- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 505199cb1252a385d878c2296a189de1b78f93ff
by kernel test robot 28 May '24

28 May '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 505199cb1252a385d878c2296a189de1b78f93ff !8056 scsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els() Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- arm64-randconfig-002-20240527 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- x86_64-buildonly-randconfig-003-20240527 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- x86_64-buildonly-randconfig-006-20240527 | |-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code | `-- fs-f2fs-.tmp_recovery.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-randconfig-012-20240527 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- x86_64-randconfig-016-20240527 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code `-- x86_64-randconfig-076-20240527 `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code clang_recent_errors |-- x86_64-allyesconfig | |-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension | `-- fs-f2fs-.tmp_recovery.o:warning:objtool:missing-symbol-for-section-.init.text `-- x86_64-buildonly-randconfig-001-20240527 `-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text elapsed time: 751m configs tested: 35 configs skipped: 147 tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240527 gcc arm64 randconfig-002-20240527 gcc arm64 randconfig-003-20240527 gcc arm64 randconfig-004-20240527 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240527 clang x86_64 buildonly-randconfig-002-20240527 gcc x86_64 buildonly-randconfig-003-20240527 gcc x86_64 buildonly-randconfig-004-20240527 gcc x86_64 buildonly-randconfig-005-20240527 gcc x86_64 buildonly-randconfig-006-20240527 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240527 clang x86_64 randconfig-002-20240527 gcc x86_64 randconfig-003-20240527 clang x86_64 randconfig-004-20240527 clang x86_64 randconfig-005-20240527 clang x86_64 randconfig-006-20240527 clang x86_64 randconfig-011-20240527 gcc x86_64 randconfig-012-20240527 gcc x86_64 randconfig-013-20240527 clang x86_64 randconfig-014-20240527 gcc x86_64 randconfig-015-20240527 gcc x86_64 randconfig-016-20240527 gcc x86_64 randconfig-071-20240527 gcc x86_64 randconfig-072-20240527 clang x86_64 randconfig-073-20240527 clang x86_64 randconfig-074-20240527 clang x86_64 randconfig-075-20240527 clang x86_64 randconfig-076-20240527 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] Bluetooth: ISO: Fix not validating setsockopt user input
by Zhao Mengmeng 28 May '24

28 May '24

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> mainline inclusion from mainline-v6.9-rc4 commit 9e8742cdfc4b0e65266bb4a901a19462bda9285e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRPG CVE: CVE-2024-35964 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Check user input length before copying data. Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") Fixes: 0731c5ab4d51 ("Bluetooth: ISO: Add support for BT_PKT_STATUS") Fixes: f764a6c2c1e4 ("Bluetooth: ISO: Add broadcast support") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Zhao Mengmeng <zhaomengmeng(a)kylinos.cn> --- net/bluetooth/iso.c | 36 ++++++++++++------------------------ 1 file changed, 12 insertions(+), 24 deletions(-) diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c index 2f63ea9e62ec..ee106bcefd57 100644 --- a/net/bluetooth/iso.c +++ b/net/bluetooth/iso.c @@ -1350,7 +1350,7 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname, sockptr_t optval, unsigned int optlen) { struct sock *sk = sock->sk; - int len, err = 0; + int err = 0; struct bt_iso_qos qos = default_qos; u32 opt; @@ -1365,10 +1365,9 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname, break; } - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) break; - } if (opt) set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); @@ -1377,10 +1376,9 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname, break; case BT_PKT_STATUS: - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) break; - } if (opt) set_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags); @@ -1395,17 +1393,9 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname, break; } - len = min_t(unsigned int, sizeof(qos), optlen); - - if (copy_from_sockptr(&qos, optval, len)) { - err = -EFAULT; - break; - } - - if (len == sizeof(qos.ucast) && !check_ucast_qos(&qos)) { - err = -EINVAL; + err = bt_copy_from_sockptr(&qos, sizeof(qos), optval, optlen); + if (err) break; - } iso_pi(sk)->qos = qos; iso_pi(sk)->qos_user_set = true; @@ -1420,18 +1410,16 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname, } if (optlen > sizeof(iso_pi(sk)->base)) { - err = -EOVERFLOW; + err = -EINVAL; break; } - len = min_t(unsigned int, sizeof(iso_pi(sk)->base), optlen); - - if (copy_from_sockptr(iso_pi(sk)->base, optval, len)) { - err = -EFAULT; + err = bt_copy_from_sockptr(iso_pi(sk)->base, optlen, optval, + optlen); + if (err) break; - } - iso_pi(sk)->base_len = len; + iso_pi(sk)->base_len = optlen; break; -- 2.33.0

2 1

[PATCH v2 openEuler-1.0-LTS] HID: betop: fix slab-out-of-bounds Write in betop_probe
by Li Huafei 28 May '24

28 May '24

From: "F.A.Sulaiman" <asha.16(a)itfac.mrt.ac.lk> stable inclusion from stable-v4.19.209 commit bb8b72374db69afa25a5b65cf1c092860c6fe914 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4OM CVE: CVE-2021-47404 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1e4ce418b1cb1a810256b5fb3fd33d22d1325993 upstream. Syzbot reported slab-out-of-bounds Write bug in hid-betopff driver. The problem is the driver assumes the device must have an input report but some malicious devices violate this assumption. So this patch checks hid_device's input is non empty before it's been used. Reported-by: syzbot+07efed3bc5a1407bd742(a)syzkaller.appspotmail.com Signed-off-by: F.A. SULAIMAN <asha.16(a)itfac.mrt.ac.lk> Reviewed-by: Pavel Skripkin <paskripkin(a)gmail.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/hid/hid-betopff.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/drivers/hid/hid-betopff.c b/drivers/hid/hid-betopff.c index 69cfc8dc6af1e..9b60efe6ec441 100644 --- a/drivers/hid/hid-betopff.c +++ b/drivers/hid/hid-betopff.c @@ -59,15 +59,22 @@ static int betopff_init(struct hid_device *hid) { struct betopff_device *betopff; struct hid_report *report; - struct hid_input *hidinput = - list_first_entry(&hid->inputs, struct hid_input, list); + struct hid_input *hidinput; struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list; - struct input_dev *dev = hidinput->input; + struct input_dev *dev; int field_count = 0; int error; int i, j; + if (list_empty(&hid->inputs)) { + hid_err(hid, "no inputs found\n"); + return -ENODEV; + } + + hidinput = list_first_entry(&hid->inputs, struct hid_input, list); + dev = hidinput->input; + if (list_empty(report_list)) { hid_err(hid, "no output reports found\n"); return -ENODEV; -- 2.25.1

2 1

[PATCH OLK-5.10 v2 0/2] CVE-2024-27408
by Xiongfeng Wang 28 May '24

28 May '24

Frank Li (1): dmaengine: dw-edma: Add support for chip-specific flags Kory Maincent (1): dmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup drivers/dma/dw-edma/dw-edma-v0-core.c | 26 +++++++++++++++++++++++--- include/linux/dma/edma.h | 10 ++++++++++ 2 files changed, 33 insertions(+), 3 deletions(-) -- 2.20.1

2 3

[PATCH OLK-5.10 0/4] adjusting the interface to adapt to the cca community
by Ju Fu 27 May '24

27 May '24

adjusting the interface to adapt to the cca community: cvm: enable secure memory alloc on multiple numa nodes cvm: support observable usage of secure memory cvm: adjusting the interface to adapt to the cca community cvm: fix data_create ram region arch/arm64/include/asm/kvm_pgtable.h | 3 + arch/arm64/include/asm/kvm_tmi.h | 59 ++- arch/arm64/include/asm/kvm_tmm.h | 8 +- arch/arm64/include/asm/sysreg.h | 3 + arch/arm64/include/uapi/asm/kvm.h | 4 + arch/arm64/kvm/arm.c | 74 +-- arch/arm64/kvm/cvm.c | 476 +++++++++++--------- arch/arm64/kvm/reset.c | 12 +- arch/arm64/kvm/tmi.c | 23 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 3 + include/uapi/linux/kvm.h | 6 +- 11 files changed, 390 insertions(+), 281 deletions(-) -- 2.25.1.windows.1

2 5

[PATCH OLK-5.10 0/2] CVE-2021-47427
by Li Nan 27 May '24

27 May '24

Mike Christie (2): scsi: iscsi: Have abort handler get ref to conn scsi: iscsi: Fix iscsi_task use after free drivers/scsi/libiscsi.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10 1/2] scsi: iscsi: Have abort handler get ref to conn
by Li Nan 27 May '24

27 May '24

From: Mike Christie <michael.christie(a)oracle.com> mainline inclusion from mainline-v5.14-rc1 commit d39df158518ccc3bf24ee18082b5e100c8f014aa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4O4 CVE: CVE-2021-47427 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If SCSI midlayer is aborting a task when we are tearing down the conn we could free the conn while the abort thread is accessing the conn. This has the abort handler get a ref to the conn so it won't be freed from under it. Note: this is not needed for device/target reset because we are holding the eh_mutex when accessing the conn. Link: https://lore.kernel.org/r/20210525181821.7617-12-michael.christie@oracle.com Reviewed-by: Lee Duncan <lduncan(a)suse.com> Signed-off-by: Mike Christie <michael.christie(a)oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/scsi/libiscsi.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c index 39d5067f804b..06246388791f 100644 --- a/drivers/scsi/libiscsi.c +++ b/drivers/scsi/libiscsi.c @@ -2286,6 +2286,7 @@ int iscsi_eh_abort(struct scsi_cmnd *sc) } conn = session->leadconn; + iscsi_get_conn(conn->cls_conn); conn->eh_abort_cnt++; age = session->age; @@ -2296,9 +2297,7 @@ int iscsi_eh_abort(struct scsi_cmnd *sc) ISCSI_DBG_EH(session, "sc completed while abort in progress\n"); spin_unlock(&session->back_lock); - spin_unlock_bh(&session->frwd_lock); - mutex_unlock(&session->eh_mutex); - return SUCCESS; + goto success; } ISCSI_DBG_EH(session, "aborting [sc %p itt 0x%x]\n", sc, task->itt); __iscsi_get_task(task); @@ -2365,6 +2364,7 @@ int iscsi_eh_abort(struct scsi_cmnd *sc) ISCSI_DBG_EH(session, "abort success [sc %p itt 0x%x]\n", sc, task->itt); iscsi_put_task(task); + iscsi_put_conn(conn->cls_conn); mutex_unlock(&session->eh_mutex); return SUCCESS; @@ -2374,6 +2374,7 @@ int iscsi_eh_abort(struct scsi_cmnd *sc) ISCSI_DBG_EH(session, "abort failed [sc %p itt 0x%x]\n", sc, task ? task->itt : 0); iscsi_put_task(task); + iscsi_put_conn(conn->cls_conn); mutex_unlock(&session->eh_mutex); return FAILED; } -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2021-47427
by Li Nan 27 May '24

27 May '24

Mike Christie (2): scsi: iscsi: Have abort handler get ref to conn scsi: iscsi: Fix iscsi_task use after free drivers/scsi/libiscsi.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS 1/2] scsi: iscsi: Have abort handler get ref to conn
by Li Nan 27 May '24

27 May '24

From: Mike Christie <michael.christie(a)oracle.com> mainline inclusion from mainline-v5.14-rc1 commit d39df158518ccc3bf24ee18082b5e100c8f014aa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4O4 CVE: CVE-2021-47427 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If SCSI midlayer is aborting a task when we are tearing down the conn we could free the conn while the abort thread is accessing the conn. This has the abort handler get a ref to the conn so it won't be freed from under it. Note: this is not needed for device/target reset because we are holding the eh_mutex when accessing the conn. Link: https://lore.kernel.org/r/20210525181821.7617-12-michael.christie@oracle.com Reviewed-by: Lee Duncan <lduncan(a)suse.com> Signed-off-by: Mike Christie <michael.christie(a)oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/scsi/libiscsi.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c index 72463874d7b4..fe685178ade7 100644 --- a/drivers/scsi/libiscsi.c +++ b/drivers/scsi/libiscsi.c @@ -2300,6 +2300,7 @@ int iscsi_eh_abort(struct scsi_cmnd *sc) } conn = session->leadconn; + iscsi_get_conn(conn->cls_conn); conn->eh_abort_cnt++; age = session->age; @@ -2310,9 +2311,7 @@ int iscsi_eh_abort(struct scsi_cmnd *sc) ISCSI_DBG_EH(session, "sc completed while abort in progress\n"); spin_unlock(&session->back_lock); - spin_unlock_bh(&session->frwd_lock); - mutex_unlock(&session->eh_mutex); - return SUCCESS; + goto success; } ISCSI_DBG_EH(session, "aborting [sc %p itt 0x%x]\n", sc, task->itt); __iscsi_get_task(task); @@ -2379,6 +2378,7 @@ int iscsi_eh_abort(struct scsi_cmnd *sc) ISCSI_DBG_EH(session, "abort success [sc %p itt 0x%x]\n", sc, task->itt); iscsi_put_task(task); + iscsi_put_conn(conn->cls_conn); mutex_unlock(&session->eh_mutex); return SUCCESS; @@ -2388,6 +2388,7 @@ int iscsi_eh_abort(struct scsi_cmnd *sc) ISCSI_DBG_EH(session, "abort failed [sc %p itt 0x%x]\n", sc, task ? task->itt : 0); iscsi_put_task(task); + iscsi_put_conn(conn->cls_conn); mutex_unlock(&session->eh_mutex); return FAILED; } -- 2.39.2

2 2

[PATCH openEuler-1.0-LTS] drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
by Ye Bin 27 May '24

27 May '24

From: Mario Limonciello <mario.limonciello(a)amd.com> mainline inclusion from mainline-v6.7-rc1 commit 760efbca74a405dc439a013a5efaa9fadc95a8c3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RFET CVE: CVE-2023-52818 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- For pptable structs that use flexible array sizes, use flexible arrays. Suggested-by: Felix Held <felix.held(a)amd.com> Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2874 Signed-off-by: Mario Limonciello <mario.limonciello(a)amd.com> Acked-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/gpu/drm/amd/include/pptable.h | 4 ++-- drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/include/pptable.h b/drivers/gpu/drm/amd/include/pptable.h index 0b6a057e0a4c..5aac8d545bdc 100644 --- a/drivers/gpu/drm/amd/include/pptable.h +++ b/drivers/gpu/drm/amd/include/pptable.h @@ -78,7 +78,7 @@ typedef struct _ATOM_PPLIB_THERMALCONTROLLER typedef struct _ATOM_PPLIB_STATE { UCHAR ucNonClockStateIndex; - UCHAR ucClockStateIndices[1]; // variable-sized + UCHAR ucClockStateIndices[]; // variable-sized } ATOM_PPLIB_STATE; @@ -473,7 +473,7 @@ typedef struct _ATOM_PPLIB_STATE_V2 /** * Driver will read the first ucNumDPMLevels in this array */ - UCHAR clockInfoIndex[1]; + UCHAR clockInfoIndex[]; } ATOM_PPLIB_STATE_V2; typedef struct _StateArray{ diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h b/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h index 1e870f58dd12..d5a4a08c6d39 100644 --- a/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h +++ b/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h @@ -179,7 +179,7 @@ typedef struct _ATOM_Tonga_MCLK_Dependency_Record { typedef struct _ATOM_Tonga_MCLK_Dependency_Table { UCHAR ucRevId; UCHAR ucNumEntries; /* Number of entries. */ - ATOM_Tonga_MCLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */ + ATOM_Tonga_MCLK_Dependency_Record entries[]; /* Dynamically allocate entries. */ } ATOM_Tonga_MCLK_Dependency_Table; typedef struct _ATOM_Tonga_SCLK_Dependency_Record { @@ -194,7 +194,7 @@ typedef struct _ATOM_Tonga_SCLK_Dependency_Record { typedef struct _ATOM_Tonga_SCLK_Dependency_Table { UCHAR ucRevId; UCHAR ucNumEntries; /* Number of entries. */ - ATOM_Tonga_SCLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */ + ATOM_Tonga_SCLK_Dependency_Record entries[]; /* Dynamically allocate entries. */ } ATOM_Tonga_SCLK_Dependency_Table; typedef struct _ATOM_Polaris_SCLK_Dependency_Record { -- 2.31.1

2 1