April 2024 - Kernel - mailweb.openeuler.org

[PATCH openEuler-22.03-LTS 0/1] CVE-2021-46926
by Liu Mingrui 10 Apr '24

10 Apr '24

CVE-2021-46926 Libin Yang (1): ALSA: hda: intel-sdw-acpi: harden detection of controller drivers/soundwire/intel_init.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 2.25.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2021-46926
by Liu Mingrui 10 Apr '24

10 Apr '24

CVE-2021-46926 Libin Yang (1): ALSA: hda: intel-sdw-acpi: harden detection of controller drivers/soundwire/intel_init.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 2.25.1

2 2

[PATCH openEuler-22.03-LTS-SP2 0/1] CVE-2021-46926
by Liu Mingrui 10 Apr '24

10 Apr '24

CVE-2021-46926 Libin Yang (1): ALSA: hda: intel-sdw-acpi: harden detection of controller drivers/soundwire/intel_init.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 2.25.1

2 2

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS 58daf587f2ce5a8a98d67136d6abfb947bda4cf9
by kernel test robot 10 Apr '24

10 Apr '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 58daf587f2ce5a8a98d67136d6abfb947bda4cf9 !5807 nilfs2: fix hang in nilfs_lookup_dirty_data_buffers() Unverified Warning (likely false positive, please contact us if interested): drivers/net/ethernet/intel/ice/ice_osdep.h:28:51: warning: array subscript 0 is outside array bounds of 'struct ice_hw[14593943096289202]' [-Warray-bounds=] drivers/video/fbdev/omap2/omapfb/dss/hdmi4_core.o: warning: objtool: missing symbol for section .text include/linux/uaccess.h:112:17: warning: 'iocommand' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'tmp_str' may be used uninitialized [-Wmaybe-uninitialized] Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allmodconfig | |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized | `-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized |-- arm64-defconfig | |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized | `-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized |-- arm64-randconfig-001-20240410 | |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized | `-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized `-- arm64-randconfig-003-20240410 |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized |-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized |-- drivers-net-ethernet-intel-ice-ice_osdep.h:warning:array-subscript-is-outside-array-bounds-of-struct-ice_hw |-- include-linux-uaccess.h:warning:iocommand-may-be-used-uninitialized `-- include-linux-uaccess.h:warning:tmp_str-may-be-used-uninitialized clang_recent_errors `-- x86_64-buildonly-randconfig-002-20240410 `-- drivers-video-fbdev-omap2-omapfb-dss-hdmi4_core.o:warning:objtool:missing-symbol-for-section-.text elapsed time: 740m configs tested: 20 configs skipped: 148 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240410 gcc arm64 randconfig-002-20240410 gcc arm64 randconfig-003-20240410 gcc arm64 randconfig-004-20240410 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240410 gcc x86_64 buildonly-randconfig-002-20240410 clang x86_64 buildonly-randconfig-003-20240410 clang x86_64 buildonly-randconfig-004-20240410 gcc x86_64 buildonly-randconfig-005-20240410 clang x86_64 buildonly-randconfig-006-20240410 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240410 clang x86_64 randconfig-002-20240410 gcc x86_64 randconfig-005-20240410 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] irqchip/gicv3-its: Add workaround for hip09 ITS erratum 162100801
by chenxiang 10 Apr '24

10 Apr '24

From: Xiang Chen <chenxiang66(a)hisilicon.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9EWDF CVE: NA -------------------------------------------------------------------------- When enabled GICv4.1 in hip09, there are some invalid vPE configurations in configuration table for some situations, which will cause some vSGI interrupts lost. To fix the issue, need to send vinvall command after vmovp. Signed-off-by: Nianyao Tang <tangnianyao(a)huawei.com> Signed-off-by: Xiang Chen <chenxiang66(a)hisilicon.com> Signed-off-by: CaiJian <caijian11(a)h-partners.com> --- Documentation/arch/arm64/silicon-errata.rst | 2 ++ arch/arm64/Kconfig | 10 ++++++ arch/arm64/configs/openeuler_defconfig | 1 + drivers/irqchip/irq-gic-v3-its.c | 36 ++++++++++++++++----- 4 files changed, 41 insertions(+), 8 deletions(-) diff --git a/Documentation/arch/arm64/silicon-errata.rst b/Documentation/arch/arm64/silicon-errata.rst index dc32dd03c85f..11645181d7f2 100644 --- a/Documentation/arch/arm64/silicon-errata.rst +++ b/Documentation/arch/arm64/silicon-errata.rst @@ -209,6 +209,8 @@ stable kernels. +----------------+-----------------+-----------------+-----------------------------+ | Hisilicon | LINXICORE9100 | #1980005 | HISILICON_ERRATUM_1980005 | +----------------+-----------------+-----------------+-----------------------------+ +| Hisilicon | Hip09 | #162100801 | HISILICON_ERRATUM_162100801 | ++----------------+-----------------+-----------------+-----------------------------+ | Hisilicon | SMMUv3 | #162100602 | HISILICON_ERRATUM_162100602 | +----------------+-----------------+-----------------+-----------------------------+ | Qualcomm Tech. | Kryo/Falkor v1 | E1003 | QCOM_FALKOR_ERRATUM_1003 | diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 8def51744a10..890461d3f5e5 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -1203,6 +1203,16 @@ config HISILICON_ERRATUM_1980005 If unsure, say N. +config HISILICON_ERRATUM_162100801 + bool "Hip09 162100801 erratum support" + default y + help + When enabled GICv4.1 in hip09, there are some invalid vPE config + in configuration tables for some situation, which will cause vSGI + interrupts lost. So fix it by sending vinvall commands after vmovp. + + If unsure, say Y. + config HISILICON_ERRATUM_162100602 bool "Hisilicon erratum 162100602" depends on ARM_SMMU_V3 && ARCH_HISI diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index afd13d9e3840..3392957edb6d 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -432,6 +432,7 @@ CONFIG_HISILICON_ERRATUM_161600802=y CONFIG_HISILICON_ERRATUM_162100125=y CONFIG_HISILICON_ERRATUM_162102203=y # CONFIG_HISILICON_ERRATUM_1980005 is not set +CONFIG_HISILICON_ERRATUM_162100801=y CONFIG_HISILICON_ERRATUM_162100602=y CONFIG_QCOM_FALKOR_ERRATUM_1003=y CONFIG_QCOM_FALKOR_ERRATUM_1009=y diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index c66676a21ad0..5bd82a4e8777 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -145,6 +145,7 @@ static int probe_devid_pool_one(void) #define ITS_FLAGS_WORKAROUND_CAVIUM_22375 (1ULL << 1) #define ITS_FLAGS_WORKAROUND_CAVIUM_23144 (1ULL << 2) #define ITS_FLAGS_FORCE_NON_SHAREABLE (1ULL << 3) +#define ITS_FLAGS_WORKAROUND_HISILICON_162100801 (1ULL << 4) #define RD_LOCAL_LPI_ENABLED BIT(0) #define RD_LOCAL_PENDTABLE_PREALLOCATED BIT(1) @@ -1526,6 +1527,14 @@ static void its_send_vmapp(struct its_node *its, its_send_single_vcommand(its, its_build_vmapp_cmd, &desc); } +static void its_send_vinvall(struct its_node *its, struct its_vpe *vpe) +{ + struct its_cmd_desc desc; + + desc.its_vinvall_cmd.vpe = vpe; + its_send_single_vcommand(its, its_build_vinvall_cmd, &desc); +} + static void its_send_vmovp(struct its_vpe *vpe) { struct its_cmd_desc desc = {}; @@ -1565,19 +1574,14 @@ static void its_send_vmovp(struct its_vpe *vpe) desc.its_vmovp_cmd.col = &its->collections[col_id]; its_send_single_vcommand(its, its_build_vmovp_cmd, &desc); + if (is_v4_1(its) && (its->flags & + ITS_FLAGS_WORKAROUND_HISILICON_162100801)) + its_send_vinvall(its, vpe); } raw_spin_unlock_irqrestore(&vmovp_lock, flags); } -static void its_send_vinvall(struct its_node *its, struct its_vpe *vpe) -{ - struct its_cmd_desc desc; - - desc.its_vinvall_cmd.vpe = vpe; - its_send_single_vcommand(its, its_build_vinvall_cmd, &desc); -} - static void its_send_vinv(struct its_device *dev, u32 event_id) { struct its_cmd_desc desc; @@ -5089,6 +5093,14 @@ static bool its_set_non_coherent(void *data) return true; } +static bool __maybe_unused its_enable_quirk_hip09_162100801(void *data) +{ + struct its_node *its = data; + + its->flags |= ITS_FLAGS_WORKAROUND_HISILICON_162100801; + return true; +} + static const struct gic_quirk its_quirks[] = { #ifdef CONFIG_CAVIUM_ERRATUM_22375 { @@ -5135,6 +5147,14 @@ static const struct gic_quirk its_quirks[] = { .init = its_enable_quirk_hip07_161600802, }, #endif +#ifdef CONFIG_HISILICON_ERRATUM_162100801 + { + .desc = "ITS: Hip09 erratum 162100801", + .iidr = 0x00051736, + .mask = 0xffffffff, + .init = its_enable_quirk_hip09_162100801, + }, +#endif #ifdef CONFIG_ROCKCHIP_ERRATUM_3588001 { .desc = "ITS: Rockchip erratum RK3588001", -- 2.30.0

2 1

[PATCH OLK-5.10] RDMA/srpt: Support specifying the srpt_service_guid parameter
by Ziyang Xuan 10 Apr '24

10 Apr '24

From: Bart Van Assche <bvanassche(a)acm.org> stable inclusion from stable-v5.10.211 commit 5a5c039dac1b1b7ba3e91c791f4421052bf79b82 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E3EE CVE: CVE-2024-26744 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fdfa083549de5d50ebf7f6811f33757781e838c0 ] Make loading ib_srpt with this parameter set work. The current behavior is that setting that parameter while loading the ib_srpt kernel module triggers the following kernel crash: BUG: kernel NULL pointer dereference, address: 0000000000000000 Call Trace: <TASK> parse_one+0x18c/0x1d0 parse_args+0xe1/0x230 load_module+0x8de/0xa60 init_module_from_file+0x8b/0xd0 idempotent_init_module+0x181/0x240 __x64_sys_finit_module+0x5a/0xb0 do_syscall_64+0x5f/0xe0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 Cc: LiHonggang <honggangli(a)163.com> Reported-by: LiHonggang <honggangli(a)163.com> Fixes: a42d985bd5b2 ("ib_srpt: Initial SRP Target merge for v3.3-rc1") Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> Link: https://lore.kernel.org/r/20240205004207.17031-1-bvanassche@acm.org Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- drivers/infiniband/ulp/srpt/ib_srpt.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c index 983f59c87b79..80e99e9e9717 100644 --- a/drivers/infiniband/ulp/srpt/ib_srpt.c +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c @@ -79,12 +79,16 @@ module_param(srpt_srq_size, int, 0444); MODULE_PARM_DESC(srpt_srq_size, "Shared receive queue (SRQ) size."); +static int srpt_set_u64_x(const char *buffer, const struct kernel_param *kp) +{ + return kstrtou64(buffer, 16, (u64 *)kp->arg); +} static int srpt_get_u64_x(char *buffer, const struct kernel_param *kp) { return sprintf(buffer, "0x%016llx\n", *(u64 *)kp->arg); } -module_param_call(srpt_service_guid, NULL, srpt_get_u64_x, &srpt_service_guid, - 0444); +module_param_call(srpt_service_guid, srpt_set_u64_x, srpt_get_u64_x, + &srpt_service_guid, 0444); MODULE_PARM_DESC(srpt_service_guid, "Using this value for ioc_guid, id_ext, and cm_listen_id instead of using the node_guid of the first HCA."); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] RDMA/srpt: Support specifying the srpt_service_guid parameter
by Ziyang Xuan 10 Apr '24

10 Apr '24

From: Bart Van Assche <bvanassche(a)acm.org> stable inclusion from stable-v4.19.308 commit 84f1dac960cfa210a3b7a7522e6c2320ae91932b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E3EE CVE: CVE-2024-26744 -------------------------------- [ Upstream commit fdfa083549de5d50ebf7f6811f33757781e838c0 ] Make loading ib_srpt with this parameter set work. The current behavior is that setting that parameter while loading the ib_srpt kernel module triggers the following kernel crash: BUG: kernel NULL pointer dereference, address: 0000000000000000 Call Trace: <TASK> parse_one+0x18c/0x1d0 parse_args+0xe1/0x230 load_module+0x8de/0xa60 init_module_from_file+0x8b/0xd0 idempotent_init_module+0x181/0x240 __x64_sys_finit_module+0x5a/0xb0 do_syscall_64+0x5f/0xe0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 Cc: LiHonggang <honggangli(a)163.com> Reported-by: LiHonggang <honggangli(a)163.com> Fixes: a42d985bd5b2 ("ib_srpt: Initial SRP Target merge for v3.3-rc1") Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> Link: https://lore.kernel.org/r/20240205004207.17031-1-bvanassche@acm.org Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- drivers/infiniband/ulp/srpt/ib_srpt.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c index ea4afdeb06a4..7550c9777ed1 100644 --- a/drivers/infiniband/ulp/srpt/ib_srpt.c +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c @@ -82,12 +82,16 @@ module_param(srpt_srq_size, int, 0444); MODULE_PARM_DESC(srpt_srq_size, "Shared receive queue (SRQ) size."); +static int srpt_set_u64_x(const char *buffer, const struct kernel_param *kp) +{ + return kstrtou64(buffer, 16, (u64 *)kp->arg); +} static int srpt_get_u64_x(char *buffer, const struct kernel_param *kp) { return sprintf(buffer, "0x%016llx", *(u64 *)kp->arg); } -module_param_call(srpt_service_guid, NULL, srpt_get_u64_x, &srpt_service_guid, - 0444); +module_param_call(srpt_service_guid, srpt_set_u64_x, srpt_get_u64_x, + &srpt_service_guid, 0444); MODULE_PARM_DESC(srpt_service_guid, "Using this value for ioc_guid, id_ext, and cm_listen_id" " instead of using the node_guid of the first HCA."); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP2 0/1] CVE-2021-46926
by Liu Mingrui 10 Apr '24

10 Apr '24

CVE-2021-46926 Libin Yang (1): ALSA: hda: intel-sdw-acpi: harden detection of controller drivers/soundwire/intel_init.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 2.25.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2021-46926
by Liu Mingrui 10 Apr '24

10 Apr '24

CVE-2021-46926 Libin Yang (1): ALSA: hda: intel-sdw-acpi: harden detection of controller drivers/soundwire/intel_init.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 2.25.1

2 2

[PATCH openEuler-22.03-LTS 0/1] CVE-2021-46926
by Liu Mingrui 10 Apr '24

10 Apr '24

CVE-2021-46926 Libin Yang (1): ALSA: hda: intel-sdw-acpi: harden detection of controller drivers/soundwire/intel_init.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 2.25.1

2 2