January 2025 - Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/2] fix BUG: unable to handle kernel paging request in build_id_parse
by Tong Tiangen 23 Jan '25

23 Jan '25

Andrii Nakryiko (1): lib/buildid: Handle memfd_secret() files in build_id_parse() David Hildenbrand (1): mm: merge folio_is_secretmem() and folio_fast_pin_allowed() into gup_fast_folio_allowed() include/linux/secretmem.h | 21 ++--------------- lib/buildid.c | 5 ++++ mm/gup.c | 48 +++++++++++++++++++++++---------------- 3 files changed, 35 insertions(+), 39 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 v2 0/2] fix BUG: unable to handle kernel paging request in build_id_parse
by Tong Tiangen 23 Jan '25

23 Jan '25

Andrii Nakryiko (1): lib/buildid: Handle memfd_secret() files in build_id_parse() David Hildenbrand (1): mm: merge folio_is_secretmem() and folio_fast_pin_allowed() into gup_fast_folio_allowed() include/linux/secretmem.h | 21 ++--------------- lib/buildid.c | 5 ++++ mm/gup.c | 48 +++++++++++++++++++++++---------------- 3 files changed, 35 insertions(+), 39 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] exfat: fix the infinite loop in exfat_readdir()
by Cai Xinchen 23 Jan '25

23 Jan '25

From: Yuezhang Mo <Yuezhang.Mo(a)sony.com> stable inclusion from stable-v6.6.72 commit dc1d7afceb982e8f666e70a582e6b5aa806de063 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJ6S6 CVE: CVE-2024-57940 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fee873761bd978d077d8c55334b4966ac4cb7b59 ] If the file system is corrupted so that a cluster is linked to itself in the cluster chain, and there is an unused directory entry in the cluster, 'dentry' will not be incremented, causing condition 'dentry < max_dentries' unable to prevent an infinite loop. This infinite loop causes s_lock not to be released, and other tasks will hang, such as exfat_sync_fs(). This commit stops traversing the cluster chain when there is unused directory entry in the cluster to avoid this infinite loop. Reported-by: syzbot+205c2644abdff9d3f9fc(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=205c2644abdff9d3f9fc Tested-by: syzbot+205c2644abdff9d3f9fc(a)syzkaller.appspotmail.com Fixes: ca06197382bd ("exfat: add directory operations") Signed-off-by: Yuezhang Mo <Yuezhang.Mo(a)sony.com> Reviewed-by: Sungjong Seo <sj1557.seo(a)samsung.com> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- fs/exfat/dir.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/exfat/dir.c b/fs/exfat/dir.c index 7a715016b96f..f4f81e349cef 100644 --- a/fs/exfat/dir.c +++ b/fs/exfat/dir.c @@ -125,7 +125,7 @@ static int exfat_readdir(struct inode *inode, loff_t *cpos, struct exfat_dir_ent type = exfat_get_entry_type(ep); if (type == TYPE_UNUSED) { brelse(bh); - break; + goto out; } if (type != TYPE_FILE && type != TYPE_DIR) { @@ -189,6 +189,7 @@ static int exfat_readdir(struct inode *inode, loff_t *cpos, struct exfat_dir_ent } } +out: dir_entry->namebuf.lfn[0] = '\0'; *cpos = EXFAT_DEN_TO_B(dentry); return 0; -- 2.34.1

2 1

[openeuler:OLK-5.10 2712/2712] drivers/firmware/efi/libstub/../../../../lib/lz4/lz4_decompress.c:488:5: warning: no previous prototype for 'LZ4_decompress_safe_withPrefix64k'
by kernel test robot 23 Jan '25

23 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 8af3d979a0d4bd2f18127293d843277437e74c6e commit: e467807275555a062593aa1e89f3201644ef0ea5 [2712/2712] efi/libstub: implement generic EFI zboot config: arm64-randconfig-001-20250123 (https://download.01.org/0day-ci/archive/20250123/202501231827.ODrxloSs-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250123/202501231827.ODrxloSs-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501231827.ODrxloSs-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/firmware/efi/libstub/../../../../lib/decompress_unlz4.c:10, from drivers/firmware/efi/libstub/zboot.c:17: >> drivers/firmware/efi/libstub/../../../../lib/lz4/lz4_decompress.c:488:5: warning: no previous prototype for 'LZ4_decompress_safe_withPrefix64k' [-Wmissing-prototypes] 488 | int LZ4_decompress_safe_withPrefix64k(const char *source, char *dest, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/firmware/efi/libstub/../../../../lib/lz4/lz4_decompress.c:510:5: warning: no previous prototype for 'LZ4_decompress_safe_forceExtDict' [-Wmissing-prototypes] 510 | int LZ4_decompress_safe_forceExtDict(const char *source, char *dest, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/firmware/efi/libstub/zboot.c:162:1: warning: no previous prototype for 'efi_zboot_entry' [-Wmissing-prototypes] 162 | efi_zboot_entry(efi_handle_t handle, efi_system_table_t *systab) | ^~~~~~~~~~~~~~~ vim +/LZ4_decompress_safe_withPrefix64k +488 drivers/firmware/efi/libstub/../../../../lib/lz4/lz4_decompress.c 2209fda323e2fd Gao Xiang 2018-10-30 487 2209fda323e2fd Gao Xiang 2018-10-30 @488 int LZ4_decompress_safe_withPrefix64k(const char *source, char *dest, 2209fda323e2fd Gao Xiang 2018-10-30 489 int compressedSize, int maxOutputSize) 2209fda323e2fd Gao Xiang 2018-10-30 490 { 2209fda323e2fd Gao Xiang 2018-10-30 491 return LZ4_decompress_generic(source, dest, 2209fda323e2fd Gao Xiang 2018-10-30 492 compressedSize, maxOutputSize, 2209fda323e2fd Gao Xiang 2018-10-30 493 endOnInputSize, decode_full_block, 2209fda323e2fd Gao Xiang 2018-10-30 494 withPrefix64k, 2209fda323e2fd Gao Xiang 2018-10-30 495 (BYTE *)dest - 64 * KB, NULL, 0); 2209fda323e2fd Gao Xiang 2018-10-30 496 } 2209fda323e2fd Gao Xiang 2018-10-30 497 2209fda323e2fd Gao Xiang 2018-10-30 498 static int LZ4_decompress_safe_withSmallPrefix(const char *source, char *dest, 2209fda323e2fd Gao Xiang 2018-10-30 499 int compressedSize, 2209fda323e2fd Gao Xiang 2018-10-30 500 int maxOutputSize, 2209fda323e2fd Gao Xiang 2018-10-30 501 size_t prefixSize) 2209fda323e2fd Gao Xiang 2018-10-30 502 { 2209fda323e2fd Gao Xiang 2018-10-30 503 return LZ4_decompress_generic(source, dest, 2209fda323e2fd Gao Xiang 2018-10-30 504 compressedSize, maxOutputSize, 2209fda323e2fd Gao Xiang 2018-10-30 505 endOnInputSize, decode_full_block, 2209fda323e2fd Gao Xiang 2018-10-30 506 noDict, 2209fda323e2fd Gao Xiang 2018-10-30 507 (BYTE *)dest - prefixSize, NULL, 0); 4e1a33b105ddf2 Sven Schmidt 2017-02-24 508 } cffb78b0e0b3a3 Kyungsik Lee 2013-07-08 509 2209fda323e2fd Gao Xiang 2018-10-30 @510 int LZ4_decompress_safe_forceExtDict(const char *source, char *dest, 2209fda323e2fd Gao Xiang 2018-10-30 511 int compressedSize, int maxOutputSize, 2209fda323e2fd Gao Xiang 2018-10-30 512 const void *dictStart, size_t dictSize) 2209fda323e2fd Gao Xiang 2018-10-30 513 { 2209fda323e2fd Gao Xiang 2018-10-30 514 return LZ4_decompress_generic(source, dest, 2209fda323e2fd Gao Xiang 2018-10-30 515 compressedSize, maxOutputSize, 2209fda323e2fd Gao Xiang 2018-10-30 516 endOnInputSize, decode_full_block, 2209fda323e2fd Gao Xiang 2018-10-30 517 usingExtDict, (BYTE *)dest, 2209fda323e2fd Gao Xiang 2018-10-30 518 (const BYTE *)dictStart, dictSize); 2209fda323e2fd Gao Xiang 2018-10-30 519 } 2209fda323e2fd Gao Xiang 2018-10-30 520 :::::: The code at line 488 was first introduced by commit :::::: 2209fda323e2fd2a2d0885595fd5097717f8d2aa lib/lz4: update LZ4 decompressor module :::::: TO: Gao Xiang <gaoxiang25(a)huawei.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] memcg: fix memcg_swapmax_read() not declared warning
by Liu Shixin 23 Jan '25

23 Jan '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBIC35 -------------------------------- Eliminates warning: symbol 'memcg_swapmax_read' was not declared. Should it be static? Fixes: a095a940f784 ("memcg: add restrict to swap to cgroup1") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- mm/memcontrol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 606a481afe2e..9f86404b3714 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -4537,7 +4537,7 @@ static void memcg_swap_device_init(struct mem_cgroup *memcg, } } -u64 memcg_swapmax_read(struct cgroup_subsys_state *css, struct cftype *cft) +static u64 memcg_swapmax_read(struct cgroup_subsys_state *css, struct cftype *cft) { struct mem_cgroup *memcg = mem_cgroup_from_css(css); -- 2.34.1

2 1

[PATCH OLK-5.10] memcg: fix memcg_swapmax_read() not declared warning
by Liu Shixin 23 Jan '25

23 Jan '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBIC35 -------------------------------- Eliminates warning: symbol 'memcg_swapmax_read' was not declared. Should it be static? Fixes: 299a8ba7fce5 ("[Backport] memcg: add restrict to swap to cgroup1") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- mm/memcontrol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index d02e9166255f..d9467b38e2f7 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -4252,7 +4252,7 @@ static void memcg_swap_device_init(struct mem_cgroup *memcg, } } -u64 memcg_swapmax_read(struct cgroup_subsys_state *css, struct cftype *cft) +static u64 memcg_swapmax_read(struct cgroup_subsys_state *css, struct cftype *cft) { struct mem_cgroup *memcg = mem_cgroup_from_css(css); -- 2.34.1

2 1

[PATCH OLK-5.10 0/3] mainline to olk-5.10 RDMA/hns: Check atomic wr length
by Chengchang Tang 23 Jan '25

23 Jan '25

From: Xinghai Cen <cenxinghai(a)h-partners.com> mainline to olk-5.10: Junxian Huang (1): RDMA/hns: Check atomic wr length Xinghai Cen (2): Revert "RDMA/hns: Check atomic wr length" Revert "RDMA/hns: Fix a missing check of atomic wr length" drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 19 +++++-------------- 1 file changed, 5 insertions(+), 14 deletions(-) -- 2.33.0

2 4

[PATCH OLK-6.6] fs/proc/kcore.c: Clear ret value in read_kcore_iter after successful iov_iter_zero
by Li Huafei 23 Jan '25

23 Jan '25

From: Jiri Olsa <jolsa(a)kernel.org> stable inclusion from stable-v6.6.64 commit 6868deee4a6bb8d324e883e2f540aaa33499a0f9 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBJCJ6 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 088f294609d8f8816dc316681aef2eb61982e0da upstream. If iov_iter_zero succeeds after failed copy_from_kernel_nofault, we need to reset the ret value to zero otherwise it will be returned as final return value of read_kcore_iter. This fixes objdump -d dump over /proc/kcore for me. Cc: stable(a)vger.kernel.org Cc: Alexander Gordeev <agordeev(a)linux.ibm.com> Fixes: 3d5854d75e31 ("fs/proc/kcore.c: allow translation of physical memory addresses") Signed-off-by: Jiri Olsa <jolsa(a)kernel.org> Link: https://lore.kernel.org/r/20241121231118.3212000-1-jolsa@kernel.org Acked-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- fs/proc/kcore.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c index 7e4fa9c68c1d..4463342930d3 100644 --- a/fs/proc/kcore.c +++ b/fs/proc/kcore.c @@ -599,6 +599,7 @@ static ssize_t read_kcore_iter(struct kiocb *iocb, struct iov_iter *iter) ret = -EFAULT; goto out; } + ret = 0; /* * We know the bounce buffer is safe to copy from, so * use _copy_to_iter() directly. -- 2.25.1

2 1

[PATCH OLK-6.6 0/8] Backport tracing bugfix patches
by Li Huafei 23 Jan '25

23 Jan '25

Backport LTS-6.6 patch (patch 8): tracing: Check "%s" dereference via the field rather than the TP_printk format and its dependent patches (patch 1-7). Kees Cook (1): seq_buf: Introduce DECLARE_SEQ_BUF and seq_buf_str() Matthew Wilcox (Oracle) (1): tracing: Move readpos from seq_buf to trace_seq Steven Rostedt (5): tracing: Fix trace_check_vprintf() when tp_printk is used tracing: Fix test_event_printk() to process entire print argument tracing: Add missing helper functions in event pointer dereference check tracing: Add "%s" check in test_event_printk() tracing: Check "%s" dereference via the field and not the TP_printk format Steven Rostedt (Google) (1): tracing: Handle old buffer mappings for event strings and functions include/linux/seq_buf.h | 26 ++-- include/linux/trace_events.h | 6 +- include/linux/trace_seq.h | 2 + kernel/trace/trace.c | 233 +++++++++-------------------------- kernel/trace/trace.h | 6 +- kernel/trace/trace_events.c | 225 +++++++++++++++++++++++++-------- kernel/trace/trace_output.c | 6 +- kernel/trace/trace_seq.c | 6 +- lib/seq_buf.c | 26 ++-- 9 files changed, 286 insertions(+), 250 deletions(-) -- 2.25.1

2 9

[PATCH OLK-6.6] fs/proc/kcore.c: Clear ret value in read_kcore_iter after successful iov_iter_zero
by Li Huafei 23 Jan '25

23 Jan '25

From: Jiri Olsa <jolsa(a)kernel.org> stable inclusion from stable-v6.6.64 commit 6868deee4a6bb8d324e883e2f540aaa33499a0f9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJCJ6 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 088f294609d8f8816dc316681aef2eb61982e0da upstream. If iov_iter_zero succeeds after failed copy_from_kernel_nofault, we need to reset the ret value to zero otherwise it will be returned as final return value of read_kcore_iter. This fixes objdump -d dump over /proc/kcore for me. Cc: stable(a)vger.kernel.org Cc: Alexander Gordeev <agordeev(a)linux.ibm.com> Fixes: 3d5854d75e31 ("fs/proc/kcore.c: allow translation of physical memory addresses") Signed-off-by: Jiri Olsa <jolsa(a)kernel.org> Link: https://lore.kernel.org/r/20241121231118.3212000-1-jolsa@kernel.org Acked-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- fs/proc/kcore.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c index 7e4fa9c68c1d..4463342930d3 100644 --- a/fs/proc/kcore.c +++ b/fs/proc/kcore.c @@ -599,6 +599,7 @@ static ssize_t read_kcore_iter(struct kiocb *iocb, struct iov_iter *iter) ret = -EFAULT; goto out; } + ret = 0; /* * We know the bounce buffer is safe to copy from, so * use _copy_to_iter() directly. -- 2.25.1

2 1