- Kernel - mailweb.openeuler.org

[openeuler:OLK-5.10 3022/3022] drivers/edac/amd64_edac.c:1113:59: warning: operator '>>' has lower precedence than '-'; '-' will be evaluated first
by kernel test robot 08 Jul '25

08 Jul '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 42f2d0a01a04fb2be4ff38f644059278b52c13b0 commit: 7e65f9c59b205c1c185e60023756dd02b6b08f80 [3022/3022] EDAC/amd64: Fix the calculation of cs id for Hygon family 18h model 4h config: x86_64-rhel-9.4-rust (https://download.01.org/0day-ci/archive/20250708/202507080616.PEORXKcZ-lkp@…) compiler: clang version 21.0.0git (https://github.com/llvm/llvm-project 01c97b4953e87ae455bd4c41e3de3f0f0f29c61c) rustc: rustc 1.58.0 (02072b482 2022-01-11) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250708/202507080616.PEORXKcZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507080616.PEORXKcZ-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/edac/amd64_edac.c:1113:59: warning: operator '>>' has lower precedence than '-'; '-' will be evaluated first [-Wshift-op-parentheses] 1113 | cs_id |= ((cs_fabric_id & die_id_mask) >> die_id_shift - 4) << die_id_bit; | ~~ ~~~~~~~~~~~~~^~~ drivers/edac/amd64_edac.c:1113:59: note: place parentheses around the '-' expression to silence this warning 1113 | cs_id |= ((cs_fabric_id & die_id_mask) >> die_id_shift - 4) << die_id_bit; | ^ | ( ) 1 warning generated. vim +1113 drivers/edac/amd64_edac.c 962 963 static int hygon_umc_normaddr_to_sysaddr(u64 norm_addr, u16 nid, u8 umc, u64 *sys_addr) 964 { 965 u64 dram_base_addr, dram_limit_addr, dram_hole_base; 966 /* We start from the normalized address */ 967 u64 ret_addr = norm_addr; 968 969 u32 tmp; 970 971 u8 die_id_shift, die_id_mask, socket_id_shift, socket_id_mask; 972 u8 intlv_num_dies, intlv_num_chan, intlv_num_sockets; 973 u8 intlv_addr_sel, intlv_addr_bit; 974 u8 num_intlv_bits, hashed_bit; 975 u8 lgcy_mmio_hole_en, base = 0; 976 u8 cs_mask, cs_id = 0; 977 bool hash_enabled = false; 978 979 /* Read DramOffset, check if base 1 is used. */ 980 if (amd_df_indirect_read(nid, 0, 0x214, umc, &tmp)) 981 goto out_err; 982 983 /* Remove HiAddrOffset from normalized address, if enabled: */ 984 if (tmp & BIT(0)) { 985 u64 hi_addr_offset = (tmp & GENMASK_ULL(31, 20)) << 8; 986 987 if (norm_addr >= hi_addr_offset) { 988 ret_addr -= hi_addr_offset; 989 base = 1; 990 } 991 } 992 993 /* Read D18F0x110 (DramBaseAddress). */ 994 if (amd_df_indirect_read(nid, 0, 0x110 + (8 * base), umc, &tmp)) 995 goto out_err; 996 997 /* Check if address range is valid. */ 998 if (!(tmp & BIT(0))) { 999 pr_err("%s: Invalid DramBaseAddress range: 0x%x.\n", 1000 __func__, tmp); 1001 goto out_err; 1002 } 1003 1004 intlv_num_sockets = (tmp >> 2) & 0x3; 1005 lgcy_mmio_hole_en = tmp & BIT(1); 1006 intlv_num_chan = (tmp >> 4) & 0xF; 1007 intlv_addr_sel = (tmp >> 8) & 0x7; 1008 dram_base_addr = (tmp & GENMASK_ULL(31, 12)) << 16; 1009 1010 /* {0, 1, 2, 3} map to address bits {8, 9, 10, 11} respectively */ 1011 if (intlv_addr_sel > 3) { 1012 pr_err("%s: Invalid interleave address select %d.\n", 1013 __func__, intlv_addr_sel); 1014 goto out_err; 1015 } 1016 1017 /* Read D18F0x114 (DramLimitAddress). */ 1018 if (amd_df_indirect_read(nid, 0, 0x114 + (8 * base), umc, &tmp)) 1019 goto out_err; 1020 1021 intlv_num_dies = (tmp >> 10) & 0x3; 1022 dram_limit_addr = ((tmp & GENMASK_ULL(31, 12)) << 16) | GENMASK_ULL(27, 0); 1023 1024 intlv_addr_bit = intlv_addr_sel + 8; 1025 1026 /* Re-use intlv_num_chan by setting it equal to log2(#channels) */ 1027 switch (intlv_num_chan) { 1028 case 0: 1029 intlv_num_chan = 0; 1030 break; 1031 case 1: 1032 intlv_num_chan = 1; 1033 break; 1034 case 3: 1035 intlv_num_chan = 2; 1036 break; 1037 case 5: 1038 intlv_num_chan = 3; 1039 break; 1040 case 7: 1041 intlv_num_chan = 4; 1042 break; 1043 1044 case 8: 1045 intlv_num_chan = 1; 1046 hash_enabled = true; 1047 break; 1048 default: 1049 if (boot_cpu_data.x86_model == 0x4 && 1050 intlv_num_chan == 2) 1051 break; 1052 pr_err("%s: Invalid number of interleaved channels %d.\n", 1053 __func__, intlv_num_chan); 1054 goto out_err; 1055 } 1056 1057 num_intlv_bits = intlv_num_chan; 1058 1059 if (intlv_num_dies > 2) { 1060 pr_err("%s: Invalid number of interleaved nodes/dies %d.\n", 1061 __func__, intlv_num_dies); 1062 goto out_err; 1063 } 1064 1065 num_intlv_bits += intlv_num_dies; 1066 1067 /* Add a bit if sockets are interleaved. */ 1068 num_intlv_bits += intlv_num_sockets; 1069 1070 /* Assert num_intlv_bits in the correct range. */ 1071 if (num_intlv_bits > 7) { 1072 pr_err("%s: Invalid interleave bits %d.\n", 1073 __func__, num_intlv_bits); 1074 goto out_err; 1075 } 1076 1077 if (num_intlv_bits > 0) { 1078 u64 temp_addr_x, temp_addr_i, temp_addr_y; 1079 u8 die_id_bit, sock_id_bit, cs_fabric_id; 1080 1081 /* 1082 * Read FabricBlockInstanceInformation3_CS[BlockFabricID]. 1083 * This is the fabric id for this coherent slave. Use 1084 * umc/channel# as instance id of the coherent slave 1085 * for FICAA. 1086 */ 1087 if (amd_df_indirect_read(nid, 0, 0x50, umc, &tmp)) 1088 goto out_err; 1089 1090 cs_fabric_id = (tmp >> 8) & 0x7FF; 1091 die_id_bit = 0; 1092 1093 /* If interleaved over more than 1 channel: */ 1094 if (intlv_num_chan) { 1095 die_id_bit = intlv_num_chan; 1096 cs_mask = (1 << die_id_bit) - 1; 1097 cs_id = cs_fabric_id & cs_mask; 1098 } 1099 1100 sock_id_bit = die_id_bit; 1101 1102 /* Read D18F1x208 (SystemFabricIdMask). */ 1103 if (intlv_num_dies || intlv_num_sockets) 1104 if (amd_df_indirect_read(nid, 1, 0x208, umc, &tmp)) 1105 goto out_err; 1106 1107 /* If interleaved over more than 1 die. */ 1108 if (intlv_num_dies) { 1109 sock_id_bit = die_id_bit + intlv_num_dies; 1110 die_id_shift = (tmp >> 12) & 0xF; 1111 die_id_mask = tmp & 0x7FF; 1112 > 1113 cs_id |= ((cs_fabric_id & die_id_mask) >> die_id_shift - 4) << die_id_bit; 1114 } 1115 1116 /* If interleaved over more than 1 socket. */ 1117 if (intlv_num_sockets) { 1118 socket_id_shift = (tmp >> 28) & 0xF; 1119 socket_id_mask = (tmp >> 16) & 0x7FF; 1120 1121 cs_id |= ((cs_fabric_id & socket_id_mask) >> socket_id_shift) << sock_id_bit; 1122 } 1123 1124 /* 1125 * The pre-interleaved address consists of XXXXXXIIIYYYYY 1126 * where III is the ID for this CS, and XXXXXXYYYYY are the 1127 * address bits from the post-interleaved address. 1128 * "num_intlv_bits" has been calculated to tell us how many "I" 1129 * bits there are. "intlv_addr_bit" tells us how many "Y" bits 1130 * there are (where "I" starts). 1131 */ 1132 temp_addr_y = ret_addr & GENMASK_ULL(intlv_addr_bit-1, 0); 1133 temp_addr_i = (cs_id << intlv_addr_bit); 1134 temp_addr_x = (ret_addr & GENMASK_ULL(63, intlv_addr_bit)) << num_intlv_bits; 1135 ret_addr = temp_addr_x | temp_addr_i | temp_addr_y; 1136 } 1137 1138 /* Add dram base address */ 1139 ret_addr += dram_base_addr; 1140 1141 /* If legacy MMIO hole enabled */ 1142 if (lgcy_mmio_hole_en) { 1143 if (amd_df_indirect_read(nid, 0, 0x104, umc, &tmp)) 1144 goto out_err; 1145 1146 dram_hole_base = tmp & GENMASK(31, 24); 1147 if (ret_addr >= dram_hole_base) 1148 ret_addr += (BIT_ULL(32) - dram_hole_base); 1149 } 1150 1151 if (hash_enabled) { 1152 /* Save some parentheses and grab ls-bit at the end. */ 1153 hashed_bit = (ret_addr >> 12) ^ 1154 (ret_addr >> 18) ^ 1155 (ret_addr >> 21) ^ 1156 (ret_addr >> 30) ^ 1157 cs_id; 1158 1159 hashed_bit &= BIT(0); 1160 1161 if (hashed_bit != ((ret_addr >> intlv_addr_bit) & BIT(0))) 1162 ret_addr ^= BIT(intlv_addr_bit); 1163 } 1164 1165 /* Is calculated system address is above DRAM limit address? */ 1166 if (ret_addr > dram_limit_addr) 1167 goto out_err; 1168 1169 *sys_addr = ret_addr; 1170 return 0; 1171 1172 out_err: 1173 return -EINVAL; 1174 } 1175 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 1/3] uapi/auxvec: Define AT_HWCAP3 and AT_HWCAP4 aux vector, entries
by Qi Xi 07 Jul '25

07 Jul '25

From: Peter Bergner <bergner(a)linux.ibm.com> mainline inclusion from mainline-v6.9-rc1 commit 3281366a8e79a512956382885091565db1036b64 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IC76OZ CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- Changes from v1: - Add Acked-by lines. The powerpc toolchain keeps a copy of the HWCAP bit masks in our TCB for fast access by the __builtin_cpu_supports built-in function. The TCB space for the HWCAP entries - which are created in pairs - is an ABI extension, so waiting to create the space for HWCAP3 and HWCAP4 until we need them is problematical. Define AT_HWCAP3 and AT_HWCAP4 in the generic uapi header so they can be used in glibc to reserve space in the powerpc TCB for their future use. I scanned through the Linux and GLIBC source codes looking for unused AT_* values and 29 and 30 did not seem to be used, so they are what I went with. This has received Acked-by's from both GLIBC and Linux kernel developers and no reservations or Nacks from anyone. Arnd, we seem to have consensus on the patch below. Is this something you could take and apply to your tree? Peter Signed-off-by: Peter Bergner <bergner(a)linux.ibm.com> Acked-by: Adhemerval Zanella <adhemerval.zanella(a)linaro.org> Acked-by: Nicholas Piggin <npiggin(a)gmail.com> Acked-by: Szabolcs Nagy <szabolcs.nagy(a)arm.com> Acked-by: Arnd Bergmann <arnd(a)arndb.de> Commit: Michael Ellerman <mpe(a)ellerman.id.au> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/a406b535-dc55-4856-8ae9-5a063644a1af@linux.ibm.com Signed-off-by: Hongye Lin <linhongye(a)h-partners.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- include/uapi/linux/auxvec.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/include/uapi/linux/auxvec.h b/include/uapi/linux/auxvec.h index c7e502bf5a6f..f8e7677e48c4 100644 --- a/include/uapi/linux/auxvec.h +++ b/include/uapi/linux/auxvec.h @@ -30,6 +30,8 @@ * differ from AT_PLATFORM. */ #define AT_RANDOM 25 /* address of 16 random bytes */ #define AT_HWCAP2 26 /* extension of AT_HWCAP */ +#define AT_HWCAP3 29 /* extension of AT_HWCAP */ +#define AT_HWCAP4 30 /* extension of AT_HWCAP */ #define AT_EXECFN 31 /* filename of program */ -- 2.33.0

2 3

[PATCH openEuler-1.0-LTS] dm raid: fix address sanitizer warning in raid_status
by Zhang Qilong 07 Jul '25

07 Jul '25

From: Mikulas Patocka <mpatocka(a)redhat.com> stable inclusion from stable-v4.19.256 commit b856ce5f4b55f752144baf17e9d5c415072652c5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAMW CVE: CVE-2022-50084 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- dm raid: fix address sanitizer warning in raid_status commit 1fbeea217d8f297fe0e0956a1516d14ba97d0396 upstream. There is this warning when using a kernel with the address sanitizer and running this testsuite: https://gitlab.com/cki-project/kernel-tests/-/tree/main/storage/swraid/scsi… ================================================================== BUG: KASAN: slab-out-of-bounds in raid_status+0x1747/0x2820 [dm_raid] Read of size 4 at addr ffff888079d2c7e8 by task lvcreate/13319 CPU: 0 PID: 13319 Comm: lvcreate Not tainted 5.18.0-0.rc3.<snip> #1 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 Call Trace: <TASK> dump_stack_lvl+0x6a/0x9c print_address_description.constprop.0+0x1f/0x1e0 print_report.cold+0x55/0x244 kasan_report+0xc9/0x100 raid_status+0x1747/0x2820 [dm_raid] dm_ima_measure_on_table_load+0x4b8/0xca0 [dm_mod] table_load+0x35c/0x630 [dm_mod] ctl_ioctl+0x411/0x630 [dm_mod] dm_ctl_ioctl+0xa/0x10 [dm_mod] __x64_sys_ioctl+0x12a/0x1a0 do_syscall_64+0x5b/0x80 The warning is caused by reading conf->max_nr_stripes in raid_status. The code in raid_status reads mddev->private, casts it to struct r5conf and reads the entry max_nr_stripes. However, if we have different raid type than 4/5/6, mddev->private doesn't point to struct r5conf; it may point to struct r0conf, struct r1conf, struct r10conf or struct mpconf. If we cast a pointer to one of these structs to struct r5conf, we will be reading invalid memory and KASAN warns about it. Fix this bug by reading struct r5conf only if raid type is 4, 5 or 6. Cc: stable(a)vger.kernel.org Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/md/dm-raid.c [just context conflicts] Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- drivers/md/dm-raid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c index 49209dae7fdd..377a6c8205ba 100644 --- a/drivers/md/dm-raid.c +++ b/drivers/md/dm-raid.c @@ -3531,11 +3531,11 @@ static const char *__get_dev_name(struct dm_dev *dev) static void raid_status(struct dm_target *ti, status_type_t type, unsigned int status_flags, char *result, unsigned int maxlen) { struct raid_set *rs = ti->private; struct mddev *mddev = &rs->md; - struct r5conf *conf = mddev->private; + struct r5conf *conf = rs_is_raid456(rs) ? mddev->private : NULL; int i, max_nr_stripes = conf ? conf->max_nr_stripes : 0; unsigned long recovery; unsigned int raid_param_cnt = 1; /* at least 1 for chunksize */ unsigned int sz = 0; unsigned int rebuild_disks; -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] dm raid: fix address sanitizer warning in raid_status
by Zhang Qilong 07 Jul '25

07 Jul '25

From: Mikulas Patocka <mpatocka(a)redhat.com> stable inclusion from stable-v4.19.256 commit b856ce5f4b55f752144baf17e9d5c415072652c5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAMW CVE: CVE-2022-50084 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- dm raid: fix address sanitizer warning in raid_status commit 1fbeea217d8f297fe0e0956a1516d14ba97d0396 upstream. There is this warning when using a kernel with the address sanitizer and running this testsuite: https://gitlab.com/cki-project/kernel-tests/-/tree/main/storage/swraid/scsi… ================================================================== BUG: KASAN: slab-out-of-bounds in raid_status+0x1747/0x2820 [dm_raid] Read of size 4 at addr ffff888079d2c7e8 by task lvcreate/13319 CPU: 0 PID: 13319 Comm: lvcreate Not tainted 5.18.0-0.rc3.<snip> #1 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 Call Trace: <TASK> dump_stack_lvl+0x6a/0x9c print_address_description.constprop.0+0x1f/0x1e0 print_report.cold+0x55/0x244 kasan_report+0xc9/0x100 raid_status+0x1747/0x2820 [dm_raid] dm_ima_measure_on_table_load+0x4b8/0xca0 [dm_mod] table_load+0x35c/0x630 [dm_mod] ctl_ioctl+0x411/0x630 [dm_mod] dm_ctl_ioctl+0xa/0x10 [dm_mod] __x64_sys_ioctl+0x12a/0x1a0 do_syscall_64+0x5b/0x80 The warning is caused by reading conf->max_nr_stripes in raid_status. The code in raid_status reads mddev->private, casts it to struct r5conf and reads the entry max_nr_stripes. However, if we have different raid type than 4/5/6, mddev->private doesn't point to struct r5conf; it may point to struct r0conf, struct r1conf, struct r10conf or struct mpconf. If we cast a pointer to one of these structs to struct r5conf, we will be reading invalid memory and KASAN warns about it. Fix this bug by reading struct r5conf only if raid type is 4, 5 or 6. Cc: stable(a)vger.kernel.org Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/md/dm-raid.c [just context conflicts] Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- drivers/md/dm-raid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c index 49209dae7fdd..377a6c8205ba 100644 --- a/drivers/md/dm-raid.c +++ b/drivers/md/dm-raid.c @@ -3531,11 +3531,11 @@ static const char *__get_dev_name(struct dm_dev *dev) static void raid_status(struct dm_target *ti, status_type_t type, unsigned int status_flags, char *result, unsigned int maxlen) { struct raid_set *rs = ti->private; struct mddev *mddev = &rs->md; - struct r5conf *conf = mddev->private; + struct r5conf *conf = rs_is_raid456(rs) ? mddev->private : NULL; int i, max_nr_stripes = conf ? conf->max_nr_stripes : 0; unsigned long recovery; unsigned int raid_param_cnt = 1; /* at least 1 for chunksize */ unsigned int sz = 0; unsigned int rebuild_disks; -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] dm raid: fix address sanitizer warning in raid_status
by Zhang Qilong 07 Jul '25

07 Jul '25

From: Mikulas Patocka <mpatocka(a)redhat.com> mainline inclusion from mainline-v5.19-rc4 commit 49dba30638e091120256a9e89125340795f034dc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAMW CVE: CVE-2022-50084 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- dm raid: fix address sanitizer warning in raid_status commit 1fbeea217d8f297fe0e0956a1516d14ba97d0396 upstream. There is this warning when using a kernel with the address sanitizer and running this testsuite: https://gitlab.com/cki-project/kernel-tests/-/tree/main/storage/swraid/scsi… ================================================================== BUG: KASAN: slab-out-of-bounds in raid_status+0x1747/0x2820 [dm_raid] Read of size 4 at addr ffff888079d2c7e8 by task lvcreate/13319 CPU: 0 PID: 13319 Comm: lvcreate Not tainted 5.18.0-0.rc3.<snip> #1 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 Call Trace: <TASK> dump_stack_lvl+0x6a/0x9c print_address_description.constprop.0+0x1f/0x1e0 print_report.cold+0x55/0x244 kasan_report+0xc9/0x100 raid_status+0x1747/0x2820 [dm_raid] dm_ima_measure_on_table_load+0x4b8/0xca0 [dm_mod] table_load+0x35c/0x630 [dm_mod] ctl_ioctl+0x411/0x630 [dm_mod] dm_ctl_ioctl+0xa/0x10 [dm_mod] __x64_sys_ioctl+0x12a/0x1a0 do_syscall_64+0x5b/0x80 The warning is caused by reading conf->max_nr_stripes in raid_status. The code in raid_status reads mddev->private, casts it to struct r5conf and reads the entry max_nr_stripes. However, if we have different raid type than 4/5/6, mddev->private doesn't point to struct r5conf; it may point to struct r0conf, struct r1conf, struct r10conf or struct mpconf. If we cast a pointer to one of these structs to struct r5conf, we will be reading invalid memory and KASAN warns about it. Fix this bug by reading struct r5conf only if raid type is 4, 5 or 6. Cc: stable(a)vger.kernel.org Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/md/dm-raid.c [just context conflicts] Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- drivers/md/dm-raid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c index 9a5d65d2223b..d3dce6bcbec3 100644 --- a/drivers/md/dm-raid.c +++ b/drivers/md/dm-raid.c @@ -3531,11 +3531,11 @@ static const char *__get_dev_name(struct dm_dev *dev) static void raid_status(struct dm_target *ti, status_type_t type, unsigned int status_flags, char *result, unsigned int maxlen) { struct raid_set *rs = ti->private; struct mddev *mddev = &rs->md; - struct r5conf *conf = mddev->private; + struct r5conf *conf = rs_is_raid456(rs) ? mddev->private : NULL; int i, max_nr_stripes = conf ? conf->max_nr_stripes : 0; unsigned long recovery; unsigned int raid_param_cnt = 1; /* at least 1 for chunksize */ unsigned int sz = 0; unsigned int rebuild_disks; -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS v2] bnxt_en: Fix out-of-bound memcpy() during ethtool -w
by Dong Chenchen 07 Jul '25

07 Jul '25

From: Shruti Parab <shruti.parab(a)broadcom.com> mainline inclusion from mainline-v6.15-rc5 commit 6b87bd94f34370bbf1dfa59352bed8efab5bf419 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC991C CVE: CVE-2025-37911 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When retrieving the FW coredump using ethtool, it can sometimes cause memory corruption: BUG: KFENCE: memory corruption in __bnxt_get_coredump+0x3ef/0x670 [bnxt_en] Corrupted memory at 0x000000008f0f30e8 [ ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ] (in kfence-#45): __bnxt_get_coredump+0x3ef/0x670 [bnxt_en] ethtool_get_dump_data+0xdc/0x1a0 __dev_ethtool+0xa1e/0x1af0 dev_ethtool+0xa8/0x170 dev_ioctl+0x1b5/0x580 sock_do_ioctl+0xab/0xf0 sock_ioctl+0x1ce/0x2e0 __x64_sys_ioctl+0x87/0xc0 do_syscall_64+0x5c/0xf0 entry_SYSCALL_64_after_hwframe+0x78/0x80 ... This happens when copying the coredump segment list in bnxt_hwrm_dbg_dma_data() with the HWRM_DBG_COREDUMP_LIST FW command. The info->dest_buf buffer is allocated based on the number of coredump segments returned by the FW. The segment list is then DMA'ed by the FW and the length of the DMA is returned by FW. The driver then copies this DMA'ed segment list to info->dest_buf. In some cases, this DMA length may exceed the info->dest_buf length and cause the above BUG condition. Fix it by capping the copy length to not exceed the length of info->dest_buf. The extra DMA data contains no useful information. This code path is shared for the HWRM_DBG_COREDUMP_LIST and the HWRM_DBG_COREDUMP_RETRIEVE FW commands. The buffering is different for these 2 FW commands. To simplify the logic, we need to move the line to adjust the buffer length for HWRM_DBG_COREDUMP_RETRIEVE up, so that the new check to cap the copy length will work for both commands. Fixes: c74751f4c392 ("bnxt_en: Return error if FW returns more data than dump length") Reviewed-by: Kalesh AP <kalesh-anakkur.purayil(a)broadcom.com> Signed-off-by: Shruti Parab <shruti.parab(a)broadcom.com> Signed-off-by: Michael Chan <michael.chan(a)broadcom.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c [commit b032228e58ea is not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c index 0a409ba4012a..1288064f32af 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c @@ -2778,20 +2778,25 @@ static int bnxt_hwrm_dbg_dma_data(struct bnxt *bp, void *msg, int msg_len, } } + if (cmn_req->req_type == + cpu_to_le16(HWRM_DBG_COREDUMP_RETRIEVE)) + info->dest_buf_size += len; + if (info->dest_buf) { if ((info->seg_start + off + len) <= BNXT_COREDUMP_BUF_LEN(info->buf_len)) { - memcpy(info->dest_buf + off, dma_buf, len); + u16 copylen = min_t(u16, len, + info->dest_buf_size - off); + + memcpy(info->dest_buf + off, dma_buf, copylen); + if (copylen < len) + break; } else { rc = -ENOBUFS; break; } } - if (cmn_req->req_type == - cpu_to_le16(HWRM_DBG_COREDUMP_RETRIEVE)) - info->dest_buf_size += len; - if (!(cmn_resp->flags & HWRM_DBG_CMN_FLAGS_MORE)) break; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] ipvlan: Fix out-of-bounds caused by unclear skb->cb in I2e mode
by Dong Chenchen 07 Jul '25

07 Jul '25

From: zhangqiumiao <zhangqiumiao1(a)huawei.com> openEuler inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7GVI1 CVE: CVE-2023-3090 Reference: https://gitee.com/openeuler/kernel/commit/f49546d265363c51a232f28f2aede5b42… -------------------------------- We should clear skb->cb before ip_local_out or ip6_local_out in l2e mode too. Fixes: 53f51b3cd1e4 ("ipvlan: Introduce l2e mode") Co-developed-by: "t.feng" <fengtao40(a)huawei.com> Signed-off-by: zhangqiumiao <zhangqiumiao1(a)huawei.com> Signed-off-by: dongchenchen <dongchenchen2(a)huawei.com> --- drivers/net/ipvlan/ipvlan_core.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c index 0a82752b28b5..57803d8196ed 100644 --- a/drivers/net/ipvlan/ipvlan_core.c +++ b/drivers/net/ipvlan/ipvlan_core.c @@ -578,6 +578,9 @@ static int ipvlan_process_v4_forward(struct sk_buff *skb) goto err; } skb_dst_set(skb, &rt->dst); + + memset(IPCB(skb), 0, sizeof(*IPCB(skb))); + err = ip_local_out(net, skb->sk, skb); if (unlikely(net_xmit_eval(err))) dev->stats.tx_errors++; @@ -615,6 +618,9 @@ static int ipvlan_process_v6_forward(struct sk_buff *skb) goto err; } skb_dst_set(skb, dst); + + memset(IP6CB(skb), 0, sizeof(*IP6CB(skb))); + err = ip6_local_out(net, skb->sk, skb); if (unlikely(net_xmit_eval(err))) dev->stats.tx_errors++; -- 2.25.1

2 1

[PATCH OLK-6.6 v2 0/4] CVE-2025-38099
by Pu Lehui 07 Jul '25

07 Jul '25

Pedro Nishiyama (4): Bluetooth: Add quirk for broken READ_VOICE_SETTING Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken Bluetooth: btusb: Fix regression in the initialization of fake Bluetooth controllers drivers/bluetooth/btusb.c | 2 ++ include/net/bluetooth/hci.h | 16 ++++++++++++++++ include/net/bluetooth/hci_core.h | 4 ++++ net/bluetooth/hci_event.c | 3 +++ net/bluetooth/hci_sync.c | 6 +++++- 5 files changed, 30 insertions(+), 1 deletion(-) -- 2.34.1

2 5

[PATCH OLK-6.6] crypto: null - Use spin lock instead of mutex
by Gu Bowen 07 Jul '25

07 Jul '25

From: Herbert Xu <herbert(a)gondor.apana.org.au> stable inclusion from stable-6.6.89 commit 1b66a5920b7fc7cc6251192a3fcad115b6d75dd5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC6BKL CVE: CVE-2025-37808 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit dcc47a028c24e793ce6d6efebfef1a1e92f80297 ] As the null algorithm may be freed in softirq context through af_alg, use spin locks instead of mutexes to protect the default null algorithm. Reported-by: syzbot+b3e02953598f447d4d2a(a)syzkaller.appspotmail.com Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- crypto/crypto_null.c | 39 ++++++++++++++++++++++++++------------- 1 file changed, 26 insertions(+), 13 deletions(-) diff --git a/crypto/crypto_null.c b/crypto/crypto_null.c index 5b84b0f7cc17..337867028653 100644 --- a/crypto/crypto_null.c +++ b/crypto/crypto_null.c @@ -17,10 +17,10 @@ #include <crypto/internal/skcipher.h> #include <linux/init.h> #include <linux/module.h> -#include <linux/mm.h> +#include <linux/spinlock.h> #include <linux/string.h> -static DEFINE_MUTEX(crypto_default_null_skcipher_lock); +static DEFINE_SPINLOCK(crypto_default_null_skcipher_lock); static struct crypto_sync_skcipher *crypto_default_null_skcipher; static int crypto_default_null_skcipher_refcnt; @@ -152,23 +152,32 @@ MODULE_ALIAS_CRYPTO("cipher_null"); struct crypto_sync_skcipher *crypto_get_default_null_skcipher(void) { + struct crypto_sync_skcipher *ntfm = NULL; struct crypto_sync_skcipher *tfm; - mutex_lock(&crypto_default_null_skcipher_lock); + spin_lock_bh(&crypto_default_null_skcipher_lock); tfm = crypto_default_null_skcipher; if (!tfm) { - tfm = crypto_alloc_sync_skcipher("ecb(cipher_null)", 0, 0); - if (IS_ERR(tfm)) - goto unlock; - - crypto_default_null_skcipher = tfm; + spin_unlock_bh(&crypto_default_null_skcipher_lock); + + ntfm = crypto_alloc_sync_skcipher("ecb(cipher_null)", 0, 0); + if (IS_ERR(ntfm)) + return ntfm; + + spin_lock_bh(&crypto_default_null_skcipher_lock); + tfm = crypto_default_null_skcipher; + if (!tfm) { + tfm = ntfm; + ntfm = NULL; + crypto_default_null_skcipher = tfm; + } } crypto_default_null_skcipher_refcnt++; + spin_unlock_bh(&crypto_default_null_skcipher_lock); -unlock: - mutex_unlock(&crypto_default_null_skcipher_lock); + crypto_free_sync_skcipher(ntfm); return tfm; } @@ -176,12 +185,16 @@ EXPORT_SYMBOL_GPL(crypto_get_default_null_skcipher); void crypto_put_default_null_skcipher(void) { - mutex_lock(&crypto_default_null_skcipher_lock); + struct crypto_sync_skcipher *tfm = NULL; + + spin_lock_bh(&crypto_default_null_skcipher_lock); if (!--crypto_default_null_skcipher_refcnt) { - crypto_free_sync_skcipher(crypto_default_null_skcipher); + tfm = crypto_default_null_skcipher; crypto_default_null_skcipher = NULL; } - mutex_unlock(&crypto_default_null_skcipher_lock); + spin_unlock_bh(&crypto_default_null_skcipher_lock); + + crypto_free_sync_skcipher(tfm); } EXPORT_SYMBOL_GPL(crypto_put_default_null_skcipher); -- 2.25.1

2 1

[PATCH OLK-6.6 0/4] CVE-2025-38099
by Pu Lehui 07 Jul '25

07 Jul '25

Pedro Nishiyama (4): Bluetooth: Add quirk for broken READ_VOICE_SETTING Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken Bluetooth: btusb: Fix regression in the initialization of fake Bluetooth controllers drivers/bluetooth/btusb.c | 2 ++ include/net/bluetooth/hci.h | 16 ++++++++++++++++ include/net/bluetooth/hci_core.h | 4 ++++ net/bluetooth/hci_event.c | 3 +++ net/bluetooth/hci_sync.c | 6 +++++- 5 files changed, 30 insertions(+), 1 deletion(-) -- 2.34.1

2 5