: 0000557fe41ed3d0 RCX: 00007f3da098b559 [ 112.540860] RDX: 0000000000000000 RSI: 00007f3da14c79c5 RDI: 0000000000000006 [ 112.626281] RBP: 00007f3da14c79c5 R08: 0000000000000000 R09: 00007ffeb3306b50 [ 112.711698] R10: 0000000000000006 R11: 0000000000000246 R12: 0000000000000000 [ 112.797114] R13: 0000557fe420e210 R14: 0000000000020000 R15: 0000557fe2c1ef4a [ 112.882568] Showing all locks held in the system: [ 112.956545] 5 locks held by kworker/0:1/76: [ 113.006616] #0: ("events"){+.+.}, at: [<ffffffffb00b10ed>] process_one_work+0x1ed/0x6c0 [ 113.104535] #1: ((&rpc->dpc_handler)){+.+.}, at: [<ffffffffb00b10ed>] process_one_work+0x1ed/0x6c0 [ 113.213894] #2: (&rpc->rpc_mutex){+.+.}, at: [<ffffffffb0505ca2>] aer_isr+0x32/0x3b0 [ 113.308711] #3: (pci_bus_sem){++++}, at: [<ffffffffb04ea18a>] pci_walk_bus+0x2a/0x90 [ 113.403501] #4: (&dev->mutex){....}, at: [<ffffffffb0505706>] report_error_detected+0xa6/0x210 [ 113.508715] 3 locks held by kworker/0:2/205: [ 113.559808] #0: ("events"){+.+.}, at: [<ffffffffb00b10ed>] process_one_work+0x1ed/0x6c0 [ 113.657718] #1: ((&wfc.work)){+.+.}, at: [<ffffffffb00b10ed>] process_one_work+0x1ed/0x6c0 [ 113.758745] #2: (pci_bus_sem){++++}, at: [<ffffffffb04ec978>] pci_device_add+0x158/0x240 [ 113.857710] 1 lock held by khungtaskd/239: [ 113.906729] #0: (tasklist_lock){.+.+}, at: [<ffffffffb00f07dd>] debug_show_all_locks+0x3d/0x1a0 [ 114.012972] 2 locks held by systemd-udevd/492: [ 114.066148] #0: (&dev->mutex){....}, at: [<ffffffffb06254d5>] __driver_attach+0x55/0x140 [ 114.165107] #1: (&dev->mutex){....}, at: [<ffffffffb06254f2>] __driver_attach+0x72/0x140 [ 114.281879] ============================================= Signed-off-by: Govindarajulu Varadarajan <gvaradar(a)cisco.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/pci/pcie/err.c | 48 +++++++++++++++++++++++++++++++++++++++++- 1 file changed, 47 insertions(+), 1 deletion(-) diff --git a/drivers/pci/pcie/err.c b/drivers/pci/pcie/err.c index 705893b5f7b0..573dbf4c77e1 100644 --- a/drivers/pci/pcie/err.c +++ b/drivers/pci/pcie/err.c @@ -171,6 +171,52 @@ static int report_resume(struct pci_dev *dev, void *data) return 0; } +struct aer_device_list { + struct device *dev; + struct hlist_node node; +}; + +int aer_get_pci_dev(struct pci_dev *pdev, void *data) +{ + struct hlist_head *hhead = (struct hlist_head *)data; + struct device *dev = &pdev->dev; + struct aer_device_list *entry; + + entry = kmalloc(sizeof(*entry), GFP_KERNEL); + if (!entry) + /* continue with other devices, lets not return error */ + return 0; + + entry->dev = get_device(dev); + hlist_add_head(&entry->node, hhead); + + return 0; +} + +static void aer_pci_walk_bus(struct pci_bus *top, + int (*cb)(struct pci_dev *, void *), + void *result) +{ + HLIST_HEAD(dev_hlist); + struct hlist_node *tmp; + struct aer_device_list *entry; + + pci_walk_bus(top, aer_get_pci_dev, &dev_hlist); + hlist_for_each_entry_safe(entry, tmp, &dev_hlist, node) { + struct pci_dev *pdev = container_of(entry->dev, struct pci_dev, + dev); + int err; + + err = cb(pdev, result); + if (err) + dev_err(entry->dev, "AER: recovery handler failed: %d", + err); + put_device(entry->dev); + hlist_del(&entry->node); + kfree(entry); + } +} + /** * pci_walk_bridge - walk bridges potentially AER affected * @bridge: bridge which may be a Port, an RCEC, or an RCiEP @@ -189,7 +235,7 @@ static void pci_walk_bridge(struct pci_dev *bridge, void *userdata) { if (bridge->subordinate) - pci_walk_bus(bridge->subordinate, cb, userdata); + aer_pci_walk_bus(bridge->subordinate, cb, userdata); else cb(bridge, userdata); } -- 2.33.0

2 1

[PATCH OLK-5.10] iommu/arm-smmu-v3: Fix the extra atc tlb flush
by Zhang Zekun 15 Apr '25

15 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBZUQU ------------------------------------------- The tlb invalidation code for smmu pagetable prefetch problem might cause a extra tlb invalidation for atc. Prevent it from happening. Fixes: 2da3f6871b6e ("iommu/arm-smmu-v3: Reducing the CMD_SYNC times") Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 7 ++++--- drivers/iommu/io-pgtable-arm.c | 2 +- include/linux/io-pgtable.h | 1 + 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index cedc1eda7250..89df2034f8f5 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -2311,9 +2311,7 @@ static void arm_smmu_tlb_inv_walk(unsigned long iova, size_t size, size_t granule, void *cookie) { #ifdef CONFIG_HISILICON_ERRATUM_162100602 - struct arm_smmu_domain *smmu_domain = cookie; - - if (!size && smmu_domain->smmu->options & ARM_SMMU_OPT_SYNC_BATCH) { + if (!size) { arm_smmu_tlb_inv_range_domain(iova, granule, granule, true, cookie); return; } @@ -2584,6 +2582,9 @@ static int arm_smmu_domain_finalise(struct iommu_domain *domain, else if (smmu->features & ARM_SMMU_FEAT_BBML2) pgtbl_cfg.quirks |= IO_PGTABLE_QUIRK_ARM_BBML2; + if (smmu_domain->smmu->options & ARM_SMMU_OPT_SYNC_BATCH) + pgtbl_cfg.quirks |= IO_PGTABLE_QUIRK_HISI_ERRATA; + pgtbl_ops = alloc_io_pgtable_ops(fmt, &pgtbl_cfg, smmu_domain); if (!pgtbl_ops) return -ENOMEM; diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c index dc80f2661ff7..e8a6a38db48f 100644 --- a/drivers/iommu/io-pgtable-arm.c +++ b/drivers/iommu/io-pgtable-arm.c @@ -365,7 +365,7 @@ static int __arm_lpae_map(struct arm_lpae_io_pgtable *data, unsigned long iova, if (pte) __arm_lpae_free_pages(cptep, tblsz, cfg); #ifdef CONFIG_HISILICON_ERRATUM_162100602 - if (lvl <= 2) + if (lvl <= 2 && (cfg->quirks & IO_PGTABLE_QUIRK_HISI_ERRATA)) io_pgtable_tlb_flush_walk(&data->iop, iova, 0, ARM_LPAE_GRANULE(data)); #endif } else if (!cfg->coherent_walk && !(pte & ARM_LPAE_PTE_SW_SYNC)) { diff --git a/include/linux/io-pgtable.h b/include/linux/io-pgtable.h index 27b994e42ec4..7fc863011474 100644 --- a/include/linux/io-pgtable.h +++ b/include/linux/io-pgtable.h @@ -100,6 +100,7 @@ struct io_pgtable_cfg { #define IO_PGTABLE_QUIRK_ARM_HD BIT(6) #define IO_PGTABLE_QUIRK_ARM_BBML1 BIT(7) #define IO_PGTABLE_QUIRK_ARM_BBML2 BIT(8) + #define IO_PGTABLE_QUIRK_HISI_ERRATA BIT(9) unsigned long quirks; unsigned long pgsize_bitmap; unsigned int ias; -- 2.22.0

2 1

[PATCH OLK-5.10] soc: hisilicon: Serialize the online and onfline the acpi devices
by Zhang Zekun 15 Apr '25

15 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC0DU9 ----------------------------------------------- The parallelization of hbm on and off can cause problems, such as the abnormal state of acpi device. Force paralleize the routine of power on/off the hbm device, which can fix various the abnormal state of acpi devices. Fixes: 039ec3f73992 ("soc: hisilicon: hisi_hbmdev: Add power domain control methods") Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/acpi/device_sysfs.c | 8 +++ drivers/acpi/osl.c | 5 ++ drivers/soc/hisilicon/hisi_hbmdev.c | 83 +++++++++++++++++++---------- include/linux/acpi.h | 2 + 4 files changed, 69 insertions(+), 29 deletions(-) diff --git a/drivers/acpi/device_sysfs.c b/drivers/acpi/device_sysfs.c index 57ee8314dfb8..0f0bde3a41f6 100644 --- a/drivers/acpi/device_sysfs.c +++ b/drivers/acpi/device_sysfs.c @@ -359,6 +359,11 @@ static ssize_t power_state_show(struct device *dev, static DEVICE_ATTR_RO(power_state); +static struct acpi_platform_list no_eject_plat_info[] = { + {"HISI ", "HIP11 ", 0, ACPI_SIG_IORT, all_versions, NULL, 0}, + { } +}; + static ssize_t eject_store(struct device *d, struct device_attribute *attr, const char *buf, size_t count) @@ -378,6 +383,9 @@ eject_store(struct device *d, struct device_attribute *attr, if (ACPI_FAILURE(status) || !acpi_device->flags.ejectable) return -ENODEV; + if (acpi_match_platform_list(no_eject_plat_info) >= 0) + return -ENODEV; + get_device(&acpi_device->dev); status = acpi_hotplug_schedule(acpi_device, ACPI_OST_EC_OSPM_EJECT); if (ACPI_SUCCESS(status)) diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c index 0418febc5cf2..213eb9b63776 100644 --- a/drivers/acpi/osl.c +++ b/drivers/acpi/osl.c @@ -1194,6 +1194,11 @@ bool acpi_queue_hotplug_work(struct work_struct *work) return queue_work(kacpi_hotplug_wq, work); } +void flush_hotplug_workqueue(void) +{ + flush_workqueue(kacpi_hotplug_wq); +} + acpi_status acpi_os_create_semaphore(u32 max_units, u32 initial_units, acpi_handle * handle) { diff --git a/drivers/soc/hisilicon/hisi_hbmdev.c b/drivers/soc/hisilicon/hisi_hbmdev.c index 7ed874ff2206..cb65da2c5463 100644 --- a/drivers/soc/hisilicon/hisi_hbmdev.c +++ b/drivers/soc/hisilicon/hisi_hbmdev.c @@ -19,6 +19,7 @@ struct cdev_node { struct list_head clist; }; +static struct mutex dev_lock; struct cdev_node cdev_list; static int get_pxm(struct acpi_device *acpi_device, void *arg) @@ -54,21 +55,6 @@ static ssize_t pxms_show(struct device *dev, } static DEVICE_ATTR_RO(pxms); -static int memdev_power_on(struct acpi_device *adev) -{ - acpi_handle handle = adev->handle; - acpi_status status; - - /* Power on and online the devices */ - status = acpi_evaluate_object(handle, "_ON", NULL, NULL); - if (ACPI_FAILURE(status)) { - acpi_handle_warn(handle, "Power on failed (0x%x)\n", status); - return -ENODEV; - } - - return 0; -} - static int hbmdev_check(struct acpi_device *adev, void *arg) { const char *hid = acpi_device_hid(adev); @@ -79,34 +65,61 @@ static int hbmdev_check(struct acpi_device *adev, void *arg) *found = true; return -1; } - - /* There might be devices have not attached */ - if (!adev->handler) - return 0; - - adev->handler->hotplug.demand_offline = true; } return 0; } -static int memdev_power_off(struct acpi_device *adev) +static int memdev_power_on(struct acpi_device *adev) { acpi_handle handle = adev->handle; + struct acpi_device *child; acpi_status status; - acpi_scan_lock_acquire(); - acpi_dev_for_each_child(adev, hbmdev_check, NULL); - acpi_scan_lock_release(); + list_for_each_entry(child, &adev->children, node) { + unsigned long long sta = 0; - /* Eject the devices and power off */ - status = acpi_evaluate_object(handle, "_OFF", NULL, NULL); + status = acpi_evaluate_integer(child->handle, "_STA", NULL, &sta); + if (ACPI_FAILURE(status) || (sta & ACPI_STA_DEVICE_ENABLED)) + return -EINVAL; + } + + /* Power on and online the devices */ + status = acpi_evaluate_object(handle, "_ON", NULL, NULL); if (ACPI_FAILURE(status)) { + acpi_handle_warn(handle, "Power on failed (0x%x)\n", status); return -ENODEV; } + return 0; } +static void memdev_power_off(struct acpi_device *adev) +{ + struct acpi_device *child; + + list_for_each_entry(child, &adev->children, node) { + const char *hid = acpi_device_hid(child); + acpi_status status; + + if (strcmp(hid, ACPI_MEMORY_DEVICE_HID)) + continue; + + if (!child->handler) + continue; + + child->handler->hotplug.demand_offline = true; + + get_device(&child->dev); + status = acpi_hotplug_schedule(child, ACPI_OST_EC_OSPM_EJECT); + if (ACPI_SUCCESS(status)) + continue; + + put_device(&child->dev); + + } +} + static ssize_t state_store(struct device *dev, struct device_attribute *attr, const char *buf, size_t count) { @@ -114,23 +127,33 @@ static ssize_t state_store(struct device *dev, struct device_attribute *attr, const int type = online_type_from_str(buf); int ret; + if (!mutex_trylock(&dev_lock)) + return -EBUSY; + /* Disallow pending on the mutex to avoid potential hung task*/ ret = lock_device_hotplug_sysfs(); - if (ret) + if (ret) { + mutex_unlock(&dev_lock); return ret; + } switch (type) { case STATE_ONLINE: ret = memdev_power_on(adev); break; case STATE_OFFLINE: - ret = memdev_power_off(adev); + memdev_power_off(adev); break; default: break; } + unlock_device_hotplug(); + acpi_os_wait_events_complete(); + flush_hotplug_workqueue(); + + mutex_unlock(&dev_lock); if (ret) return ret; @@ -212,6 +235,8 @@ static int __init hbmdev_init(void) if (acpi_match_platform_list(hbm_plat_info) < 0) return 0; + mutex_init(&dev_lock); + return container_init(); } module_init(hbmdev_init); diff --git a/include/linux/acpi.h b/include/linux/acpi.h index 38ad6478c4b9..0d4f5ccfc059 100644 --- a/include/linux/acpi.h +++ b/include/linux/acpi.h @@ -1416,12 +1416,14 @@ static inline void acpi_init_pcc(void) { } #ifdef CONFIG_ACPI extern int acpi_platform_notify(struct device *dev, enum kobject_action action); +extern void flush_hotplug_workqueue(void); #else static inline int acpi_platform_notify(struct device *dev, enum kobject_action action) { return 0; } +static inline void flush_hotplug_workqueue(void) {} #endif struct acpi_pptt_processor * -- 2.22.0

2 1

[PATCH OLK-5.10] soc: hisilicon: Serialize the online and onfline the acpi devices
by Zhang Zekun 15 Apr '25

15 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC0DU9 ----------------------------------------------- The parallelization of hbm on and off can cause problems, such as the abnormal state of acpi device. Force paralleize the routine of power on/off the hbm device, which can fix various the abnormal state of acpi devices. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/acpi/device_sysfs.c | 8 +++ drivers/acpi/osl.c | 5 ++ drivers/soc/hisilicon/hisi_hbmdev.c | 83 +++++++++++++++++++---------- include/linux/acpi.h | 2 + 4 files changed, 69 insertions(+), 29 deletions(-) diff --git a/drivers/acpi/device_sysfs.c b/drivers/acpi/device_sysfs.c index 57ee8314dfb8..0f0bde3a41f6 100644 --- a/drivers/acpi/device_sysfs.c +++ b/drivers/acpi/device_sysfs.c @@ -359,6 +359,11 @@ static ssize_t power_state_show(struct device *dev, static DEVICE_ATTR_RO(power_state); +static struct acpi_platform_list no_eject_plat_info[] = { + {"HISI ", "HIP11 ", 0, ACPI_SIG_IORT, all_versions, NULL, 0}, + { } +}; + static ssize_t eject_store(struct device *d, struct device_attribute *attr, const char *buf, size_t count) @@ -378,6 +383,9 @@ eject_store(struct device *d, struct device_attribute *attr, if (ACPI_FAILURE(status) || !acpi_device->flags.ejectable) return -ENODEV; + if (acpi_match_platform_list(no_eject_plat_info) >= 0) + return -ENODEV; + get_device(&acpi_device->dev); status = acpi_hotplug_schedule(acpi_device, ACPI_OST_EC_OSPM_EJECT); if (ACPI_SUCCESS(status)) diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c index 0418febc5cf2..213eb9b63776 100644 --- a/drivers/acpi/osl.c +++ b/drivers/acpi/osl.c @@ -1194,6 +1194,11 @@ bool acpi_queue_hotplug_work(struct work_struct *work) return queue_work(kacpi_hotplug_wq, work); } +void flush_hotplug_workqueue(void) +{ + flush_workqueue(kacpi_hotplug_wq); +} + acpi_status acpi_os_create_semaphore(u32 max_units, u32 initial_units, acpi_handle * handle) { diff --git a/drivers/soc/hisilicon/hisi_hbmdev.c b/drivers/soc/hisilicon/hisi_hbmdev.c index 7ed874ff2206..cb65da2c5463 100644 --- a/drivers/soc/hisilicon/hisi_hbmdev.c +++ b/drivers/soc/hisilicon/hisi_hbmdev.c @@ -19,6 +19,7 @@ struct cdev_node { struct list_head clist; }; +static struct mutex dev_lock; struct cdev_node cdev_list; static int get_pxm(struct acpi_device *acpi_device, void *arg) @@ -54,21 +55,6 @@ static ssize_t pxms_show(struct device *dev, } static DEVICE_ATTR_RO(pxms); -static int memdev_power_on(struct acpi_device *adev) -{ - acpi_handle handle = adev->handle; - acpi_status status; - - /* Power on and online the devices */ - status = acpi_evaluate_object(handle, "_ON", NULL, NULL); - if (ACPI_FAILURE(status)) { - acpi_handle_warn(handle, "Power on failed (0x%x)\n", status); - return -ENODEV; - } - - return 0; -} - static int hbmdev_check(struct acpi_device *adev, void *arg) { const char *hid = acpi_device_hid(adev); @@ -79,34 +65,61 @@ static int hbmdev_check(struct acpi_device *adev, void *arg) *found = true; return -1; } - - /* There might be devices have not attached */ - if (!adev->handler) - return 0; - - adev->handler->hotplug.demand_offline = true; } return 0; } -static int memdev_power_off(struct acpi_device *adev) +static int memdev_power_on(struct acpi_device *adev) { acpi_handle handle = adev->handle; + struct acpi_device *child; acpi_status status; - acpi_scan_lock_acquire(); - acpi_dev_for_each_child(adev, hbmdev_check, NULL); - acpi_scan_lock_release(); + list_for_each_entry(child, &adev->children, node) { + unsigned long long sta = 0; - /* Eject the devices and power off */ - status = acpi_evaluate_object(handle, "_OFF", NULL, NULL); + status = acpi_evaluate_integer(child->handle, "_STA", NULL, &sta); + if (ACPI_FAILURE(status) || (sta & ACPI_STA_DEVICE_ENABLED)) + return -EINVAL; + } + + /* Power on and online the devices */ + status = acpi_evaluate_object(handle, "_ON", NULL, NULL); if (ACPI_FAILURE(status)) { + acpi_handle_warn(handle, "Power on failed (0x%x)\n", status); return -ENODEV; } + return 0; } +static void memdev_power_off(struct acpi_device *adev) +{ + struct acpi_device *child; + + list_for_each_entry(child, &adev->children, node) { + const char *hid = acpi_device_hid(child); + acpi_status status; + + if (strcmp(hid, ACPI_MEMORY_DEVICE_HID)) + continue; + + if (!child->handler) + continue; + + child->handler->hotplug.demand_offline = true; + + get_device(&child->dev); + status = acpi_hotplug_schedule(child, ACPI_OST_EC_OSPM_EJECT); + if (ACPI_SUCCESS(status)) + continue; + + put_device(&child->dev); + + } +} + static ssize_t state_store(struct device *dev, struct device_attribute *attr, const char *buf, size_t count) { @@ -114,23 +127,33 @@ static ssize_t state_store(struct device *dev, struct device_attribute *attr, const int type = online_type_from_str(buf); int ret; + if (!mutex_trylock(&dev_lock)) + return -EBUSY; + /* Disallow pending on the mutex to avoid potential hung task*/ ret = lock_device_hotplug_sysfs(); - if (ret) + if (ret) { + mutex_unlock(&dev_lock); return ret; + } switch (type) { case STATE_ONLINE: ret = memdev_power_on(adev); break; case STATE_OFFLINE: - ret = memdev_power_off(adev); + memdev_power_off(adev); break; default: break; } + unlock_device_hotplug(); + acpi_os_wait_events_complete(); + flush_hotplug_workqueue(); + + mutex_unlock(&dev_lock); if (ret) return ret; @@ -212,6 +235,8 @@ static int __init hbmdev_init(void) if (acpi_match_platform_list(hbm_plat_info) < 0) return 0; + mutex_init(&dev_lock); + return container_init(); } module_init(hbmdev_init); diff --git a/include/linux/acpi.h b/include/linux/acpi.h index 38ad6478c4b9..0d4f5ccfc059 100644 --- a/include/linux/acpi.h +++ b/include/linux/acpi.h @@ -1416,12 +1416,14 @@ static inline void acpi_init_pcc(void) { } #ifdef CONFIG_ACPI extern int acpi_platform_notify(struct device *dev, enum kobject_action action); +extern void flush_hotplug_workqueue(void); #else static inline int acpi_platform_notify(struct device *dev, enum kobject_action action) { return 0; } +static inline void flush_hotplug_workqueue(void) {} #endif struct acpi_pptt_processor * -- 2.22.0

2 1

[PATCH OLK-5.10] iommu/arm-smmu-v3: Fix the extra atc tlb flush
by Zhang Zekun 15 Apr '25

15 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBZUQU ------------------------------------------- The tlb invalidation code for smmu pagetable prefetch problem might cause a extra tlb invalidation for atc. Prevent it from happening. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 7 ++++--- drivers/iommu/io-pgtable-arm.c | 2 +- include/linux/io-pgtable.h | 1 + 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index cedc1eda7250..89df2034f8f5 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -2311,9 +2311,7 @@ static void arm_smmu_tlb_inv_walk(unsigned long iova, size_t size, size_t granule, void *cookie) { #ifdef CONFIG_HISILICON_ERRATUM_162100602 - struct arm_smmu_domain *smmu_domain = cookie; - - if (!size && smmu_domain->smmu->options & ARM_SMMU_OPT_SYNC_BATCH) { + if (!size) { arm_smmu_tlb_inv_range_domain(iova, granule, granule, true, cookie); return; } @@ -2584,6 +2582,9 @@ static int arm_smmu_domain_finalise(struct iommu_domain *domain, else if (smmu->features & ARM_SMMU_FEAT_BBML2) pgtbl_cfg.quirks |= IO_PGTABLE_QUIRK_ARM_BBML2; + if (smmu_domain->smmu->options & ARM_SMMU_OPT_SYNC_BATCH) + pgtbl_cfg.quirks |= IO_PGTABLE_QUIRK_HISI_ERRATA; + pgtbl_ops = alloc_io_pgtable_ops(fmt, &pgtbl_cfg, smmu_domain); if (!pgtbl_ops) return -ENOMEM; diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c index dc80f2661ff7..e8a6a38db48f 100644 --- a/drivers/iommu/io-pgtable-arm.c +++ b/drivers/iommu/io-pgtable-arm.c @@ -365,7 +365,7 @@ static int __arm_lpae_map(struct arm_lpae_io_pgtable *data, unsigned long iova, if (pte) __arm_lpae_free_pages(cptep, tblsz, cfg); #ifdef CONFIG_HISILICON_ERRATUM_162100602 - if (lvl <= 2) + if (lvl <= 2 && (cfg->quirks & IO_PGTABLE_QUIRK_HISI_ERRATA)) io_pgtable_tlb_flush_walk(&data->iop, iova, 0, ARM_LPAE_GRANULE(data)); #endif } else if (!cfg->coherent_walk && !(pte & ARM_LPAE_PTE_SW_SYNC)) { diff --git a/include/linux/io-pgtable.h b/include/linux/io-pgtable.h index 27b994e42ec4..7fc863011474 100644 --- a/include/linux/io-pgtable.h +++ b/include/linux/io-pgtable.h @@ -100,6 +100,7 @@ struct io_pgtable_cfg { #define IO_PGTABLE_QUIRK_ARM_HD BIT(6) #define IO_PGTABLE_QUIRK_ARM_BBML1 BIT(7) #define IO_PGTABLE_QUIRK_ARM_BBML2 BIT(8) + #define IO_PGTABLE_QUIRK_HISI_ERRATA BIT(9) unsigned long quirks; unsigned long pgsize_bitmap; unsigned int ias; -- 2.22.0

2 1

[PATCH OLK-6.6 0/8] LoongArch: sync internal repository 20250414
by Hongchen Zhang 15 Apr '25

15 Apr '25

Ard Biesheuvel (1): objtool: Fix C jump table annotations for Clang Gao Qihang (1): LoongArch: Preserve firmware configuration if ACPI requires. Hongchen Zhang (1): LoongArch: set CONFIG_CPU_HAS_LBT=y Juxin Gao (1): LoongArch: configs: set CONFIG_UNWINDER_ORC=y Ming Wang (1): LoongArch: configs: Disable CONFIG_RT_GROUP_SCHED to prevent cgroup2 issues Tiezhu Yang (3): LoongArch: Handle fp, lsx, lasx and lbt assembly symbols LoongArch: Make some signal and ptrace functions non-static LoongArch: Export some signal functions arch/loongarch/configs/loongson3_defconfig | 3 +- arch/loongarch/include/asm/fpu.h | 6 ++++ arch/loongarch/include/asm/lbt.h | 4 +++ arch/loongarch/kernel/Makefile | 1 + arch/loongarch/kernel/extern.c | 31 ++++++++++++++++++ arch/loongarch/kernel/fpu.S | 6 ++++ arch/loongarch/kernel/lbt.S | 4 +++ arch/loongarch/kernel/ptrace.c | 37 +++++++++++++++------- arch/loongarch/kernel/signal.c | 28 +++------------- arch/loongarch/pci/acpi.c | 14 ++++++-- include/linux/compiler.h | 2 +- tools/objtool/check.c | 7 ++-- tools/objtool/include/objtool/special.h | 2 +- 13 files changed, 103 insertions(+), 42 deletions(-) create mode 100644 arch/loongarch/kernel/extern.c -- 2.43.0

2 10

[PATCH OLK-6.6 1/8] objtool: Fix C jump table annotations for Clang
by Hongchen Zhang 15 Apr '25

15 Apr '25

From: Ard Biesheuvel <ardb(a)kernel.org> mainline inclusion from mainline-v6.14-rc5 commit 73cfc53cc3b6380eccf013049574485f64cb83ca category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC10DU CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A C jump table (such as the one used by the BPF interpreter) is a const global array of absolute code addresses, and this means that the actual values in the table may not be known until the kernel is booted (e.g., when using KASLR or when the kernel VA space is sized dynamically). When using PIE codegen, the compiler will default to placing such const global objects in .data.rel.ro (which is annotated as writable), rather than .rodata (which is annotated as read-only). As C jump tables are explicitly emitted into .rodata, this used to result in warnings for LoongArch builds (which uses PIE codegen for the entire kernel) like Warning: setting incorrect section attributes for .rodata..c_jump_table due to the fact that the explicitly specified .rodata section inherited the read-write annotation that the compiler uses for such objects when using PIE codegen. This warning was suppressed by explicitly adding the read-only annotation to the __attribute__((section(""))) string, by commit c5b1184decc8 ("compiler.h: specify correct attribute for .rodata..c_jump_table") Unfortunately, this hack does not work on Clang's integrated assembler, which happily interprets the appended section type and permission specifiers as part of the section name, which therefore no longer matches the hard-coded pattern '.rodata..c_jump_table' that objtool expects, causing it to emit a warning kernel/bpf/core.o: warning: objtool: ___bpf_prog_run+0x20: sibling call from callable instruction with modified stack frame Work around this, by emitting C jump tables into .data.rel.ro instead, which is treated as .rodata by the linker script for all builds, not just PIE based ones. Fixes: c5b1184decc8 ("compiler.h: specify correct attribute for .rodata..c_jump_table") Tested-by: Tiezhu Yang <yangtiezhu(a)loongson.cn> # on LoongArch Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> Link: https://lore.kernel.org/r/20250221135704.431269-6-ardb+git@google.com Signed-off-by: Josh Poimboeuf <jpoimboe(a)kernel.org> --- include/linux/compiler.h | 2 +- tools/objtool/check.c | 7 ++++--- tools/objtool/include/objtool/special.h | 2 +- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/include/linux/compiler.h b/include/linux/compiler.h index db140f106f3d..c61c59e26e1b 100644 --- a/include/linux/compiler.h +++ b/include/linux/compiler.h @@ -133,7 +133,7 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val, #define annotate_unreachable() __annotate_unreachable(__COUNTER__) /* Annotate a C jump table to allow objtool to follow the code flow */ -#define __annotate_jump_table __section(".rodata..c_jump_table,\"a\",@progbits #") +#define __annotate_jump_table __section(".data.rel.ro.c_jump_table") #else /* !CONFIG_OBJTOOL */ #define annotate_reachable() diff --git a/tools/objtool/check.c b/tools/objtool/check.c index 6e9dd6d6db37..c88131a4b1d3 100644 --- a/tools/objtool/check.c +++ b/tools/objtool/check.c @@ -2559,13 +2559,14 @@ static void mark_rodata(struct objtool_file *file) * * - .rodata: can contain GCC switch tables * - .rodata.<func>: same, if -fdata-sections is being used - * - .rodata..c_jump_table: contains C annotated jump tables + * - .data.rel.ro.c_jump_table: contains C annotated jump tables * * .rodata.str1.* sections are ignored; they don't contain jump tables. */ for_each_sec(file, sec) { - if (!strncmp(sec->name, ".rodata", 7) && - !strstr(sec->name, ".str1.")) { + if ((!strncmp(sec->name, ".rodata", 7) && + !strstr(sec->name, ".str1.")) || + !strncmp(sec->name, ".data.rel.ro", 12)) { sec->rodata = true; found = true; } diff --git a/tools/objtool/include/objtool/special.h b/tools/objtool/include/objtool/special.h index 86d4af9c5aa9..89ee12b1a138 100644 --- a/tools/objtool/include/objtool/special.h +++ b/tools/objtool/include/objtool/special.h @@ -10,7 +10,7 @@ #include <objtool/check.h> #include <objtool/elf.h> -#define C_JUMP_TABLE_SECTION ".rodata..c_jump_table" +#define C_JUMP_TABLE_SECTION ".data.rel.ro.c_jump_table" struct special_alt { struct list_head list; -- 2.43.0

2 8

[PATCH openEuler-1.0-LTS] tty: goldfish: Use tty_port_destroy() to destroy port
by Gu Bowen 15 Apr '25

15 Apr '25

From: Wang Weiyang <wangweiyang2(a)huawei.com> stable inclusion from stable-v4.19.247 commit 326192b99c903a2193d820c30ed936cc2402382c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6XS CVE: CVE-2022-49399 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 507b05063d1b7a1fcb9f7d7c47586fc4f3508f98 ] In goldfish_tty_probe(), the port initialized through tty_port_init() should be destroyed in error paths.In goldfish_tty_remove(), qtty->port also should be destroyed or else might leak resources. Fix the above by calling tty_port_destroy(). Fixes: 666b7793d4bf ("goldfish: tty driver") Reviewed-by: Jiri Slaby <jirislaby(a)kernel.org> Signed-off-by: Wang Weiyang <wangweiyang2(a)huawei.com> Link: https://lore.kernel.org/r/20220328115844.86032-1-wangweiyang2@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/tty/goldfish.c [Context conflicts due to commit 499e13aac6c7 ("tty: goldfish: Fix free_irq() on remove") has merged.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/tty/goldfish.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/tty/goldfish.c b/drivers/tty/goldfish.c index 48ea55beaf43..d6e82eb61fc2 100644 --- a/drivers/tty/goldfish.c +++ b/drivers/tty/goldfish.c @@ -407,6 +407,7 @@ static int goldfish_tty_probe(struct platform_device *pdev) err_tty_register_device_failed: free_irq(irq, qtty); err_dec_line_count: + tty_port_destroy(&qtty->port); goldfish_tty_current_line_count--; if (goldfish_tty_current_line_count == 0) goldfish_tty_delete_driver(); @@ -428,6 +429,7 @@ static int goldfish_tty_remove(struct platform_device *pdev) iounmap(qtty->base); qtty->base = NULL; free_irq(qtty->irq, qtty); + tty_port_destroy(&qtty->port); goldfish_tty_current_line_count--; if (goldfish_tty_current_line_count == 0) goldfish_tty_delete_driver(); -- 2.25.1

2 1

[PATCH OLK-5.10] drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()
by Wang Zhaolong 15 Apr '25

15 Apr '25

From: Jiang Liu <gerry(a)linux.alibaba.com> mainline inclusion from mainline-v6.14-rc3 commit 1abb2648698bf10783d2236a6b4a7ca5e8021699 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC78 CVE: CVE-2025-21780 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- It malicious user provides a small pptable through sysfs and then a bigger pptable, it may cause buffer overflow attack in function smu_sys_set_pp_table(). Reviewed-by: Lijo Lazar <lijo.lazar(a)amd.com> Signed-off-by: Jiang Liu <gerry(a)linux.alibaba.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org Conflicts: drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c [The smu->mutex in the context has not been removed.] Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c index ee27970cfff9..98c9ac875daa 100644 --- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c @@ -325,12 +325,14 @@ int smu_sys_set_pp_table(struct smu_context *smu, void *buf, size_t size) dev_err(smu->adev->dev, "pp table size not matched !\n"); return -EIO; } mutex_lock(&smu->mutex); - if (!smu_table->hardcode_pptable) + if (!smu_table->hardcode_pptable || smu_table->power_play_table_size < size) { + kfree(smu_table->hardcode_pptable); smu_table->hardcode_pptable = kzalloc(size, GFP_KERNEL); + } if (!smu_table->hardcode_pptable) { ret = -ENOMEM; goto failed; } -- 2.34.3

2 1