November 2024 - Kernel - mailweb.openeuler.org

[PATCH openEuler-22.03-LTS-SP1] pinctrl: ocelot: fix system hang on level based interrupts
by Zeng Heng 25 Nov '24

25 Nov '24

From: Sergey Matsievskiy <matsievskiysv(a)gmail.com> mainline inclusion from mainline-v6.12-rc4 commit 93b8ddc54507a227087c60a0013ed833b6ae7d3c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YX2 CVE: CVE-2024-50196 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The current implementation only calls chained_irq_enter() and chained_irq_exit() if it detects pending interrupts. ``` for (i = 0; i < info->stride; i++) { uregmap_read(info->map, id_reg + 4 * i, &reg); if (!reg) continue; chained_irq_enter(parent_chip, desc); ``` However, in case of GPIO pin configured in level mode and the parent controller configured in edge mode, GPIO interrupt might be lowered by the hardware. In the result, if the interrupt is short enough, the parent interrupt is still pending while the GPIO interrupt is cleared; chained_irq_enter() never gets called and the system hangs trying to service the parent interrupt. Moving chained_irq_enter() and chained_irq_exit() outside the for loop ensures that they are called even when GPIO interrupt is lowered by the hardware. The similar code with chained_irq_enter() / chained_irq_exit() functions wrapping interrupt checking loop may be found in many other drivers: ``` grep -r -A 10 chained_irq_enter drivers/pinctrl ``` Cc: stable(a)vger.kernel.org Signed-off-by: Sergey Matsievskiy <matsievskiysv(a)gmail.com> Reviewed-by: Alexandre Belloni <alexandre.belloni(a)bootlin.com> Link: https://lore.kernel.org/20241012105743.12450-2-matsievskiysv@gmail.com Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Conflicts: drivers/pinctrl/pinctrl-ocelot.c [Fix context conflicts.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/pinctrl/pinctrl-ocelot.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/pinctrl/pinctrl-ocelot.c b/drivers/pinctrl/pinctrl-ocelot.c index a4a1b00f7f0d..e8ee2ade5293 100644 --- a/drivers/pinctrl/pinctrl-ocelot.c +++ b/drivers/pinctrl/pinctrl-ocelot.c @@ -1097,22 +1097,21 @@ static void ocelot_irq_handler(struct irq_desc *desc) unsigned int reg = 0, irq, i; unsigned long irqs; + chained_irq_enter(parent_chip, desc); + for (i = 0; i < info->stride; i++) { regmap_read(info->map, id_reg + 4 * i, &reg); if (!reg) continue; - chained_irq_enter(parent_chip, desc); - irqs = reg; for_each_set_bit(irq, &irqs, min(32U, info->desc->npins - 32 * i)) generic_handle_irq(irq_linear_revmap(chip->irq.domain, irq + 32 * i)); - - chained_irq_exit(parent_chip, desc); } + chained_irq_exit(parent_chip, desc); } static int ocelot_gpiochip_register(struct platform_device *pdev, -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 1291/1291] drivers/mmc/host/phytium-mci-pci.c:48:15: error: implicit declaration of function 'pcim_enable_device'; did you mean 'pci_enable_device'?
by kernel test robot 25 Nov '24

25 Nov '24

Hi Malloy, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 81e029d5dd0cae934243168eee37ef303ebcce38 commit: d65622e6edee11f7fcbd295bdb5aef86e12dfef3 [1291/1291] mmc: add support for Phytium MMC config: arm64-randconfig-003-20241113 (https://download.01.org/0day-ci/archive/20241125/202411251324.yzrltIBa-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241125/202411251324.yzrltIBa-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411251324.yzrltIBa-lkp@intel.com/ All error/warnings (new ones prefixed by >>): drivers/mmc/host/phytium-mci-pci.c: In function 'phytium_mci_pci_probe': >> drivers/mmc/host/phytium-mci-pci.c:48:15: error: implicit declaration of function 'pcim_enable_device'; did you mean 'pci_enable_device'? [-Werror=implicit-function-declaration] 48 | ret = pcim_enable_device(pdev); | ^~~~~~~~~~~~~~~~~~ | pci_enable_device >> drivers/mmc/host/phytium-mci-pci.c:61:9: error: implicit declaration of function 'pci_enable_msi'; did you mean 'pci_enable_sriov'? [-Werror=implicit-function-declaration] 61 | pci_enable_msi(pdev); | ^~~~~~~~~~~~~~ | pci_enable_sriov drivers/mmc/host/phytium-mci-pci.c: At top level: >> drivers/mmc/host/phytium-mci-pci.c:180:1: warning: data definition has no type or storage class 180 | module_pci_driver(phytium_mci_pci_driver); | ^~~~~~~~~~~~~~~~~ >> drivers/mmc/host/phytium-mci-pci.c:180:1: error: type defaults to 'int' in declaration of 'module_pci_driver' [-Werror=implicit-int] >> drivers/mmc/host/phytium-mci-pci.c:180:1: warning: parameter names (without types) in function declaration [-Wdeclaration-missing-parameter-type] >> drivers/mmc/host/phytium-mci-pci.c:171:26: warning: 'phytium_mci_pci_driver' defined but not used [-Wunused-variable] 171 | static struct pci_driver phytium_mci_pci_driver = { | ^~~~~~~~~~~~~~~~~~~~~~ cc1: some warnings being treated as errors vim +48 drivers/mmc/host/phytium-mci-pci.c 40 41 static int 42 phytium_mci_pci_probe(struct pci_dev *pdev, const struct pci_device_id *pid) 43 { 44 struct phytium_mci_host *host; 45 struct mmc_host *mmc; 46 int ret; 47 > 48 ret = pcim_enable_device(pdev); 49 50 if (ret) 51 return ret; 52 pci_set_master(pdev); 53 54 mmc = mmc_alloc_host(sizeof(struct phytium_mci_host), &pdev->dev); 55 56 if (!mmc) 57 return -ENOMEM; 58 59 host = mmc_priv(mmc); 60 > 61 pci_enable_msi(pdev); 62 63 host->irq = pdev->irq; 64 host->irq_flags = IRQF_SHARED; 65 host->dev = &pdev->dev; 66 ret = pcim_iomap_regions(pdev, 1 << PCI_BAR_NO, pci_name(pdev)); 67 68 if (ret) { 69 dev_err(&pdev->dev, "I/O memory remapping failed\n"); 70 goto host_free; 71 } 72 73 host->base = pcim_iomap_table(pdev)[PCI_BAR_NO]; 74 host->is_use_dma = 1; 75 host->is_device_x100 = 1; 76 77 if (pdev->devfn == 2) { 78 host->caps = emmc_caps; 79 host->caps2 = emmc_caps2; 80 } else { 81 host->caps = sd_caps; 82 host->caps2 = sd_caps2; 83 mmc->f_max = 25000000; /* stable frequency */ 84 } 85 86 host->mmc = mmc; 87 host->clk_rate = MCI_CLK; 88 89 dev_info(&pdev->dev, 90 "%s %d:[bar %d] addr:0x%llx size:0x%llx km:0x%llx devfn:%d\n", 91 __func__, __LINE__, PCI_BAR_NO, pci_resource_start(pdev, 0), 92 pci_resource_len(pdev, 0), (uint64_t)host->base, pdev->devfn); 93 94 dev_dbg(&pdev->dev, "%s %d:irq:0x%x\n", __func__, __LINE__, host->irq); 95 96 ret = phytium_mci_common_probe(host); 97 98 if (ret == MCI_REALEASE_MEM) { 99 ret = -ENOMEM; 100 goto release_mem; 101 } else if (ret) { 102 goto release; 103 } 104 pci_set_drvdata(pdev, mmc); 105 dev_info(&pdev->dev, 106 "%s %d: probe phytium mci successful.\n", __func__, __LINE__); 107 return 0; 108 109 release: 110 phytium_mci_deinit_hw(host); 111 release_mem: 112 113 if (host->dma.adma_table) { 114 dma_free_coherent(&pdev->dev, 115 MAX_BD_NUM * sizeof(struct phytium_adma2_64_desc), 116 host->dma.adma_table, host->dma.adma_addr); 117 } 118 host_free: 119 mmc_free_host(mmc); 120 pci_disable_device(pdev); 121 return ret; 122 } 123 124 static void phytium_mci_pci_remove(struct pci_dev *pdev) 125 { 126 struct phytium_mci_host *host; 127 struct mmc_host *mmc; 128 129 mmc = pci_get_drvdata(pdev); 130 if (!mmc) { 131 dev_info(&pdev->dev, 132 "%s %d: mmc is null.\n", __func__, __LINE__); 133 return; 134 } 135 host = mmc_priv(mmc); 136 if (!host) { 137 dev_info(&pdev->dev, 138 "%s %d: host is null.\n", __func__, __LINE__); 139 mmc_remove_host(mmc); 140 mmc_free_host(mmc); 141 return; 142 } 143 144 del_timer(&host->hotplug_timer); 145 146 mmc_remove_host(host->mmc); 147 148 if (host->dma.adma_table) { 149 dma_free_coherent(&pdev->dev, 150 MAX_BD_NUM * sizeof(struct phytium_adma2_64_desc), 151 host->dma.adma_table, host->dma.adma_addr); 152 } 153 phytium_mci_deinit_hw(host); 154 mmc_free_host(mmc); 155 pci_set_drvdata(pdev, NULL); 156 } 157 158 static const struct pci_device_id phytium_mci_pci_tbl[] = { 159 { 160 .vendor = 0x1DB7, 161 .device = 0xDC28, 162 .subvendor = PCI_ANY_ID, 163 .subdevice = PCI_ANY_ID, 164 .class = 0x5, 165 .class_mask = 0, 166 }, 167 {} 168 }; 169 MODULE_DEVICE_TABLE(pci, phytium_mci_pci_tbl); 170 > 171 static struct pci_driver phytium_mci_pci_driver = { 172 .name = "phytium-mci-pci", 173 .id_table = phytium_mci_pci_tbl, 174 .probe = phytium_mci_pci_probe, 175 .remove = phytium_mci_pci_remove, 176 .driver = { 177 .pm = &phytium_mci_dev_pm_ops, 178 } 179 }; > 180 module_pci_driver(phytium_mci_pci_driver); 181 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2415/2415] mm/memcontrol.c:5402:40: error: implicit declaration of function 'ksm_process_profit'
by kernel test robot 25 Nov '24

25 Nov '24

Hi Nanyong, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: c09bf9815abdd0805b9c0cd61353271d7ecf156f commit: 0f6fb3570be40b783d8c756d64297be1a8e3d2b3 [2415/2415] memcg: support ksm merge any mode per cgroup config: x86_64-buildonly-randconfig-004-20241111 (https://download.01.org/0day-ci/archive/20241125/202411251245.WgcEUBZC-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241125/202411251245.WgcEUBZC-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411251245.WgcEUBZC-lkp@intel.com/ All errors (new ones prefixed by >>): mm/memcontrol.c: In function 'memory_ksm_show': >> mm/memcontrol.c:5402:40: error: implicit declaration of function 'ksm_process_profit' [-Werror=implicit-function-declaration] 5402 | ksm_process_profits += ksm_process_profit(mm); | ^~~~~~~~~~~~~~~~~~ cc1: some warnings being treated as errors vim +/ksm_process_profit +5402 mm/memcontrol.c 5379 5380 static int memory_ksm_show(struct seq_file *m, void *v) 5381 { 5382 unsigned long ksm_merging_pages = 0; 5383 unsigned long ksm_rmap_items = 0; 5384 long ksm_process_profits = 0; 5385 unsigned int tasks = 0; 5386 struct task_struct *task; 5387 struct mm_struct *mm; 5388 struct css_task_iter it; 5389 struct mem_cgroup *memcg = mem_cgroup_from_seq(m); 5390 5391 css_task_iter_start(&memcg->css, CSS_TASK_ITER_PROCS, &it); 5392 while ((task = css_task_iter_next(&it))) { 5393 mm = get_task_mm(task); 5394 if (!mm) 5395 continue; 5396 5397 if (test_bit(MMF_VM_MERGE_ANY, &mm->flags)) 5398 tasks++; 5399 5400 ksm_rmap_items += mm->ksm_rmap_items; 5401 ksm_merging_pages += mm->ksm_merging_pages; > 5402 ksm_process_profits += ksm_process_profit(mm); 5403 mmput(mm); 5404 } 5405 css_task_iter_end(&it); 5406 5407 seq_printf(m, "merge any state: %d\n", READ_ONCE(memcg->ksm_merge_any)); 5408 seq_printf(m, "merge any tasks: %u\n", tasks); 5409 seq_printf(m, "ksm_rmap_items %lu\n", ksm_rmap_items); 5410 seq_printf(m, "ksm_merging_pages %lu\n", ksm_merging_pages); 5411 seq_printf(m, "ksm_process_profits %ld\n", ksm_process_profits); 5412 return 0; 5413 } 5414 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] pinctrl: ocelot: fix system hang on level based interrupts
by Zeng Heng 25 Nov '24

25 Nov '24

From: Sergey Matsievskiy <matsievskiysv(a)gmail.com> mainline inclusion from mainline-v6.12-rc4 commit 93b8ddc54507a227087c60a0013ed833b6ae7d3c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YX2 CVE: CVE-2024-50196 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The current implementation only calls chained_irq_enter() and chained_irq_exit() if it detects pending interrupts. ``` for (i = 0; i < info->stride; i++) { uregmap_read(info->map, id_reg + 4 * i, &reg); if (!reg) continue; chained_irq_enter(parent_chip, desc); ``` However, in case of GPIO pin configured in level mode and the parent controller configured in edge mode, GPIO interrupt might be lowered by the hardware. In the result, if the interrupt is short enough, the parent interrupt is still pending while the GPIO interrupt is cleared; chained_irq_enter() never gets called and the system hangs trying to service the parent interrupt. Moving chained_irq_enter() and chained_irq_exit() outside the for loop ensures that they are called even when GPIO interrupt is lowered by the hardware. The similar code with chained_irq_enter() / chained_irq_exit() functions wrapping interrupt checking loop may be found in many other drivers: ``` grep -r -A 10 chained_irq_enter drivers/pinctrl ``` Cc: stable(a)vger.kernel.org Signed-off-by: Sergey Matsievskiy <matsievskiysv(a)gmail.com> Reviewed-by: Alexandre Belloni <alexandre.belloni(a)bootlin.com> Link: https://lore.kernel.org/20241012105743.12450-2-matsievskiysv@gmail.com Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Conflicts: drivers/pinctrl/pinctrl-ocelot.c [Fix context conflicts.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/pinctrl/pinctrl-ocelot.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/pinctrl/pinctrl-ocelot.c b/drivers/pinctrl/pinctrl-ocelot.c index a4a1b00f7f0d..e8ee2ade5293 100644 --- a/drivers/pinctrl/pinctrl-ocelot.c +++ b/drivers/pinctrl/pinctrl-ocelot.c @@ -1097,22 +1097,21 @@ static void ocelot_irq_handler(struct irq_desc *desc) unsigned int reg = 0, irq, i; unsigned long irqs; + chained_irq_enter(parent_chip, desc); + for (i = 0; i < info->stride; i++) { regmap_read(info->map, id_reg + 4 * i, &reg); if (!reg) continue; - chained_irq_enter(parent_chip, desc); - irqs = reg; for_each_set_bit(irq, &irqs, min(32U, info->desc->npins - 32 * i)) generic_handle_irq(irq_linear_revmap(chip->irq.domain, irq + 32 * i)); - - chained_irq_exit(parent_chip, desc); } + chained_irq_exit(parent_chip, desc); } static int ocelot_gpiochip_register(struct platform_device *pdev, -- 2.25.1

2 1

[openeuler:OLK-6.6 1466/1466] loongson3-acpi-cpufreq.c:undefined reference to `acpi_processor_unregister_performance'
by kernel test robot 25 Nov '24

25 Nov '24

Hi liuyun, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: e2e6e833f0e931accd24012488ed312ed9f63150 commit: 47a0b6f372d7f05822d021f86b21a34fd2142225 [1466/1466] cpufreq: Add cpufreq driver for LoongArch config: loongarch-randconfig-r053-20241114 (https://download.01.org/0day-ci/archive/20241125/202411251114.dtutDKWn-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241125/202411251114.dtutDKWn-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411251114.dtutDKWn-lkp@intel.com/ All errors (new ones prefixed by >>): loongarch64-linux-ld: drivers/cpufreq/loongson3-acpi-cpufreq.o: in function `loongson3_cpufreq_cpu_exit': >> loongson3-acpi-cpufreq.c:(.text+0x5b4): undefined reference to `acpi_processor_unregister_performance' loongarch64-linux-ld: drivers/cpufreq/loongson3-acpi-cpufreq.o: in function `.L231': >> loongson3-acpi-cpufreq.c:(.text+0x1ba8): undefined reference to `acpi_processor_register_performance' loongarch64-linux-ld: drivers/cpufreq/loongson3-acpi-cpufreq.o: in function `.L276': loongson3-acpi-cpufreq.c:(.text+0x225c): undefined reference to `acpi_processor_unregister_performance' -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] media: av7110: fix a spectre vulnerability
by Li Huafei 25 Nov '24

25 Nov '24

From: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> mainline inclusion from mainline-v6.12-rc7 commit 458ea1c0be991573ec436aa0afa23baacfae101a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5AVC CVE: CVE-2024-50289 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As warned by smatch: drivers/staging/media/av7110/av7110_ca.c:270 dvb_ca_ioctl() warn: potential spectre issue 'av7110->ci_slot' [w] (local cap) There is a spectre-related vulnerability at the code. Fix it. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Conflicts: drivers/media/pci/ttpci/av7110.h drivers/media/pci/ttpci/av7110_ca.c drivers/staging/media/av7110/av7110.h drivers/staging/media/av7110/av7110_ca.c Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/media/pci/ttpci/av7110.h | 4 +++- drivers/media/pci/ttpci/av7110_ca.c | 26 ++++++++++++++++++-------- 2 files changed, 21 insertions(+), 9 deletions(-) diff --git a/drivers/media/pci/ttpci/av7110.h b/drivers/media/pci/ttpci/av7110.h index 809d938ae166..f77766008b97 100644 --- a/drivers/media/pci/ttpci/av7110.h +++ b/drivers/media/pci/ttpci/av7110.h @@ -86,6 +86,8 @@ struct infrared { u32 ir_config; }; +#define MAX_CI_SLOTS 2 + /* place to store all the necessary device information */ struct av7110 { @@ -166,7 +168,7 @@ struct av7110 { /* CA */ - struct ca_slot_info ci_slot[2]; + struct ca_slot_info ci_slot[MAX_CI_SLOTS]; enum av7110_video_mode vidmode; struct dmxdev dmxdev; diff --git a/drivers/media/pci/ttpci/av7110_ca.c b/drivers/media/pci/ttpci/av7110_ca.c index c1338e074a3d..7216365331a6 100644 --- a/drivers/media/pci/ttpci/av7110_ca.c +++ b/drivers/media/pci/ttpci/av7110_ca.c @@ -18,6 +18,7 @@ #include <linux/timer.h> #include <linux/poll.h> #include <linux/gfp.h> +#include <linux/nospec.h> #include "av7110.h" #include "av7110_hw.h" @@ -26,23 +27,28 @@ void CI_handle(struct av7110 *av7110, u8 *data, u16 len) { + unsigned slot_num; + dprintk(8, "av7110:%p\n",av7110); if (len < 3) return; switch (data[0]) { case CI_MSG_CI_INFO: - if (data[2] != 1 && data[2] != 2) + if (data[2] != 1 && data[2] != MAX_CI_SLOTS) break; + + slot_num = array_index_nospec(data[2] - 1, MAX_CI_SLOTS); + switch (data[1]) { case 0: - av7110->ci_slot[data[2] - 1].flags = 0; + av7110->ci_slot[slot_num].flags = 0; break; case 1: - av7110->ci_slot[data[2] - 1].flags |= CA_CI_MODULE_PRESENT; + av7110->ci_slot[slot_num].flags |= CA_CI_MODULE_PRESENT; break; case 2: - av7110->ci_slot[data[2] - 1].flags |= CA_CI_MODULE_READY; + av7110->ci_slot[slot_num].flags |= CA_CI_MODULE_READY; break; } break; @@ -264,15 +270,19 @@ static int dvb_ca_ioctl(struct file *file, unsigned int cmd, void *parg) case CA_GET_SLOT_INFO: { struct ca_slot_info *info=(struct ca_slot_info *)parg; + unsigned int slot_num; if (info->num < 0 || info->num > 1) { mutex_unlock(&av7110->ioctl_mutex); return -EINVAL; } - av7110->ci_slot[info->num].num = info->num; - av7110->ci_slot[info->num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ? - CA_CI_LINK : CA_CI; - memcpy(info, &av7110->ci_slot[info->num], sizeof(struct ca_slot_info)); + slot_num = array_index_nospec(info->num, MAX_CI_SLOTS); + + av7110->ci_slot[slot_num].num = info->num; + av7110->ci_slot[slot_num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ? + CA_CI_LINK : CA_CI; + memcpy(info, &av7110->ci_slot[slot_num], + sizeof(struct ca_slot_info)); break; } -- 2.25.1

2 1

[PATCH OLK-5.10] media: av7110: fix a spectre vulnerability
by Li Huafei 25 Nov '24

25 Nov '24

From: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> mainline inclusion from mainline-v6.12-rc7 commit 458ea1c0be991573ec436aa0afa23baacfae101a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5AVC CVE: CVE-2024-50289 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As warned by smatch: drivers/staging/media/av7110/av7110_ca.c:270 dvb_ca_ioctl() warn: potential spectre issue 'av7110->ci_slot' [w] (local cap) There is a spectre-related vulnerability at the code. Fix it. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Conflicts: drivers/media/pci/ttpci/av7110.h drivers/media/pci/ttpci/av7110_ca.c drivers/staging/media/av7110/av7110.h drivers/staging/media/av7110/av7110_ca.c Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/media/pci/ttpci/av7110.h | 4 +++- drivers/media/pci/ttpci/av7110_ca.c | 26 ++++++++++++++++++-------- 2 files changed, 21 insertions(+), 9 deletions(-) diff --git a/drivers/media/pci/ttpci/av7110.h b/drivers/media/pci/ttpci/av7110.h index 809d938ae166..f77766008b97 100644 --- a/drivers/media/pci/ttpci/av7110.h +++ b/drivers/media/pci/ttpci/av7110.h @@ -86,6 +86,8 @@ struct infrared { u32 ir_config; }; +#define MAX_CI_SLOTS 2 + /* place to store all the necessary device information */ struct av7110 { @@ -166,7 +168,7 @@ struct av7110 { /* CA */ - struct ca_slot_info ci_slot[2]; + struct ca_slot_info ci_slot[MAX_CI_SLOTS]; enum av7110_video_mode vidmode; struct dmxdev dmxdev; diff --git a/drivers/media/pci/ttpci/av7110_ca.c b/drivers/media/pci/ttpci/av7110_ca.c index c1338e074a3d..7216365331a6 100644 --- a/drivers/media/pci/ttpci/av7110_ca.c +++ b/drivers/media/pci/ttpci/av7110_ca.c @@ -18,6 +18,7 @@ #include <linux/timer.h> #include <linux/poll.h> #include <linux/gfp.h> +#include <linux/nospec.h> #include "av7110.h" #include "av7110_hw.h" @@ -26,23 +27,28 @@ void CI_handle(struct av7110 *av7110, u8 *data, u16 len) { + unsigned slot_num; + dprintk(8, "av7110:%p\n",av7110); if (len < 3) return; switch (data[0]) { case CI_MSG_CI_INFO: - if (data[2] != 1 && data[2] != 2) + if (data[2] != 1 && data[2] != MAX_CI_SLOTS) break; + + slot_num = array_index_nospec(data[2] - 1, MAX_CI_SLOTS); + switch (data[1]) { case 0: - av7110->ci_slot[data[2] - 1].flags = 0; + av7110->ci_slot[slot_num].flags = 0; break; case 1: - av7110->ci_slot[data[2] - 1].flags |= CA_CI_MODULE_PRESENT; + av7110->ci_slot[slot_num].flags |= CA_CI_MODULE_PRESENT; break; case 2: - av7110->ci_slot[data[2] - 1].flags |= CA_CI_MODULE_READY; + av7110->ci_slot[slot_num].flags |= CA_CI_MODULE_READY; break; } break; @@ -264,15 +270,19 @@ static int dvb_ca_ioctl(struct file *file, unsigned int cmd, void *parg) case CA_GET_SLOT_INFO: { struct ca_slot_info *info=(struct ca_slot_info *)parg; + unsigned int slot_num; if (info->num < 0 || info->num > 1) { mutex_unlock(&av7110->ioctl_mutex); return -EINVAL; } - av7110->ci_slot[info->num].num = info->num; - av7110->ci_slot[info->num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ? - CA_CI_LINK : CA_CI; - memcpy(info, &av7110->ci_slot[info->num], sizeof(struct ca_slot_info)); + slot_num = array_index_nospec(info->num, MAX_CI_SLOTS); + + av7110->ci_slot[slot_num].num = info->num; + av7110->ci_slot[slot_num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ? + CA_CI_LINK : CA_CI; + memcpy(info, &av7110->ci_slot[slot_num], + sizeof(struct ca_slot_info)); break; } -- 2.25.1

2 1

[PATCH OLK-6.6] media: av7110: fix a spectre vulnerability
by Li Huafei 25 Nov '24

25 Nov '24

From: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> mainline inclusion from mainline-v6.12-rc7 commit 458ea1c0be991573ec436aa0afa23baacfae101a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5AVC CVE: CVE-2024-50289 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As warned by smatch: drivers/staging/media/av7110/av7110_ca.c:270 dvb_ca_ioctl() warn: potential spectre issue 'av7110->ci_slot' [w] (local cap) There is a spectre-related vulnerability at the code. Fix it. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Conflicts: drivers/staging/media/av7110/av7110.h drivers/staging/media/av7110/av7110_ca.c [ Context conflict caused by unmerged commit f6ed8943fb06 ('media: av7110: coding style fixes: logging'). ] Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/staging/media/av7110/av7110.h | 4 +++- drivers/staging/media/av7110/av7110_ca.c | 26 ++++++++++++++++-------- 2 files changed, 21 insertions(+), 9 deletions(-) diff --git a/drivers/staging/media/av7110/av7110.h b/drivers/staging/media/av7110/av7110.h index 809d938ae166..f77766008b97 100644 --- a/drivers/staging/media/av7110/av7110.h +++ b/drivers/staging/media/av7110/av7110.h @@ -86,6 +86,8 @@ struct infrared { u32 ir_config; }; +#define MAX_CI_SLOTS 2 + /* place to store all the necessary device information */ struct av7110 { @@ -166,7 +168,7 @@ struct av7110 { /* CA */ - struct ca_slot_info ci_slot[2]; + struct ca_slot_info ci_slot[MAX_CI_SLOTS]; enum av7110_video_mode vidmode; struct dmxdev dmxdev; diff --git a/drivers/staging/media/av7110/av7110_ca.c b/drivers/staging/media/av7110/av7110_ca.c index c1338e074a3d..7216365331a6 100644 --- a/drivers/staging/media/av7110/av7110_ca.c +++ b/drivers/staging/media/av7110/av7110_ca.c @@ -18,6 +18,7 @@ #include <linux/timer.h> #include <linux/poll.h> #include <linux/gfp.h> +#include <linux/nospec.h> #include "av7110.h" #include "av7110_hw.h" @@ -26,23 +27,28 @@ void CI_handle(struct av7110 *av7110, u8 *data, u16 len) { + unsigned slot_num; + dprintk(8, "av7110:%p\n",av7110); if (len < 3) return; switch (data[0]) { case CI_MSG_CI_INFO: - if (data[2] != 1 && data[2] != 2) + if (data[2] != 1 && data[2] != MAX_CI_SLOTS) break; + + slot_num = array_index_nospec(data[2] - 1, MAX_CI_SLOTS); + switch (data[1]) { case 0: - av7110->ci_slot[data[2] - 1].flags = 0; + av7110->ci_slot[slot_num].flags = 0; break; case 1: - av7110->ci_slot[data[2] - 1].flags |= CA_CI_MODULE_PRESENT; + av7110->ci_slot[slot_num].flags |= CA_CI_MODULE_PRESENT; break; case 2: - av7110->ci_slot[data[2] - 1].flags |= CA_CI_MODULE_READY; + av7110->ci_slot[slot_num].flags |= CA_CI_MODULE_READY; break; } break; @@ -264,15 +270,19 @@ static int dvb_ca_ioctl(struct file *file, unsigned int cmd, void *parg) case CA_GET_SLOT_INFO: { struct ca_slot_info *info=(struct ca_slot_info *)parg; + unsigned int slot_num; if (info->num < 0 || info->num > 1) { mutex_unlock(&av7110->ioctl_mutex); return -EINVAL; } - av7110->ci_slot[info->num].num = info->num; - av7110->ci_slot[info->num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ? - CA_CI_LINK : CA_CI; - memcpy(info, &av7110->ci_slot[info->num], sizeof(struct ca_slot_info)); + slot_num = array_index_nospec(info->num, MAX_CI_SLOTS); + + av7110->ci_slot[slot_num].num = info->num; + av7110->ci_slot[slot_num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ? + CA_CI_LINK : CA_CI; + memcpy(info, &av7110->ci_slot[slot_num], + sizeof(struct ca_slot_info)); break; } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amd/display: Initialize denominators' default to 1
by dinglongwei 25 Nov '24

25 Nov '24

From: Alex Hung <alex.hung(a)amd.com> stable inclusion from stable-v6.11.3 commit 7f8e93b862aba08d540f1e9e03e0ceb4d0cfd5fb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRC8 CVE: CVE-2024-49899 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b995c0a6de6c74656a0c39cd57a0626351b13e3c ] [WHAT & HOW] Variables used as denominators and maybe not assigned to other values, should not be 0. Change their default to 1 so they are never 0. This fixes 10 DIVIDE_BY_ZERO issues reported by Coverity. Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Signed-off-by: Jerry Zuo <jerry.zuo(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_shared.c [Context conflicts: no dml2_core_shared.c file in current version, introduced in higher version] Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- .../gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c | 2 +- drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c index 799bae229e67..0c5186f01c45 100644 --- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c +++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c @@ -78,7 +78,7 @@ static void calculate_ttu_cursor(struct display_mode_lib *mode_lib, static unsigned int get_bytes_per_element(enum source_format_class source_format, bool is_chroma) { - unsigned int ret_val = 0; + unsigned int ret_val = 1; if (source_format == dm_444_16) { if (!is_chroma) diff --git a/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c b/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c index 414da64f5734..74fe5e6bb09d 100644 --- a/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c +++ b/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c @@ -39,7 +39,7 @@ static unsigned int get_bytes_per_element(enum source_format_class source_format, bool is_chroma) { - unsigned int ret_val = 0; + unsigned int ret_val = 1; if (source_format == dm_444_16) { if (!is_chroma) -- 2.17.1

2 1

[PATCH OLK-5.10] drm/amd/display: Initialize denominators' default to 1
by dinglongwei 25 Nov '24

25 Nov '24

From: Alex Hung <alex.hung(a)amd.com> stable inclusion from stable-v6.11.3 commit 7f8e93b862aba08d540f1e9e03e0ceb4d0cfd5fb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRC8 CVE: CVE-2024-49899 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b995c0a6de6c74656a0c39cd57a0626351b13e3c ] [WHAT & HOW] Variables used as denominators and maybe not assigned to other values, should not be 0. Change their default to 1 so they are never 0. This fixes 10 DIVIDE_BY_ZERO issues reported by Coverity. Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Signed-off-by: Jerry Zuo <jerry.zuo(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_shared.c [Context conflicts: no dml2_core_shared.c file in current version, introduced in higher version] Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- .../gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c | 2 +- drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c index 799bae229e67..0c5186f01c45 100644 --- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c +++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c @@ -78,7 +78,7 @@ static void calculate_ttu_cursor(struct display_mode_lib *mode_lib, static unsigned int get_bytes_per_element(enum source_format_class source_format, bool is_chroma) { - unsigned int ret_val = 0; + unsigned int ret_val = 1; if (source_format == dm_444_16) { if (!is_chroma) diff --git a/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c b/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c index 414da64f5734..74fe5e6bb09d 100644 --- a/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c +++ b/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c @@ -39,7 +39,7 @@ static unsigned int get_bytes_per_element(enum source_format_class source_format, bool is_chroma) { - unsigned int ret_val = 0; + unsigned int ret_val = 1; if (source_format == dm_444_16) { if (!is_chroma) -- 2.17.1

2 1

2024

2023

2022

2021

2020

2019

Kernel November 2024