February 2024 - Kernel - mailweb.openeuler.org

[PATCH openEuler-22.03-LTS] ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()
by Yuntao Liu 26 Feb '24

26 Feb '24

From: Tuo Li <islituo(a)gmail.com> stable inclusion from stable-v5.10.192 commit 9f9eed451176ffcac6b5ba0f6dae1a6b4a1cb0eb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I917HR CVE: CVE-2024-23196 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1f4a08fed450db87fbb5ff5105354158bdbe1a22 ] The variable codec->regmap is often protected by the lock codec->regmap_lock when is accessed. However, it is accessed without holding the lock when is accessed in snd_hdac_regmap_sync(): if (codec->regmap) In my opinion, this may be a harmful race, because if codec->regmap is set to NULL right after the condition is checked, a null-pointer dereference can occur in the called function regcache_sync(): map->lock(map->lock_arg); --> Line 360 in drivers/base/regmap/regcache.c To fix this possible null-pointer dereference caused by data race, the mutex_lock coverage is extended to protect the if statement as well as the function call to regcache_sync(). [ Note: the lack of the regmap_lock itself is harmless for the current codec driver implementations, as snd_hdac_regmap_sync() is only for PM runtime resume that is prohibited during the codec probe. But the change makes the whole code more consistent, so it's merged as is -- tiwai ] Reported-by: BassCheck <bass(a)buaa.edu.cn> Signed-off-by: Tuo Li <islituo(a)gmail.com> Link: https://lore.kernel.org/r/20230703031016.1184711-1-islituo@gmail.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/hda/hdac_regmap.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/sound/hda/hdac_regmap.c b/sound/hda/hdac_regmap.c index f258cb3a6895..9b1bcabd8414 100644 --- a/sound/hda/hdac_regmap.c +++ b/sound/hda/hdac_regmap.c @@ -596,10 +596,9 @@ EXPORT_SYMBOL_GPL(snd_hdac_regmap_update_raw_once); */ void snd_hdac_regmap_sync(struct hdac_device *codec) { - if (codec->regmap) { - mutex_lock(&codec->regmap_lock); + mutex_lock(&codec->regmap_lock); + if (codec->regmap) regcache_sync(codec->regmap); - mutex_unlock(&codec->regmap_lock); - } + mutex_unlock(&codec->regmap_lock); } EXPORT_SYMBOL_GPL(snd_hdac_regmap_sync); -- 2.34.1

2 1

[PATCH OLK-5.10 0/6] CVE-2024-26586
by Liu Jian 26 Feb '24

26 Feb '24

backport the fix patches from 5.10lts Amit Cohen (1): mlxsw: spectrum_acl_erp: Fix error flow of pool allocation failure Christophe JAILLET (1): mlxsw: spectrum: Use 'bitmap_zalloc()' when applicable Ido Schimmel (4): mlxsw: spectrum_acl_tcam: Add missing mutex_destroy() mlxsw: spectrum_acl_tcam: Make fini symmetric to init mlxsw: spectrum_acl_tcam: Reorder functions to avoid forward declarations mlxsw: spectrum_acl_tcam: Fix stack corruption .../mellanox/mlxsw/spectrum_acl_atcam.c | 8 +- .../mellanox/mlxsw/spectrum_acl_erp.c | 8 +- .../mellanox/mlxsw/spectrum_acl_tcam.c | 131 +++++++++--------- .../ethernet/mellanox/mlxsw/spectrum_cnt.c | 9 +- .../mellanox/mlxsw/spectrum_switchdev.c | 11 +- .../drivers/net/mlxsw/spectrum-2/tc_flower.sh | 106 +++++++++++++- 6 files changed, 187 insertions(+), 86 deletions(-) -- 2.34.1

2 7

[PATCH OLK-6.6 0/2] Remove WQ_FLAG_BOOKMARK flag
by Zizhi Wo 26 Feb '24

26 Feb '24

Fix softlockup by removing the wait_queue flag: WQ_FLAG_BOOKMARK. Matthew Wilcox (Oracle) (2): filemap: remove use of wait bookmarks sched: remove wait bookmarks include/linux/wait.h | 9 +++---- kernel/sched/wait.c | 60 ++++++++------------------------------------ mm/filemap.c | 21 +--------------- 3 files changed, 14 insertions(+), 76 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10] mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path
by Zhengchao Shao 26 Feb '24

26 Feb '24

From: Ido Schimmel <idosch(a)nvidia.com> mainline inclusion from mainline-v6.8-rc1 commit efeb7dfea8ee10cdec11b6b6ba4e405edbe75809 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EE7 CVE: CVE-2024-26595 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When calling mlxsw_sp_acl_tcam_region_destroy() from an error path after failing to attach the region to an ACL group, we hit a NULL pointer dereference upon 'region->group->tcam' [1]. Fix by retrieving the 'tcam' pointer using mlxsw_sp_acl_to_tcam(). [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] RIP: 0010:mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0 [...] Call Trace: mlxsw_sp_acl_tcam_vchunk_get+0x88b/0xa20 mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b Fixes: 22a677661f56 ("mlxsw: spectrum: Introduce ACL core with simple TCAM implementation") Signed-off-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Amit Cohen <amcohen(a)nvidia.com> Reviewed-by: Jiri Pirko <jiri(a)nvidia.com> Signed-off-by: Petr Machata <petrm(a)nvidia.com> Acked-by: Paolo Abeni <pabeni(a)redhat.com> Link: https://lore.kernel.org/r/fb6a4542bbc9fcab5a523802d97059bffbca7126.17055020… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c index 7cccc41dd69c..a7689cdd1efc 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c @@ -744,13 +744,13 @@ static void mlxsw_sp_acl_tcam_region_destroy(struct mlxsw_sp *mlxsw_sp, struct mlxsw_sp_acl_tcam_region *region) { + struct mlxsw_sp_acl_tcam *tcam = &mlxsw_sp->acl->tcam; const struct mlxsw_sp_acl_tcam_ops *ops = mlxsw_sp->acl_tcam_ops; ops->region_fini(mlxsw_sp, region->priv); mlxsw_sp_acl_tcam_region_disable(mlxsw_sp, region); mlxsw_sp_acl_tcam_region_free(mlxsw_sp, region); - mlxsw_sp_acl_tcam_region_id_put(region->group->tcam, - region->id); + mlxsw_sp_acl_tcam_region_id_put(tcam, region->id); kfree(region); } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path
by Zhengchao Shao 26 Feb '24

26 Feb '24

From: Ido Schimmel <idosch(a)nvidia.com> mainline inclusion from mainline-v6.8-rc1 commit efeb7dfea8ee10cdec11b6b6ba4e405edbe75809 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EE7 CVE: CVE-2024-26595 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When calling mlxsw_sp_acl_tcam_region_destroy() from an error path after failing to attach the region to an ACL group, we hit a NULL pointer dereference upon 'region->group->tcam' [1]. Fix by retrieving the 'tcam' pointer using mlxsw_sp_acl_to_tcam(). [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] RIP: 0010:mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0 [...] Call Trace: mlxsw_sp_acl_tcam_vchunk_get+0x88b/0xa20 mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b Fixes: 22a677661f56 ("mlxsw: spectrum: Introduce ACL core with simple TCAM implementation") Signed-off-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Amit Cohen <amcohen(a)nvidia.com> Reviewed-by: Jiri Pirko <jiri(a)nvidia.com> Signed-off-by: Petr Machata <petrm(a)nvidia.com> Acked-by: Paolo Abeni <pabeni(a)redhat.com> Link: https://lore.kernel.org/r/fb6a4542bbc9fcab5a523802d97059bffbca7126.17055020… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c index 30931a2c025b..7ce670e71a7c 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c @@ -571,12 +571,13 @@ static void mlxsw_sp_acl_tcam_region_destroy(struct mlxsw_sp *mlxsw_sp, struct mlxsw_sp_acl_tcam_region *region) { + struct mlxsw_sp_acl_tcam *tcam = &mlxsw_sp->acl->tcam; const struct mlxsw_sp_acl_tcam_ops *ops = mlxsw_sp->acl_tcam_ops; ops->region_fini(mlxsw_sp, region->priv); mlxsw_sp_acl_tcam_region_disable(mlxsw_sp, region); mlxsw_sp_acl_tcam_region_free(mlxsw_sp, region); - mlxsw_sp_acl_tcam_region_id_put(region->group->tcam, region->id); + mlxsw_sp_acl_tcam_region_id_put(tcam, region->id); mlxsw_afk_key_info_put(region->key_info); kfree(region); } -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 14777/21632] drivers/scsi/huawei/hifc/hifc_hwif.c:517:65: sparse: sparse: incorrect type in argument 4 (different base types)
by kernel test robot 26 Feb '24

26 Feb '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b97b63500af297c36f80416fd1f1193d227cf51a commit: 7fc993d55d1b54ae40e29dfac825a18d04d644c6 [14777/21632] scsi/hifc: add hifc driver FC service module config: x86_64-randconfig-122-20240218 (https://download.01.org/0day-ci/archive/20240226/202402261420.bgeVvnXn-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240226/202402261420.bgeVvnXn-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402261420.bgeVvnXn-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/scsi/huawei/hifc/hifc_hwif.c:27:16: sparse: sparse: cast to restricted __be32 drivers/scsi/huawei/hifc/hifc_hwif.c:32:16: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int val @@ got restricted __be32 [usertype] @@ drivers/scsi/huawei/hifc/hifc_hwif.c:32:16: sparse: expected unsigned int val drivers/scsi/huawei/hifc/hifc_hwif.c:32:16: sparse: got restricted __be32 [usertype] drivers/scsi/huawei/hifc/hifc_hwif.c:453:29: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *cfg_regs_base @@ got void *cfg_reg_base @@ drivers/scsi/huawei/hifc/hifc_hwif.c:453:29: sparse: expected unsigned char [noderef] [usertype] __iomem *cfg_regs_base drivers/scsi/huawei/hifc/hifc_hwif.c:453:29: sparse: got void *cfg_reg_base drivers/scsi/huawei/hifc/hifc_hwif.c:454:30: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *intr_regs_base @@ got void *intr_reg_base @@ drivers/scsi/huawei/hifc/hifc_hwif.c:454:30: sparse: expected unsigned char [noderef] [usertype] __iomem *intr_regs_base drivers/scsi/huawei/hifc/hifc_hwif.c:454:30: sparse: got void *intr_reg_base drivers/scsi/huawei/hifc/hifc_hwif.c:457:23: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *db_base @@ got void *db_base @@ drivers/scsi/huawei/hifc/hifc_hwif.c:457:23: sparse: expected unsigned char [noderef] [usertype] __iomem *db_base drivers/scsi/huawei/hifc/hifc_hwif.c:457:23: sparse: got void *db_base >> drivers/scsi/huawei/hifc/hifc_hwif.c:517:65: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted gfp_t [usertype] flag @@ got unsigned int flag @@ drivers/scsi/huawei/hifc/hifc_hwif.c:517:65: sparse: expected restricted gfp_t [usertype] flag drivers/scsi/huawei/hifc/hifc_hwif.c:517:65: sparse: got unsigned int flag drivers/scsi/huawei/hifc/hifc_hwif.c:532:65: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted gfp_t [usertype] flag @@ got unsigned int flag @@ drivers/scsi/huawei/hifc/hifc_hwif.c:532:65: sparse: expected restricted gfp_t [usertype] flag drivers/scsi/huawei/hifc/hifc_hwif.c:532:65: sparse: got unsigned int flag In file included from drivers/scsi/huawei/hifc/hifc_hwif.c:14: In file included from drivers/scsi/huawei/hifc/hifc_knl_adp.h:30: In file included from include/scsi/scsi_host.h:12: In file included from include/linux/blk-mq.h:5: In file included from include/linux/blkdev.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. drivers/scsi/huawei/hifc/hifc_hwif.c:442: warning: Function parameter or member 'intr_reg_base' not described in 'hifc_init_hwif' drivers/scsi/huawei/hifc/hifc_hwif.c:442: warning: Function parameter or member 'db_base_phy' not described in 'hifc_init_hwif' drivers/scsi/huawei/hifc/hifc_hwif.c:442: warning: Function parameter or member 'db_base' not described in 'hifc_init_hwif' drivers/scsi/huawei/hifc/hifc_hwif.c:442: warning: Function parameter or member 'dwqe_mapping' not described in 'hifc_init_hwif' vim +517 drivers/scsi/huawei/hifc/hifc_hwif.c 218105be120513 Chenguangli 2020-11-16 508 218105be120513 Chenguangli 2020-11-16 509 int hifc_dma_zalloc_coherent_align(void *dev_hdl, u64 size, u64 align, 218105be120513 Chenguangli 2020-11-16 510 unsigned flag, 218105be120513 Chenguangli 2020-11-16 511 struct hifc_dma_addr_align *mem_align) 218105be120513 Chenguangli 2020-11-16 512 { 218105be120513 Chenguangli 2020-11-16 513 void *vaddr, *align_vaddr; 218105be120513 Chenguangli 2020-11-16 514 dma_addr_t paddr, align_paddr; 218105be120513 Chenguangli 2020-11-16 515 u64 real_size = size; 218105be120513 Chenguangli 2020-11-16 516 218105be120513 Chenguangli 2020-11-16 @517 vaddr = dma_zalloc_coherent(dev_hdl, real_size, &paddr, flag); 218105be120513 Chenguangli 2020-11-16 518 if (!vaddr) 218105be120513 Chenguangli 2020-11-16 519 return -ENOMEM; 218105be120513 Chenguangli 2020-11-16 520 218105be120513 Chenguangli 2020-11-16 521 align_paddr = ALIGN(paddr, align); 218105be120513 Chenguangli 2020-11-16 522 /* align */ 218105be120513 Chenguangli 2020-11-16 523 if (align_paddr == paddr) { 218105be120513 Chenguangli 2020-11-16 524 align_vaddr = vaddr; 218105be120513 Chenguangli 2020-11-16 525 goto out; 218105be120513 Chenguangli 2020-11-16 526 } 218105be120513 Chenguangli 2020-11-16 527 218105be120513 Chenguangli 2020-11-16 528 dma_free_coherent(dev_hdl, real_size, vaddr, paddr); 218105be120513 Chenguangli 2020-11-16 529 218105be120513 Chenguangli 2020-11-16 530 /* realloc memory for align */ 218105be120513 Chenguangli 2020-11-16 531 real_size = size + align; 218105be120513 Chenguangli 2020-11-16 532 vaddr = dma_zalloc_coherent(dev_hdl, real_size, &paddr, flag); 218105be120513 Chenguangli 2020-11-16 533 if (!vaddr) 218105be120513 Chenguangli 2020-11-16 534 return -ENOMEM; 218105be120513 Chenguangli 2020-11-16 535 218105be120513 Chenguangli 2020-11-16 536 align_paddr = ALIGN(paddr, align); 218105be120513 Chenguangli 2020-11-16 537 align_vaddr = (void *)((u64)vaddr + (align_paddr - paddr)); 218105be120513 Chenguangli 2020-11-16 538 218105be120513 Chenguangli 2020-11-16 539 out: 218105be120513 Chenguangli 2020-11-16 540 mem_align->real_size = (u32)real_size; 218105be120513 Chenguangli 2020-11-16 541 mem_align->ori_vaddr = vaddr; 218105be120513 Chenguangli 2020-11-16 542 mem_align->ori_paddr = paddr; 218105be120513 Chenguangli 2020-11-16 543 mem_align->align_vaddr = align_vaddr; 218105be120513 Chenguangli 2020-11-16 544 mem_align->align_paddr = align_paddr; 218105be120513 Chenguangli 2020-11-16 545 218105be120513 Chenguangli 2020-11-16 546 return 0; 218105be120513 Chenguangli 2020-11-16 547 } 218105be120513 Chenguangli 2020-11-16 548 :::::: The code at line 517 was first introduced by commit :::::: 218105be120513109ae9ea5418c10586913274d4 scsi/hifc: add hifc driver chip resource module :::::: TO: Chenguangli <chenguangli2(a)huawei.com> :::::: CC: Yang Yingliang <yangyingliang(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] mlxsw: spectrum_acl_tcam: Fix stack corruption
by Liu Jian 26 Feb '24

26 Feb '24

From: Ido Schimmel <idosch(a)nvidia.com> mainline inclusion from mainline-v6.8-rc1 commit 483ae90d8f976f8339cf81066312e1329f2d3706 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932WD CVE: CVE-2024-26586 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- When tc filters are first added to a net device, the corresponding local port gets bound to an ACL group in the device. The group contains a list of ACLs. In turn, each ACL points to a different TCAM region where the filters are stored. During forwarding, the ACLs are sequentially evaluated until a match is found. One reason to place filters in different regions is when they are added with decreasing priorities and in an alternating order so that two consecutive filters can never fit in the same region because of their key usage. In Spectrum-2 and newer ASICs the firmware started to report that the maximum number of ACLs in a group is more than 16, but the layout of the register that configures ACL groups (PAGT) was not updated to account for that. It is therefore possible to hit stack corruption [1] in the rare case where more than 16 ACLs in a group are required. Fix by limiting the maximum ACL group size to the minimum between what the firmware reports and the maximum ACLs that fit in the PAGT register. Add a test case to make sure the machine does not crash when this condition is hit. [1] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: mlxsw_sp_acl_tcam_group_update+0x116/0x120 [...] dump_stack_lvl+0x36/0x50 panic+0x305/0x330 __stack_chk_fail+0x15/0x20 mlxsw_sp_acl_tcam_group_update+0x116/0x120 mlxsw_sp_acl_tcam_group_region_attach+0x69/0x110 mlxsw_sp_acl_tcam_vchunk_get+0x492/0xa20 mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b Fixes: c3ab435466d5 ("mlxsw: spectrum: Extend to support Spectrum-2 ASIC") Reported-by: Orel Hagag <orelh(a)nvidia.com> Signed-off-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Amit Cohen <amcohen(a)nvidia.com> Signed-off-by: Petr Machata <petrm(a)nvidia.com> Acked-by: Paolo Abeni <pabeni(a)redhat.com> Link: https://lore.kernel.org/r/2d91c89afba59c22587b444994ae419dbea8d876.17055020… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> Conflicts: drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh --- .../mellanox/mlxsw/spectrum_acl_tcam.c | 2 + .../drivers/net/mlxsw/spectrum-2/tc_flower.sh | 56 ++++++++++++++++++- 2 files changed, 57 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c index 30931a2c025b..d4ddea426939 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c @@ -57,6 +57,8 @@ int mlxsw_sp_acl_tcam_init(struct mlxsw_sp *mlxsw_sp, tcam->max_groups = max_groups; tcam->max_group_size = MLXSW_CORE_RES_GET(mlxsw_sp->core, ACL_MAX_GROUP_SIZE); + tcam->max_group_size = min_t(unsigned int, tcam->max_group_size, + MLXSW_REG_PAGT_ACL_MAX_NUM); err = ops->init(mlxsw_sp, tcam->priv, tcam); if (err) diff --git a/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh b/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh index 3b75180f455d..61f0ce8454e0 100755 --- a/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh +++ b/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh @@ -8,7 +8,7 @@ lib_dir=$(dirname $0)/../../../../net/forwarding ALL_TESTS="single_mask_test identical_filters_test two_masks_test \ - multiple_masks_test ctcam_edge_cases_test" + multiple_masks_test ctcam_edge_cases_test max_group_size_test" NUM_NETIFS=2 source $lib_dir/tc_common.sh source $lib_dir/lib.sh @@ -324,6 +324,60 @@ ctcam_edge_cases_test() ctcam_no_atcam_masks_test } +max_group_size_test() +{ + # The number of ACLs in an ACL group is limited. Once the maximum + # number of ACLs has been reached, filters cannot be added. This test + # verifies that when this limit is reached, insertion fails without + # crashing. + + RET=0 + + local num_acls=32 + local max_size + local ret + + if [[ "$tcflags" != "skip_sw" ]]; then + return 0; + fi + + for ((i=1; i < $num_acls; i++)); do + if [[ $(( i % 2 )) == 1 ]]; then + tc filter add dev $h2 ingress pref $i proto ipv4 \ + flower $tcflags dst_ip 198.51.100.1/32 \ + ip_proto tcp tcp_flags 0x01/0x01 \ + action drop &> /dev/null + else + tc filter add dev $h2 ingress pref $i proto ipv6 \ + flower $tcflags dst_ip 2001:db8:1::1/128 \ + action drop &> /dev/null + fi + + ret=$? + [[ $ret -ne 0 ]] && max_size=$((i - 1)) && break + done + + # We expect to exceed the maximum number of ACLs in a group, so that + # insertion eventually fails. Otherwise, the test should be adjusted to + # add more filters. + check_fail $ret "expected to exceed number of ACLs in a group" + + for ((; i >= 1; i--)); do + if [[ $(( i % 2 )) == 1 ]]; then + tc filter del dev $h2 ingress pref $i proto ipv4 \ + flower $tcflags dst_ip 198.51.100.1/32 \ + ip_proto tcp tcp_flags 0x01/0x01 \ + action drop &> /dev/null + else + tc filter del dev $h2 ingress pref $i proto ipv6 \ + flower $tcflags dst_ip 2001:db8:1::1/128 \ + action drop &> /dev/null + fi + done + + log_test "max ACL group size test ($tcflags). max size $max_size" +} + setup_prepare() { h1=${NETIFS[p1]} -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS 0/1] backport patch to fix CVE vulnerabilities from olk-6.6
by Yuntao Liu 26 Feb '24

26 Feb '24

patch to fix CVE-2024-23196. Tuo Li (1): ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync() sound/hda/hdac_regmap.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS v3 0/2] CVE-2023-52435
by Ziyang Xuan 26 Feb '24

26 Feb '24

v3: - Add fixes tag for patch 2. v2: - Fix comment head of patch 1. - Fix compile warning of patch 1. Eric Dumazet (1): net: prevent mss overflow in skb_segment() Ziyang Xuan (1): net: Fix compile warning in skb_segment() net/core/skbuff.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH OLK-6.6] kvm: kabi: KABI reservation for RME
by Guangwei Zhou 26 Feb '24

26 Feb '24

driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I92TT5 CVE: NA ---------------------------------------------------------------------- Reserve KABI for struct kvm_arch and struct kvm_vcpu_arch for ARMv9 RME feature. Signed-off-by: Guangwei Zhou <zhouguangwei5(a)huawei.com> --- arch/arm64/include/asm/kvm_host.h | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h index 993b60d7219d..7c34e0b0b875 100644 --- a/arch/arm64/include/asm/kvm_host.h +++ b/arch/arm64/include/asm/kvm_host.h @@ -27,6 +27,7 @@ #include <asm/fpsimd.h> #include <asm/kvm.h> #include <asm/kvm_asm.h> +#include <linux/kabi.h> #define __KVM_HAVE_ARCH_INTC_INITIALIZED @@ -286,6 +287,15 @@ struct kvm_arch { cpumask_var_t sched_cpus; /* Union of all vcpu's cpus_ptr */ u64 tlbi_dvmbm; #endif + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + KABI_RESERVE(8) }; struct kvm_vcpu_fault_info { @@ -604,6 +614,26 @@ struct kvm_vcpu_arch { cpumask_var_t sched_cpus; cpumask_var_t pre_sched_cpus; #endif + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + KABI_RESERVE(8) + KABI_RESERVE(9) + KABI_RESERVE(10) + KABI_RESERVE(11) + KABI_RESERVE(12) + KABI_RESERVE(13) + KABI_RESERVE(14) + KABI_RESERVE(15) + KABI_RESERVE(16) + KABI_RESERVE(17) + KABI_RESERVE(18) + KABI_RESERVE(19) }; /* -- 2.33.0

2 1