From: Thomas Gleixner <tglx(a)linutronix.de>
stable inclusion
from stable-v6.1.113
commit b566c7d8a2de403ccc9d8a06195e19bbb386d0e4
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issue/IAYR8E
CVE: CVE-2024-50002
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 4b30051c4864234ec57290c3d142db7c88f10d8a ]
Module insertion invokes static_call_add_module() to initialize the static
calls in a module. static_call_add_module() invokes __static_call_init(),
which allocates a struct static_call_mod to either encapsulate the built-in
static call sites of the associated key into it so further modules can be
added or to append the module to the module chain.
If that allocation fails the function returns with an error code and the
module core invokes static_call_del_module() to clean up eventually added
static_call_mod entries.
This works correctly, when all keys used by the module were converted over
to a module chain before the failure. If not then static_call_del_module()
causes a #GP as it blindly assumes that key::mods points to a valid struct
static_call_mod.
The problem is that key::mods is not a individual struct member of struct
static_call_key, it's part of a union to save space:
union {
/* bit 0: 0 = mods, 1 = sites */
unsigned long type;
struct static_call_mod *mods;
struct static_call_site *sites;
};
key::sites is a pointer to the list of built-in usage sites of the static
call. The type of the pointer is differentiated by bit 0. A mods pointer
has the bit clear, the sites pointer has the bit set.
As static_call_del_module() blidly assumes that the pointer is a valid
static_call_mod type, it fails to check for this failure case and
dereferences the pointer to the list of built-in call sites, which is
obviously bogus.
Cure it by checking whether the key has a sites or a mods pointer.
If it's a sites pointer then the key is not to be touched. As the sites are
walked in the same order as in __static_call_init() the site walk can be
terminated because all subsequent sites have not been touched by the init
code due to the error exit.
If it was converted before the allocation fail, then the inner loop which
searches for a module match will find nothing.
A fail in the second allocation in __static_call_init() is harmless and
does not require special treatment. The first allocation succeeded and
converted the key to a module chain. That first entry has mod::mod == NULL
and mod::next == NULL, so the inner loop of static_call_del_module() will
neither find a module match nor a module chain. The next site in the walk
was either already converted, but can't match the module, or it will exit
the outer loop because it has a static_call_site pointer and not a
static_call_mod pointer.
Fixes: 9183c3f9ed71 ("static_call: Add inline static call infrastructure")
Closes: https://lore.kernel.org/all/20230915082126.4187913-1-ruanjinjie@huawei.com
Reported-by: Jinjie Ruan <ruanjinjie(a)huawei.com>
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Tested-by: Jinjie Ruan <ruanjinjie(a)huawei.com>
Link: https://lore.kernel.org/r/87zfon6b0s.ffs@tglx
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Gu Bowen <gubowen5(a)huawei.com>
---
kernel/static_call_inline.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/kernel/static_call_inline.c b/kernel/static_call_inline.c
index b80a507c1263..0e5794cdf56c 100644
--- a/kernel/static_call_inline.c
+++ b/kernel/static_call_inline.c
@@ -405,6 +405,17 @@ static void static_call_del_module(struct module *mod)
for (site = start; site < stop; site++) {
key = static_call_key(site);
+
+ /*
+ * If the key was not updated due to a memory allocation
+ * failure in __static_call_init() then treating key::sites
+ * as key::mods in the code below would cause random memory
+ * access and #GP. In that case all subsequent sites have
+ * not been touched either, so stop iterating.
+ */
+ if (!static_call_key_has_mods(key))
+ break;
+
if (key == prev_key)
continue;
--
2.25.1
hulk inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IB10SX
--------------------------------
This reverts commit 09996a7c8dc8bd525e05d29985f9d68a30b65188.
The reverted commit modified differently from the original stable due to a
bug in git am.
The original patch has been merged by CVE-2024-38552.
So revert this buggy patch.
Fixes: 09996a7c8dc8 ("drm/amd/display: Fix potential index out of bounds in color transformation function")
Signed-off-by: Wang Hai <wanghai38(a)huawei.com>
---
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c | 5 -----
1 file changed, 5 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
index c970cea26592..c0372aa4ec83 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
@@ -571,11 +571,6 @@ bool cm_helper_translate_curve_to_degamma_hw_format(
i += increment) {
if (j == hw_points - 1)
break;
- if (i >= TRANSFER_FUNC_POINTS) {
- DC_LOG_ERROR("Index out of bounds: i=%d, TRANSFER_FUNC_POINTS=%d\n",
- i, TRANSFER_FUNC_POINTS);
- return false;
- }
rgb_resulted[j].red = output_tf->tf_pts.red[i];
rgb_resulted[j].green = output_tf->tf_pts.green[i];
rgb_resulted[j].blue = output_tf->tf_pts.blue[i];
--
2.17.1
Hi Nick,
FYI, the error/warning still remains.
tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS
head: 0d426553bb97ebfcb4ea34e8fd63477a44316644
commit: f25433cb156a967d9b426ebaadf197c2369398e7 [9263/23983] drm/amd/display: readd -msse2 to prevent Clang from emitting libcalls to undefined SW FP routines
config: x86_64-randconfig-071-20241104 (https://download.01.org/0day-ci/archive/20241105/202411050901.GVulQ30e-lkp@…)
compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241105/202411050901.GVulQ30e-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202411050901.GVulQ30e-lkp@intel.com/
All warnings (new ones prefixed by >>):
In file included from drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dml1_display_rq_dlg_calc.c:26:
In file included from drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dml1_display_rq_dlg_calc.h:29:
In file included from drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dml_common_defs.h:29:
In file included from drivers/gpu/drm/amd/amdgpu/../display/dc/dm_services.h:35:
In file included from drivers/gpu/drm/amd/amdgpu/../display/dc/dm_services_types.h:29:
In file included from drivers/gpu/drm/amd/amdgpu/../display/dc/os_types.h:31:
In file included from include/drm/drmP.h:62:
In file included from arch/x86/include/asm/pgalloc.h:7:
include/linux/pagemap.h:401:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict]
401 | filler_t *filler = (filler_t *)mapping->a_ops->readpage;
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
>> drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dml1_display_rq_dlg_calc.o: warning: objtool: dml1_rq_dlg_get_dlg_params()+0x2efb: unreachable instruction
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
tree: https://gitee.com/openeuler/kernel.git OLK-6.6
head: ab4fcabb7d813ddd7a455c85557f8d0891df4c41
commit: 11557c1ae4529f133483879b7ee00b7d8c653be7 [9864/16090] x86/cpu/zhaoxin: Encapsulate access to kh40000_dma_direct_ops within function
config: x86_64-buildonly-randconfig-002-20241104 (https://download.01.org/0day-ci/archive/20241105/202411050505.GKcOQBxL-lkp@…)
compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241105/202411050505.GKcOQBxL-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202411050505.GKcOQBxL-lkp@intel.com/
All warnings (new ones prefixed by >>):
In file included from arch/x86/kernel/early-quirks.c:13:
In file included from include/linux/pci.h:1666:
In file included from include/linux/dmapool.h:14:
In file included from include/linux/scatterlist.h:8:
In file included from include/linux/mm.h:2235:
include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion]
522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_"
| ~~~~~~~~~~~ ^ ~~~
arch/x86/kernel/early-quirks.c:722:6: warning: no previous prototype for function 'is_zhaoxin_kh40000' [-Wmissing-prototypes]
722 | bool is_zhaoxin_kh40000(void)
| ^
arch/x86/kernel/early-quirks.c:722:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
722 | bool is_zhaoxin_kh40000(void)
| ^
| static
>> arch/x86/kernel/early-quirks.c:727:34: warning: no previous prototype for function 'kh40000_get_direct_dma_ops' [-Wmissing-prototypes]
727 | __weak const struct dma_map_ops *kh40000_get_direct_dma_ops(void)
| ^
arch/x86/kernel/early-quirks.c:727:14: note: declare 'static' if the function is not intended to be used outside of this translation unit
727 | __weak const struct dma_map_ops *kh40000_get_direct_dma_ops(void)
| ^
| static
3 warnings generated.
vim +/kh40000_get_direct_dma_ops +727 arch/x86/kernel/early-quirks.c
721
> 722 bool is_zhaoxin_kh40000(void)
723 {
724 return zhaoxin_kh40000;
725 }
726
> 727 __weak const struct dma_map_ops *kh40000_get_direct_dma_ops(void)
728 {
729 return dma_ops;
730 }
731
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS
head: 0d426553bb97ebfcb4ea34e8fd63477a44316644
commit: 857e8d34273e190118d5cb5002e1ed45d1b5185d [1231/1231] arm64/mpam: Using software-defined id for rdtgroup instead of 32-bit integer
config: arm64-randconfig-001-20241029 (https://download.01.org/0day-ci/archive/20241105/202411050407.BuL0Qgyb-lkp@…)
compiler: aarch64-linux-gcc (GCC) 14.1.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241105/202411050407.BuL0Qgyb-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202411050407.BuL0Qgyb-lkp@intel.com/
All warnings (new ones prefixed by >>):
arch/arm64/kernel/mpam/mpam_resctrl.c:163:1: warning: conflicting types for 'mpam_get_raw_resctrl_resource' due to enum/integer mismatch; have 'struct raw_resctrl_resource *(enum resctrl_resource_level)' [-Wenum-int-mismatch]
163 | mpam_get_raw_resctrl_resource(enum resctrl_resource_level level)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from arch/arm64/kernel/mpam/mpam_resctrl.c:47:
arch/arm64/kernel/mpam/mpam_internal.h:184:1: note: previous declaration of 'mpam_get_raw_resctrl_resource' with type 'struct raw_resctrl_resource *(u32)' {aka 'struct raw_resctrl_resource *(unsigned int)'}
184 | mpam_get_raw_resctrl_resource(u32 level);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> arch/arm64/kernel/mpam/mpam_resctrl.c:520:5: warning: no previous prototype for 'closid_bitmap_init' [-Wmissing-prototypes]
520 | int closid_bitmap_init(void)
| ^~~~~~~~~~~~~~~~~~
arch/arm64/kernel/mpam/mpam_resctrl.c:875:5: warning: no previous prototype for 'cpus_ctrl_write' [-Wmissing-prototypes]
875 | int cpus_ctrl_write(struct rdtgroup *rdtgrp, cpumask_var_t newmask,
| ^~~~~~~~~~~~~~~
arch/arm64/kernel/mpam/mpam_resctrl.c:972:5: warning: no previous prototype for 'cpus_mon_write' [-Wmissing-prototypes]
972 | int cpus_mon_write(struct rdtgroup *rdtgrp, cpumask_var_t newmask,
| ^~~~~~~~~~~~~~
arch/arm64/kernel/mpam/mpam_resctrl.c: In function 'rdt_last_cmd_printf':
arch/arm64/kernel/mpam/mpam_resctrl.c:1116:9: warning: function 'rdt_last_cmd_printf' might be a candidate for 'gnu_printf' format attribute [-Wsuggest-attribute=format]
1116 | seq_buf_vprintf(&last_cmd_status, fmt, ap);
| ^~~~~~~~~~~~~~~
--
arch/arm64/kernel/mpam/mpam_ctrlmon.c: In function 'resctrl_mkdir_mondata_all_subdir':
arch/arm64/kernel/mpam/mpam_ctrlmon.c:561:54: warning: variable 'rr' set but not used [-Wunused-but-set-variable]
561 | struct raw_resctrl_resource *rr;
| ^~
arch/arm64/kernel/mpam/mpam_ctrlmon.c:320: warning: Function parameter or member 's' not described in 'show_doms'
arch/arm64/kernel/mpam/mpam_ctrlmon.c:320: warning: Function parameter or member 'r' not described in 'show_doms'
arch/arm64/kernel/mpam/mpam_ctrlmon.c:320: warning: Function parameter or member 'schema_name' not described in 'show_doms'
>> arch/arm64/kernel/mpam/mpam_ctrlmon.c:320: warning: Function parameter or member 'closid' not described in 'show_doms'
vim +/closid_bitmap_init +520 arch/arm64/kernel/mpam/mpam_resctrl.c
519
> 520 int closid_bitmap_init(void)
521 {
522 int ret;
523
524 mpam_resctrl_closid_collect();
525 if (!num_intpartid || !num_reqpartid)
526 return -EINVAL;
527
528 if (intpartid_free_map)
529 kfree(intpartid_free_map);
530 if (reqpartid_free_map)
531 kfree(reqpartid_free_map);
532
533 ret = local_closid_bitmap_init(num_intpartid, &intpartid_free_map);
534 if (ret)
535 goto out;
536
537 ret = local_closid_bitmap_init(num_reqpartid, &reqpartid_free_map);
538 if (ret)
539 goto out;
540
541 return 0;
542 out:
543 return ret;
544 }
545
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
tree: https://gitee.com/openeuler/kernel.git OLK-6.6
head: ab4fcabb7d813ddd7a455c85557f8d0891df4c41
commit: 11557c1ae4529f133483879b7ee00b7d8c653be7 [9864/16090] x86/cpu/zhaoxin: Encapsulate access to kh40000_dma_direct_ops within function
config: x86_64-buildonly-randconfig-003-20241104 (https://download.01.org/0day-ci/archive/20241105/202411050406.Ec1bzJ2a-lkp@…)
compiler: gcc-11 (Debian 11.3.0-12) 11.3.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241105/202411050406.Ec1bzJ2a-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202411050406.Ec1bzJ2a-lkp@intel.com/
All warnings (new ones prefixed by >>):
arch/x86/kernel/early-quirks.c:722:6: warning: no previous prototype for 'is_zhaoxin_kh40000' [-Wmissing-prototypes]
722 | bool is_zhaoxin_kh40000(void)
| ^~~~~~~~~~~~~~~~~~
>> arch/x86/kernel/early-quirks.c:727:34: warning: no previous prototype for 'kh40000_get_direct_dma_ops' [-Wmissing-prototypes]
727 | __weak const struct dma_map_ops *kh40000_get_direct_dma_ops(void)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
vim +/kh40000_get_direct_dma_ops +727 arch/x86/kernel/early-quirks.c
726
> 727 __weak const struct dma_map_ops *kh40000_get_direct_dma_ops(void)
728 {
729 return dma_ops;
730 }
731
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki