November 2024 - Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 1219/1219] drivers/watchdog/menz69_wdt.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 07 Nov '24

07 Nov '24

Hi Johannes, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: bafa65a8c91fb9c99706d2d22210690199f95779 commit: 81ceed41d0c2b2c9300de7bc30c1451680257f52 [1219/1219] watchdog: add driver for the MEN 16z069 IP-Core config: x86_64-buildonly-randconfig-001-20241025 (https://download.01.org/0day-ci/archive/20241107/202411072224.Ht1FxwCI-lkp@…) compiler: clang version 19.1.2 (https://github.com/llvm/llvm-project 7ba7d8e2f7b6445b60679da826210cdde29eaf8b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241107/202411072224.Ht1FxwCI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411072224.Ht1FxwCI-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/watchdog/menz69_wdt.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/4] fix CVE-2024-49926
by Xiangwei Li 07 Nov '24

07 Nov '24

Greg Kroah-Hartman (3): [Backport] rcu-tasks: Pull sampling of ->percpu_dequeue_lim out of loop [Backport] rcu-tasks: Add data to eliminate RCU-tasks/do_exit() deadlocks [Backport] rcu-tasks: Initialize data to eliminate RCU-tasks/do_exit() deadlocks Zqiang (1): [Backport] rcu-tasks: Fix access non-existent percpu rtpcp variable in rcu_tasks_need_gpcb() include/linux/sched.h | 2 + init/init_task.c | 1 + kernel/fork.c | 1 + kernel/rcu/tasks.h | 90 ++++++++++++++++++++++++++++--------------- 4 files changed, 64 insertions(+), 30 deletions(-) -- 2.25.1

2 5

[openeuler:OLK-6.6 7453/16477] mm/kasan/shadow.c:90:undefined reference to `__memcpy_mc'
by kernel test robot 07 Nov '24

07 Nov '24

Hi Tong, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 22b613ee43a0f885bbff81aa3cad98b2b8d62850 commit: b991780c836ceb9a479c6c6e385e914b487e353a [7453/16477] arm64: introduce copy_mc_to_kernel() implementation config: arm64-randconfig-002-20241107 (https://download.01.org/0day-ci/archive/20241107/202411071929.8uoaYBta-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241107/202411071929.8uoaYBta-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411071929.8uoaYBta-lkp@intel.com/ All errors (new ones prefixed by >>): aarch64-linux-ld: Unexpected GOT/PLT entries detected! aarch64-linux-ld: Unexpected run-time procedure linkages detected! aarch64-linux-ld: mm/kasan/shadow.o: in function `memcpy_mc': >> mm/kasan/shadow.c:90:(.text+0x648): undefined reference to `__memcpy_mc' vim +90 mm/kasan/shadow.c 81 82 #ifdef __HAVE_ARCH_MEMCPY_MC 83 #undef memcpy_mc 84 int memcpy_mc(void *dest, const void *src, size_t len) 85 { 86 if (!kasan_check_range(src, len, false, _RET_IP_) || 87 !kasan_check_range(dest, len, true, _RET_IP_)) 88 return (int)len; 89 > 90 return __memcpy_mc(dest, src, len); 91 } 92 #endif 93 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1231/1231] arch/arm64/kernel/mpam/mpam_ctrlmon.c:201: warning: Function parameter or member 'rdtgrp' not described in 'resctrl_group_resync_domain_ctrls'
by kernel test robot 07 Nov '24

07 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: bafa65a8c91fb9c99706d2d22210690199f95779 commit: 273a0966b93355cd69473db4ab13e2f727623a0e [1231/1231] mpam: update monitor rmid and group configuration config: arm64-randconfig-001-20241029 (https://download.01.org/0day-ci/archive/20241107/202411071854.JMBS7gBz-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241107/202411071854.JMBS7gBz-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411071854.JMBS7gBz-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/arm64/kernel/mpam/mpam_ctrlmon.c:596:5: warning: no previous prototype for 'resctrl_group_mondata_show' [-Wmissing-prototypes] 596 | int resctrl_group_mondata_show(struct seq_file *m, void *arg) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ arch/arm64/kernel/mpam/mpam_ctrlmon.c: In function 'resctrl_mkdir_mondata_all_subdir': arch/arm64/kernel/mpam/mpam_ctrlmon.c:786:54: warning: variable 'rr' set but not used [-Wunused-but-set-variable] 786 | struct raw_resctrl_resource *rr; | ^~ >> arch/arm64/kernel/mpam/mpam_ctrlmon.c:201: warning: Function parameter or member 'rdtgrp' not described in 'resctrl_group_resync_domain_ctrls' >> arch/arm64/kernel/mpam/mpam_ctrlmon.c:201: warning: Function parameter or member 'r' not described in 'resctrl_group_resync_domain_ctrls' >> arch/arm64/kernel/mpam/mpam_ctrlmon.c:201: warning: Function parameter or member 'dom' not described in 'resctrl_group_resync_domain_ctrls' arch/arm64/kernel/mpam/mpam_ctrlmon.c:472: warning: Function parameter or member 's' not described in 'show_doms' arch/arm64/kernel/mpam/mpam_ctrlmon.c:472: warning: Function parameter or member 'r' not described in 'show_doms' arch/arm64/kernel/mpam/mpam_ctrlmon.c:472: warning: Function parameter or member 'schema_name' not described in 'show_doms' arch/arm64/kernel/mpam/mpam_ctrlmon.c:472: warning: Function parameter or member 'type' not described in 'show_doms' arch/arm64/kernel/mpam/mpam_ctrlmon.c:472: warning: Function parameter or member 'closid' not described in 'show_doms' vim +201 arch/arm64/kernel/mpam/mpam_ctrlmon.c 191 192 /** 193 * Resync resctrl group domain ctrls, use rdtgrp->resync to indicate 194 * whether the resync procedure will be called. When resync==1, all 195 * domain ctrls of this group be synchronized again. This happens 196 * when rmid of this group is changed, and all configurations need to 197 * be remapped again accordingly. 198 */ 199 static void resctrl_group_resync_domain_ctrls(struct rdtgroup *rdtgrp, 200 struct resctrl_resource *r, struct rdt_domain *dom) > 201 { 202 int i; 203 int staged_start, staged_end; 204 struct resctrl_staged_config *cfg; 205 struct sd_closid closid; 206 struct list_head *head; 207 struct rdtgroup *entry; 208 struct msr_param para; 209 bool cdp_both_ctrl; 210 211 cfg = dom->staged_cfg; 212 para.closid = &closid; 213 214 staged_start = (r->cdp_enable) ? CDP_CODE : CDP_BOTH; 215 staged_end = (r->cdp_enable) ? CDP_DATA : CDP_BOTH; 216 217 for (i = staged_start; i <= staged_end; i++) { 218 cdp_both_ctrl = cfg[i].cdp_both_ctrl; 219 /* 220 * for ctrl group configuration, hw_closid of cfg[i] equals 221 * to rdtgrp->closid.intpartid. 222 */ 223 closid.intpartid = hw_closid_val(cfg[i].hw_closid); 224 resctrl_cdp_mpamid_map_val(rdtgrp->closid.reqpartid, 225 cfg[i].conf_type, closid.reqpartid); 226 resctrl_dom_ctrl_config(cdp_both_ctrl, r, dom, &para); 227 228 /* 229 * we should synchronize all child mon groups' 230 * configuration from this ctrl rdtgrp 231 */ 232 head = &rdtgrp->mon.crdtgrp_list; 233 list_for_each_entry(entry, head, mon.crdtgrp_list) { 234 resctrl_cdp_mpamid_map_val(entry->closid.reqpartid, 235 cfg[i].conf_type, closid.reqpartid); 236 resctrl_dom_ctrl_config(cdp_both_ctrl, r, dom, &para); 237 } 238 } 239 } 240 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] RDMA/hns: Fix DCA mmap area PUAF
by Chengchang Tang 07 Nov '24

07 Nov '24

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB2H4P ---------------------------------------------------------------------- DCA mmap area would be freed after driver reseted or hot unplugged. At this time, the vma is still valid, which may lead to a PUAF. Using rdma_user_mmap_io() to remap this area to ensure the vma is zapped after dirver removal. Fixes: d3caaebdbfe9 ("RDMA/hns: Optimize user DCA perfermance by sharing DCA status") Signed-off-by: Chengchang Tang <tangchengchang(a)huawei.com> Signed-off-by: Xinghai Cen <cenxinghai(a)h-partners.com> --- drivers/infiniband/hw/hns/hns_roce_dca.c | 3 +- drivers/infiniband/hw/hns/hns_roce_main.c | 39 ++++------------------- 2 files changed, 9 insertions(+), 33 deletions(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_dca.c b/drivers/infiniband/hw/hns/hns_roce_dca.c index 49adf43261d6..4cef41591795 100644 --- a/drivers/infiniband/hw/hns/hns_roce_dca.c +++ b/drivers/infiniband/hw/hns/hns_roce_dca.c @@ -1132,7 +1132,8 @@ static void init_udca_status(struct hns_roce_ucontext *uctx, int udca_max_qps, return; ctx->dca_mmap_entry = hns_roce_user_mmap_entry_insert(ib_uctx, - (u64)kaddr, size, HNS_ROCE_MMAP_TYPE_DCA); + (u64)virt_to_phys(kaddr), size, + HNS_ROCE_MMAP_TYPE_DCA); if (!ctx->dca_mmap_entry) { free_pages_exact(kaddr, size); return; diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c index 1302c58c3937..d488c3d5986f 100644 --- a/drivers/infiniband/hw/hns/hns_roce_main.c +++ b/drivers/infiniband/hw/hns/hns_roce_main.c @@ -644,36 +644,6 @@ static void hns_roce_dealloc_ucontext(struct ib_ucontext *ibcontext) ida_free(&hr_dev->uar_ida.ida, (int)context->uar.logic_idx); } -static int mmap_dca(struct ib_ucontext *context, struct vm_area_struct *vma) -{ - struct hns_roce_ucontext *uctx = to_hr_ucontext(context); - struct hns_roce_dca_ctx *ctx = &uctx->dca_ctx; - struct page **pages; - unsigned long num; - int ret; - - if ((vma->vm_end - vma->vm_start != (ctx->status_npage * PAGE_SIZE) || - !(vma->vm_flags & VM_SHARED))) - return -EINVAL; - - if (!(vma->vm_flags & VM_WRITE) || (vma->vm_flags & VM_EXEC)) - return -EPERM; - - if (!ctx->buf_status) - return -EOPNOTSUPP; - - pages = kcalloc(ctx->status_npage, sizeof(struct page *), GFP_KERNEL); - if (!pages) - return -ENOMEM; - - for (num = 0; num < ctx->status_npage; num++) - pages[num] = virt_to_page(ctx->buf_status + num * PAGE_SIZE); - - ret = vm_insert_pages(vma, vma->vm_start, pages, &num); - kfree(pages); - return ret; -} - static int hns_roce_mmap(struct ib_ucontext *uctx, struct vm_area_struct *vma) { struct hns_roce_dev *hr_dev = to_hr_dev(uctx->device); @@ -703,8 +673,13 @@ static int hns_roce_mmap(struct ib_ucontext *uctx, struct vm_area_struct *vma) prot = pgprot_device(vma->vm_page_prot); break; case HNS_ROCE_MMAP_TYPE_DCA: - ret = mmap_dca(uctx, vma); - goto out; + if (!(vma->vm_flags & VM_WRITE) || (vma->vm_flags & VM_EXEC)) { + ret = -EPERM; + goto out; + } + vm_flags_set(vma, VM_DONTEXPAND); + prot = vma->vm_page_prot; + break; case HNS_ROCE_MMAP_TYPE_RESET: if (vma->vm_flags & (VM_WRITE | VM_EXEC)) { ret = -EINVAL; -- 2.33.0

2 1

[PATCH OLK-6.6] nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net
by Li Lingfeng 07 Nov '24

07 Nov '24

From: Yang Erkun <yangerkun(a)huaweicloud.com> stable inclusion from stable-v6.6.59 commit f965dc0f099a54fca100acf6909abe52d0c85328 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2Q1N CVE: CVE-2024-50121 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d5ff2fb2e7167e9483846e34148e60c0c016a1f6 ] In the normal case, when we excute `echo 0 > /proc/fs/nfsd/threads`, the function `nfs4_state_destroy_net` in `nfs4_state_shutdown_net` will release all resources related to the hashed `nfs4_client`. If the `nfsd_client_shrinker` is running concurrently, the `expire_client` function will first unhash this client and then destroy it. This can lead to the following warning. Additionally, numerous use-after-free errors may occur as well. nfsd_client_shrinker echo 0 > /proc/fs/nfsd/threads expire_client nfsd_shutdown_net unhash_client ... nfs4_state_shutdown_net /* won't wait shrinker exit */ /* cancel_work(&nn->nfsd_shrinker_work) * nfsd_file for this /* won't destroy unhashed client1 */ * client1 still alive nfs4_state_destroy_net */ nfsd_file_cache_shutdown /* trigger warning */ kmem_cache_destroy(nfsd_file_slab) kmem_cache_destroy(nfsd_file_mark_slab) /* release nfsd_file and mark */ __destroy_client ==================================================================== BUG nfsd_file (Not tainted): Objects remaining in nfsd_file on __kmem_cache_shutdown() -------------------------------------------------------------------- CPU: 4 UID: 0 PID: 764 Comm: sh Not tainted 6.12.0-rc3+ #1 dump_stack_lvl+0x53/0x70 slab_err+0xb0/0xf0 __kmem_cache_shutdown+0x15c/0x310 kmem_cache_destroy+0x66/0x160 nfsd_file_cache_shutdown+0xac/0x210 [nfsd] nfsd_destroy_serv+0x251/0x2a0 [nfsd] nfsd_svc+0x125/0x1e0 [nfsd] write_threads+0x16a/0x2a0 [nfsd] nfsctl_transaction_write+0x74/0xa0 [nfsd] vfs_write+0x1a5/0x6d0 ksys_write+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e ==================================================================== BUG nfsd_file_mark (Tainted: G B W ): Objects remaining nfsd_file_mark on __kmem_cache_shutdown() -------------------------------------------------------------------- dump_stack_lvl+0x53/0x70 slab_err+0xb0/0xf0 __kmem_cache_shutdown+0x15c/0x310 kmem_cache_destroy+0x66/0x160 nfsd_file_cache_shutdown+0xc8/0x210 [nfsd] nfsd_destroy_serv+0x251/0x2a0 [nfsd] nfsd_svc+0x125/0x1e0 [nfsd] write_threads+0x16a/0x2a0 [nfsd] nfsctl_transaction_write+0x74/0xa0 [nfsd] vfs_write+0x1a5/0x6d0 ksys_write+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e To resolve this issue, cancel `nfsd_shrinker_work` using synchronous mode in nfs4_state_shutdown_net. Fixes: 7c24fa225081 ("NFSD: replace delayed_work with work_struct for nfsd_client_shrinker") Signed-off-by: Yang Erkun <yangerkun(a)huaweicloud.com> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4state.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 7390322242d7..901fc68636cd 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -8255,7 +8255,7 @@ nfs4_state_shutdown_net(struct net *net) struct nfsd_net *nn = net_generic(net, nfsd_net_id); unregister_shrinker(&nn->nfsd_client_shrinker); - cancel_work(&nn->nfsd_shrinker_work); + cancel_work_sync(&nn->nfsd_shrinker_work); cancel_delayed_work_sync(&nn->laundromat_work); locks_end_grace(&nn->nfsd4_manager); -- 2.31.1

2 1

[PATCH OLK-6.6 0/1] CVE-2024-50133
by Lin Yujun 07 Nov '24

07 Nov '24

Thomas Weißschuh (1): LoongArch: Don't crash in stack_top() for tasks without vDSO arch/loongarch/kernel/process.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-50133
by Lin Yujun 07 Nov '24

07 Nov '24

Thomas Weißschuh (1): LoongArch: Don't crash in stack_top() for tasks without vDSO arch/loongarch/kernel/process.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] CVE-2024-50133
by Lin Yujun 07 Nov '24

07 Nov '24

Thomas Weißschuh (1): LoongArch: Don't crash in stack_top() for tasks without vDSO arch/loongarch/kernel/process.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH 0/2] Some bug fix patches for OLK-5.10 perf
by Yushan Wang 07 Nov '24

07 Nov '24

From: zhangqz <14294317+zhangqizhi3(a)user.noreply.gitee.com> Some bug fix patches for OLK-5.10 perf John Garry (2): perf metricgroup: Fix for metrics containing duration_time perf metricgroup: Fix system PMU metrics tools/perf/util/metricgroup.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) -- 2.33.0

1 2

2024

2023

2022

2021

2020

2019

Kernel November 2024