July 2024 - Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] drm/amdgpu: add error handle to avoid out-of-bounds
by Wenyu Huang 27 Jul '24

27 Jul '24

From: Bob Zhou <bob.zhou(a)amd.com> stable inclusion from stable-v6.6.34 commit 5b0a3dc3e87821acb80e841b464d335aff242691 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA8AED CVE: CVE-2024-39471 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8b2faf1a4f3b6c748c0da36cda865a226534d520 upstream. if the sdma_v4_0_irq_id_to_seq return -EINVAL, the process should be stop to avoid out-of-bounds read, so directly return -EINVAL. Signed-off-by: Bob Zhou <bob.zhou(a)amd.com> Acked-by: Christian König <christian.koenig(a)amd.com> Reviewed-by: Le Ma <le.ma(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c index cd37f45e01a11..31d82b68053ec 100644 --- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c +++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c @@ -2031,6 +2031,9 @@ static int sdma_v4_0_process_trap_irq(struct amdgpu_device *adev, DRM_DEBUG("IH: SDMA trap\n"); instance = sdma_v4_0_irq_id_to_seq(entry->client_id); + if (instance < 0) + return instance; + switch (entry->ring_id) { case 0: amdgpu_fence_process(&adev->sdma.instance[instance].ring); -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 11543/23370] drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_qres.o: warning: objtool: missing symbol for section .text
by kernel test robot 27 Jul '24

27 Jul '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 365ea86d72567c1550e42ecf0e3f4521da9a5570 commit: ed046b8a9bc5f5836ece3a3efa29c54f0fc904e7 [11543/23370] net: hns3: rename hns3_cae's files and remove send_cmdq config: x86_64-buildonly-randconfig-005-20240727 (https://download.01.org/0day-ci/archive/20240727/202407271613.wxmYLLXu-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240727/202407271613.wxmYLLXu-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202407271613.wxmYLLXu-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qres.c:6:5: warning: no previous prototype for function 'hns3_get_qres_rx_value' [-Wmissing-prototypes] 6 | int hns3_get_qres_rx_value(struct hns3_nic_priv *net_priv, int ring_id, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qres.c:6:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6 | int hns3_get_qres_rx_value(struct hns3_nic_priv *net_priv, int ring_id, | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qres.c:54:5: warning: no previous prototype for function 'hns3_get_qres_tx_value' [-Wmissing-prototypes] 54 | int hns3_get_qres_tx_value(struct hns3_nic_priv *net_priv, int ring_id, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qres.c:54:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 54 | int hns3_get_qres_tx_value(struct hns3_nic_priv *net_priv, int ring_id, | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qres.c:100:6: warning: no previous prototype for function 'fill_queue_info' [-Wmissing-prototypes] 100 | void fill_queue_info(struct hns3_nic_priv *net_priv, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qres.c:100:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 100 | void fill_queue_info(struct hns3_nic_priv *net_priv, | ^ | static 3 warnings generated. >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_qres.o: warning: objtool: missing symbol for section .text -- drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:19:6: warning: no previous prototype for function 'fill_port_info' [-Wmissing-prototypes] 19 | void fill_port_info(struct hclge_port_info *get_port_info_out, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:19:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 19 | void fill_port_info(struct hclge_port_info *get_port_info_out, | ^ | static 1 warning generated. >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_port.o: warning: objtool: missing symbol for section .text -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_hilink_param.o: warning: objtool: missing symbol for section .text -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_irq.o: warning: objtool: missing symbol for section .text -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_qinfo.o: warning: objtool: missing symbol for section .text -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_rss.o: warning: objtool: missing symbol for section .text -- drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:20:5: warning: no previous prototype for function 'hclge_test_send_generic_cmd' [-Wmissing-prototypes] 20 | int hclge_test_send_generic_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:20:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 20 | int hclge_test_send_generic_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:62:5: warning: no previous prototype for function 'hclge_test_send_allocate_cmd' [-Wmissing-prototypes] 62 | int hclge_test_send_allocate_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:62:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 62 | int hclge_test_send_allocate_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:100:5: warning: no previous prototype for function 'hclge_test_send_key_cfg_cmd' [-Wmissing-prototypes] 100 | int hclge_test_send_key_cfg_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:100:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 100 | int hclge_test_send_key_cfg_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:153:5: warning: no previous prototype for function 'hclge_test_send_tcam_op_cmd' [-Wmissing-prototypes] 153 | int hclge_test_send_tcam_op_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:153:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 153 | int hclge_test_send_tcam_op_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:224:5: warning: no previous prototype for function 'hclge_test_send_ad_op_cmd' [-Wmissing-prototypes] 224 | int hclge_test_send_ad_op_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:224:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 224 | int hclge_test_send_ad_op_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:267:5: warning: no previous prototype for function 'hclge_test_send_cnt_op_cmd' [-Wmissing-prototypes] 267 | int hclge_test_send_cnt_op_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:267:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 267 | int hclge_test_send_cnt_op_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ | static 6 warnings generated. >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_fd.o: warning: objtool: missing symbol for section .text -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_mac.o: warning: objtool: missing symbol for section .text -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_vlan.o: warning: objtool: missing symbol for section .text -- drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:9:19: warning: no previous prototype for function 'get_val_hdev' [-Wmissing-prototypes] 9 | struct hclge_dev *get_val_hdev(struct hns3_nic_priv *net_priv) | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:9:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 9 | struct hclge_dev *get_val_hdev(struct hns3_nic_priv *net_priv) | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:19:5: warning: no previous prototype for function 'hns3_cmd_rx_priv_wl_config' [-Wmissing-prototypes] 19 | int hns3_cmd_rx_priv_wl_config(struct hclge_dev *hdev, u16 tc, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:19:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 19 | int hns3_cmd_rx_priv_wl_config(struct hclge_dev *hdev, u16 tc, | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:89:5: warning: no previous prototype for function 'hns3_cmd_common_thrd_config' [-Wmissing-prototypes] 89 | int hns3_cmd_common_thrd_config(struct hclge_dev *hdev, u16 tc, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:89:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 89 | int hns3_cmd_common_thrd_config(struct hclge_dev *hdev, u16 tc, | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:161:5: warning: no previous prototype for function 'hns3_cmd_common_wl_config' [-Wmissing-prototypes] 161 | int hns3_cmd_common_wl_config(struct hclge_dev *hdev, u32 high, u32 low, u32 en) | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:161:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 161 | int hns3_cmd_common_wl_config(struct hclge_dev *hdev, u32 high, u32 low, u32 en) | ^ | static 4 warnings generated. >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_qos.o: warning: objtool: missing symbol for section .text -- drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_promisc.c:6:5: warning: no previous prototype for function 'hns3_read_promisc_mode_cfg' [-Wmissing-prototypes] 6 | int hns3_read_promisc_mode_cfg(struct hns3_nic_priv *nic_dev, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_promisc.c:6:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6 | int hns3_read_promisc_mode_cfg(struct hns3_nic_priv *nic_dev, | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_promisc.c:44:5: warning: no previous prototype for function 'hns3_set_promisc_mode_cfg' [-Wmissing-prototypes] 44 | int hns3_set_promisc_mode_cfg(struct hns3_nic_priv *nic_dev, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_promisc.c:44:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 44 | int hns3_set_promisc_mode_cfg(struct hns3_nic_priv *nic_dev, | ^ | static 2 warnings generated. >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_promisc.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] drm/amdgpu: add error handle to avoid out-of-bounds
by Wenyu Huang 27 Jul '24

27 Jul '24

From: Bob Zhou <bob.zhou(a)amd.com> stable inclusion from stable-v5.10.220 commit 8112fa72b7f139052843ff484130d6f97e9f052f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA8AED CVE: CVE-2024-39471 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 8b2faf1a4f3b6c748c0da36cda865a226534d520 upstream. if the sdma_v4_0_irq_id_to_seq return -EINVAL, the process should be stop to avoid out-of-bounds read, so directly return -EINVAL. Signed-off-by: Bob Zhou <bob.zhou(a)amd.com> Acked-by: Christian König <christian.koenig(a)amd.com> Reviewed-by: Le Ma <le.ma(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c index dbcaef3f35da9..c54834ed8751e 100644 --- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c +++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c @@ -2073,6 +2073,9 @@ static int sdma_v4_0_process_trap_irq(struct amdgpu_device *adev, DRM_DEBUG("IH: SDMA trap\n"); instance = sdma_v4_0_irq_id_to_seq(entry->client_id); + if (instance < 0) + return instance; + switch (entry->ring_id) { case 0: amdgpu_fence_process(&adev->sdma.instance[instance].ring); -- 2.34.1

2 1

[PATCH OLK-6.6] mm/page_table_check: fix crash on ZONE_DEVICE
by Wupeng Ma 27 Jul '24

27 Jul '24

From: Peter Xu <peterx(a)redhat.com> stable inclusion from stable-v6.6.36 commit 84d3549d54f5ff9fa3281257be3019386f51d1a0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACSUZ CVE: CVE-2024-40948 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8bb592c2eca8fd2bc06db7d80b38da18da4a2f43 upstream. Not all pages may apply to pgtable check. One example is ZONE_DEVICE pages: they map PFNs directly, and they don't allocate page_ext at all even if there's struct page around. One may reference devm_memremap_pages(). When both ZONE_DEVICE and page-table-check enabled, then try to map some dax memories, one can trigger kernel bug constantly now when the kernel was trying to inject some pfn maps on the dax device: kernel BUG at mm/page_table_check.c:55! While it's pretty legal to use set_pxx_at() for ZONE_DEVICE pages for page fault resolutions, skip all the checks if page_ext doesn't even exist in pgtable checker, which applies to ZONE_DEVICE but maybe more. Link: https://lkml.kernel.org/r/20240605212146.994486-1-peterx@redhat.com Fixes: df4e817b7108 ("mm: page table check") Signed-off-by: Peter Xu <peterx(a)redhat.com> Reviewed-by: Pasha Tatashin <pasha.tatashin(a)soleen.com> Reviewed-by: Dan Williams <dan.j.williams(a)intel.com> Reviewed-by: Alistair Popple <apopple(a)nvidia.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- mm/page_table_check.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/mm/page_table_check.c b/mm/page_table_check.c index af69c3c8f7c2..6363f93a47c6 100644 --- a/mm/page_table_check.c +++ b/mm/page_table_check.c @@ -71,6 +71,9 @@ static void page_table_check_clear(unsigned long pfn, unsigned long pgcnt) page = pfn_to_page(pfn); page_ext = page_ext_get(page); + if (!page_ext) + return; + BUG_ON(PageSlab(page)); anon = PageAnon(page); @@ -108,6 +111,9 @@ static void page_table_check_set(unsigned long pfn, unsigned long pgcnt, page = pfn_to_page(pfn); page_ext = page_ext_get(page); + if (!page_ext) + return; + BUG_ON(PageSlab(page)); anon = PageAnon(page); @@ -138,7 +144,10 @@ void __page_table_check_zero(struct page *page, unsigned int order) BUG_ON(PageSlab(page)); page_ext = page_ext_get(page); - BUG_ON(!page_ext); + + if (!page_ext) + return; + for (i = 0; i < (1ul << order); i++) { struct page_table_check *ptc = get_page_table_check(page_ext); -- 2.25.1

2 1

[PATCH OLK-5.10] net/smc: enable smcrv1 when RNIC supports rocev2
by Zhengchao Shao 27 Jul '24

27 Jul '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAFYD8 ----------------------------------------- When the RNIC supports rocev2, smcrv1 can also be used to send and receive packets. Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/smc/smc_ib.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/net/smc/smc_ib.c b/net/smc/smc_ib.c index 2e0d7aeefc41..3e45bcc51cb4 100644 --- a/net/smc/smc_ib.c +++ b/net/smc/smc_ib.c @@ -201,8 +201,7 @@ int smc_ib_determine_gid(struct smc_ib_device *smcibdev, u8 ibport, if (!IS_ERR(ndev) && ((!vlan_id && !is_vlan_dev(ndev)) || (vlan_id && is_vlan_dev(ndev) && - vlan_dev_vlan_id(ndev) == vlan_id)) && - attr->gid_type == IB_GID_TYPE_ROCE) { + vlan_dev_vlan_id(ndev) == vlan_id))) { rcu_read_unlock(); if (gid) memcpy(gid, &attr->gid, SMC_GID_SIZE); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] NFC: port100: fix use-after-free in port100_send_complete
by Wupeng Ma 27 Jul '24

27 Jul '24

From: Pavel Skripkin <paskripkin(a)gmail.com> stable inclusion from stable-v4.19.235 commit b1db33d4e54bc35d8db96ce143ea0ef92e23d58e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6S9P CVE: CVE-2022-48857 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f80cfe2f26581f188429c12bd937eb905ad3ac7b ] Syzbot reported UAF in port100_send_complete(). The root case is in missing usb_kill_urb() calls on error handling path of ->probe function. port100_send_complete() accesses devm allocated memory which will be freed on probe failure. We should kill this urbs before returning an error from probe function to prevent reported use-after-free Fail log: BUG: KASAN: use-after-free in port100_send_complete+0x16e/0x1a0 drivers/nfc/port100.c:935 Read of size 1 at addr ffff88801bb59540 by task ksoftirqd/2/26 ... Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x8d/0x303 mm/kasan/report.c:255 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 port100_send_complete+0x16e/0x1a0 drivers/nfc/port100.c:935 __usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1670 ... Allocated by task 1255: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:436 [inline] ____kasan_kmalloc mm/kasan/common.c:515 [inline] ____kasan_kmalloc mm/kasan/common.c:474 [inline] __kasan_kmalloc+0xa6/0xd0 mm/kasan/common.c:524 alloc_dr drivers/base/devres.c:116 [inline] devm_kmalloc+0x96/0x1d0 drivers/base/devres.c:823 devm_kzalloc include/linux/device.h:209 [inline] port100_probe+0x8a/0x1320 drivers/nfc/port100.c:1502 Freed by task 1255: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:45 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:366 [inline] ____kasan_slab_free+0xff/0x140 mm/kasan/common.c:328 kasan_slab_free include/linux/kasan.h:236 [inline] __cache_free mm/slab.c:3437 [inline] kfree+0xf8/0x2b0 mm/slab.c:3794 release_nodes+0x112/0x1a0 drivers/base/devres.c:501 devres_release_all+0x114/0x190 drivers/base/devres.c:530 really_probe+0x626/0xcc0 drivers/base/dd.c:670 Reported-and-tested-by: syzbot+16bcb127fb73baeecb14(a)syzkaller.appspotmail.com Fixes: 0347a6ab300a ("NFC: port100: Commands mechanism implementation") Signed-off-by: Pavel Skripkin <paskripkin(a)gmail.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)canonical.com> Link: https://lore.kernel.org/r/20220308185007.6987-1-paskripkin@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- drivers/nfc/port100.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/nfc/port100.c b/drivers/nfc/port100.c index 60ae382f50da..08da712ad45f 100644 --- a/drivers/nfc/port100.c +++ b/drivers/nfc/port100.c @@ -1618,7 +1618,9 @@ static int port100_probe(struct usb_interface *interface, nfc_digital_free_device(dev->nfc_digital_dev); error: + usb_kill_urb(dev->in_urb); usb_free_urb(dev->in_urb); + usb_kill_urb(dev->out_urb); usb_free_urb(dev->out_urb); usb_put_dev(dev->udev); -- 2.25.1

2 1

[openeuler:OLK-5.10] BUILD SUCCESS 2b2a7e656e24161c2ed8fbec4744b6f231431b7f
by kernel test robot 27 Jul '24

27 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 2b2a7e656e24161c2ed8fbec4744b6f231431b7f !10316 sched: Add cfs_preferred_nid_init hook elapsed time: 731m configs tested: 35 configs skipped: 138 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240727 clang-20 arm64 randconfig-002-20240727 gcc-14.1.0 arm64 randconfig-003-20240727 gcc-14.1.0 arm64 randconfig-004-20240727 clang-20 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240727 gcc-8 x86_64 buildonly-randconfig-002-20240727 gcc-13 x86_64 buildonly-randconfig-003-20240727 gcc-13 x86_64 buildonly-randconfig-004-20240727 gcc-13 x86_64 buildonly-randconfig-005-20240727 clang-18 x86_64 buildonly-randconfig-006-20240727 gcc-13 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240727 gcc-13 x86_64 randconfig-002-20240727 clang-18 x86_64 randconfig-003-20240727 clang-18 x86_64 randconfig-004-20240727 clang-18 x86_64 randconfig-005-20240727 gcc-13 x86_64 randconfig-006-20240727 clang-18 x86_64 randconfig-011-20240727 gcc-13 x86_64 randconfig-012-20240727 gcc-13 x86_64 randconfig-013-20240727 clang-18 x86_64 randconfig-014-20240727 gcc-10 x86_64 randconfig-015-20240727 gcc-12 x86_64 randconfig-016-20240727 gcc-10 x86_64 randconfig-071-20240727 gcc-13 x86_64 randconfig-072-20240727 gcc-13 x86_64 randconfig-073-20240727 gcc-8 x86_64 randconfig-074-20240727 gcc-8 x86_64 randconfig-075-20240727 clang-18 x86_64 randconfig-076-20240727 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD SUCCESS 06bfbb032512dd58dfe4598cca653d0021fea49a
by kernel test robot 27 Jul '24

27 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 06bfbb032512dd58dfe4598cca653d0021fea49a !9892 support for SMC-D loopback_lo feature Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | `-- clang:warning:no-such-include-directory:drivers-infiniband-hw-hiroce3-include-mag |-- arm64-defconfig | |-- WARNING:modpost:vmlinux:section-mismatch-in-reference:arm_smmu_device_probe-(section:.text)-arm_smmu_v3_plat_info-(section:.init.data) | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- arm64-randconfig-002-20240727 | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- arm64-randconfig-003-20240727 | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- loongarch-allmodconfig | `-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument |-- loongarch-defconfig | |-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- loongarch-randconfig-001-20240727 | |-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- loongarch-randconfig-002-20240727 | |-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and `-- x86_64-allyesconfig `-- drivers-gpu-drm-amd-amdgpu-..-amdkfd-kfd_topology.c:warning:stack-frame-size-()-exceeds-limit-()-in-kfd_topology_add_device elapsed time: 726m configs tested: 31 configs skipped: 134 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240727 clang-20 arm64 randconfig-002-20240727 gcc-14.1.0 arm64 randconfig-003-20240727 gcc-14.1.0 arm64 randconfig-004-20240727 clang-20 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch defconfig gcc-14.1.0 loongarch randconfig-001-20240727 gcc-14.1.0 loongarch randconfig-002-20240727 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240727 gcc-8 x86_64 buildonly-randconfig-002-20240727 gcc-13 x86_64 buildonly-randconfig-003-20240727 gcc-13 x86_64 buildonly-randconfig-004-20240727 gcc-13 x86_64 buildonly-randconfig-005-20240727 clang-18 x86_64 buildonly-randconfig-006-20240727 gcc-13 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240727 gcc-13 x86_64 randconfig-002-20240727 clang-18 x86_64 randconfig-003-20240727 clang-18 x86_64 randconfig-004-20240727 clang-18 x86_64 randconfig-005-20240727 gcc-13 x86_64 randconfig-006-20240727 clang-18 x86_64 randconfig-011-20240727 gcc-13 x86_64 randconfig-012-20240727 gcc-13 x86_64 randconfig-013-20240727 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 9458/23370] drivers/iommu/.tmp_amd_iommu_quirks.o: warning: objtool: missing symbol for section .text
by kernel test robot 27 Jul '24

27 Jul '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 365ea86d72567c1550e42ecf0e3f4521da9a5570 commit: fe2ee4839a7421367da12f5610e1b45c619fcbad [9458/23370] iommu/amd: Override wrong IVRS IOAPIC on Raven Ridge systems config: x86_64-buildonly-randconfig-005-20240727 (https://download.01.org/0day-ci/archive/20240727/202407271424.5G6KyQ0z-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240727/202407271424.5G6KyQ0z-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202407271424.5G6KyQ0z-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/iommu/.tmp_amd_iommu_quirks.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] kobject: Fix global-out-of-bounds in kobject_action_type()
by Xia Fukun 27 Jul '24

27 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9REGZ CVE: NA -------------------------------- The following c language code can trigger KASAN's global variable out-of-bounds access error in kobject_action_type(): int main() { int fd; char *filename = "/sys/block/ram12/uevent"; char str[86] = "offline"; int len = 86; fd = open(filename, O_WRONLY); if (fd == -1) { printf("open"); exit(1); } if (write(fd, str, len) == -1) { printf("write"); exit(1); } close(fd); return 0; } Function kobject_action_type() receives the input parameters buf and count, where count is the length of the string buf. In the use case we provided, count is 86, the count_first is 85. Buf points to a string with a length of 86, and its first seven characters are "offline". In line 87 of the code, kobject_actions[action] is the string "offline" with the length of 7,an out-of-boundary access will appear: kobject_actions[action][85]. Modify the judgment logic in line 87. If the length of the string kobject_actions[action] is greater than count_first(e.g. buf is "off", count is 3), continue the loop. Otherwise, the match is considered successful. This change means that our test case will be successfully parsed as an offline event and no out-of-bounds access error will occur. Fixes: f36776fafbaa ("kobject: support passing in variables for synthetic uevents") Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- lib/kobject_uevent.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c index 26d21339bef27..b5fc7b9ce197a 100644 --- a/lib/kobject_uevent.c +++ b/lib/kobject_uevent.c @@ -84,7 +84,7 @@ static int kobject_action_type(const char *buf, size_t count, for (action = 0; action < ARRAY_SIZE(kobject_actions); action++) { if (strncmp(kobject_actions[action], buf, count_first) != 0) continue; - if (kobject_actions[action][count_first] != '\0') + if (strlen(kobject_actions[action]) > count_first) continue; if (args) *args = args_start; -- 2.34.1

2 1