tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS
head: c55d99182a85f38a964fe23a2db2ddf42739a151
commit: b8815fbbe89b0d15fa3296c3e57d2197a92f5bc0 [18534/23123] ACPI: CPPC: Fix cppc_cpufreq_init failed in CPU Hotplug situation
config: x86_64-randconfig-103-20240609
compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202406302227.jm9BopPY-lkp@intel.com/
cocci warnings: (new ones prefixed by >>)
>> drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed.
vim +614 drivers/acpi/cppc_acpi.c
576
577 int acpi_get_psd_map(struct cppc_cpudata **all_cpu_data)
578 {
579 struct cpc_desc **cpc_pptr, *cpc_ptr;
580 int parsed_core_num = 0;
581 int i, ret;
582
583 cpc_pptr = kcalloc(num_possible_cpus(), sizeof(void *), GFP_KERNEL);
584 if (!cpc_pptr)
585 return -ENOMEM;
586 for_each_possible_cpu(i) {
587 cpc_pptr[i] = kzalloc(sizeof(struct cpc_desc), GFP_KERNEL);
588 if (!cpc_pptr[i]) {
589 ret = -ENOMEM;
590 goto out;
591 }
592 }
593
594 /*
595 * We can not use acpi_get_devices() to walk the processor devices
596 * because some processor device is not present.
597 */
598 ret = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT,
599 ACPI_UINT32_MAX, acpi_parse_cpc, NULL,
600 cpc_pptr, (void **)&parsed_core_num);
601 if (ret)
602 goto out;
603 if (parsed_core_num != num_possible_cpus()) {
604 ret = -EINVAL;
605 goto out;
606 }
607
608 ret = __acpi_get_psd_map(all_cpu_data, cpc_pptr);
609
610 out:
611 for_each_possible_cpu(i) {
612 cpc_ptr = cpc_pptr[i];
613 if (cpc_ptr)
> 614 kfree(cpc_ptr);
615 }
616 kfree(cpc_pptr);
617
618 return ret;
619 }
620 EXPORT_SYMBOL_GPL(acpi_get_psd_map);
621
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Hi Malloy,
FYI, the error/warning still remains.
tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS
head: c55d99182a85f38a964fe23a2db2ddf42739a151
commit: e8483fcd43fc1dbb8d21bb7eacce804cbab6a7c6 [21291/23123] spi: add phytium spi support
config: x86_64-randconfig-005-20240420
compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18)
reproduce (this is a W=1 build):
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202406301902.JqosVzpZ-lkp@intel.com/
All warnings (new ones prefixed by >>):
>> drivers/spi/spi-phytium-plat.c:186:34: warning: unused variable 'phytium_spi_of_match' [-Wunused-const-variable]
186 | static const struct of_device_id phytium_spi_of_match[] = {
| ^~~~~~~~~~~~~~~~~~~~
1 warning generated.
Kconfig warnings: (for reference only)
WARNING: unmet direct dependencies detected for SPI_PHYTIUM
Depends on [n]: SPI [=y] && SPI_MASTER [=y] && (ARCH_PHYTIUM || COMPILE_TEST [=n])
Selected by [y]:
- SPI_PHYTIUM_PLAT [=y] && SPI [=y] && SPI_MASTER [=y]
vim +/phytium_spi_of_match +186 drivers/spi/spi-phytium-plat.c
185
> 186 static const struct of_device_id phytium_spi_of_match[] = {
187 { .compatible = "phytium,spi", .data = (void *)0 },
188 { /* end of table */}
189 };
190 MODULE_DEVICE_TABLE(of, phytium_spi_of_match);
191
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Hi Cheng,
FYI, the error/warning still remains.
tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS
head: c55d99182a85f38a964fe23a2db2ddf42739a151
commit: 7e2ab91ea07673f855f16b54b7c6e6853b2efc1c [13138/23123] livepatch/x86: support livepatch without ftrace
config: x86_64-randconfig-073-20240521
compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1)
reproduce (this is a W=1 build):
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202406301639.M9qvyoyY-lkp@intel.com/
All warnings (new ones prefixed by >>):
>> kernel/livepatch/core.c:75:16: warning: no previous prototype for function 'klp_check_patch_kprobed' [-Wmissing-prototypes]
75 | struct kprobe *klp_check_patch_kprobed(struct klp_patch *patch)
| ^
kernel/livepatch/core.c:75:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
75 | struct kprobe *klp_check_patch_kprobed(struct klp_patch *patch)
| ^
| static
kernel/livepatch/core.c:402:5: warning: no previous prototype for function 'klp_try_disable_patch' [-Wmissing-prototypes]
402 | int klp_try_disable_patch(void *data)
| ^
kernel/livepatch/core.c:402:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
402 | int klp_try_disable_patch(void *data)
| ^
| static
kernel/livepatch/core.c:441:13: warning: no previous prototype for function 'arch_klp_code_modify_prepare' [-Wmissing-prototypes]
441 | void __weak arch_klp_code_modify_prepare(void)
| ^
kernel/livepatch/core.c:441:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
441 | void __weak arch_klp_code_modify_prepare(void)
| ^
| static
kernel/livepatch/core.c:445:13: warning: no previous prototype for function 'arch_klp_code_modify_post_process' [-Wmissing-prototypes]
445 | void __weak arch_klp_code_modify_post_process(void)
| ^
kernel/livepatch/core.c:445:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
445 | void __weak arch_klp_code_modify_post_process(void)
| ^
| static
kernel/livepatch/core.c:617:5: warning: no previous prototype for function 'klp_try_enable_patch' [-Wmissing-prototypes]
617 | int klp_try_enable_patch(void *data)
| ^
kernel/livepatch/core.c:617:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
617 | int klp_try_enable_patch(void *data)
| ^
| static
kernel/livepatch/core.c:1013:12: warning: no previous prototype for function 'arch_klp_func_can_patch' [-Wmissing-prototypes]
1013 | int __weak arch_klp_func_can_patch(struct klp_func *func)
| ^
kernel/livepatch/core.c:1013:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
1013 | int __weak arch_klp_func_can_patch(struct klp_func *func)
| ^
| static
6 warnings generated.
vim +/klp_check_patch_kprobed +75 kernel/livepatch/core.c
7e8d223e3ef865 Cheng Jian 2019-01-28 69
c8f9d7a3aae362 Cheng Jian 2019-01-28 70 #ifdef CONFIG_LIVEPATCH_RESTRICT_KPROBE
c8f9d7a3aae362 Cheng Jian 2019-01-28 71 /*
c8f9d7a3aae362 Cheng Jian 2019-01-28 72 * Check whether a function has been registered with kprobes before patched.
c8f9d7a3aae362 Cheng Jian 2019-01-28 73 * We can't patched this function util we unregisted the kprobes.
c8f9d7a3aae362 Cheng Jian 2019-01-28 74 */
c8f9d7a3aae362 Cheng Jian 2019-01-28 @75 struct kprobe *klp_check_patch_kprobed(struct klp_patch *patch)
c8f9d7a3aae362 Cheng Jian 2019-01-28 76 {
c8f9d7a3aae362 Cheng Jian 2019-01-28 77 struct klp_object *obj;
c8f9d7a3aae362 Cheng Jian 2019-01-28 78 struct klp_func *func;
c8f9d7a3aae362 Cheng Jian 2019-01-28 79 struct kprobe *kp;
c8f9d7a3aae362 Cheng Jian 2019-01-28 80 int i;
c8f9d7a3aae362 Cheng Jian 2019-01-28 81
c8f9d7a3aae362 Cheng Jian 2019-01-28 82 klp_for_each_object(patch, obj) {
c8f9d7a3aae362 Cheng Jian 2019-01-28 83 klp_for_each_func(obj, func) {
c8f9d7a3aae362 Cheng Jian 2019-01-28 84 for (i = 0; i < func->old_size; i++) {
c8f9d7a3aae362 Cheng Jian 2019-01-28 85 kp = get_kprobe((void *)func->old_addr + i);
c8f9d7a3aae362 Cheng Jian 2019-01-28 86 if (kp) {
c8f9d7a3aae362 Cheng Jian 2019-01-28 87 pr_err("func %s has been probed, (un)patch failed\n",
c8f9d7a3aae362 Cheng Jian 2019-01-28 88 func->old_name);
c8f9d7a3aae362 Cheng Jian 2019-01-28 89 return kp;
c8f9d7a3aae362 Cheng Jian 2019-01-28 90 }
c8f9d7a3aae362 Cheng Jian 2019-01-28 91 }
c8f9d7a3aae362 Cheng Jian 2019-01-28 92 }
c8f9d7a3aae362 Cheng Jian 2019-01-28 93 }
c8f9d7a3aae362 Cheng Jian 2019-01-28 94
c8f9d7a3aae362 Cheng Jian 2019-01-28 95 return NULL;
c8f9d7a3aae362 Cheng Jian 2019-01-28 96 }
c8f9d7a3aae362 Cheng Jian 2019-01-28 97 #else
c8f9d7a3aae362 Cheng Jian 2019-01-28 98 static inline struct kprobe *klp_check_patch_kprobed(struct klp_patch *patch)
c8f9d7a3aae362 Cheng Jian 2019-01-28 99 {
c8f9d7a3aae362 Cheng Jian 2019-01-28 100 return NULL;
c8f9d7a3aae362 Cheng Jian 2019-01-28 101 }
c8f9d7a3aae362 Cheng Jian 2019-01-28 102 #endif /* CONFIG_LIVEPATCH_RESTRICT_KPROBE */
c8f9d7a3aae362 Cheng Jian 2019-01-28 103
:::::: The code at line 75 was first introduced by commit
:::::: c8f9d7a3aae362482f81ba7c6819d410d66619ab livepatch/core: Restrict livepatch patched/unpatched when plant kprobe
:::::: TO: Cheng Jian <cj.chengjian(a)huawei.com>
:::::: CC: Xie XiuQi <xiexiuqi(a)huawei.com>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS
head: c55d99182a85f38a964fe23a2db2ddf42739a151
commit: 7fc993d55d1b54ae40e29dfac825a18d04d644c6 [14777/23123] scsi/hifc: add hifc driver FC service module
config: x86_64-buildonly-randconfig-001-20240627
compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1)
reproduce (this is a W=1 build):
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202406301629.78CQgAev-lkp@intel.com/
All warnings (new ones prefixed by >>):
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/scsi/huawei/hifc/unf_npiv.c:173:14: warning: no previous prototype for function 'unf_alloc_vp_index' [-Wmissing-prototypes]
173 | unsigned int unf_alloc_vp_index(struct unf_vport_pool_s *v_vport_pool,
| ^
drivers/scsi/huawei/hifc/unf_npiv.c:173:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
173 | unsigned int unf_alloc_vp_index(struct unf_vport_pool_s *v_vport_pool,
| ^
| static
drivers/scsi/huawei/hifc/unf_npiv.c:229:6: warning: no previous prototype for function 'unf_free_vp_index' [-Wmissing-prototypes]
229 | void unf_free_vp_index(struct unf_vport_pool_s *v_vport_pool,
| ^
drivers/scsi/huawei/hifc/unf_npiv.c:229:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
229 | void unf_free_vp_index(struct unf_vport_pool_s *v_vport_pool,
| ^
| static
drivers/scsi/huawei/hifc/unf_npiv.c:255:21: warning: no previous prototype for function 'unf_get_free_vport' [-Wmissing-prototypes]
255 | struct unf_lport_s *unf_get_free_vport(struct unf_lport_s *v_lport)
| ^
drivers/scsi/huawei/hifc/unf_npiv.c:255:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
255 | struct unf_lport_s *unf_get_free_vport(struct unf_lport_s *v_lport)
| ^
| static
drivers/scsi/huawei/hifc/unf_npiv.c:287:6: warning: no previous prototype for function 'unf_vport_back_to_pool' [-Wmissing-prototypes]
287 | void unf_vport_back_to_pool(void *v_vport)
| ^
drivers/scsi/huawei/hifc/unf_npiv.c:287:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
287 | void unf_vport_back_to_pool(void *v_vport)
| ^
| static
drivers/scsi/huawei/hifc/unf_npiv.c:312:6: warning: no previous prototype for function 'unf_init_vport_from_lport' [-Wmissing-prototypes]
312 | void unf_init_vport_from_lport(struct unf_lport_s *v_vport,
| ^
drivers/scsi/huawei/hifc/unf_npiv.c:312:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
312 | void unf_init_vport_from_lport(struct unf_lport_s *v_vport,
| ^
| static
drivers/scsi/huawei/hifc/unf_npiv.c:339:6: warning: no previous prototype for function 'unf_check_vport_pool_status' [-Wmissing-prototypes]
339 | void unf_check_vport_pool_status(struct unf_lport_s *v_lport)
| ^
drivers/scsi/huawei/hifc/unf_npiv.c:339:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
339 | void unf_check_vport_pool_status(struct unf_lport_s *v_lport)
| ^
| static
drivers/scsi/huawei/hifc/unf_npiv.c:366:6: warning: no previous prototype for function 'unf_vport_deinit' [-Wmissing-prototypes]
366 | void unf_vport_deinit(void *v_vport)
| ^
drivers/scsi/huawei/hifc/unf_npiv.c:366:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
366 | void unf_vport_deinit(void *v_vport)
| ^
| static
drivers/scsi/huawei/hifc/unf_npiv.c:410:14: warning: no previous prototype for function 'unf_vport_init' [-Wmissing-prototypes]
410 | unsigned int unf_vport_init(void *v_vport)
| ^
drivers/scsi/huawei/hifc/unf_npiv.c:410:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
410 | unsigned int unf_vport_init(void *v_vport)
| ^
| static
drivers/scsi/huawei/hifc/unf_npiv.c:928:6: warning: no previous prototype for function 'unf_vport_abort_all_sfs_exch' [-Wmissing-prototypes]
928 | void unf_vport_abort_all_sfs_exch(struct unf_lport_s *vport)
| ^
drivers/scsi/huawei/hifc/unf_npiv.c:928:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
928 | void unf_vport_abort_all_sfs_exch(struct unf_lport_s *vport)
| ^
| static
drivers/scsi/huawei/hifc/unf_npiv.c:979:6: warning: no previous prototype for function 'unf_vport_abort_ini_io_exch' [-Wmissing-prototypes]
979 | void unf_vport_abort_ini_io_exch(struct unf_lport_s *vport)
| ^
drivers/scsi/huawei/hifc/unf_npiv.c:979:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
979 | void unf_vport_abort_ini_io_exch(struct unf_lport_s *vport)
| ^
| static
drivers/scsi/huawei/hifc/unf_npiv.c:1028:6: warning: no previous prototype for function 'unf_vport_abort_all_exch' [-Wmissing-prototypes]
1028 | void unf_vport_abort_all_exch(struct unf_lport_s *vport)
| ^
drivers/scsi/huawei/hifc/unf_npiv.c:1028:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
1028 | void unf_vport_abort_all_exch(struct unf_lport_s *vport)
| ^
| static
drivers/scsi/huawei/hifc/unf_npiv.c:1037:14: warning: no previous prototype for function 'unf_vport_wait_all_exch_removed' [-Wmissing-prototypes]
1037 | unsigned int unf_vport_wait_all_exch_removed(struct unf_lport_s *vport)
| ^
drivers/scsi/huawei/hifc/unf_npiv.c:1037:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
1037 | unsigned int unf_vport_wait_all_exch_removed(struct unf_lport_s *vport)
| ^
| static
drivers/scsi/huawei/hifc/unf_npiv.c:1114:14: warning: no previous prototype for function 'unf_vport_wait_rports_removed' [-Wmissing-prototypes]
1114 | unsigned int unf_vport_wait_rports_removed(struct unf_lport_s *vport)
| ^
drivers/scsi/huawei/hifc/unf_npiv.c:1114:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
1114 | unsigned int unf_vport_wait_rports_removed(struct unf_lport_s *vport)
| ^
| static
drivers/scsi/huawei/hifc/unf_npiv.c:1303:5: warning: no previous prototype for function 'unf_process_vports_linkup' [-Wmissing-prototypes]
1303 | int unf_process_vports_linkup(void *v_arg_in, void *v_arg_out)
| ^
drivers/scsi/huawei/hifc/unf_npiv.c:1303:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
1303 | int unf_process_vports_linkup(void *v_arg_in, void *v_arg_out)
| ^
| static
15 warnings generated.
>> drivers/scsi/huawei/hifc/unf_npiv.o: warning: objtool: missing symbol for section .text
--
In file included from drivers/scsi/huawei/hifc/unf_io_abnormal.c:8:
In file included from drivers/scsi/huawei/hifc/unf_exchg.h:9:
In file included from drivers/scsi/huawei/hifc/unf_scsi_common.h:10:
In file included from drivers/scsi/huawei/hifc/hifc_knl_adp.h:30:
In file included from include/scsi/scsi_host.h:12:
In file included from include/linux/blk-mq.h:5:
In file included from include/linux/blkdev.h:16:
include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict]
425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage;
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/scsi/huawei/hifc/unf_io_abnormal.c:445:5: warning: no previous prototype for function 'unf_send_scsi_mgmt_cmnd' [-Wmissing-prototypes]
445 | int unf_send_scsi_mgmt_cmnd(struct unf_xchg_s *v_xchg,
| ^
drivers/scsi/huawei/hifc/unf_io_abnormal.c:445:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
445 | int unf_send_scsi_mgmt_cmnd(struct unf_xchg_s *v_xchg,
| ^
| static
2 warnings generated.
>> drivers/scsi/huawei/hifc/unf_io_abnormal.o: warning: objtool: missing symbol for section .text
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
From: Fedor Pchelkin <pchelkin(a)ispras.ru>
mainline inclusion
from mainline-v6.10-rc2
commit e64746e74f717961250a155e14c156616fcd981f
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA7DCL
CVE: CVE-2024-39277
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
cpumask_of_node() can be called for NUMA_NO_NODE inside do_map_benchmark()
resulting in the following sanitizer report:
UBSAN: array-index-out-of-bounds in ./arch/x86/include/asm/topology.h:72:28
index -1 is out of range for type 'cpumask [64][1]'
CPU: 1 PID: 990 Comm: dma_map_benchma Not tainted 6.9.0-rc6 #29
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
Call Trace:
<TASK>
dump_stack_lvl (lib/dump_stack.c:117)
ubsan_epilogue (lib/ubsan.c:232)
__ubsan_handle_out_of_bounds (lib/ubsan.c:429)
cpumask_of_node (arch/x86/include/asm/topology.h:72) [inline]
do_map_benchmark (kernel/dma/map_benchmark.c:104)
map_benchmark_ioctl (kernel/dma/map_benchmark.c:246)
full_proxy_unlocked_ioctl (fs/debugfs/file.c:333)
__x64_sys_ioctl (fs/ioctl.c:890)
do_syscall_64 (arch/x86/entry/common.c:83)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
Use cpumask_of_node() in place when binding a kernel thread to a cpuset
of a particular node.
Note that the provided node id is checked inside map_benchmark_ioctl().
It's just a NUMA_NO_NODE case which is not handled properly later.
Found by Linux Verification Center (linuxtesting.org).
Fixes: 65789daa8087 ("dma-mapping: add benchmark support for streaming DMA APIs")
Signed-off-by: Fedor Pchelkin <pchelkin(a)ispras.ru>
Acked-by: Barry Song <baohua(a)kernel.org>
Signed-off-by: Christoph Hellwig <hch(a)lst.de>
Signed-off-by: Liu Shixin <liushixin2(a)huawei.com>
---
kernel/dma/map_benchmark.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/kernel/dma/map_benchmark.c b/kernel/dma/map_benchmark.c
index e0e64f8b0739..c2d225e1cd47 100644
--- a/kernel/dma/map_benchmark.c
+++ b/kernel/dma/map_benchmark.c
@@ -121,7 +121,6 @@ static int do_map_benchmark(struct map_benchmark_data *map)
struct task_struct **tsk;
int threads = map->bparam.threads;
int node = map->bparam.node;
- const cpumask_t *cpu_mask = cpumask_of_node(node);
u64 loops;
int ret = 0;
int i;
@@ -142,7 +141,7 @@ static int do_map_benchmark(struct map_benchmark_data *map)
}
if (node != NUMA_NO_NODE)
- kthread_bind_mask(tsk[i], cpu_mask);
+ kthread_bind_mask(tsk[i], cpumask_of_node(node));
}
/* clear the old value in the previous benchmark */
--
2.25.1
From: Zhipeng Lu <alexious(a)zju.edu.cn>
stable inclusion
from stable-v5.10.219
commit 4b68b861b514a5c09220d622ac3784c0ebac6c80
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6SGC
CVE: CVE-2024-38547
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 3b621e9e9e148c0928ab109ac3d4b81487469acb ]
The allocation failure of mycs->yuv_scaler_binary in load_video_binaries()
is followed with a dereference of mycs->yuv_scaler_binary after the
following call chain:
sh_css_pipe_load_binaries()
|-> load_video_binaries(mycs->yuv_scaler_binary == NULL)
|
|-> sh_css_pipe_unload_binaries()
|-> unload_video_binaries()
In unload_video_binaries(), it calls to ia_css_binary_unload with argument
&pipe->pipe_settings.video.yuv_scaler_binary[i], which refers to the
same memory slot as mycs->yuv_scaler_binary. Thus, a null-pointer
dereference is triggered.
Link: https://lore.kernel.org/r/20240118151303.3828292-1-alexious@zju.edu.cn
Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2")
Signed-off-by: Zhipeng Lu <alexious(a)zju.edu.cn>
Reviewed-by: Andy Shevchenko <andy.shevchenko(a)gmail.com>
Signed-off-by: Hans de Goede <hdegoede(a)redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Liu Shixin <liushixin2(a)huawei.com>
---
drivers/staging/media/atomisp/pci/sh_css.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/staging/media/atomisp/pci/sh_css.c b/drivers/staging/media/atomisp/pci/sh_css.c
index 54a18921fbd1..cb0354520360 100644
--- a/drivers/staging/media/atomisp/pci/sh_css.c
+++ b/drivers/staging/media/atomisp/pci/sh_css.c
@@ -5477,6 +5477,7 @@ static int load_video_binaries(struct ia_css_pipe *pipe)
mycs->yuv_scaler_binary = kzalloc(cas_scaler_descr.num_stage *
sizeof(struct ia_css_binary), GFP_KERNEL);
if (!mycs->yuv_scaler_binary) {
+ mycs->num_yuv_scaler = 0;
err = -ENOMEM;
return err;
}
--
2.25.1