From: Javier Carrasco <javier.carrasco.cruz(a)gmail.com>
stable inclusion
from stable-v5.10.228
commit bf3ab8e1c28f10df0823d4ff312f83c952b06a15
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YWA
CVE: CVE-2024-50198
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit c7c44e57750c31de43906d97813273fdffcf7d02 upstream.
The dev pointer that is received as an argument in the
in_illuminance_period_available_show function references the device
embedded in the IIO device, not in the i2c client.
dev_to_iio_dev() must be used to accessthe right data. The current
implementation leads to a segmentation fault on every attempt to read
the attribute because indio_dev gets a NULL assignment.
This bug has been present since the first appearance of the driver,
apparently since the last version (V6) before getting applied. A
constant attribute was used until then, and the last modifications might
have not been tested again.
Cc: stable(a)vger.kernel.org
Fixes: 7b779f573c48 ("iio: light: add driver for veml6030 ambient light sensor")
Signed-off-by: Javier Carrasco <javier.carrasco.cruz(a)gmail.com>
Link: https://patch.msgid.link/20240913-veml6035-v1-3-0b09c0c90418@gmail.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com>
---
drivers/iio/light/veml6030.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/iio/light/veml6030.c b/drivers/iio/light/veml6030.c
index de85c9b30be1..c13626548003 100644
--- a/drivers/iio/light/veml6030.c
+++ b/drivers/iio/light/veml6030.c
@@ -99,9 +99,8 @@ static const char * const period_values[] = {
static ssize_t in_illuminance_period_available_show(struct device *dev,
struct device_attribute *attr, char *buf)
{
+ struct veml6030_data *data = iio_priv(dev_to_iio_dev(dev));
int ret, reg, x;
- struct iio_dev *indio_dev = i2c_get_clientdata(to_i2c_client(dev));
- struct veml6030_data *data = iio_priv(indio_dev);
ret = regmap_read(data->regmap, VEML6030_REG_ALS_CONF, ®);
if (ret) {
--
2.34.1
Hi WenChen,
FYI, the error/warning still remains.
tree: https://gitee.com/openeuler/kernel.git OLK-5.10
head: 400fd9ccb52e01bf78acae2bbc1710923a15f033
commit: 6d14be01fcb032c478cd4669b32526fda0393195 [2417/2417] urma: upload kernel patch for 20240318_happy_birthday
config: x86_64-randconfig-001-20241112 (https://download.01.org/0day-ci/archive/20241113/202411130755.ZXqCXQU2-lkp@…)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241113/202411130755.ZXqCXQU2-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202411130755.ZXqCXQU2-lkp@intel.com/
All warnings (new ones prefixed by >>):
drivers/ub/urma/ubcore/ubcore_ctp.c: In function 'ubcore_find_remove_ctp':
>> drivers/ub/urma/ubcore/ubcore_ctp.c:114:42: warning: the comparison will always evaluate as 'false' for the address of 'head' will never be NULL [-Waddress]
114 | if (&dev->ht[UBCORE_HT_CTP].head == NULL) {
| ^~
In file included from drivers/ub/urma/ubcore/ubcore_hash_table.h:24,
from drivers/ub/urma/ubcore/ubcore_ctp.c:23:
include/urma/ubcore_types.h:162:28: note: 'head' declared here
162 | struct hlist_head *head;
| ^~~~
--
drivers/ub/urma/ubcore/ubcore_tpg.c: In function 'ubcore_find_remove_tpg':
>> drivers/ub/urma/ubcore/ubcore_tpg.c:113:42: warning: the comparison will always evaluate as 'false' for the address of 'head' will never be NULL [-Waddress]
113 | if (&dev->ht[UBCORE_HT_TPG].head == NULL) {
| ^~
In file included from drivers/ub/urma/ubcore/ubcore_hash_table.h:24,
from drivers/ub/urma/ubcore/ubcore_tpg.c:23:
include/urma/ubcore_types.h:162:28: note: 'head' declared here
162 | struct hlist_head *head;
| ^~~~
drivers/ub/urma/ubcore/ubcore_tpg.c: In function 'ubcore_find_remove_tp_node':
drivers/ub/urma/ubcore/ubcore_tpg.c:149:44: warning: the comparison will always evaluate as 'false' for the address of 'head' will never be NULL [-Waddress]
149 | if (&dev->ht[UBCORE_HT_UB_TP].head == NULL) {
| ^~
include/urma/ubcore_types.h:162:28: note: 'head' declared here
162 | struct hlist_head *head;
| ^~~~
--
drivers/ub/urma/ubcore/ubcore_utp.c: In function 'ubcore_find_remove_utp':
>> drivers/ub/urma/ubcore/ubcore_utp.c:139:42: warning: the comparison will always evaluate as 'false' for the address of 'head' will never be NULL [-Waddress]
139 | if (&dev->ht[UBCORE_HT_UTP].head == NULL) {
| ^~
In file included from drivers/ub/urma/ubcore/ubcore_hash_table.h:24,
from drivers/ub/urma/ubcore/ubcore_utp.c:23:
include/urma/ubcore_types.h:162:28: note: 'head' declared here
162 | struct hlist_head *head;
| ^~~~
Kconfig warnings: (for reference only)
WARNING: unmet direct dependencies detected for PGP_KEY_PARSER
Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n]
Selected by [y]:
- PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y]
vim +114 drivers/ub/urma/ubcore/ubcore_ctp.c
108
109 struct ubcore_ctp *ubcore_find_remove_ctp(struct ubcore_device *dev, uint32_t idx)
110 {
111 struct ubcore_ctp *ctp;
112
113 spin_lock(&dev->ht[UBCORE_HT_CTP].lock);
> 114 if (&dev->ht[UBCORE_HT_CTP].head == NULL) {
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Hi Chen,
FYI, the error/warning still remains.
tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS
head: 58ec866c31299a4b0d63a01cb026877c5f85e4d9
commit: 6943b93b464351cbc35aa002e86bac48e08b1c3f [1291/1291] mm: add support for limiting the usage of reliable memory in pagecache
config: arm64-randconfig-003-20241113 (https://download.01.org/0day-ci/archive/20241113/202411130708.2IT5fUX3-lkp@…)
compiler: aarch64-linux-gcc (GCC) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241113/202411130708.2IT5fUX3-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202411130708.2IT5fUX3-lkp@intel.com/
All warnings (new ones prefixed by >>):
mm/mem_reliable.c:42:22: warning: 'reliable_pagecache_max_bytes' defined but not used [-Wunused-variable]
42 | static unsigned long reliable_pagecache_max_bytes = ULONG_MAX;
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> mm/mem_reliable.c:41:22: warning: 'zero' defined but not used [-Wunused-variable]
41 | static unsigned long zero;
| ^~~~
vim +/zero +41 mm/mem_reliable.c
40
> 41 static unsigned long zero;
42 static unsigned long reliable_pagecache_max_bytes = ULONG_MAX;
43
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Hi luochunsheng,
FYI, the error/warning still remains.
tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS
head: 58ec866c31299a4b0d63a01cb026877c5f85e4d9
commit: d70a672bcf377261c1b9f07009d22aef935e7b92 [1290/1290] iommu: smmu-v3 support Virtualization feature when 3408iMR/3416iMRraid card exist
config: arm64-randconfig-001-20241112 (https://download.01.org/0day-ci/archive/20241113/202411130719.5GGQe3oi-lkp@…)
compiler: aarch64-linux-gcc (GCC) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241113/202411130719.5GGQe3oi-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202411130719.5GGQe3oi-lkp@intel.com/
All errors (new ones prefixed by >>):
drivers/iommu/arm-smmu-v3.c: In function 'arm_smmu_init_strtab_2lvl':
>> drivers/iommu/arm-smmu-v3.c:2896:41: error: 'pci_bus_type' undeclared (first use in this function); did you mean 'pci_pcie_type'?
2896 | ret = bus_for_each_dev(&pci_bus_type, NULL, (void *)smmu,
| ^~~~~~~~~~~~
| pci_pcie_type
drivers/iommu/arm-smmu-v3.c:2896:41: note: each undeclared identifier is reported only once for each function it appears in
drivers/iommu/arm-smmu-v3.c: In function 'arm_smmu_write_strtab_ent':
drivers/iommu/arm-smmu-v3.c:1229:28: warning: this statement may fall through [-Wimplicit-fallthrough=]
1229 | if (disable_bypass)
| ^
drivers/iommu/arm-smmu-v3.c:1231:17: note: here
1231 | default:
| ^~~~~~~
vim +2896 drivers/iommu/arm-smmu-v3.c
2861
2862 /* Calculate the L1 size, capped to the SIDSIZE. */
2863 size = STRTAB_L1_SZ_SHIFT - (ilog2(STRTAB_L1_DESC_DWORDS) + 3);
2864 size = min(size, smmu->sid_bits - STRTAB_SPLIT);
2865 cfg->num_l1_ents = 1 << size;
2866
2867 size += STRTAB_SPLIT;
2868 if (size < smmu->sid_bits)
2869 dev_warn(smmu->dev,
2870 "2-level strtab only covers %u/%u bits of SID\n",
2871 size, smmu->sid_bits);
2872
2873 l1size = cfg->num_l1_ents * (STRTAB_L1_DESC_DWORDS << 3);
2874 strtab = dmam_alloc_coherent(smmu->dev, l1size, &cfg->strtab_dma,
2875 GFP_KERNEL | __GFP_ZERO);
2876 if (!strtab) {
2877 dev_err(smmu->dev,
2878 "failed to allocate l1 stream table (%u bytes)\n",
2879 size);
2880 return -ENOMEM;
2881 }
2882 cfg->strtab = strtab;
2883
2884 /* Configure strtab_base_cfg for 2 levels */
2885 reg = FIELD_PREP(STRTAB_BASE_CFG_FMT, STRTAB_BASE_CFG_FMT_2LVL);
2886 reg |= FIELD_PREP(STRTAB_BASE_CFG_LOG2SIZE, size);
2887 reg |= FIELD_PREP(STRTAB_BASE_CFG_SPLIT, STRTAB_SPLIT);
2888 cfg->strtab_base_cfg = reg;
2889
2890 #ifdef CONFIG_SMMU_BYPASS_DEV
2891 ret = arm_smmu_init_l1_strtab(smmu);
2892 if (ret)
2893 return ret;
2894
2895 if (smmu_bypass_devices_num) {
> 2896 ret = bus_for_each_dev(&pci_bus_type, NULL, (void *)smmu,
2897 arm_smmu_prepare_init_l2_strtab);
2898 }
2899 return ret;
2900 #else
2901 return arm_smmu_init_l1_strtab(smmu);
2902 #endif
2903 }
2904
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Hi Xu,
FYI, the error/warning still remains.
tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS
head: 58ec866c31299a4b0d63a01cb026877c5f85e4d9
commit: 0c40cea7cfc2d1d9762e6fbbb531a43e6dac95ca [1290/1290] NMI: Enable arm-pmu interrupt as NMI in Acensed.
config: arm64-randconfig-003-20241112 (https://download.01.org/0day-ci/archive/20241113/202411130527.FCTcx7wa-lkp@…)
compiler: aarch64-linux-gcc (GCC) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241113/202411130527.FCTcx7wa-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202411130527.FCTcx7wa-lkp@intel.com/
All errors (new ones prefixed by >>):
arch/arm64/mm/init.c:469:13: warning: no previous prototype for 'arm64_memblock_init' [-Wmissing-prototypes]
469 | void __init arm64_memblock_init(void)
| ^~~~~~~~~~~~~~~~~~~
arch/arm64/mm/init.c: In function 'ascend_enable_all_features':
arch/arm64/mm/init.c:787:17: error: 'mem_sleep_current' undeclared (first use in this function)
787 | mem_sleep_current = PM_SUSPEND_ON;
| ^~~~~~~~~~~~~~~~~
arch/arm64/mm/init.c:787:17: note: each undeclared identifier is reported only once for each function it appears in
>> arch/arm64/mm/init.c:790:17: error: 'pmu_nmi_enable' undeclared (first use in this function); did you mean 'perf_pmu_enable'?
790 | pmu_nmi_enable = true;
| ^~~~~~~~~~~~~~
| perf_pmu_enable
vim +790 arch/arm64/mm/init.c
774
775 void ascend_enable_all_features(void)
776 {
777 if (IS_ENABLED(CONFIG_ASCEND_DVPP_MMAP))
778 enable_mmap_dvpp = 1;
779
780 if (IS_ENABLED(CONFIG_ASCEND_IOPF_HIPRI))
781 enable_iopf_hipri = 1;
782
783 if (IS_ENABLED(CONFIG_ASCEND_CHARGE_MIGRATE_HUGEPAGES))
784 enable_charge_mighp = 1;
785
786 if (IS_ENABLED(CONFIG_SUSPEND))
787 mem_sleep_current = PM_SUSPEND_ON;
788
789 if (IS_ENABLED(CONFIG_PMU_WATCHDOG))
> 790 pmu_nmi_enable = true;
791
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki