- Kernel - mailweb.openeuler.org

[openeuler:OLK-5.10 11219/30000] vmlinux.o: warning: objtool: do_syscall_64()+0x46: call to memset() leaves .noinstr.text section
by kernel test robot 09 Oct '24

09 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 411e7ef551c128efdf5b4e53cc01245ba85b3817 commit: 130620d5878d2348208258965876547a69353f9f [11219/30000] x86/entry: Enable random_kstack_offset support config: x86_64-buildonly-randconfig-006-20241009 (https://download.01.org/0day-ci/archive/20241009/202410091420.7w9TkxwA-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241009/202410091420.7w9TkxwA-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410091420.7w9TkxwA-lkp@intel.com/ All warnings (new ones prefixed by >>): >> vmlinux.o: warning: objtool: do_syscall_64()+0x46: call to memset() leaves .noinstr.text section vmlinux.o: warning: objtool: fixup_bad_iret()+0x36: call to memset() leaves .noinstr.text section ld.lld: error: undefined symbol: __tsan_memset >>> referenced by do_mounts.c >>> do_mounts.o:(name_to_dev_t) in archive init/built-in.a >>> referenced by do_mounts.c >>> do_mounts.o:(mount_block_root) in archive init/built-in.a >>> referenced by vsyscall_64.c >>> entry/vsyscall/vsyscall_64.o:(trace_event_raw_event_emulate_vsyscall) in archive arch/x86/built-in.a >>> referenced 14932 more times -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

openEuler Kernel SIG双周例会
by openEuler conference 09 Oct '24

09 Oct '24

您好！ Kernel 邀请您参加 2024-10-11 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中（新增议题可回复此邮件申报，也可直接填写至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/960499088 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2024-10-11 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 议题征集中（新增议题可回复此邮件申报，也可直接填写至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/960499088. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. More information: https://www.openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS] platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses
by Wupeng Ma 09 Oct '24

09 Oct '24

From: Hans de Goede <hdegoede(a)redhat.com> stable inclusion from stable-v6.6.52 commit 6821a82616f60aa72c5909b3e252ad97fb9f7e2a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAUA6B CVE: CVE-2024-46859 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f52e98d16e9bd7dd2b3aef8e38db5cbc9899d6a4 upstream. The panasonic laptop code in various places uses the SINF array with index values of 0 - SINF_CUR_BRIGHT(0x0d) without checking that the SINF array is big enough. Not all panasonic laptops have this many SINF array entries, for example the Toughbook CF-18 model only has 10 SINF array entries. So it only supports the AC+DC brightness entries and mute. Check that the SINF array has a minimum size which covers all AC+DC brightness entries and refuse to load if the SINF array is smaller. For higher SINF indexes hide the sysfs attributes when the SINF array does not contain an entry for that attribute, avoiding show()/store() accessing the array out of bounds and add bounds checking to the probe() and resume() code accessing these. Fixes: e424fb8cc4e6 ("panasonic-laptop: avoid overflow in acpi_pcc_hotkey_add()") Cc: stable(a)vger.kernel.org Signed-off-by: Hans de Goede <hdegoede(a)redhat.com> Link: https://lore.kernel.org/r/20240909113227.254470-1-hdegoede@redhat.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/platform/x86/panasonic-laptop.c [Ma Wupeng: mode SINF_ECO_MODE, SINF_CUR_BRIGHT do not exist until 5.11] Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- drivers/platform/x86/panasonic-laptop.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) diff --git a/drivers/platform/x86/panasonic-laptop.c b/drivers/platform/x86/panasonic-laptop.c index 8361ad75389a..71e55d90f712 100644 --- a/drivers/platform/x86/panasonic-laptop.c +++ b/drivers/platform/x86/panasonic-laptop.c @@ -429,6 +429,18 @@ static DEVICE_ATTR(lcdtype, S_IRUGO, show_lcdtype, NULL); static DEVICE_ATTR(mute, S_IRUGO, show_mute, NULL); static DEVICE_ATTR(sticky_key, S_IRUGO | S_IWUSR, show_sticky, set_sticky); +static umode_t pcc_sysfs_is_visible(struct kobject *kobj, struct attribute *attr, int idx) +{ + struct device *dev = kobj_to_dev(kobj); + struct acpi_device *acpi = to_acpi_device(dev); + struct pcc_acpi *pcc = acpi_driver_data(acpi); + + if (attr == &dev_attr_mute.attr) + return (pcc->num_sifr > SINF_MUTE) ? attr->mode : 0; + + return attr->mode; +} + static struct attribute *pcc_sysfs_entries[] = { &dev_attr_numbatt.attr, &dev_attr_lcdtype.attr, @@ -438,8 +450,9 @@ static struct attribute *pcc_sysfs_entries[] = { }; static const struct attribute_group pcc_attr_group = { - .name = NULL, /* put in device directory */ - .attrs = pcc_sysfs_entries, + .name = NULL, /* put in device directory */ + .attrs = pcc_sysfs_entries, + .is_visible = pcc_sysfs_is_visible, }; @@ -559,8 +572,12 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device) num_sifr = acpi_pcc_get_sqty(device); - if (num_sifr < 0 || num_sifr > 255) { - ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "num_sifr out of range")); + /* + * pcc->sinf is expected to at least have the AC+DC brightness entries. + * Accesses to higher SINF entries are checked against num_sifr. + */ + if (num_sifr <= SINF_DC_CUR_BRIGHT || num_sifr > 255) { + ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "num_sifr %d out of range %d - 255\n", num_sifr, SINF_DC_CUR_BRIGHT + 1)); return -ENODEV; } -- 2.25.1

2 1

[PATCH OLK-6.6] usb: gadget: aspeed_udc: validate endpoint index for ast udc
by Gu Bowen 09 Oct '24

09 Oct '24

From: Ma Ke <make24(a)iscas.ac.cn> stable inclusion from stable-v6.6.51 commit b2a50ffdd1a079869a62198a8d1441355c513c7c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9NW CVE: CVE-2024-46836 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ee0d382feb44ec0f445e2ad63786cd7f3f6a8199 ] We should verify the bound of the array to assure that host may not manipulate the index to point past endpoint array. Found by static analysis. Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> Reviewed-by: Andrew Jeffery <andrew(a)codeconstruct.com.au> Acked-by: Andrew Jeffery <andrew(a)codeconstruct.com.au> Link: https://lore.kernel.org/r/20240625022306.2568122-1-make24@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/usb/gadget/udc/aspeed_udc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/gadget/udc/aspeed_udc.c b/drivers/usb/gadget/udc/aspeed_udc.c index fc2ead0fe621..4868286574a1 100644 --- a/drivers/usb/gadget/udc/aspeed_udc.c +++ b/drivers/usb/gadget/udc/aspeed_udc.c @@ -1009,6 +1009,8 @@ static void ast_udc_getstatus(struct ast_udc_dev *udc) break; case USB_RECIP_ENDPOINT: epnum = crq.wIndex & USB_ENDPOINT_NUMBER_MASK; + if (epnum >= AST_UDC_NUM_ENDPOINTS) + goto stall; status = udc->ep[epnum].stopped; break; default: -- 2.25.1

2 1

[PATCH OLK-6.6] drm/amd/display: added NULL check at start of dc_validate_stream
by Yu Liao 09 Oct '24

09 Oct '24

From: winstang <winstang(a)amd.com> stable inclusion from stable-v6.6.50 commit 154a50bf4221a6a6ccf88d565b8184da7c40a2dd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9N4 CVE: CVE-2024-46802 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 26c56049cc4f1705b498df013949427692a4b0d5 ] [Why] prevent invalid memory access [How] check if dc and stream are NULL Co-authored-by: winstang <winstang(a)amd.com> Reviewed-by: Alvin Lee <alvin.lee2(a)amd.com> Acked-by: Zaeem Mohamed <zaeem.mohamed(a)amd.com> Signed-off-by: winstang <winstang(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c index 84923c5400d3..733e445331ea 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c @@ -3927,6 +3927,9 @@ void resource_build_bit_depth_reduction_params(struct dc_stream_state *stream, enum dc_status dc_validate_stream(struct dc *dc, struct dc_stream_state *stream) { + if (dc == NULL || stream == NULL) + return DC_ERROR_UNEXPECTED; + struct dc_link *link = stream->link; struct timing_generator *tg = dc->res_pool->timing_generators[0]; enum dc_status res = DC_OK; -- 2.33.0

2 1

[openeuler:OLK-5.10 28633/30000] arch/x86/kernel/paravirt.c:65:2: error: implicit declaration of function '__text_gen_insn'
by kernel test robot 09 Oct '24

09 Oct '24

Hi Peter, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 17befaf8efea2ff937fa7e0d754885a67f67ce71 commit: 822da186955cbcd69b4715b8a307053e6c756f30 [28633/30000] x86/ibt,paravirt: Use text_gen_insn() for paravirt_patch() config: x86_64-buildonly-randconfig-002-20241009 (https://download.01.org/0day-ci/archive/20241009/202410091222.YZTQ9zgW-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241009/202410091222.YZTQ9zgW-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410091222.YZTQ9zgW-lkp@intel.com/ All errors (new ones prefixed by >>): >> arch/x86/kernel/paravirt.c:65:2: error: implicit declaration of function '__text_gen_insn' [-Werror,-Wimplicit-function-declaration] 65 | __text_gen_insn(insn_buff, CALL_INSN_OPCODE, | ^ >> arch/x86/kernel/paravirt.c:65:29: error: use of undeclared identifier 'CALL_INSN_OPCODE' 65 | __text_gen_insn(insn_buff, CALL_INSN_OPCODE, | ^ >> arch/x86/kernel/paravirt.c:66:26: error: use of undeclared identifier 'CALL_INSN_SIZE' 66 | (void *)addr, target, CALL_INSN_SIZE); | ^ arch/x86/kernel/paravirt.c:67:9: error: use of undeclared identifier 'CALL_INSN_SIZE' 67 | return CALL_INSN_SIZE; | ^ arch/x86/kernel/paravirt.c:327:4: warning: cast from 'void (*)(struct mmu_gather *, struct page *)' to 'void (*)(struct mmu_gather *, void *)' converts to incompatible function type [-Wcast-function-type-strict] 327 | (void (*)(struct mmu_gather *, void *))tlb_remove_page, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning and 4 errors generated. vim +/__text_gen_insn +65 arch/x86/kernel/paravirt.c 61 62 static unsigned paravirt_patch_call(void *insn_buff, const void *target, 63 unsigned long addr, unsigned len) 64 { > 65 __text_gen_insn(insn_buff, CALL_INSN_OPCODE, > 66 (void *)addr, target, CALL_INSN_SIZE); 67 return CALL_INSN_SIZE; 68 } 69 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] cpufreq: intel_pstate: Revise global turbo disable check
by Yipeng Zou 09 Oct '24

09 Oct '24

From: Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> mainline inclusion from mainline-v6.7-rc1 commit 37b6ddba967c601479bea418a7ac6ff16b6232b7 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAVI54 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Setting global turbo flag based on CPU 0 P-state limits is problematic as it limits max P-state request on every CPU on the system just based on its P-state limits. There are two cases in which global.turbo_disabled flag is set: - When the MSR_IA32_MISC_ENABLE_TURBO_DISABLE bit is set to 1 in the MSR MSR_IA32_MISC_ENABLE. This bit can be only changed by the system BIOS before power up. - When the max non turbo P-state is same as max turbo P-state for CPU 0. The second check is not a valid to decide global turbo state based on the CPU 0. CPU 0 max turbo P-state can be same as max non turbo P-state, but for other CPUs this may not be true. There is no guarantee that max P-state limits are same for every CPU. This is possible that during fusing max P-state for a CPU is constrained. Also with the Intel Speed Select performance profile, CPU 0 may not be present in all profiles. In this case the max non turbo and turbo P-state can be set to the lowest possible P-state by the hardware when switched to such profile. Since max non turbo and turbo P-state is same, global.turbo_disabled flag will be set. Once global.turbo_disabled is set, any scaling max and min frequency update for any CPU will result in its max P-state constrained to the max non turbo P-state. Hence remove the check of max non turbo P-state equal to max turbo P-state of CPU 0 to set global turbo disabled flag. Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> [ rjw: Subject edit ] Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- drivers/cpufreq/intel_pstate.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c index 0ee3a04bb102..c563f70d084d 100644 --- a/drivers/cpufreq/intel_pstate.c +++ b/drivers/cpufreq/intel_pstate.c @@ -595,13 +595,9 @@ static void intel_pstate_hybrid_hwp_adjust(struct cpudata *cpu) static inline void update_turbo_state(void) { u64 misc_en; - struct cpudata *cpu; - cpu = all_cpu_data[0]; rdmsrl(MSR_IA32_MISC_ENABLE, misc_en); - global.turbo_disabled = - (misc_en & MSR_IA32_MISC_ENABLE_TURBO_DISABLE || - cpu->pstate.max_pstate == cpu->pstate.turbo_pstate); + global.turbo_disabled = misc_en & MSR_IA32_MISC_ENABLE_TURBO_DISABLE; } static int min_perf_pct_min(void) -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] CVE-2024-46857
by Zhang Changzhong 09 Oct '24

09 Oct '24

Benjamin Poirier (1): net/mlx5: Fix bridge mode operations when there are no VFs Chris Mi (1): net/mlx5: E-switch, Introduce flag to indicate if fdb table is created drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 7 +++++-- drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 9 +++++++++ 2 files changed, 14 insertions(+), 2 deletions(-) -- 2.9.5

2 3

[openeuler:OLK-6.6 3892/14286] include/linux/mmzone.h:1788:2: error: #error Allocator MAX_ORDER exceeds SECTION_SIZE
by kernel test robot 09 Oct '24

09 Oct '24

Hi zhangtianyang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: fb512ada4da1a8aefba17392d87452a37796a0f2 commit: c93eb12529e21dbb59796132f4fdf75fad4eddaf [3892/14286] LoongArch: Adapted SECTION_SIZE_BITS with page size config: loongarch-randconfig-002-20241009 (https://download.01.org/0day-ci/archive/20241009/202410091038.th2Iv8Hi-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241009/202410091038.th2Iv8Hi-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410091038.th2Iv8Hi-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from include/linux/gfp.h:7, from include/linux/mm.h:7, from arch/loongarch/kernel/asm-offsets.c:9: >> include/linux/mmzone.h:1788:2: error: #error Allocator MAX_ORDER exceeds SECTION_SIZE 1788 | #error Allocator MAX_ORDER exceeds SECTION_SIZE | ^~~~~ arch/loongarch/kernel/asm-offsets.c:18:6: warning: no previous prototype for 'output_ptreg_defines' [-Wmissing-prototypes] 18 | void output_ptreg_defines(void) | ^~~~~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:65:6: warning: no previous prototype for 'output_task_defines' [-Wmissing-prototypes] 65 | void output_task_defines(void) | ^~~~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:80:6: warning: no previous prototype for 'output_thread_info_defines' [-Wmissing-prototypes] 80 | void output_thread_info_defines(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:96:6: warning: no previous prototype for 'output_thread_defines' [-Wmissing-prototypes] 96 | void output_thread_defines(void) | ^~~~~~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:132:6: warning: no previous prototype for 'output_thread_fpu_defines' [-Wmissing-prototypes] 132 | void output_thread_fpu_defines(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:173:6: warning: no previous prototype for 'output_thread_lbt_defines' [-Wmissing-prototypes] 173 | void output_thread_lbt_defines(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:183:6: warning: no previous prototype for 'output_mm_defines' [-Wmissing-prototypes] 183 | void output_mm_defines(void) | ^~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:215:6: warning: no previous prototype for 'output_sc_defines' [-Wmissing-prototypes] 215 | void output_sc_defines(void) | ^~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:223:6: warning: no previous prototype for 'output_signal_defines' [-Wmissing-prototypes] 223 | void output_signal_defines(void) | ^~~~~~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:261:6: warning: no previous prototype for 'output_smpboot_defines' [-Wmissing-prototypes] 261 | void output_smpboot_defines(void) | ^~~~~~~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:294:6: warning: no previous prototype for 'output_kvm_defines' [-Wmissing-prototypes] 294 | void output_kvm_defines(void) | ^~~~~~~~~~~~~~~~~~ make[3]: *** [scripts/Makefile.build:116: arch/loongarch/kernel/asm-offsets.s] Error 1 shuffle=526995723 make[3]: Target 'prepare' not remade because of errors. make[2]: *** [Makefile:1202: prepare0] Error 2 shuffle=526995723 make[2]: Target 'prepare' not remade because of errors. make[1]: *** [Makefile:234: __sub-make] Error 2 shuffle=526995723 make[1]: Target 'prepare' not remade because of errors. make: *** [Makefile:234: __sub-make] Error 2 shuffle=526995723 make: Target 'prepare' not remade because of errors. vim +1788 include/linux/mmzone.h d41dee369bff3b Andy Whitcroft 2005-06-23 1783 835c134ec4dd75 Mel Gorman 2007-10-16 1784 #define SECTION_BLOCKFLAGS_BITS \ d9c2340052278d Mel Gorman 2007-10-16 1785 ((1UL << (PFN_SECTION_SHIFT - pageblock_order)) * NR_PAGEBLOCK_BITS) 835c134ec4dd75 Mel Gorman 2007-10-16 1786 23baf831a32c04 Kirill A. Shutemov 2023-03-15 1787 #if (MAX_ORDER + PAGE_SHIFT) > SECTION_SIZE_BITS d41dee369bff3b Andy Whitcroft 2005-06-23 @1788 #error Allocator MAX_ORDER exceeds SECTION_SIZE d41dee369bff3b Andy Whitcroft 2005-06-23 1789 #endif d41dee369bff3b Andy Whitcroft 2005-06-23 1790 :::::: The code at line 1788 was first introduced by commit :::::: d41dee369bff3b9dcb6328d4d822926c28cc2594 [PATCH] sparsemem memory model :::::: TO: Andy Whitcroft <apw(a)shadowen.org> :::::: CC: Linus Torvalds <torvalds(a)ppc970.osdl.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] net/mlx5: Fix bridge mode operations when there are no VFs
by Zhang Changzhong 09 Oct '24

09 Oct '24

From: Benjamin Poirier <bpoirier(a)nvidia.com> stable inclusion from stable-v6.6.52 commit 65feee671e37f3b6eda0b6af28f204b5bcf7fa50 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9OW CVE: CVE-2024-46857 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b1d305abef4640af1b4f1b4774d513cd81b10cfc ] Currently, trying to set the bridge mode attribute when numvfs=0 leads to a crash: bridge link set dev eth2 hwmode vepa [ 168.967392] BUG: kernel NULL pointer dereference, address: 0000000000000030 [...] [ 168.969989] RIP: 0010:mlx5_add_flow_rules+0x1f/0x300 [mlx5_core] [...] [ 168.976037] Call Trace: [ 168.976188] <TASK> [ 168.978620] _mlx5_eswitch_set_vepa_locked+0x113/0x230 [mlx5_core] [ 168.979074] mlx5_eswitch_set_vepa+0x7f/0xa0 [mlx5_core] [ 168.979471] rtnl_bridge_setlink+0xe9/0x1f0 [ 168.979714] rtnetlink_rcv_msg+0x159/0x400 [ 168.980451] netlink_rcv_skb+0x54/0x100 [ 168.980675] netlink_unicast+0x241/0x360 [ 168.980918] netlink_sendmsg+0x1f6/0x430 [ 168.981162] ____sys_sendmsg+0x3bb/0x3f0 [ 168.982155] ___sys_sendmsg+0x88/0xd0 [ 168.985036] __sys_sendmsg+0x59/0xa0 [ 168.985477] do_syscall_64+0x79/0x150 [ 168.987273] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 168.987773] RIP: 0033:0x7f8f7950f917 (esw->fdb_table.legacy.vepa_fdb is null) The bridge mode is only relevant when there are multiple functions per port. Therefore, prevent setting and getting this setting when there are no VFs. Note that after this change, there are no settings to change on the PF interface using `bridge link` when there are no VFs, so the interface no longer appears in the `bridge link` output. Fixes: 4b89251de024 ("net/mlx5: Support ndo bridge_setlink and getlink") Signed-off-by: Benjamin Poirier <bpoirier(a)nvidia.com> Reviewed-by: Cosmin Ratiu <cratiu(a)nvidia.com> Signed-off-by: Saeed Mahameed <saeedm(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c index 255bc8b..8587cd5 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c @@ -319,7 +319,7 @@ int mlx5_eswitch_set_vepa(struct mlx5_eswitch *esw, u8 setting) return -EPERM; mutex_lock(&esw->state_lock); - if (esw->mode != MLX5_ESWITCH_LEGACY) { + if (esw->mode != MLX5_ESWITCH_LEGACY || !mlx5_esw_is_fdb_created(esw)) { err = -EOPNOTSUPP; goto out; } @@ -339,7 +339,7 @@ int mlx5_eswitch_get_vepa(struct mlx5_eswitch *esw, u8 *setting) if (!mlx5_esw_allowed(esw)) return -EPERM; - if (esw->mode != MLX5_ESWITCH_LEGACY) + if (esw->mode != MLX5_ESWITCH_LEGACY || !mlx5_esw_is_fdb_created(esw)) return -EOPNOTSUPP; *setting = esw->fdb_table.legacy.vepa_uplink_rule ? 1 : 0; -- 2.9.5

2 1

2025

2024

2023

2022

2021

2020

2019

Kernel