- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 3c67b39e386a36efca1f95d96d16cf1a716b5617
by kernel test robot 06 Mar '25

06 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 3c67b39e386a36efca1f95d96d16cf1a716b5617 !15314 drm/imx: Fix memory leak in imx_pd_connector_get_modes Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- mm-kasan-kasan_init.c:warning:variable-p4d-set-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-allnoconfig | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-defconfig | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-001-20250305 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-002-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-003-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-kasan-kasan_init.c:warning:variable-p4d-set-but-not-used | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-004-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-allnoconfig | |-- mm-hugetlb.c:linux-share_pool.h-is-included-more-than-once. | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-shmem.c:linux-share_pool.h-is-included-more-than-once. | |-- mm-swap.c:linux-memremap.h-is-included-more-than-once. | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- mm-.tmp_ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-002-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-003-20250305 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-004-20250305 | |-- include-asm-generic-bug.h:warning:mcu_ctrl-may-be-used-uninitialized | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-005-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-006-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-defconfig | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-101-20250305 | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-102-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-103-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-104-20250305 | |-- drivers-acpi-cppc_acpi.c:WARNING:NULL-check-before-some-freeing-functions-is-not-needed. | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration `-- x86_64-randconfig-161-20250305 |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page `-- mm-vmalloc.c:warning:variable-start-set-but-not-used elapsed time: 931m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250305 gcc-14.2.0 arm64 randconfig-002-20250305 gcc-14.2.0 arm64 randconfig-003-20250305 gcc-14.2.0 arm64 randconfig-004-20250305 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250305 clang-19 x86_64 buildonly-randconfig-002-20250305 gcc-12 x86_64 buildonly-randconfig-003-20250305 clang-19 x86_64 buildonly-randconfig-004-20250305 gcc-12 x86_64 buildonly-randconfig-005-20250305 clang-19 x86_64 buildonly-randconfig-006-20250305 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] ALSA: usb-audio: Cancel pending work at closing a MIDI substream
by Zhang Kunbo 06 Mar '25

06 Mar '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.121 commit 40bdb5ec957aca5c5c1924602bef6b0ab18e22d3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6ZR CVE: CVE-2022-49545 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0125de38122f0f66bf61336158d12a1aabfe6425 upstream. At closing a USB MIDI output substream, there might be still a pending work, which would eventually access the rawmidi runtime object that is being released. For fixing the race, make sure to cancel the pending work at closing. Reported-by: syzbot+6912c9592caca7ca0e7d(a)syzkaller.appspotmail.com Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/000000000000e7e75005dfd07cf6@google.com Link: https://lore.kernel.org/r/20220525131203.11299-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- sound/usb/midi.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sound/usb/midi.c b/sound/usb/midi.c index dcfc546d81b9..4ec7cbdddfd0 100644 --- a/sound/usb/midi.c +++ b/sound/usb/midi.c @@ -1161,6 +1161,9 @@ static int snd_usbmidi_output_open(struct snd_rawmidi_substream *substream) static int snd_usbmidi_output_close(struct snd_rawmidi_substream *substream) { + struct usbmidi_out_port *port = substream->runtime->private_data; + + cancel_work_sync(&port->ep->work); return substream_open(substream, 0, 0); } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ipw2x00: Fix potential NULL dereference in libipw_xmit()
by Zhang Kunbo 05 Mar '25

05 Mar '25

From: Haowen Bai <baihaowen(a)meizu.com> stable inclusion from stable-v4.19.247 commit 167affc11781d7d35c4c3a7630a549ac74dd0b21 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6MY CVE: CVE-2022-49544 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e8366bbabe1d207cf7c5b11ae50e223ae6fc278b ] crypt and crypt->ops could be null, so we need to checking null before dereference Signed-off-by: Haowen Bai <baihaowen(a)meizu.com> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://lore.kernel.org/r/1648797055-25730-1-git-send-email-baihaowen@meizu… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/net/wireless/intel/ipw2x00/libipw_tx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/intel/ipw2x00/libipw_tx.c b/drivers/net/wireless/intel/ipw2x00/libipw_tx.c index 84205aa508df..daa4f9eb08ff 100644 --- a/drivers/net/wireless/intel/ipw2x00/libipw_tx.c +++ b/drivers/net/wireless/intel/ipw2x00/libipw_tx.c @@ -397,7 +397,7 @@ netdev_tx_t libipw_xmit(struct sk_buff *skb, struct net_device *dev) /* Each fragment may need to have room for encryption * pre/postfix */ - if (host_encrypt) + if (host_encrypt && crypt && crypt->ops) bytes_per_frag -= crypt->ops->extra_mpdu_prefix_len + crypt->ops->extra_mpdu_postfix_len; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes
by Zhang Kunbo 05 Mar '25

05 Mar '25

From: Liu Zixian <liuzixian4(a)huawei.com> stable inclusion from stable-v4.19.247 commit edafcad84c4134ebec4bc24b29ca4497a1184eea category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1Y3 CVE: CVE-2022-49532 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 194d250cdc4a40ccbd179afd522a9e9846957402 ] drm_cvt_mode may return NULL and we should check it. This bug is found by syzkaller: FAULT_INJECTION stacktrace: [ 168.567394] FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 1 [ 168.567403] CPU: 1 PID: 6425 Comm: syz Kdump: loaded Not tainted 4.19.90-vhulk2201.1.0.h1035.kasan.eulerosv2r10.aarch64 #1 [ 168.567406] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 [ 168.567408] Call trace: [ 168.567414] dump_backtrace+0x0/0x310 [ 168.567418] show_stack+0x28/0x38 [ 168.567423] dump_stack+0xec/0x15c [ 168.567427] should_fail+0x3ac/0x3d0 [ 168.567437] __should_failslab+0xb8/0x120 [ 168.567441] should_failslab+0x28/0xc0 [ 168.567445] kmem_cache_alloc_trace+0x50/0x640 [ 168.567454] drm_mode_create+0x40/0x90 [ 168.567458] drm_cvt_mode+0x48/0xc78 [ 168.567477] virtio_gpu_conn_get_modes+0xa8/0x140 [virtio_gpu] [ 168.567485] drm_helper_probe_single_connector_modes+0x3a4/0xd80 [ 168.567492] drm_mode_getconnector+0x2e0/0xa70 [ 168.567496] drm_ioctl_kernel+0x11c/0x1d8 [ 168.567514] drm_ioctl+0x558/0x6d0 [ 168.567522] do_vfs_ioctl+0x160/0xf30 [ 168.567525] ksys_ioctl+0x98/0xd8 [ 168.567530] __arm64_sys_ioctl+0x50/0xc8 [ 168.567536] el0_svc_common+0xc8/0x320 [ 168.567540] el0_svc_handler+0xf8/0x160 [ 168.567544] el0_svc+0x10/0x218 KASAN stacktrace: [ 168.567561] BUG: KASAN: null-ptr-deref in virtio_gpu_conn_get_modes+0xb4/0x140 [virtio_gpu] [ 168.567565] Read of size 4 at addr 0000000000000054 by task syz/6425 [ 168.567566] [ 168.567571] CPU: 1 PID: 6425 Comm: syz Kdump: loaded Not tainted 4.19.90-vhulk2201.1.0.h1035.kasan.eulerosv2r10.aarch64 #1 [ 168.567573] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 [ 168.567575] Call trace: [ 168.567578] dump_backtrace+0x0/0x310 [ 168.567582] show_stack+0x28/0x38 [ 168.567586] dump_stack+0xec/0x15c [ 168.567591] kasan_report+0x244/0x2f0 [ 168.567594] __asan_load4+0x58/0xb0 [ 168.567607] virtio_gpu_conn_get_modes+0xb4/0x140 [virtio_gpu] [ 168.567612] drm_helper_probe_single_connector_modes+0x3a4/0xd80 [ 168.567617] drm_mode_getconnector+0x2e0/0xa70 [ 168.567621] drm_ioctl_kernel+0x11c/0x1d8 [ 168.567624] drm_ioctl+0x558/0x6d0 [ 168.567628] do_vfs_ioctl+0x160/0xf30 [ 168.567632] ksys_ioctl+0x98/0xd8 [ 168.567636] __arm64_sys_ioctl+0x50/0xc8 [ 168.567641] el0_svc_common+0xc8/0x320 [ 168.567645] el0_svc_handler+0xf8/0x160 [ 168.567649] el0_svc+0x10/0x218 Signed-off-by: Liu Zixian <liuzixian4(a)huawei.com> Link: http://patchwork.freedesktop.org/patch/msgid/20220322091730.1653-1-liuzixia… Signed-off-by: Gerd Hoffmann <kraxel(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/gpu/drm/virtio/virtgpu_display.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/virtio/virtgpu_display.c b/drivers/gpu/drm/virtio/virtgpu_display.c index 25503b933599..7511f416eb67 100644 --- a/drivers/gpu/drm/virtio/virtgpu_display.c +++ b/drivers/gpu/drm/virtio/virtgpu_display.c @@ -180,6 +180,8 @@ static int virtio_gpu_conn_get_modes(struct drm_connector *connector) DRM_DEBUG("add mode: %dx%d\n", width, height); mode = drm_cvt_mode(connector->dev, width, height, 60, false, false, false); + if (!mode) + return count; mode->type |= DRM_MODE_TYPE_PREFERRED; drm_mode_probed_add(connector, mode); count++; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 00/23] Support perf --bpf-counters
by Tengda Wu 05 Mar '25

05 Mar '25

This is a minimal patch series to enable '--bpf-counters' options for perf tool in 5.10 kernel version. How to compile? =============== 1. Download openEuler kernel source code: git clone https://gitee.com/openeuler/kernel.git 2. Download these patches, apply them in kernel/ directory: cd kernel/ git am --reject /path/to/*.patch 3. Prepare some requirements before compiling perf tool: Not list one by one here, please refer to [1]. [1] https://medium.com/@manas.marwah/building-perf-tool-fc838f084f71 4. Compile perf tool: cd tools/perf make BUILD_BPF_SKEL=1 If successful, you will see a binary file named 'perf' under tools/perf/ directory. How to use? =========== 1. Use bperf to sample a process: $ perf stat --bpf-counters -e cycles,instructions \ perf bench sched messaging -g 1 -l 100 -t # Running 'sched/messaging' benchmark: # 20 sender and receiver threads per group # 1 groups == 40 threads run Total time: 0.011 [sec] Performance counter stats for 'perf bench sched messaging -g 1 -l 100 -t': 639,816,606 cycles 284,102,919 instructions # 0.44 insn per cycle 0.018093452 seconds time elapsed 0.023612000 seconds user 0.255643000 seconds sys 2. Use bperf to sample a container: $ perf stat --bpf-counters -e cycles,instructions --timeout 1000 \ --for-each-cgroup docker/66166578dd7d17655923862792a0b9d60c8785fdc1bb8da8b76daedb205c4b10 Performance counter stats for 'system wide': 7,402,983 cycles docker/66166578dd7d17655923862792a0b9d60c8785fdc1bb8da8b76daedb205c4b10 6,036,926 instructions docker/66166578dd7d17655923862792a0b9d60c8785fdc1bb8da8b76daedb205c4b10 # 0.82 insn per cycle 1.004999462 seconds time elapsed How to integrate via bpf? ======================== If you are interested in process sampling, please check the following bpf progs: tools/perf/util/bpf_skel/bperf_leader.bpf.c tools/perf/util/bpf_skel/bperf_follower.bpf.c And if you are interested in container sampling, please check the following bpf prog: tools/perf/util/bpf_skel/bperf_cgroup.bpf.c There have some documents in tools/perf/util/bpf_counter.c, search the keywords 'bperf: share hardware PMCs with BPF' in it and see how bperf works. That's all. Enjoy. Namhyung Kim (9): bpf: Allow bpf_get_current_ancestor_cgroup_id for tracing perf core: Factor out __perf_sw_event_sched perf core: Add PERF_COUNT_SW_CGROUP_SWITCHES event perf tools: Add 'cgroup-switches' software event perf tools: Add read_cgroup_id() function perf tools: Add cgroup_is_v2() helper perf bpf_counter: Move common functions to bpf_counter.h perf stat: Enable BPF counter with --for-each-cgroup perf stat: Fix BPF program section name Song Liu (12): bpftool: Add Makefile target bootstrap perf build: Support build BPF skeletons with perf perf stat: Enable counting events for BPF programs perf stat: Introduce 'bperf' to share hardware PMCs with BPF perf stat: Measure 't0' and 'ref_time' after enable_counters() perf util: Move bpf_perf definitions to a libperf header perf bpf: check perf_attr_map is compatible with the perf binary perf stat: Introduce config stat.bpf-counter-events perf stat: Introduce ':b' modifier perf stat: Introduce bpf_counter_ops->disable() perf bpf: Fix building perf with BUILD_BPF_SKEL=1 by default in more distros perf bpf_skel: Do not use typedef to avoid error on old clang Tengda Wu (1): perf stat: Support inherit events during fork() for bperf Xiaomeng Zhang (1): perf stat: Increase perf_attr_map entries include/linux/perf_event.h | 40 +- include/uapi/linux/perf_event.h | 1 + kernel/trace/bpf_trace.c | 2 + tools/bpf/bpftool/Makefile | 2 + tools/build/Makefile.feature | 4 +- tools/include/uapi/linux/perf_event.h | 7 + tools/lib/perf/include/perf/bpf_perf.h | 31 + tools/perf/Documentation/perf-stat.txt | 31 + tools/perf/Makefile.config | 9 + tools/perf/Makefile.perf | 65 +- tools/perf/builtin-stat.c | 111 ++- tools/perf/util/Build | 2 + tools/perf/util/bpf_counter.c | 828 ++++++++++++++++++ tools/perf/util/bpf_counter.h | 131 +++ tools/perf/util/bpf_counter_cgroup.c | 307 +++++++ tools/perf/util/bpf_skel/.gitignore | 3 + tools/perf/util/bpf_skel/bperf_cgroup.bpf.c | 191 ++++ tools/perf/util/bpf_skel/bperf_follower.bpf.c | 162 ++++ tools/perf/util/bpf_skel/bperf_leader.bpf.c | 55 ++ tools/perf/util/bpf_skel/bperf_u.h | 19 + .../util/bpf_skel/bpf_prog_profiler.bpf.c | 93 ++ tools/perf/util/cgroup.c | 47 + tools/perf/util/cgroup.h | 13 + tools/perf/util/config.c | 4 + tools/perf/util/evlist.c | 4 + tools/perf/util/evsel.c | 27 + tools/perf/util/evsel.h | 32 + tools/perf/util/parse-events.c | 12 +- tools/perf/util/parse-events.l | 3 +- tools/perf/util/python.c | 27 + tools/perf/util/stat-display.c | 4 +- tools/perf/util/stat.c | 2 +- tools/perf/util/target.c | 34 +- tools/perf/util/target.h | 8 + tools/scripts/Makefile.include | 1 + 35 files changed, 2266 insertions(+), 46 deletions(-) create mode 100644 tools/lib/perf/include/perf/bpf_perf.h create mode 100644 tools/perf/util/bpf_counter.c create mode 100644 tools/perf/util/bpf_counter.h create mode 100644 tools/perf/util/bpf_counter_cgroup.c create mode 100644 tools/perf/util/bpf_skel/.gitignore create mode 100644 tools/perf/util/bpf_skel/bperf_cgroup.bpf.c create mode 100644 tools/perf/util/bpf_skel/bperf_follower.bpf.c create mode 100644 tools/perf/util/bpf_skel/bperf_leader.bpf.c create mode 100644 tools/perf/util/bpf_skel/bperf_u.h create mode 100644 tools/perf/util/bpf_skel/bpf_prog_profiler.bpf.c -- 2.34.1

2 24

[PATCH OLK-6.6] btrfs: fix use-after-free when attempting to join an aborted transaction
by Long Li 05 Mar '25

05 Mar '25

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.10-rc2 commit e2f0943cf37305dbdeaf9846e3c941451bcdef63 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPCA5 CVE: CVE-2025-21753 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When we are trying to join the current transaction and if it's aborted, we read its 'aborted' field after unlocking fs_info->trans_lock and without holding any extra reference count on it. This means that a concurrent task that is aborting the transaction may free the transaction before we read its 'aborted' field, leading to a use-after-free. Fix this by reading the 'aborted' field while holding fs_info->trans_lock since any freeing task must first acquire that lock and set fs_info->running_transaction to NULL before freeing the transaction. This was reported by syzbot and Dmitry with the following stack traces from KASAN: ================================================================== BUG: KASAN: slab-use-after-free in join_transaction+0xd9b/0xda0 fs/btrfs/transaction.c:278 Read of size 4 at addr ffff888011839024 by task kworker/u4:9/1128 CPU: 0 UID: 0 PID: 1128 Comm: kworker/u4:9 Not tainted 6.13.0-rc7-syzkaller-00019-gc45323b7560e #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Workqueue: events_unbound btrfs_async_reclaim_data_space Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 join_transaction+0xd9b/0xda0 fs/btrfs/transaction.c:278 start_transaction+0xaf8/0x1670 fs/btrfs/transaction.c:697 flush_space+0x448/0xcf0 fs/btrfs/space-info.c:803 btrfs_async_reclaim_data_space+0x159/0x510 fs/btrfs/space-info.c:1321 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317 worker_thread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Allocated by task 5315: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329 kmalloc_noprof include/linux/slab.h:901 [inline] join_transaction+0x144/0xda0 fs/btrfs/transaction.c:308 start_transaction+0xaf8/0x1670 fs/btrfs/transaction.c:697 btrfs_create_common+0x1b2/0x2e0 fs/btrfs/inode.c:6572 lookup_open fs/namei.c:3649 [inline] open_last_lookups fs/namei.c:3748 [inline] path_openat+0x1c03/0x3590 fs/namei.c:3984 do_filp_open+0x27f/0x4e0 fs/namei.c:4014 do_sys_openat2+0x13e/0x1d0 fs/open.c:1402 do_sys_open fs/open.c:1417 [inline] __do_sys_creat fs/open.c:1495 [inline] __se_sys_creat fs/open.c:1489 [inline] __x64_sys_creat+0x123/0x170 fs/open.c:1489 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5336: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2353 [inline] slab_free mm/slub.c:4613 [inline] kfree+0x196/0x430 mm/slub.c:4761 cleanup_transaction fs/btrfs/transaction.c:2063 [inline] btrfs_commit_transaction+0x2c97/0x3720 fs/btrfs/transaction.c:2598 insert_balance_item+0x1284/0x20b0 fs/btrfs/volumes.c:3757 btrfs_balance+0x992/0x10c0 fs/btrfs/volumes.c:4633 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3670 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888011839000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 36 bytes inside of freed 2048-byte region [ffff888011839000, ffff888011839800) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11838 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801ac42000 ffffea0000493400 dead000000000002 raw: 0000000000000000 0000000000080008 00000001f5000000 0000000000000000 head: 00fff00000000040 ffff88801ac42000 ffffea0000493400 dead000000000002 head: 0000000000000000 0000000000080008 00000001f5000000 0000000000000000 head: 00fff00000000003 ffffea0000460e01 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 57, tgid 57 (kworker/0:2), ts 67248182943, free_ts 67229742023 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1558 prep_new_page mm/page_alloc.c:1566 [inline] get_page_from_freelist+0x365c/0x37a0 mm/page_alloc.c:3476 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4753 alloc_pages_mpol_noprof+0x3e1/0x780 mm/mempolicy.c:2269 alloc_slab_page+0x6a/0x110 mm/slub.c:2423 allocate_slab+0x5a/0x2b0 mm/slub.c:2589 new_slab mm/slub.c:2642 [inline] ___slab_alloc+0xc27/0x14a0 mm/slub.c:3830 __slab_alloc+0x58/0xa0 mm/slub.c:3920 __slab_alloc_node mm/slub.c:3995 [inline] slab_alloc_node mm/slub.c:4156 [inline] __do_kmalloc_node mm/slub.c:4297 [inline] __kmalloc_node_track_caller_noprof+0x2e9/0x4c0 mm/slub.c:4317 kmalloc_reserve+0x111/0x2a0 net/core/skbuff.c:609 __alloc_skb+0x1f3/0x440 net/core/skbuff.c:678 alloc_skb include/linux/skbuff.h:1323 [inline] alloc_skb_with_frags+0xc3/0x820 net/core/skbuff.c:6612 sock_alloc_send_pskb+0x91a/0xa60 net/core/sock.c:2884 sock_alloc_send_skb include/net/sock.h:1803 [inline] mld_newpack+0x1c3/0xaf0 net/ipv6/mcast.c:1747 add_grhead net/ipv6/mcast.c:1850 [inline] add_grec+0x1492/0x19a0 net/ipv6/mcast.c:1988 mld_send_cr net/ipv6/mcast.c:2114 [inline] mld_ifc_work+0x691/0xd90 net/ipv6/mcast.c:2651 page last free pid 5300 tgid 5300 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1127 [inline] free_unref_page+0xd3f/0x1010 mm/page_alloc.c:2659 __slab_free+0x2c2/0x380 mm/slub.c:4524 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x9a/0x140 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4119 [inline] slab_alloc_node mm/slub.c:4168 [inline] __do_kmalloc_node mm/slub.c:4297 [inline] __kmalloc_noprof+0x236/0x4c0 mm/slub.c:4310 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1037 [inline] fib_create_info+0xc14/0x25b0 net/ipv4/fib_semantics.c:1435 fib_table_insert+0x1f6/0x1f20 net/ipv4/fib_trie.c:1231 fib_magic+0x3d8/0x620 net/ipv4/fib_frontend.c:1112 fib_add_ifaddr+0x40c/0x5e0 net/ipv4/fib_frontend.c:1156 fib_netdev_event+0x375/0x490 net/ipv4/fib_frontend.c:1494 notifier_call_chain+0x1a5/0x3f0 kernel/notifier.c:85 __dev_notify_flags+0x207/0x400 dev_change_flags+0xf0/0x1a0 net/core/dev.c:9045 do_setlink+0xc90/0x4210 net/core/rtnetlink.c:3109 rtnl_changelink net/core/rtnetlink.c:3723 [inline] __rtnl_newlink net/core/rtnetlink.c:3875 [inline] rtnl_newlink+0x1bb6/0x2210 net/core/rtnetlink.c:4012 Memory state around the buggy address: ffff888011838f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888011838f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888011839000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888011839080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888011839100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Reported-by: syzbot+45212e9d87a98c3f5b42(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/678e7da5.050a0220.303755.007c.GAE@googl… Reported-by: Dmitry Vyukov <dvyukov(a)google.com> Link: https://lore.kernel.org/linux-btrfs/CACT4Y+ZFBdo7pT8L2AzM=vegZwjp-wNkVJZQf0… Fixes: 871383be592b ("btrfs: add missing unlocks to transaction abort paths") Reviewed-by: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/btrfs/transaction.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c index 0548072c642f..aa03db69a016 100644 --- a/fs/btrfs/transaction.c +++ b/fs/btrfs/transaction.c @@ -278,8 +278,10 @@ static noinline int join_transaction(struct btrfs_fs_info *fs_info, cur_trans = fs_info->running_transaction; if (cur_trans) { if (TRANS_ABORTED(cur_trans)) { + const int abort_error = cur_trans->aborted; + spin_unlock(&fs_info->trans_lock); - return cur_trans->aborted; + return abort_error; } if (btrfs_blocked_trans_types[cur_trans->state] & type) { spin_unlock(&fs_info->trans_lock); -- 2.39.2

2 1

[PATCH OLK-6.6] partitions: mac: fix handling of bogus partition table
by Long Li 05 Mar '25

05 Mar '25

From: Jann Horn <jannh(a)google.com> mainline inclusion from mainline-v6.10-rc2 commit 80e648042e512d5a767da251d44132553fe04ae0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5K CVE: CVE-2025-21772 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fix several issues in partition probing: - The bailout for a bad partoffset must use put_dev_sector(), since the preceding read_part_sector() succeeded. - If the partition table claims a silly sector size like 0xfff bytes (which results in partition table entries straddling sector boundaries), bail out instead of accessing out-of-bounds memory. - We must not assume that the partition table contains proper NUL termination - use strnlen() and strncmp() instead of strlen() and strcmp(). Cc: stable(a)vger.kernel.org Signed-off-by: Jann Horn <jannh(a)google.com> Link: https://lore.kernel.org/r/20250214-partition-mac-v1-1-c1c626dffbd5@google.c… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- block/partitions/mac.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/block/partitions/mac.c b/block/partitions/mac.c index 7b521df00a39..6415213cd184 100644 --- a/block/partitions/mac.c +++ b/block/partitions/mac.c @@ -51,13 +51,25 @@ int mac_partition(struct parsed_partitions *state) } secsize = be16_to_cpu(md->block_size); put_dev_sector(sect); + + /* + * If the "block size" is not a power of 2, things get weird - we might + * end up with a partition straddling a sector boundary, so we wouldn't + * be able to read a partition entry with read_part_sector(). + * Real block sizes are probably (?) powers of two, so just require + * that. + */ + if (!is_power_of_2(secsize)) + return -1; datasize = round_down(secsize, 512); data = read_part_sector(state, datasize / 512, &sect); if (!data) return -1; partoffset = secsize % 512; - if (partoffset + sizeof(*part) > datasize) + if (partoffset + sizeof(*part) > datasize) { + put_dev_sector(sect); return -1; + } part = (struct mac_partition *) (data + partoffset); if (be16_to_cpu(part->signature) != MAC_PARTITION_MAGIC) { put_dev_sector(sect); @@ -110,8 +122,8 @@ int mac_partition(struct parsed_partitions *state) int i, l; goodness++; - l = strlen(part->name); - if (strcmp(part->name, "/") == 0) + l = strnlen(part->name, sizeof(part->name)); + if (strncmp(part->name, "/", sizeof(part->name)) == 0) goodness++; for (i = 0; i <= l - 4; ++i) { if (strncasecmp(part->name + i, "root", -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] net: tipc: fix possible refcount leak in tipc_sk_create()
by Wang Liang 05 Mar '25

05 Mar '25

From: Hangyu Hua <hbh25y(a)gmail.com> stable inclusion from stable-v4.19.253 commit ef488669b2652bde5b6ee5a409a5b048a2a50db4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP398 CVE: CVE-2022-49620 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 00aff3590fc0a73bddd3b743863c14e76fd35c0c ] Free sk in case tipc_sk_insert() fails. Signed-off-by: Hangyu Hua <hbh25y(a)gmail.com> Reviewed-by: Tung Nguyen <tung.q.nguyen(a)dektech.com.au> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/tipc/socket.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/tipc/socket.c b/net/tipc/socket.c index 6a1e7ff667ad..f8a555def98f 100644 --- a/net/tipc/socket.c +++ b/net/tipc/socket.c @@ -453,6 +453,7 @@ static int tipc_sk_create(struct net *net, struct socket *sock, sock_init_data(sock, sk); tipc_set_sk_state(sk, TIPC_OPEN); if (tipc_sk_insert(tsk)) { + sk_free(sk); pr_warn("Socket create failed; port number exhausted\n"); return -EINVAL; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2025-21702
by Wang Liang 05 Mar '25

05 Mar '25

Eric Dumazet (1): net_sched: sch_fifo: implement lockless __fifo_dump() Quang Le (1): pfifo_tail_enqueue: Drop new packet when sch->limit == 0 net/sched/sch_fifo.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] net: sched: Disallow replacing of child qdisc from one parent to another
by Wang Liang 05 Mar '25

05 Mar '25

From: Jamal Hadi Salim <jhs(a)mojatatu.com> mainline inclusion from mainline-v6.14-rc1 commit bc50835e83f60f56e9bec2b392fb5544f250fb6f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBM687 CVE: CVE-2025-21700 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Lion Ackermann was able to create a UAF which can be abused for privilege escalation with the following script Step 1. create root qdisc tc qdisc add dev lo root handle 1:0 drr step2. a class for packet aggregation do demonstrate uaf tc class add dev lo classid 1:1 drr step3. a class for nesting tc class add dev lo classid 1:2 drr step4. a class to graft qdisc to tc class add dev lo classid 1:3 drr step5. tc qdisc add dev lo parent 1:1 handle 2:0 plug limit 1024 step6. tc qdisc add dev lo parent 1:2 handle 3:0 drr step7. tc class add dev lo classid 3:1 drr step 8. tc qdisc add dev lo parent 3:1 handle 4:0 pfifo step 9. Display the class/qdisc layout tc class ls dev lo class drr 1:1 root leaf 2: quantum 64Kb class drr 1:2 root leaf 3: quantum 64Kb class drr 3:1 root leaf 4: quantum 64Kb tc qdisc ls qdisc drr 1: dev lo root refcnt 2 qdisc plug 2: dev lo parent 1:1 qdisc pfifo 4: dev lo parent 3:1 limit 1000p qdisc drr 3: dev lo parent 1:2 step10. trigger the bug <=== prevented by this patch tc qdisc replace dev lo parent 1:3 handle 4:0 step 11. Redisplay again the qdiscs/classes tc class ls dev lo class drr 1:1 root leaf 2: quantum 64Kb class drr 1:2 root leaf 3: quantum 64Kb class drr 1:3 root leaf 4: quantum 64Kb class drr 3:1 root leaf 4: quantum 64Kb tc qdisc ls qdisc drr 1: dev lo root refcnt 2 qdisc plug 2: dev lo parent 1:1 qdisc pfifo 4: dev lo parent 3:1 refcnt 2 limit 1000p qdisc drr 3: dev lo parent 1:2 Observe that a) parent for 4:0 does not change despite the replace request. There can only be one parent. b) refcount has gone up by two for 4:0 and c) both class 1:3 and 3:1 are pointing to it. Step 12. send one packet to plug echo "" | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10001)) step13. send one packet to the grafted fifo echo "" | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10003)) step14. lets trigger the uaf tc class delete dev lo classid 1:3 tc class delete dev lo classid 1:1 The semantics of "replace" is for a del/add _on the same node_ and not a delete from one node(3:1) and add to another node (1:3) as in step10. While we could "fix" with a more complex approach there could be consequences to expectations so the patch takes the preventive approach of "disallow such config". Joint work with Lion Ackermann <nnamrec(a)gmail.com> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20250116013713.900000-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/sched/sch_api.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index 36a5d3ceead2..489d8213e305 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -1519,6 +1519,10 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n, q = qdisc_lookup(dev, tcm->tcm_handle); if (!q) goto create_n_graft; + if (q->parent != tcm->tcm_parent) { + NL_SET_ERR_MSG(extack, "Cannot move an existing qdisc to a different parent"); + return -EINVAL; + } if (n->nlmsg_flags & NLM_F_EXCL) { NL_SET_ERR_MSG(extack, "Exclusivity flag on, cannot override"); return -EEXIST; -- 2.34.1

2 1