- Kernel - mailweb.openeuler.org

[openEuler-1.0-LTS] jfs: add check read-only before truncation in jfs_truncate_nolock()
by Yongqiang Liu 28 Apr '25

28 Apr '25

From: Zhang Yuwei <zhangyuwei20(a)huawei.com> mainline inclusion from mainline-v6.15-rc1 commit b5799dd77054c1ec49b0088b006c9908e256843b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QOQ CVE: CVE-2024-58094 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Added a check for "read-only" mode in the `jfs_truncate_nolock` function to avoid errors related to writing to a read-only filesystem. Call stack: block_write_begin() { jfs_write_failed() { jfs_truncate() { jfs_truncate_nolock() { txEnd() { ... log = JFS_SBI(tblk->sb)->log; // (log == NULL) If the `isReadOnly(ip)` condition is triggered in `jfs_truncate_nolock`, the function execution will stop, and no further data modification will occur. Instead, the `xtTruncate` function will be called with the "COMMIT_WMAP" flag, preventing modifications in "read-only" mode. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+4e89b5368baba8324e07(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=4e89b5368baba8324e07 Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Reviewed-by: Chen Jun <chenjun102(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/jfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c index 68779cc3609a..5a60ba8c021e 100644 --- a/fs/jfs/inode.c +++ b/fs/jfs/inode.c @@ -381,7 +381,7 @@ void jfs_truncate_nolock(struct inode *ip, loff_t length) ASSERT(length >= 0); - if (test_cflag(COMMIT_Nolink, ip)) { + if (test_cflag(COMMIT_Nolink, ip) || isReadOnly(ip)) { xtTruncate(0, ip, length, COMMIT_WMAP); return; } -- 2.34.1

1 0

[PATCH OLK-5.10] jfs: add check read-only before truncation in jfs_truncate_nolock()
by zhangyuwei20＠huawei.com 28 Apr '25

28 Apr '25

From: Zhang Yuwei <zhangyuwei20(a)huawei.com> mainline inclusion from mainline-v6.15-rc1 commit b5799dd77054c1ec49b0088b006c9908e256843b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QOQ CVE: CVE-2024-58094 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Added a check for "read-only" mode in the `jfs_truncate_nolock` function to avoid errors related to writing to a read-only filesystem. Call stack: block_write_begin() { jfs_write_failed() { jfs_truncate() { jfs_truncate_nolock() { txEnd() { ... log = JFS_SBI(tblk->sb)->log; // (log == NULL) If the `isReadOnly(ip)` condition is triggered in `jfs_truncate_nolock`, the function execution will stop, and no further data modification will occur. Instead, the `xtTruncate` function will be called with the "COMMIT_WMAP" flag, preventing modifications in "read-only" mode. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+4e89b5368baba8324e07(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=4e89b5368baba8324e07 Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- fs/jfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c index 980aa3300f10..515cd45d0386 100644 --- a/fs/jfs/inode.c +++ b/fs/jfs/inode.c @@ -379,7 +379,7 @@ void jfs_truncate_nolock(struct inode *ip, loff_t length) ASSERT(length >= 0); - if (test_cflag(COMMIT_Nolink, ip)) { + if (test_cflag(COMMIT_Nolink, ip) || isReadOnly(ip)) { xtTruncate(0, ip, length, COMMIT_WMAP); return; } -- 2.22.0

1 0

[PATCH openEuler-1.0-LTS 0/2] Backport SMC patchs
by Wang Liang 28 Apr '25

28 Apr '25

Ursula Braun (2): net/smc: propagate file from SMC to TCP socket net/smc: fix closing of fallback SMC sockets include/net/sock.h | 6 ------ net/smc/af_smc.c | 45 +++++++++++++++++++++++++++++++++++---------- 2 files changed, 35 insertions(+), 16 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/5] drm: LoongArch: fix rx550/gfx6/gfx7/gfx8 error
by Hongchen Zhang 28 Apr '25

28 Apr '25

Tianrui Zhao (3): drm/amdgpu: Fix pcie order dislocation drm/amdgpu: make duplicated EOP packet for GFX6 have real content drm/amdgpu: Fix RX550 pcie order dislocation. lvjianmin (2): drm/radeon: repeat the same EOP packet for EOP workaround on CIK drm/amdgpu: make duplicated EOP packet for GFX7/8 have real content drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 5 + drivers/gpu/drm/amd/amdgpu/amdgpu_ih.c | 161 ++++++++++++++++++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_ih.h | 6 + drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 4 + drivers/gpu/drm/amd/amdgpu/amdgpu_irq.h | 3 + drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 19 +++ drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 13 +- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 13 +- drivers/gpu/drm/radeon/cik.c | 9 +- 9 files changed, 218 insertions(+), 15 deletions(-) -- 2.33.0

2 6

[PATCH OLK-5.10 0/2] fuse: support fastpath
by chenrenhui 28 Apr '25

28 Apr '25

Support fuse fastpath by using the newly added kernel_ipc module. chenrenhui (2): ipc: add kernel_ipc module to enable fast process switching fuse: support fastpath via kernel_ipc Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 2 + fs/fuse/Kconfig | 6 + fs/fuse/dev.c | 744 +++++++++++++++++++++++++ fs/fuse/dir.c | 87 ++- fs/fuse/file.c | 263 ++++++++- fs/fuse/fuse_i.h | 54 ++ fs/fuse/inode.c | 112 ++++ fs/fuse/readdir.c | 8 + include/linux/kernel_ipc.h | 48 ++ include/uapi/linux/fuse.h | 20 + ipc/Kconfig | 5 + ipc/Makefile | 2 +- ipc/kernel_ipc.c | 318 +++++++++++ 14 files changed, 1642 insertions(+), 29 deletions(-) create mode 100644 include/linux/kernel_ipc.h create mode 100644 ipc/Kconfig create mode 100644 ipc/kernel_ipc.c -- 2.33.0

2 3

[PATCH OLK-6.6] irqchip/mbigen: add check before deference 'mgn_chip'
by Bowen You 28 Apr '25

28 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC4H9T -------------------------------- In function vtimer_mbigen_set_regs, variable dereferenced before check and it caused a warning: drivers/irqchip/irq-mbigen.c:746 vtimer_mbigen_set_regs() warn: variable dereferenced before check 'mgn_chip' (see line 737) To fix this, move the null-check logic before access base member in mgn_chip. Fixes: b8b70fe6bcf0 ("mbigen: Sets the regs related to vtimer irqbypass") Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/irqchip/irq-mbigen.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/irqchip/irq-mbigen.c b/drivers/irqchip/irq-mbigen.c index 4e603fa73c33..a6aba60df599 100644 --- a/drivers/irqchip/irq-mbigen.c +++ b/drivers/irqchip/irq-mbigen.c @@ -719,6 +719,9 @@ static int vtimer_mbigen_set_regs(struct platform_device *pdev) if (!vtimer_irqbypass) return 0; + if (!mgn_chip) + return -ENOMEM; + addr = mgn_chip->base + MBIGEN_CTLR_OFFSET; val = readl_relaxed(addr); mpidr_aff3 = (val & MBIGEN_AFF3_MASK) >> MBIGEN_AFF3_SHIFT; @@ -728,9 +731,6 @@ static int vtimer_mbigen_set_regs(struct platform_device *pdev) } res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - if (!mgn_chip) - return -ENOMEM; - if (res->start == CHIP0_TA_MBIGEN_PHY_BASE) { addr = ioremap(CHIP0_TA_PERI_PHY_BASE, 4); if (!addr) { -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] jfs: add check read-only before truncation in jfs_truncate_nolock()
by zhangyuwei20＠huawei.com 28 Apr '25

28 Apr '25

From: Zhang Yuwei <zhangyuwei20(a)huawei.com> mainline inclusion from mainline-v6.15-rc1 commit b5799dd77054c1ec49b0088b006c9908e256843b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QOQ CVE: CVE-2024-58094 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Added a check for "read-only" mode in the `jfs_truncate_nolock` function to avoid errors related to writing to a read-only filesystem. Call stack: block_write_begin() { jfs_write_failed() { jfs_truncate() { jfs_truncate_nolock() { txEnd() { ... log = JFS_SBI(tblk->sb)->log; // (log == NULL) If the `isReadOnly(ip)` condition is triggered in `jfs_truncate_nolock`, the function execution will stop, and no further data modification will occur. Instead, the `xtTruncate` function will be called with the "COMMIT_WMAP" flag, preventing modifications in "read-only" mode. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+4e89b5368baba8324e07(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=4e89b5368baba8324e07 Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> --- fs/jfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c index 68779cc3609a..5a60ba8c021e 100644 --- a/fs/jfs/inode.c +++ b/fs/jfs/inode.c @@ -381,7 +381,7 @@ void jfs_truncate_nolock(struct inode *ip, loff_t length) ASSERT(length >= 0); - if (test_cflag(COMMIT_Nolink, ip)) { + if (test_cflag(COMMIT_Nolink, ip) || isReadOnly(ip)) { xtTruncate(0, ip, length, COMMIT_WMAP); return; } -- 2.22.0

1 0

[PATCH openEuler-1.0-LTS] jfs: add check read-only before truncation in jfs_truncate_nolock()
by zhangyuwei20＠huawei.com 28 Apr '25

28 Apr '25

From: Zhang Yuwei <zhangyuwei20(a)huawei.com> mainline inclusion from mainline-v6.15-rc1 commit b5799dd77054c1ec49b0088b006c9908e256843b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QOQ CVE: CVE-2024-58094 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Added a check for "read-only" mode in the `jfs_truncate_nolock` function to avoid errors related to writing to a read-only filesystem. Call stack: block_write_begin() { jfs_write_failed() { jfs_truncate() { jfs_truncate_nolock() { txEnd() { ... log = JFS_SBI(tblk->sb)->log; // (log == NULL) If the `isReadOnly(ip)` condition is triggered in `jfs_truncate_nolock`, the function execution will stop, and no further data modification will occur. Instead, the `xtTruncate` function will be called with the "COMMIT_WMAP" flag, preventing modifications in "read-only" mode. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+4e89b5368baba8324e07(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=4e89b5368baba8324e07 Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> --- fs/jfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c index 68779cc3609a..5a60ba8c021e 100644 --- a/fs/jfs/inode.c +++ b/fs/jfs/inode.c @@ -381,7 +381,7 @@ void jfs_truncate_nolock(struct inode *ip, loff_t length) ASSERT(length >= 0); - if (test_cflag(COMMIT_Nolink, ip)) { + if (test_cflag(COMMIT_Nolink, ip) || isReadOnly(ip)) { xtTruncate(0, ip, length, COMMIT_WMAP); return; } -- 2.22.0

1 0

[PATCH OLK-6.6] irqchip/mbigen: add check before deference 'mgn_chip'
by Bowen You 28 Apr '25

28 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC4H9T -------------------------------- In function vtimer_mbigen_set_regs, variable dereferenced before check and it caused a warning: drivers/irqchip/irq-mbigen.c:746 vtimer_mbigen_set_regs() warn: variable dereferenced before check 'mgn_chip' (see line 737) To fix this, move the null-check logic before access base member in mgn_chip. Fixes: b8b70fe6bcf0 ("mbigen: Sets the regs related to vtimer irqbypass") Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/irqchip/irq-mbigen.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/irqchip/irq-mbigen.c b/drivers/irqchip/irq-mbigen.c index 4e603fa73c33..56954d959629 100644 --- a/drivers/irqchip/irq-mbigen.c +++ b/drivers/irqchip/irq-mbigen.c @@ -719,6 +719,9 @@ static int vtimer_mbigen_set_regs(struct platform_device *pdev) if (!vtimer_irqbypass) return 0; + if (!mgn_chip) + return -ENOMEM; + addr = mgn_chip->base + MBIGEN_CTLR_OFFSET; val = readl_relaxed(addr); mpidr_aff3 = (val & MBIGEN_AFF3_MASK) >> MBIGEN_AFF3_SHIFT; @@ -728,8 +731,6 @@ static int vtimer_mbigen_set_regs(struct platform_device *pdev) } res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - if (!mgn_chip) - return -ENOMEM; if (res->start == CHIP0_TA_MBIGEN_PHY_BASE) { addr = ioremap(CHIP0_TA_PERI_PHY_BASE, 4); -- 2.34.1

2 1

[PATCH OLK-5.10] [Backport] scsi: qla2xxx: Fix premature hw access after PCI error
by Lin Ruifeng 28 Apr '25

28 Apr '25

From: Quinn Tran <qutran(a)marvell.com> stable inclusion from stable-v5.15.33 commit 5ef6319f9882699613d5182fbd7929b017e8c5ab category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6P6 CVE: CVE-2022-49157 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e35920ab7874d5e2faeb4f958a74bfa793f1ce5a upstream. After a recoverable PCI error has been detected and recovered, qla driver needs to check to see if the error condition still persist and/or wait for the OS to give the resume signal. Sep 8 22:26:03 localhost kernel: WARNING: CPU: 9 PID: 124606 at qla_tmpl.c:440 qla27xx_fwdt_entry_t266+0x55/0x60 [qla2xxx] Sep 8 22:26:03 localhost kernel: RIP: 0010:qla27xx_fwdt_entry_t266+0x55/0x60 [qla2xxx] Sep 8 22:26:03 localhost kernel: Call Trace: Sep 8 22:26:03 localhost kernel: ? qla27xx_walk_template+0xb1/0x1b0 [qla2xxx] Sep 8 22:26:03 localhost kernel: ? qla27xx_execute_fwdt_template+0x12a/0x160 [qla2xxx] Sep 8 22:26:03 localhost kernel: ? qla27xx_fwdump+0xa0/0x1c0 [qla2xxx] Sep 8 22:26:03 localhost kernel: ? qla2xxx_pci_mmio_enabled+0xfb/0x120 [qla2xxx] Sep 8 22:26:03 localhost kernel: ? report_mmio_enabled+0x44/0x80 Sep 8 22:26:03 localhost kernel: ? report_slot_reset+0x80/0x80 Sep 8 22:26:03 localhost kernel: ? pci_walk_bus+0x70/0x90 Sep 8 22:26:03 localhost kernel: ? aer_dev_correctable_show+0xc0/0xc0 Sep 8 22:26:03 localhost kernel: ? pcie_do_recovery+0x1bb/0x240 Sep 8 22:26:03 localhost kernel: ? aer_recover_work_func+0xaa/0xd0 Sep 8 22:26:03 localhost kernel: ? process_one_work+0x1a7/0x360 .. Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-8041:22: detected PCI disconnect. Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-107ff:22: qla27xx_fwdt_entry_t262: dump ram MB failed. Area 5h start 198013h end 198013h Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-107ff:22: Unable to capture FW dump Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-1015:22: cmd=0x0, waited 5221 msecs Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-680d:22: mmio enabled returning. Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-d04c:22: MBX Command timeout for cmd 0, iocontrol=ffffffff jiffies=10140f2e5 mb[0-3]=[0xffff 0xffff 0xffff 0xffff] Link: https://lore.kernel.org/r/20220110050218.3958-6-njavali@marvell.com Cc: stable(a)vger.kernel.org Reviewed-by: Himanshu Madhani <himanshu.madhani(a)oracle.com> Signed-off-by: Quinn Tran <qutran(a)marvell.com> Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/scsi/qla2xxx/qla_os.c | 10 +++++++++- drivers/scsi/qla2xxx/qla_tmpl.c | 9 +++++++-- 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c index a6ecb4bb7456..b60da5d4d79c 100644 --- a/drivers/scsi/qla2xxx/qla_os.c +++ b/drivers/scsi/qla2xxx/qla_os.c @@ -7444,7 +7444,7 @@ qla2xxx_pci_error_detected(struct pci_dev *pdev, pci_channel_state_t state) switch (state) { case pci_channel_io_normal: - ha->flags.eeh_busy = 0; + qla_pci_set_eeh_busy(vha); if (ql2xmqsupport || ql2xnvmeenable) { set_bit(QPAIR_ONLINE_CHECK_NEEDED, &vha->dpc_flags); qla2xxx_wake_dpc(vha); @@ -7485,9 +7485,16 @@ qla2xxx_pci_mmio_enabled(struct pci_dev *pdev) "mmio enabled\n"); ha->pci_error_state = QLA_PCI_MMIO_ENABLED; + if (IS_QLA82XX(ha)) return PCI_ERS_RESULT_RECOVERED; + if (qla2x00_isp_reg_stat(ha)) { + ql_log(ql_log_info, base_vha, 0x803f, + "During mmio enabled, PCI/Register disconnect still detected.\n"); + goto out; + } + spin_lock_irqsave(&ha->hardware_lock, flags); if (IS_QLA2100(ha) || IS_QLA2200(ha)){ stat = rd_reg_word(&reg->hccr); @@ -7509,6 +7516,7 @@ qla2xxx_pci_mmio_enabled(struct pci_dev *pdev) "RISC paused -- mmio_enabled, Dumping firmware.\n"); qla2xxx_dump_fw(base_vha); } +out: /* set PCI_ERS_RESULT_NEED_RESET to trigger call to qla2xxx_pci_slot_reset */ ql_dbg(ql_dbg_aer, base_vha, 0x600d, "mmio enabled returning.\n"); diff --git a/drivers/scsi/qla2xxx/qla_tmpl.c b/drivers/scsi/qla2xxx/qla_tmpl.c index 26c13a953b97..b0a74b036cf4 100644 --- a/drivers/scsi/qla2xxx/qla_tmpl.c +++ b/drivers/scsi/qla2xxx/qla_tmpl.c @@ -435,8 +435,13 @@ qla27xx_fwdt_entry_t266(struct scsi_qla_host *vha, { ql_dbg(ql_dbg_misc, vha, 0xd20a, "%s: reset risc [%lx]\n", __func__, *len); - if (buf) - WARN_ON_ONCE(qla24xx_soft_reset(vha->hw) != QLA_SUCCESS); + if (buf) { + if (qla24xx_soft_reset(vha->hw) != QLA_SUCCESS) { + ql_dbg(ql_dbg_async, vha, 0x5001, + "%s: unable to soft reset\n", __func__); + return INVALID_ENTRY; + } + } return qla27xx_next_entry(ent); } -- 2.22.0

2 1