- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 1355/1355] include/linux/share_pool.h:150:26: sparse: sparse: incorrect type in return expression (different address spaces)
by kernel test robot 28 Dec '24

28 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 773f731853f1368508a0b112047bd9b5a4bb9a5e commit: 4a280fac30d27ae2aff096f9f99aa12d50f83426 [1355/1355] ascend: share_pool: support share pool features for ascend platform config: arm64-randconfig-r133-20241227 (https://download.01.org/0day-ci/archive/20241228/202412281933.AtwopaHj-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20241228/202412281933.AtwopaHj-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412281933.AtwopaHj-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/gup.c: note: in included file: >> include/linux/share_pool.h:150:26: sparse: sparse: incorrect type in return expression (different address spaces) @@ expected struct task_struct * @@ got struct task_struct [noderef] __rcu *owner @@ include/linux/share_pool.h:150:26: sparse: expected struct task_struct * include/linux/share_pool.h:150:26: sparse: got struct task_struct [noderef] __rcu *owner mm/gup.c:1769:47: sparse: sparse: self-comparison always evaluates to false mm/gup.c:1794:47: sparse: sparse: self-comparison always evaluates to false mm/gup.c:1830:6: warning: no previous prototype for 'gup_fast_permitted' [-Wmissing-prototypes] 1830 | bool gup_fast_permitted(unsigned long start, int nr_pages, int write) | ^~~~~~~~~~~~~~~~~~ vim +150 include/linux/share_pool.h 2facb5901ceebe Ding Tianhong 2021-10-30 146 2facb5901ceebe Ding Tianhong 2021-10-30 147 static inline struct task_struct *sp_get_task(struct mm_struct *mm) 2facb5901ceebe Ding Tianhong 2021-10-30 148 { 2facb5901ceebe Ding Tianhong 2021-10-30 149 if (enable_ascend_share_pool) 2facb5901ceebe Ding Tianhong 2021-10-30 @150 return mm->owner; 2facb5901ceebe Ding Tianhong 2021-10-30 151 else 2facb5901ceebe Ding Tianhong 2021-10-30 152 return current; 2facb5901ceebe Ding Tianhong 2021-10-30 153 } 2facb5901ceebe Ding Tianhong 2021-10-30 154 :::::: The code at line 150 was first introduced by commit :::::: 2facb5901ceebe6736c0d192ca50be5d26c70ad9 ascend: vmalloc: export new function for share pool :::::: TO: Ding Tianhong <dingtianhong(a)huawei.com> :::::: CC: Yang Yingliang <yangyingliang(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2601/2601] net/smc/smc_core.c:770:6: sparse: sparse: symbol '__smcr_link_clear' was not declared. Should it be static?
by kernel test robot 28 Dec '24

28 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 053a6b6f8e4c86200cdb20bc80c063c3bb119859 commit: 7dad816cb1f8841fda526c0978c10a94793f1178 [2601/2601] anolis: net/smc: Resolve the race between SMC-R link access and clear config: x86_64-randconfig-121-20241228 (https://download.01.org/0day-ci/archive/20241228/202412281741.d8yDMbp6-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241228/202412281741.d8yDMbp6-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412281741.d8yDMbp6-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> net/smc/smc_core.c:770:6: sparse: sparse: symbol '__smcr_link_clear' was not declared. Should it be static? vim +/__smcr_link_clear +770 net/smc/smc_core.c 769 > 770 void __smcr_link_clear(struct smc_link *lnk) 771 { 772 smc_wr_free_link_mem(lnk); 773 smc_lgr_put(lnk->lgr); /* lgr_hold in smcr_link_init() */ 774 memset(lnk, 0, sizeof(struct smc_link)); 775 lnk->state = SMC_LNK_UNUSED; 776 } 777 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2589/2589] drivers/block/nbd.o: warning: objtool: nbd_alloc_and_init_config()+0x35: unreachable instruction
by kernel test robot 28 Dec '24

28 Dec '24

Hi Yu, FYI, the error/warning was bisected to this commit, please ignore it if it's irrelevant. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 053a6b6f8e4c86200cdb20bc80c063c3bb119859 commit: d2cdad29e00e63ab3a32f5f0d90acc757ff5653a [2589/2589] nbd: fold nbd config initialization into nbd_alloc_config() config: x86_64-buildonly-randconfig-002-20241218 (https://download.01.org/0day-ci/archive/20241228/202412281725.LnOuPqEI-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241228/202412281725.LnOuPqEI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412281725.LnOuPqEI-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/block/nbd.o: warning: objtool: nbd_alloc_and_init_config()+0x35: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] hwmon: (nct6775-core) Fix overflows seen when writing limit attributes
by Li Huafei 28 Dec '24

28 Dec '24

From: Pei Xiao <xiaopei01(a)kylinos.cn> stable inclusion from stable-v6.6.64 commit 685c10269c41d23d7a2b85d3fd6b6345390c8746 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGY CVE: CVE-2024-53159 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 57ee12b6c514146c19b6a159013b48727a012960 ] DIV_ROUND_CLOSEST() after kstrtoul() results in an overflow if a large number such as 18446744073709551615 is provided by the user. Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations. Signed-off-by: Pei Xiao <xiaopei01(a)kylinos.cn> Fixes: c3963bc0a0cf ("hwmon: (nct6775) Split core and platform driver") Message-ID: <7d5084cea33f7c0fd0578c59adfff71f93de94d9.1731375425.git.xiaopei01(a)kylinos.cn> Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/hwmon/nct6775-core.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/hwmon/nct6775-core.c b/drivers/hwmon/nct6775-core.c index 8da7aa1614d7..16f6b7ba2a5d 100644 --- a/drivers/hwmon/nct6775-core.c +++ b/drivers/hwmon/nct6775-core.c @@ -2878,8 +2878,7 @@ store_target_temp(struct device *dev, struct device_attribute *attr, if (err < 0) return err; - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, - data->target_temp_mask); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, data->target_temp_mask * 1000), 1000); mutex_lock(&data->update_lock); data->target_temp[nr] = val; @@ -2959,7 +2958,7 @@ store_temp_tolerance(struct device *dev, struct device_attribute *attr, return err; /* Limit tolerance as needed */ - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, data->tolerance_mask); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, data->tolerance_mask * 1000), 1000); mutex_lock(&data->update_lock); data->temp_tolerance[index][nr] = val; @@ -3085,7 +3084,7 @@ store_weight_temp(struct device *dev, struct device_attribute *attr, if (err < 0) return err; - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, 255); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, 255000), 1000); mutex_lock(&data->update_lock); data->weight_temp[index][nr] = val; -- 2.25.1

2 1

[PATCH OLK-6.6] firmware_loader: Fix possible resource leak in fw_log_firmware_info()
by dinglongwei 28 Dec '24

28 Dec '24

From: Gaosheng Cui <cuigaosheng1(a)huawei.com> stable inclusion from stable-v6.6.64 commit 789a72498d32f88d24371c10985aceb46397056c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAFY CVE: CVE-2024-53202 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- firmware_loader: Fix possible resource leak in fw_log_firmware_info() [ Upstream commit 369a9c046c2fdfe037f05b43b84c386bdbccc103 ] The alg instance should be released under the exception path, otherwise there may be resource leak here. To mitigate this, free the alg instance with crypto_free_shash when kmalloc fails. Fixes: 02fe26f25325 ("firmware_loader: Add debug message with checksum for FW file") Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> Reviewed-by: Amadeusz Sławiński <amadeuszx.slawinski(a)linux.intel.com> Reviewed-by: Russ Weight <russ.weight(a)linux.dev> Link: https://lore.kernel.org/r/20241016110335.3677924-1-cuigaosheng1@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- drivers/base/firmware_loader/main.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_loader/main.c index 0b18c6b46e65..f3133ba831c5 100644 --- a/drivers/base/firmware_loader/main.c +++ b/drivers/base/firmware_loader/main.c @@ -824,19 +824,18 @@ static void fw_log_firmware_info(const struct firmware *fw, const char *name, st shash->tfm = alg; if (crypto_shash_digest(shash, fw->data, fw->size, sha256buf) < 0) - goto out_shash; + goto out_free; for (int i = 0; i < SHA256_DIGEST_SIZE; i++) sprintf(&outbuf[i * 2], "%02x", sha256buf[i]); outbuf[SHA256_BLOCK_SIZE] = 0; dev_dbg(device, "Loaded FW: %s, sha256: %s\n", name, outbuf); -out_shash: - crypto_free_shash(alg); out_free: kfree(shash); kfree(outbuf); kfree(sha256buf); + crypto_free_shash(alg); } #else static void fw_log_firmware_info(const struct firmware *fw, const char *name, -- 2.22.0

2 1

[openeuler:openEuler-1.0-LTS 1355/1355] include/linux/kern_levels.h:5:25: warning: format '%p' expects argument of type 'void *', but argument 40 has type 'long unsigned int'
by kernel test robot 28 Dec '24

28 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 773f731853f1368508a0b112047bd9b5a4bb9a5e commit: 2d2fe6b40444bd8f84f674930ac5f98a6314702e [1355/1355] ascend: mm: add an owner for mm_struct config: arm64-randconfig-r133-20241227 (https://download.01.org/0day-ci/archive/20241228/202412281637.7HUx9YuE-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20241228/202412281637.7HUx9YuE-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412281637.7HUx9YuE-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t In file included from include/linux/printk.h:7, from include/linux/kernel.h:14, from mm/debug.c:9: mm/debug.c: In function 'dump_mm': >> include/linux/kern_levels.h:5:25: warning: format '%p' expects argument of type 'void *', but argument 40 has type 'long unsigned int' [-Wformat=] 5 | #define KERN_SOH "\001" /* ASCII Start Of Header */ | ^~~~~~ include/linux/kern_levels.h:8:25: note: in expansion of macro 'KERN_SOH' 8 | #define KERN_EMERG KERN_SOH "0" /* system is unusable */ | ^~~~~~~~ include/linux/printk.h:342:16: note: in expansion of macro 'KERN_EMERG' 342 | printk(KERN_EMERG pr_fmt(fmt), ##__VA_ARGS__) | ^~~~~~~~~~ mm/debug.c:117:9: note: in expansion of macro 'pr_emerg' 117 | pr_emerg("mm %px mmap %px seqnum %llu task_size %lu\n" | ^~~~~~~~ >> include/linux/kern_levels.h:5:25: warning: format '%lu' expects argument of type 'long unsigned int', but argument 42 has type 'int' [-Wformat=] 5 | #define KERN_SOH "\001" /* ASCII Start Of Header */ | ^~~~~~ include/linux/kern_levels.h:8:25: note: in expansion of macro 'KERN_SOH' 8 | #define KERN_EMERG KERN_SOH "0" /* system is unusable */ | ^~~~~~~~ include/linux/printk.h:342:16: note: in expansion of macro 'KERN_EMERG' 342 | printk(KERN_EMERG pr_fmt(fmt), ##__VA_ARGS__) | ^~~~~~~~~~ mm/debug.c:117:9: note: in expansion of macro 'pr_emerg' 117 | pr_emerg("mm %px mmap %px seqnum %llu task_size %lu\n" | ^~~~~~~~ include/linux/kern_levels.h:5:25: warning: format '%d' expects argument of type 'int', but argument 44 has type 'long unsigned int' [-Wformat=] 5 | #define KERN_SOH "\001" /* ASCII Start Of Header */ | ^~~~~~ include/linux/kern_levels.h:8:25: note: in expansion of macro 'KERN_SOH' 8 | #define KERN_EMERG KERN_SOH "0" /* system is unusable */ | ^~~~~~~~ include/linux/printk.h:342:16: note: in expansion of macro 'KERN_EMERG' 342 | printk(KERN_EMERG pr_fmt(fmt), ##__VA_ARGS__) | ^~~~~~~~~~ mm/debug.c:117:9: note: in expansion of macro 'pr_emerg' 117 | pr_emerg("mm %px mmap %px seqnum %llu task_size %lu\n" | ^~~~~~~~ include/linux/kern_levels.h:5:25: warning: format '%lx' expects argument of type 'long unsigned int', but argument 45 has type 'const long unsigned int *' [-Wformat=] 5 | #define KERN_SOH "\001" /* ASCII Start Of Header */ | ^~~~~~ include/linux/kern_levels.h:8:25: note: in expansion of macro 'KERN_SOH' 8 | #define KERN_EMERG KERN_SOH "0" /* system is unusable */ | ^~~~~~~~ include/linux/printk.h:342:16: note: in expansion of macro 'KERN_EMERG' 342 | printk(KERN_EMERG pr_fmt(fmt), ##__VA_ARGS__) | ^~~~~~~~~~ mm/debug.c:117:9: note: in expansion of macro 'pr_emerg' 117 | pr_emerg("mm %px mmap %px seqnum %llu task_size %lu\n" | ^~~~~~~~ include/linux/kern_levels.h:5:25: warning: format '%p' expects a matching 'void *' argument [-Wformat=] 5 | #define KERN_SOH "\001" /* ASCII Start Of Header */ | ^~~~~~ include/linux/kern_levels.h:8:25: note: in expansion of macro 'KERN_SOH' 8 | #define KERN_EMERG KERN_SOH "0" /* system is unusable */ | ^~~~~~~~ include/linux/printk.h:342:16: note: in expansion of macro 'KERN_EMERG' 342 | printk(KERN_EMERG pr_fmt(fmt), ##__VA_ARGS__) | ^~~~~~~~~~ mm/debug.c:117:9: note: in expansion of macro 'pr_emerg' 117 | pr_emerg("mm %px mmap %px seqnum %llu task_size %lu\n" | ^~~~~~~~ vim +5 include/linux/kern_levels.h 314ba3520e513a Joe Perches 2012-07-30 4 04d2c8c83d0e3a Joe Perches 2012-07-30 @5 #define KERN_SOH "\001" /* ASCII Start Of Header */ 04d2c8c83d0e3a Joe Perches 2012-07-30 6 #define KERN_SOH_ASCII '\001' 04d2c8c83d0e3a Joe Perches 2012-07-30 7 :::::: The code at line 5 was first introduced by commit :::::: 04d2c8c83d0e3ac5f78aeede51babb3236200112 printk: convert the format for KERN_<LEVEL> to a 2 byte pattern :::::: TO: Joe Perches <joe(a)perches.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] ocfs2: free inode when ocfs2_get_init_inode() fails
by Jinjie Ruan 28 Dec '24

28 Dec '24

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> stable inclusion from stable-v6.6.66 commit a84d507d3290aca249b44ae992af9e10590cc5f6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAN4 CVE: CVE-2024-56630 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 965b5dd1894f4525f38c1b5f99b0106a07dbb5db ] syzbot is reporting busy inodes after unmount, for commit 9c89fe0af826 ("ocfs2: Handle error from dquot_initialize()") forgot to call iput() when new_inode() succeeded and dquot_initialize() failed. Link: https://lkml.kernel.org/r/e68c0224-b7c6-4784-b4fa-a9fc8c675525@I-love.SAKUR… Fixes: 9c89fe0af826 ("ocfs2: Handle error from dquot_initialize()") Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Reported-by: syzbot+0af00f6a2cba2058b5db(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0af00f6a2cba2058b5db Tested-by: syzbot+0af00f6a2cba2058b5db(a)syzkaller.appspotmail.com Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- fs/ocfs2/namei.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c index 21b3d5b9be60..4e6d8a3f727d 100644 --- a/fs/ocfs2/namei.c +++ b/fs/ocfs2/namei.c @@ -200,8 +200,10 @@ static struct inode *ocfs2_get_init_inode(struct inode *dir, umode_t mode) mode = mode_strip_sgid(&nop_mnt_idmap, dir, mode); inode_init_owner(&nop_mnt_idmap, inode, dir, mode); status = dquot_initialize(inode); - if (status) + if (status) { + iput(inode); return ERR_PTR(status); + } return inode; } -- 2.34.1

2 1

[PATCH OLK-5.10] ocfs2: free inode when ocfs2_get_init_inode() fails
by Jinjie Ruan 28 Dec '24

28 Dec '24

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> stable inclusion from stable-v5.10.231 commit 9c19ea59965ebb482e227532f7bbb01792fb028c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAN4 CVE: CVE-2024-56630 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit 965b5dd1894f4525f38c1b5f99b0106a07dbb5db ] syzbot is reporting busy inodes after unmount, for commit 9c89fe0af826 ("ocfs2: Handle error from dquot_initialize()") forgot to call iput() when new_inode() succeeded and dquot_initialize() failed. Link: https://lkml.kernel.org/r/e68c0224-b7c6-4784-b4fa-a9fc8c675525@I-love.SAKUR… Fixes: 9c89fe0af826 ("ocfs2: Handle error from dquot_initialize()") Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Reported-by: syzbot+0af00f6a2cba2058b5db(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0af00f6a2cba2058b5db Tested-by: syzbot+0af00f6a2cba2058b5db(a)syzkaller.appspotmail.com Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- fs/ocfs2/namei.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c index 5c98813b3dca..a1d7f62975bd 100644 --- a/fs/ocfs2/namei.c +++ b/fs/ocfs2/namei.c @@ -201,8 +201,10 @@ static struct inode *ocfs2_get_init_inode(struct inode *dir, umode_t mode) mode = mode_strip_sgid(dir, mode); inode_init_owner(inode, dir, mode); status = dquot_initialize(inode); - if (status) + if (status) { + iput(inode); return ERR_PTR(status); + } return inode; } -- 2.34.1

2 1

[OLK-5.10] ocfs2: free inode when ocfs2_get_init_inode() fails
by Jinjie Ruan 28 Dec '24

28 Dec '24

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> stable inclusion from stable-v5.10.231 commit 9c19ea59965ebb482e227532f7bbb01792fb028c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAN4 CVE: CVE-2024-56630 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit 965b5dd1894f4525f38c1b5f99b0106a07dbb5db ] syzbot is reporting busy inodes after unmount, for commit 9c89fe0af826 ("ocfs2: Handle error from dquot_initialize()") forgot to call iput() when new_inode() succeeded and dquot_initialize() failed. Link: https://lkml.kernel.org/r/e68c0224-b7c6-4784-b4fa-a9fc8c675525@I-love.SAKUR… Fixes: 9c89fe0af826 ("ocfs2: Handle error from dquot_initialize()") Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Reported-by: syzbot+0af00f6a2cba2058b5db(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0af00f6a2cba2058b5db Tested-by: syzbot+0af00f6a2cba2058b5db(a)syzkaller.appspotmail.com Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- fs/ocfs2/namei.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c index 5c98813b3dca..a1d7f62975bd 100644 --- a/fs/ocfs2/namei.c +++ b/fs/ocfs2/namei.c @@ -201,8 +201,10 @@ static struct inode *ocfs2_get_init_inode(struct inode *dir, umode_t mode) mode = mode_strip_sgid(dir, mode); inode_init_owner(inode, dir, mode); status = dquot_initialize(inode); - if (status) + if (status) { + iput(inode); return ERR_PTR(status); + } return inode; } -- 2.34.1

1 0

[OLK-6.6] ocfs2: free inode when ocfs2_get_init_inode() fails
by Jinjie Ruan 28 Dec '24

28 Dec '24

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> stable inclusion from stable-v6.6.66 commit a84d507d3290aca249b44ae992af9e10590cc5f6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAN4 CVE: CVE-2024-56630 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 965b5dd1894f4525f38c1b5f99b0106a07dbb5db ] syzbot is reporting busy inodes after unmount, for commit 9c89fe0af826 ("ocfs2: Handle error from dquot_initialize()") forgot to call iput() when new_inode() succeeded and dquot_initialize() failed. Link: https://lkml.kernel.org/r/e68c0224-b7c6-4784-b4fa-a9fc8c675525@I-love.SAKUR… Fixes: 9c89fe0af826 ("ocfs2: Handle error from dquot_initialize()") Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Reported-by: syzbot+0af00f6a2cba2058b5db(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0af00f6a2cba2058b5db Tested-by: syzbot+0af00f6a2cba2058b5db(a)syzkaller.appspotmail.com Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- fs/ocfs2/namei.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c index 21b3d5b9be60..4e6d8a3f727d 100644 --- a/fs/ocfs2/namei.c +++ b/fs/ocfs2/namei.c @@ -200,8 +200,10 @@ static struct inode *ocfs2_get_init_inode(struct inode *dir, umode_t mode) mode = mode_strip_sgid(&nop_mnt_idmap, dir, mode); inode_init_owner(&nop_mnt_idmap, inode, dir, mode); status = dquot_initialize(inode); - if (status) + if (status) { + iput(inode); return ERR_PTR(status); + } return inode; } -- 2.34.1

1 0