- Kernel - mailweb.openeuler.org

[PATCH V4 openEuler-1.0-LTS 0/1] Fix CVE-2023-52572 in openEuler-1.0-LTS
by Wang Zhaolong 13 Feb '25

13 Feb '25

V1 -> V2: In the compound_send_recv(), correct the credits[i] update condition MID_RESPONSE_RECEIVED to MID_RESPONSE_READY. V2 -> V3: Correct conflicts and Signed-off-by information. V3 -> V4 Correct conflicts information. Zhang Xiaoxu (1): cifs: Fix UAF in cifs_demultiplex_thread() fs/cifs/cifsglob.h | 1 + fs/cifs/connect.c | 3 ++- fs/cifs/transport.c | 32 +++++++++++++++++++++----------- 3 files changed, 24 insertions(+), 12 deletions(-) -- 2.34.3

2 2

[PATCH V3 openEuler-1.0-LTS 0/1] Fix CVE-2023-52572 in openEuler-1.0-LTS
by Wang Zhaolong 13 Feb '25

13 Feb '25

V1 -> V2: In the compound_send_recv(), correct the credits[i] update condition MID_RESPONSE_RECEIVED to MID_RESPONSE_READY. V2 -> V3: Correct conflicts and Signed-off-by information. Zhang Xiaoxu (1): cifs: Fix UAF in cifs_demultiplex_thread() fs/cifs/cifsglob.h | 1 + fs/cifs/connect.c | 3 ++- fs/cifs/transport.c | 32 +++++++++++++++++++++----------- 3 files changed, 24 insertions(+), 12 deletions(-) -- 2.34.3

2 2

[PATCH V2 openEuler-1.0-LTS 0/1] Fix CVE-2023-52572 in openEuler-1.0-LTS
by Wang Zhaolong 13 Feb '25

13 Feb '25

V1 -> V2: In the compound_send_recv(), correct the credits[i] update condition MID_RESPONSE_RECEIVED to MID_RESPONSE_READY. Zhang Xiaoxu (1): cifs: Fix UAF in cifs_demultiplex_thread() fs/cifs/cifsglob.h | 1 + fs/cifs/connect.c | 3 ++- fs/cifs/transport.c | 32 +++++++++++++++++++++----------- 3 files changed, 24 insertions(+), 12 deletions(-) -- 2.34.3

2 2

[PATCH OLK-5.10] kasan: fix incorrect return type of quarantine_put()
by Kaixiong Yu 13 Feb '25

13 Feb '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBLXYN -------------------------------- The return type of quarantine_put() leads to complie errors. Fix it by changing void type into bool. Fixes: 83271e84716b ("kasan: sanitize objects when metadata doesn't fit") Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- mm/kasan/kasan.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h index 17d97ffbbdeb..e147b9595ee8 100644 --- a/mm/kasan/kasan.h +++ b/mm/kasan/kasan.h @@ -195,7 +195,7 @@ bool quarantine_put(struct kmem_cache *cache, void *object); void quarantine_reduce(void); void quarantine_remove_cache(struct kmem_cache *cache); #else -static inline void quarantine_put(struct kmem_cache *cache, void *object) { return false; } +static inline bool quarantine_put(struct kmem_cache *cache, void *object) { return false; } static inline void quarantine_reduce(void) { } static inline void quarantine_remove_cache(struct kmem_cache *cache) { } #endif -- 2.34.1

2 1

[PATCH OLK-6.6] fs/proc: fix softlockup in __read_vmcore (part 2)
by Li Huafei 13 Feb '25

13 Feb '25

From: Rik van Riel <riel(a)surriel.com> stable inclusion from stable-v6.6.74 commit a5a2ee8144c3897d37403a69118c3e3dc5713958 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBLWTG CVE: CVE-2025-21694 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit cbc5dde0a461240046e8a41c43d7c3b76d5db952 upstream. Since commit 5cbcb62dddf5 ("fs/proc: fix softlockup in __read_vmcore") the number of softlockups in __read_vmcore at kdump time have gone down, but they still happen sometimes. In a memory constrained environment like the kdump image, a softlockup is not just a harmless message, but it can interfere with things like RCU freeing memory, causing the crashdump to get stuck. The second loop in __read_vmcore has a lot more opportunities for natural sleep points, like scheduling out while waiting for a data write to happen, but apparently that is not always enough. Add a cond_resched() to the second loop in __read_vmcore to (hopefully) get rid of the softlockups. Link: https://lkml.kernel.org/r/20250110102821.2a37581b@fangorn Fixes: 5cbcb62dddf5 ("fs/proc: fix softlockup in __read_vmcore") Signed-off-by: Rik van Riel <riel(a)surriel.com> Reported-by: Breno Leitao <leitao(a)debian.org> Cc: Baoquan He <bhe(a)redhat.com> Cc: Dave Young <dyoung(a)redhat.com> Cc: Vivek Goyal <vgoyal(a)redhat.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- fs/proc/vmcore.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c index 8319bcbe3ee3..3303cb04e12c 100644 --- a/fs/proc/vmcore.c +++ b/fs/proc/vmcore.c @@ -404,6 +404,8 @@ static ssize_t __read_vmcore(struct iov_iter *iter, loff_t *fpos) if (!iov_iter_count(iter)) return acc; } + + cond_resched(); } return acc; -- 2.25.1

2 1

[openeuler:OLK-5.10 2737/2737] drivers/scsi/linkdata/ps3stor/ps3_recovery.c: ps3_ioc_state.h is included more than once.
by kernel test robot 13 Feb '25

13 Feb '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 7152a244f5f9fb024d93d293168ce0b62309680a commit: 13f748eddc9dfdec8a18922ed601e1906dcb183a [2737/2737] [PATCH] SCSI: Linkdata: Supports Linkdata HBA/RAID Controllers :::::: branch date: 9 hours ago :::::: commit date: 3 days ago compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/r/202502111949.SlRodAD8-lkp@intel.com/ includecheck warnings: (new ones prefixed by >>) >> drivers/scsi/linkdata/ps3stor/ps3_recovery.c: ps3_ioc_state.h is included more than once. >> drivers/scsi/linkdata/ps3stor/ps3_recovery.c: ps3_recovery.h is included more than once. -- >> drivers/scsi/linkdata/ps3stor/ps3_device_update.c: linux/mutex.h is included more than once. >> drivers/scsi/linkdata/ps3stor/ps3_device_update.c: ps3_device_update.h is included more than once. -- >> drivers/scsi/linkdata/ps3stor/linux/ps3_dump.c: linux/uaccess.h is included more than once. -- >> drivers/scsi/linkdata/ps3stor/ps3_device_manager.c: scsi/scsi_tcq.h is included more than once. -- >> drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c: ps3_driver_log.h is included more than once. -- >> drivers/scsi/linkdata/ps3stor/ps3_ioctl.c: linux/mutex.h is included more than once. -- >> drivers/scsi/linkdata/ps3stor/ps3_debug.c: ps3_htp_def.h is included more than once. >> drivers/scsi/linkdata/ps3stor/ps3_debug.c: ps3_instance_manager.h is included more than once. -- >> drivers/scsi/linkdata/ps3stor/ps3_mgr_channel.c: ps3_cmd_complete.h is included more than once. -- >> drivers/scsi/linkdata/ps3stor/ps3_mgr_cmd.c: linux/mutex.h is included more than once. -- >> drivers/scsi/linkdata/ps3stor/ps3_irq.c: linux/kernel.h is included more than once. -- >> drivers/scsi/linkdata/ps3stor/ps3_scsih.c: ps3_module_para.h is included more than once. -- >> drivers/scsi/linkdata/ps3stor/ps3_instance_manager.h: ps3_irq.h is included more than once. >> drivers/scsi/linkdata/ps3stor/ps3_instance_manager.h: ps3_cmd_channel.h is included more than once. >> drivers/scsi/linkdata/ps3stor/ps3_instance_manager.h: ps3_inner_data.h is included more than once. -- >> drivers/scsi/linkdata/ps3stor/linux/ps3_base.c: ps3_scsi_cmd_err.h is included more than once. >> drivers/scsi/linkdata/ps3stor/linux/ps3_base.c: ps3_driver_log.h is included more than once. -- >> drivers/scsi/linkdata/ps3stor/ps3_ioc_adp.c: ps3_scsih.h is included more than once. vim +10 drivers/scsi/linkdata/ps3stor/ps3_recovery.c 6 7 #include <scsi/scsi.h> 8 #endif 9 #include "ps3_recovery.h" > 10 #include "ps3_ioc_state.h" 11 #include "ps3_event.h" 12 #include "ps3_mgr_channel.h" 13 #include "ps3_cmd_complete.h" 14 #include "ps3_device_update.h" 15 #include "ps3_ioc_manager.h" 16 #include "ps3_mgr_cmd.h" 17 #include "ps3_scsi_cmd_err.h" 18 #include "ps3_scsih.h" 19 #include "ps3_cmd_statistics.h" 20 #include "ps3_r1x_write_lock.h" > 21 #include "ps3_ioc_state.h" 22 #include "ps3_module_para.h" 23 #include "ps3_ioctl.h" 24 #include "ps3_dump.h" 25 #include "ps3_cli_debug.h" 26 #include "ps3_kernel_version.h" 27 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION c9132e94ade9d43addb67dcb35070321e487b584
by kernel test robot 13 Feb '25

13 Feb '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: c9132e94ade9d43addb67dcb35070321e487b584 !15065 fix CVE-2025-21668 Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- mm-dynamic_pool.c:warning:variable-ret-is-uninitialized-when-used-here | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags |-- arm64-allnoconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- arm64-randconfig-001-20250212 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- arm64-randconfig-002-20250212 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- arm64-randconfig-003-20250212 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags |-- arm64-randconfig-004-20250212 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- loongarch-allmodconfig | |-- include-trace-stages-init.h:warning:str__bonding__trace_system_name-defined-but-not-used | |-- include-trace-stages-init.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- loongarch-allnoconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- loongarch-randconfig-001-20250212 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- loongarch-randconfig-002-20250212 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- x86_64-allnoconfig | |-- include-linux-sched-signal.h:linux-kabi.h-is-included-more-than-once. | |-- include-net-tcp.h:linux-kabi.h-is-included-more-than-once. | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags |-- x86_64-allyesconfig | |-- mm-dynamic_pool.c:warning:variable-ret-is-uninitialized-when-used-here | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags |-- x86_64-buildonly-randconfig-001-20250212 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- x86_64-buildonly-randconfig-002-20250212 | |-- drivers-net-ethernet-huawei-hinic-hinic_main.c:error:member-reference-type-int-is-not-a-pointer | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags |-- x86_64-buildonly-randconfig-003-20250212 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags |-- x86_64-buildonly-randconfig-004-20250212 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags |-- x86_64-buildonly-randconfig-005-20250212 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- x86_64-buildonly-randconfig-006-20250212 | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_register_cmd_notifier | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_unregister_cmd_notifier | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags `-- x86_64-defconfig |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead `-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags elapsed time: 769m configs tested: 19 configs skipped: 88 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250212 gcc-14.2.0 arm64 randconfig-002-20250212 gcc-14.2.0 arm64 randconfig-003-20250212 clang-16 arm64 randconfig-004-20250212 gcc-14.2.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250212 gcc-14.2.0 loongarch randconfig-002-20250212 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250212 gcc-11 x86_64 buildonly-randconfig-002-20250212 clang-19 x86_64 buildonly-randconfig-003-20250212 clang-19 x86_64 buildonly-randconfig-004-20250212 clang-19 x86_64 buildonly-randconfig-005-20250212 gcc-12 x86_64 buildonly-randconfig-006-20250212 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2738/2738] include/linux/compiler_attributes.h:221:41: warning: attribute 'fallthrough' not preceding a case label or default label
by kernel test robot 12 Feb '25

12 Feb '25

Hi Ze, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 83b361e2942e85c04f931c63e78bc54215a2db25 commit: 0695e18bbaebbfbe22b049104bbb9a4300a9f30c [2738/2738] mm: Add PMU based memory sampling abstract layer config: arm64-randconfig-r054-20250212 (https://download.01.org/0day-ci/archive/20250212/202502121559.DteGFyD7-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250212/202502121559.DteGFyD7-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502121559.DteGFyD7-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from include/linux/compiler_types.h:65, from <command-line>: drivers/arm/spe/spe.c: In function '__arm_spe_dev_probe': >> include/linux/compiler_attributes.h:221:41: warning: attribute 'fallthrough' not preceding a case label or default label 221 | # define fallthrough __attribute__((__fallthrough__)) | ^~~~~~~~~~~~~ drivers/arm/spe/spe.c:492:17: note: in expansion of macro 'fallthrough' 492 | fallthrough; | ^~~~~~~~~~~ >> include/linux/compiler_attributes.h:221:41: warning: attribute 'fallthrough' not preceding a case label or default label 221 | # define fallthrough __attribute__((__fallthrough__)) | ^~~~~~~~~~~~~ drivers/arm/spe/spe.c:514:17: note: in expansion of macro 'fallthrough' 514 | fallthrough; | ^~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for ARM_SPE_MEM_SAMPLING Depends on [n]: ARM64 [=y] && !ARM_SPE_PMU [=y] Selected by [y]: - MEM_SAMPLING [=y] && ARM64 [=y] WARNING: unmet direct dependencies detected for ARM64_ERRATUM_845719 Depends on [n]: AARCH32_EL0 [=n] Selected by [y]: - ARCH_MXC [=y] && COMPAT [=y] vim +/fallthrough +221 include/linux/compiler_attributes.h 294f69e662d157 Joe Perches 2019-10-05 209 294f69e662d157 Joe Perches 2019-10-05 210 /* 294f69e662d157 Joe Perches 2019-10-05 211 * Add the pseudo keyword 'fallthrough' so case statement blocks 294f69e662d157 Joe Perches 2019-10-05 212 * must end with any of these keywords: 294f69e662d157 Joe Perches 2019-10-05 213 * break; 294f69e662d157 Joe Perches 2019-10-05 214 * fallthrough; 294f69e662d157 Joe Perches 2019-10-05 215 * goto <label>; 294f69e662d157 Joe Perches 2019-10-05 216 * return [expression]; 294f69e662d157 Joe Perches 2019-10-05 217 * 294f69e662d157 Joe Perches 2019-10-05 218 * gcc: https://gcc.gnu.org/onlinedocs/gcc/Statement-Attributes.html#Statement-Attr… 294f69e662d157 Joe Perches 2019-10-05 219 */ 294f69e662d157 Joe Perches 2019-10-05 220 #if __has_attribute(__fallthrough__) 294f69e662d157 Joe Perches 2019-10-05 @221 # define fallthrough __attribute__((__fallthrough__)) 294f69e662d157 Joe Perches 2019-10-05 222 #else 294f69e662d157 Joe Perches 2019-10-05 223 # define fallthrough do {} while (0) /* fallthrough */ a3f8a30f3f0079 Miguel Ojeda 2018-08-30 224 #endif a3f8a30f3f0079 Miguel Ojeda 2018-08-30 225 :::::: The code at line 221 was first introduced by commit :::::: 294f69e662d1570703e9b56e95be37a9fd3afba5 compiler_attributes.h: Add 'fallthrough' pseudo keyword for switch/case use :::::: TO: Joe Perches <joe(a)perches.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1423/1423] kernel/bpf/verifier.o: warning: objtool: do_check()+0x2bd2: can't find switch jump table
by kernel test robot 12 Feb '25

12 Feb '25

Hi Daniel, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 6a6cc2b6b95dc80ae01221670e21a8059229a023 commit: b2fdc6d8c190bbe579cbc19c520f3d7c25e9fb44 [1423/1423] bpf: Do not mark insn as seen under speculative path verification config: x86_64-randconfig-103-20250211 (https://download.01.org/0day-ci/archive/20250212/202502121329.j5PZcydK-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250212/202502121329.j5PZcydK-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502121329.j5PZcydK-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/bpf/verifier.c:6228:16: warning: cast from 'unsigned int (*)(const void *, const struct bpf_insn *)' to 'u64 (*)(u64, u64, u64, u64, u64)' (aka 'unsigned long long (*)(unsigned long long, unsigned long long, unsigned long long, unsigned long long, unsigned long long)') converts to incompatible function type [-Wcast-function-type-strict] 6228 | insn->imm = (u64 (*)(u64, u64, u64, u64, u64)) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 6229 | func[subprog]->bpf_func - | ~~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf/verifier.c:6569:17: warning: cast from 'void *(*)(struct bpf_map *, void *)' to 'u64 (*)(u64, u64, u64, u64, u64)' (aka 'unsigned long long (*)(unsigned long long, unsigned long long, unsigned long long, unsigned long long, unsigned long long)') converts to incompatible function type [-Wcast-function-type-strict] 6569 | insn->imm = BPF_CAST_CALL(ops->map_lookup_elem) - | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/filter.h:323:4: note: expanded from macro 'BPF_CAST_CALL' 323 | ((u64 (*)(u64, u64, u64, u64, u64))(x)) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf/verifier.c:6573:17: warning: cast from 'int (*)(struct bpf_map *, void *, void *, u64)' (aka 'int (*)(struct bpf_map *, void *, void *, unsigned long long)') to 'u64 (*)(u64, u64, u64, u64, u64)' (aka 'unsigned long long (*)(unsigned long long, unsigned long long, unsigned long long, unsigned long long, unsigned long long)') converts to incompatible function type [-Wcast-function-type-strict] 6573 | insn->imm = BPF_CAST_CALL(ops->map_update_elem) - | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/filter.h:323:4: note: expanded from macro 'BPF_CAST_CALL' 323 | ((u64 (*)(u64, u64, u64, u64, u64))(x)) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf/verifier.c:6577:17: warning: cast from 'int (*)(struct bpf_map *, void *)' to 'u64 (*)(u64, u64, u64, u64, u64)' (aka 'unsigned long long (*)(unsigned long long, unsigned long long, unsigned long long, unsigned long long, unsigned long long)') converts to incompatible function type [-Wcast-function-type-strict] 6577 | insn->imm = BPF_CAST_CALL(ops->map_delete_elem) - | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/filter.h:323:4: note: expanded from macro 'BPF_CAST_CALL' 323 | ((u64 (*)(u64, u64, u64, u64, u64))(x)) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 4 warnings generated. >> kernel/bpf/verifier.o: warning: objtool: do_check()+0x2bd2: can't find switch jump table -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] irqchip/gic-v3-its: Don't enable interrupts in its_irq_set_vcpu_affinity()
by Yuntao Liu 12 Feb '25

12 Feb '25

From: Tomas Krcka <krckatom(a)amazon.de> stable inclusion from stable-v6.6.74 commit 6c84ff2e788fce0099ee3e71a3ed258b1ca1a223 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBL2TI CVE: CVE-2024-57949 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 35cb2c6ce7da545f3b5cb1e6473ad7c3a6f08310 upstream. The following call-chain leads to enabling interrupts in a nested interrupt disabled section: irq_set_vcpu_affinity() irq_get_desc_lock() raw_spin_lock_irqsave() <--- Disable interrupts its_irq_set_vcpu_affinity() guard(raw_spinlock_irq) <--- Enables interrupts when leaving the guard() irq_put_desc_unlock() <--- Warns because interrupts are enabled This was broken in commit b97e8a2f7130, which replaced the original raw_spin_[un]lock() pair with guard(raw_spinlock_irq). Fix the issue by using guard(raw_spinlock). [ tglx: Massaged change log ] Fixes: b97e8a2f7130 ("irqchip/gic-v3-its: Fix potential race condition in its_vlpi_prop_update()") Signed-off-by: Tomas Krcka <krckatom(a)amazon.de> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Reviewed-by: Marc Zyngier <maz(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/all/20241230150825.62894-1-krckatom@amazon.de Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- drivers/irqchip/irq-gic-v3-its.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index 256d53cd5d6b..2a6ce3996b6f 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -2287,7 +2287,7 @@ static int its_irq_set_vcpu_affinity(struct irq_data *d, void *vcpu_info) if (!is_v4(its_dev->its)) return -EINVAL; - guard(raw_spinlock_irq)(&its_dev->event_map.vlpi_lock); + guard(raw_spinlock)(&its_dev->event_map.vlpi_lock); /* Unmap request? */ if (!info) -- 2.34.1

2 1