- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] block: mark GFP_NOIO around sysfs ->store()
by Li Lingfeng 06 Mar '25

06 Mar '25

From: Ming Lei <tom.leiming(a)gmail.com> mainline inclusion from mainline-v6.14-rc1 commit 7c0be4ead1f8f5f8be0803f347de0de81e3b8e1c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPLKB CVE: CVE-2025-21817 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- sysfs ->store is called with queue freezed, meantime we have several ->store() callbacks(update_nr_requests, wbt, scheduler) to allocate memory with GFP_KERNEL which may run into direct reclaim code path, then potential deadlock can be caused. Fix the issue by marking NOIO around sysfs ->store() Reported-by: Thomas Hellström <thomas.hellstrom(a)linux.intel.com> Cc: stable(a)vger.kernel.org Signed-off-by: Ming Lei <ming.lei(a)redhat.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: John Garry <john.g.garry(a)oracle.com> Link: https://lore.kernel.org/r/20250113015833.698458-1-ming.lei@redhat.com Link: https://lore.kernel.org/linux-block/Z4RkemI9f6N5zoEF@fedora/T/#mc774c65eeca… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: block/blk-sysfs.c [Commit a16230649ce27f8ac7dd8a5b079d9657aa96de16 ("block: add a store_limit operations for sysfs entries") add check of store_limit in queue_attr_store; commit af2814149883 ("block: freeze the queue in queue_attr_store") move blk_mq_freeze_queue to queue_attr_store.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- block/blk-sysfs.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c index 2de6c14dfecf..8d1bab14b83a 100644 --- a/block/blk-sysfs.c +++ b/block/blk-sysfs.c @@ -773,13 +773,16 @@ queue_attr_store(struct kobject *kobj, struct attribute *attr, struct queue_sysfs_entry *entry = to_queue(attr); struct gendisk *disk = container_of(kobj, struct gendisk, queue_kobj); struct request_queue *q = disk->queue; + unsigned int noio_flag; ssize_t res; if (!entry->store) return -EIO; mutex_lock(&q->sysfs_lock); + noio_flag = memalloc_noio_save(); res = entry->store(q, page, length); + memalloc_noio_restore(noio_flag); mutex_unlock(&q->sysfs_lock); return res; } -- 2.31.1

2 1

[PATCH OLK-6.6] USB: hub: Ignore non-compliant devices with too many configs or interfaces
by Bowen You 06 Mar '25

06 Mar '25

From: Alan Stern <stern(a)rowland.harvard.edu> mainline inclusion from mainline-v6.12-rc1 commit 2240fed37afbcdb5e8b627bc7ad986891100e05d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC7J CVE: CVE-2025-21776 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Robert Morris created a test program which can cause usb_hub_to_struct_hub() to dereference a NULL or inappropriate pointer: Oops: general protection fault, probably for non-canonical address 0xcccccccccccccccc: 0000 [#1] SMP DEBUG_PAGEALLOC PTI CPU: 7 UID: 0 PID: 117 Comm: kworker/7:1 Not tainted 6.13.0-rc3-00017-gf44d154d6e3d #14 Hardware name: FreeBSD BHYVE/BHYVE, BIOS 14.0 10/17/2021 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_hub_adjust_deviceremovable+0x78/0x110 ... Call Trace: <TASK> ? die_addr+0x31/0x80 ? exc_general_protection+0x1b4/0x3c0 ? asm_exc_general_protection+0x26/0x30 ? usb_hub_adjust_deviceremovable+0x78/0x110 hub_probe+0x7c7/0xab0 usb_probe_interface+0x14b/0x350 really_probe+0xd0/0x2d0 ? __pfx___device_attach_driver+0x10/0x10 __driver_probe_device+0x6e/0x110 driver_probe_device+0x1a/0x90 __device_attach_driver+0x7e/0xc0 bus_for_each_drv+0x7f/0xd0 __device_attach+0xaa/0x1a0 bus_probe_device+0x8b/0xa0 device_add+0x62e/0x810 usb_set_configuration+0x65d/0x990 usb_generic_driver_probe+0x4b/0x70 usb_probe_device+0x36/0xd0 The cause of this error is that the device has two interfaces, and the hub driver binds to interface 1 instead of interface 0, which is where usb_hub_to_struct_hub() looks. We can prevent the problem from occurring by refusing to accept hub devices that violate the USB spec by having more than one configuration or interface. Reported-and-tested-by: Robert Morris <rtm(a)csail.mit.edu> Cc: stable <stable(a)kernel.org> Closes: https://lore.kernel.org/linux-usb/95564.1737394039@localhost/ Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu> Link: https://lore.kernel.org/r/c27f3bf4-63d8-4fb5-ac82-09e3cd19f61c@rowland.harv… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/usb/core/hub.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c index 1ba3feb5e190..f295609649b1 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -1818,6 +1818,17 @@ static int hub_probe(struct usb_interface *intf, const struct usb_device_id *id) desc = intf->cur_altsetting; hdev = interface_to_usbdev(intf); + /* + * The USB 2.0 spec prohibits hubs from having more than one + * configuration or interface, and we rely on this prohibition. + * Refuse to accept a device that violates it. + */ + if (hdev->descriptor.bNumConfigurations > 1 || + hdev->actconfig->desc.bNumInterfaces > 1) { + dev_err(&intf->dev, "Invalid hub with more than one config or interface\n"); + return -EINVAL; + } + /* * Set default autosuspend delay as 0 to speedup bus suspend, * based on the below considerations: -- 2.34.1

2 1

[openeuler:OLK-5.10] BUILD REGRESSION 498e359119c3e45a3f0b2a869228d2b910836bc0
by kernel test robot 06 Mar '25

06 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 498e359119c3e45a3f0b2a869228d2b910836bc0 !15307 net: sfc: add missing xdp queue reinitialization Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-002-20250305 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-004-20250305 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-allnoconfig | |-- Warning:arch-x86-kernel-cpu-resctrl-monitor.c-references-a-file-that-doesn-t-exist:Documentation-x86-resctrl.rst | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_scsi_cmd_err.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_cli.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_driver_log.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_dump.c:linux-uaccess.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_htp_def.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_instance_manager.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:scsi-scsi_tcq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:ps3_device_update.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_cmd_channel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_inner_data.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_irq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:ps3_scsih.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:linux-kernel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_channel.c:ps3_cmd_complete.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_cmd.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_ioc_state.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_recovery.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:ps3_module_para.h-is-included-more-than-once. | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-page_alloc.c:linux-vmalloc.h-is-included-more-than-once. | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-allyesconfig | |-- arch-x86-kernel-cpu-resctrl-rdtgroup.c:warning:variable-h-set-but-not-used | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpu_registers_pos | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-save_fpregs_to_fpkernelstate | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete_exit-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli_debug.c:error:no-previous-prototype-for-function-ps3_dump_context_show-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_close-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_open-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_write-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_filename_build-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_local_time-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_resp_status_convert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_trigger_irq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_cmd_stat_content_clear-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_io_recv_ok_stat_inc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:error:no-previous-prototype-for-function-ps3_dump_dir_length-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_pd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_vd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.c:error:no-previous-prototype-for-function-ps3_sas_expander_phys_refresh-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_hba-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_raid-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_switch-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_manager.c:error:no-previous-prototype-for-function-ps3_hard_reset_to_ready-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:error:no-previous-prototype-for-function-ps3_clean_mgr_cmd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_module_para.c:error:no-previous-prototype-for-function-ps3_cli_ver_query-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_cmd_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_reset-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_notify-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clean-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_all_pd_rc_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_cmd_waitq_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_exclusive_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_pd_waitq_ratio_update-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_tg_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_vd_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_conflict_queue_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_check-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_range_check_and_insert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.c:error:no-previous-prototype-for-function-rbtDelNodeDo-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_hard_recovery_state_finish-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_alloc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_delete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_free-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_irq_queue_destroy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_state_transfer-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.c:error:no-previous-prototype-for-function-ps3_sas_update_phy_info-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_set_task_manager_busy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_wait_for_outstanding_complete-Werror-Wmissing-prototypes | |-- mm-damon-core-test.h:warning:comparison-of-distinct-pointer-types-(-typeof-(__left)-(aka-unsigned-int-)-and-typeof-(__right)-(aka-int-)) | |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-001-20250305 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-damon-core-test.h:warning:comparison-of-distinct-pointer-types-(-typeof-(__left)-(aka-unsigned-int-)-and-typeof-(__right)-(aka-int-)) | |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-002-20250305 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-003-20250305 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-004-20250305 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-005-20250305 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-006-20250305 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch `-- x86_64-defconfig |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch elapsed time: 760m configs tested: 15 configs skipped: 85 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250305 clang-15 arm64 randconfig-002-20250305 gcc-14.2.0 arm64 randconfig-003-20250305 clang-21 arm64 randconfig-004-20250305 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250305 clang-19 x86_64 buildonly-randconfig-002-20250305 gcc-12 x86_64 buildonly-randconfig-003-20250305 clang-19 x86_64 buildonly-randconfig-004-20250305 gcc-12 x86_64 buildonly-randconfig-005-20250305 clang-19 x86_64 buildonly-randconfig-006-20250305 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 3c67b39e386a36efca1f95d96d16cf1a716b5617
by kernel test robot 06 Mar '25

06 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 3c67b39e386a36efca1f95d96d16cf1a716b5617 !15314 drm/imx: Fix memory leak in imx_pd_connector_get_modes Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- mm-kasan-kasan_init.c:warning:variable-p4d-set-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-allnoconfig | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-defconfig | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-001-20250305 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-002-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-003-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-kasan-kasan_init.c:warning:variable-p4d-set-but-not-used | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-004-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-allnoconfig | |-- mm-hugetlb.c:linux-share_pool.h-is-included-more-than-once. | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-shmem.c:linux-share_pool.h-is-included-more-than-once. | |-- mm-swap.c:linux-memremap.h-is-included-more-than-once. | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- mm-.tmp_ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-002-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-003-20250305 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-004-20250305 | |-- include-asm-generic-bug.h:warning:mcu_ctrl-may-be-used-uninitialized | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-005-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-006-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-defconfig | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-101-20250305 | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-102-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-103-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-104-20250305 | |-- drivers-acpi-cppc_acpi.c:WARNING:NULL-check-before-some-freeing-functions-is-not-needed. | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration `-- x86_64-randconfig-161-20250305 |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page `-- mm-vmalloc.c:warning:variable-start-set-but-not-used elapsed time: 931m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250305 gcc-14.2.0 arm64 randconfig-002-20250305 gcc-14.2.0 arm64 randconfig-003-20250305 gcc-14.2.0 arm64 randconfig-004-20250305 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250305 clang-19 x86_64 buildonly-randconfig-002-20250305 gcc-12 x86_64 buildonly-randconfig-003-20250305 clang-19 x86_64 buildonly-randconfig-004-20250305 gcc-12 x86_64 buildonly-randconfig-005-20250305 clang-19 x86_64 buildonly-randconfig-006-20250305 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] ALSA: usb-audio: Cancel pending work at closing a MIDI substream
by Zhang Kunbo 06 Mar '25

06 Mar '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.121 commit 40bdb5ec957aca5c5c1924602bef6b0ab18e22d3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6ZR CVE: CVE-2022-49545 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0125de38122f0f66bf61336158d12a1aabfe6425 upstream. At closing a USB MIDI output substream, there might be still a pending work, which would eventually access the rawmidi runtime object that is being released. For fixing the race, make sure to cancel the pending work at closing. Reported-by: syzbot+6912c9592caca7ca0e7d(a)syzkaller.appspotmail.com Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/000000000000e7e75005dfd07cf6@google.com Link: https://lore.kernel.org/r/20220525131203.11299-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- sound/usb/midi.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sound/usb/midi.c b/sound/usb/midi.c index dcfc546d81b9..4ec7cbdddfd0 100644 --- a/sound/usb/midi.c +++ b/sound/usb/midi.c @@ -1161,6 +1161,9 @@ static int snd_usbmidi_output_open(struct snd_rawmidi_substream *substream) static int snd_usbmidi_output_close(struct snd_rawmidi_substream *substream) { + struct usbmidi_out_port *port = substream->runtime->private_data; + + cancel_work_sync(&port->ep->work); return substream_open(substream, 0, 0); } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ipw2x00: Fix potential NULL dereference in libipw_xmit()
by Zhang Kunbo 05 Mar '25

05 Mar '25

From: Haowen Bai <baihaowen(a)meizu.com> stable inclusion from stable-v4.19.247 commit 167affc11781d7d35c4c3a7630a549ac74dd0b21 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6MY CVE: CVE-2022-49544 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e8366bbabe1d207cf7c5b11ae50e223ae6fc278b ] crypt and crypt->ops could be null, so we need to checking null before dereference Signed-off-by: Haowen Bai <baihaowen(a)meizu.com> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://lore.kernel.org/r/1648797055-25730-1-git-send-email-baihaowen@meizu… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/net/wireless/intel/ipw2x00/libipw_tx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/intel/ipw2x00/libipw_tx.c b/drivers/net/wireless/intel/ipw2x00/libipw_tx.c index 84205aa508df..daa4f9eb08ff 100644 --- a/drivers/net/wireless/intel/ipw2x00/libipw_tx.c +++ b/drivers/net/wireless/intel/ipw2x00/libipw_tx.c @@ -397,7 +397,7 @@ netdev_tx_t libipw_xmit(struct sk_buff *skb, struct net_device *dev) /* Each fragment may need to have room for encryption * pre/postfix */ - if (host_encrypt) + if (host_encrypt && crypt && crypt->ops) bytes_per_frag -= crypt->ops->extra_mpdu_prefix_len + crypt->ops->extra_mpdu_postfix_len; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes
by Zhang Kunbo 05 Mar '25

05 Mar '25

From: Liu Zixian <liuzixian4(a)huawei.com> stable inclusion from stable-v4.19.247 commit edafcad84c4134ebec4bc24b29ca4497a1184eea category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1Y3 CVE: CVE-2022-49532 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 194d250cdc4a40ccbd179afd522a9e9846957402 ] drm_cvt_mode may return NULL and we should check it. This bug is found by syzkaller: FAULT_INJECTION stacktrace: [ 168.567394] FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 1 [ 168.567403] CPU: 1 PID: 6425 Comm: syz Kdump: loaded Not tainted 4.19.90-vhulk2201.1.0.h1035.kasan.eulerosv2r10.aarch64 #1 [ 168.567406] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 [ 168.567408] Call trace: [ 168.567414] dump_backtrace+0x0/0x310 [ 168.567418] show_stack+0x28/0x38 [ 168.567423] dump_stack+0xec/0x15c [ 168.567427] should_fail+0x3ac/0x3d0 [ 168.567437] __should_failslab+0xb8/0x120 [ 168.567441] should_failslab+0x28/0xc0 [ 168.567445] kmem_cache_alloc_trace+0x50/0x640 [ 168.567454] drm_mode_create+0x40/0x90 [ 168.567458] drm_cvt_mode+0x48/0xc78 [ 168.567477] virtio_gpu_conn_get_modes+0xa8/0x140 [virtio_gpu] [ 168.567485] drm_helper_probe_single_connector_modes+0x3a4/0xd80 [ 168.567492] drm_mode_getconnector+0x2e0/0xa70 [ 168.567496] drm_ioctl_kernel+0x11c/0x1d8 [ 168.567514] drm_ioctl+0x558/0x6d0 [ 168.567522] do_vfs_ioctl+0x160/0xf30 [ 168.567525] ksys_ioctl+0x98/0xd8 [ 168.567530] __arm64_sys_ioctl+0x50/0xc8 [ 168.567536] el0_svc_common+0xc8/0x320 [ 168.567540] el0_svc_handler+0xf8/0x160 [ 168.567544] el0_svc+0x10/0x218 KASAN stacktrace: [ 168.567561] BUG: KASAN: null-ptr-deref in virtio_gpu_conn_get_modes+0xb4/0x140 [virtio_gpu] [ 168.567565] Read of size 4 at addr 0000000000000054 by task syz/6425 [ 168.567566] [ 168.567571] CPU: 1 PID: 6425 Comm: syz Kdump: loaded Not tainted 4.19.90-vhulk2201.1.0.h1035.kasan.eulerosv2r10.aarch64 #1 [ 168.567573] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 [ 168.567575] Call trace: [ 168.567578] dump_backtrace+0x0/0x310 [ 168.567582] show_stack+0x28/0x38 [ 168.567586] dump_stack+0xec/0x15c [ 168.567591] kasan_report+0x244/0x2f0 [ 168.567594] __asan_load4+0x58/0xb0 [ 168.567607] virtio_gpu_conn_get_modes+0xb4/0x140 [virtio_gpu] [ 168.567612] drm_helper_probe_single_connector_modes+0x3a4/0xd80 [ 168.567617] drm_mode_getconnector+0x2e0/0xa70 [ 168.567621] drm_ioctl_kernel+0x11c/0x1d8 [ 168.567624] drm_ioctl+0x558/0x6d0 [ 168.567628] do_vfs_ioctl+0x160/0xf30 [ 168.567632] ksys_ioctl+0x98/0xd8 [ 168.567636] __arm64_sys_ioctl+0x50/0xc8 [ 168.567641] el0_svc_common+0xc8/0x320 [ 168.567645] el0_svc_handler+0xf8/0x160 [ 168.567649] el0_svc+0x10/0x218 Signed-off-by: Liu Zixian <liuzixian4(a)huawei.com> Link: http://patchwork.freedesktop.org/patch/msgid/20220322091730.1653-1-liuzixia… Signed-off-by: Gerd Hoffmann <kraxel(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/gpu/drm/virtio/virtgpu_display.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/virtio/virtgpu_display.c b/drivers/gpu/drm/virtio/virtgpu_display.c index 25503b933599..7511f416eb67 100644 --- a/drivers/gpu/drm/virtio/virtgpu_display.c +++ b/drivers/gpu/drm/virtio/virtgpu_display.c @@ -180,6 +180,8 @@ static int virtio_gpu_conn_get_modes(struct drm_connector *connector) DRM_DEBUG("add mode: %dx%d\n", width, height); mode = drm_cvt_mode(connector->dev, width, height, 60, false, false, false); + if (!mode) + return count; mode->type |= DRM_MODE_TYPE_PREFERRED; drm_mode_probed_add(connector, mode); count++; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 00/23] Support perf --bpf-counters
by Tengda Wu 05 Mar '25

05 Mar '25

This is a minimal patch series to enable '--bpf-counters' options for perf tool in 5.10 kernel version. How to compile? =============== 1. Download openEuler kernel source code: git clone https://gitee.com/openeuler/kernel.git 2. Download these patches, apply them in kernel/ directory: cd kernel/ git am --reject /path/to/*.patch 3. Prepare some requirements before compiling perf tool: Not list one by one here, please refer to [1]. [1] https://medium.com/@manas.marwah/building-perf-tool-fc838f084f71 4. Compile perf tool: cd tools/perf make BUILD_BPF_SKEL=1 If successful, you will see a binary file named 'perf' under tools/perf/ directory. How to use? =========== 1. Use bperf to sample a process: $ perf stat --bpf-counters -e cycles,instructions \ perf bench sched messaging -g 1 -l 100 -t # Running 'sched/messaging' benchmark: # 20 sender and receiver threads per group # 1 groups == 40 threads run Total time: 0.011 [sec] Performance counter stats for 'perf bench sched messaging -g 1 -l 100 -t': 639,816,606 cycles 284,102,919 instructions # 0.44 insn per cycle 0.018093452 seconds time elapsed 0.023612000 seconds user 0.255643000 seconds sys 2. Use bperf to sample a container: $ perf stat --bpf-counters -e cycles,instructions --timeout 1000 \ --for-each-cgroup docker/66166578dd7d17655923862792a0b9d60c8785fdc1bb8da8b76daedb205c4b10 Performance counter stats for 'system wide': 7,402,983 cycles docker/66166578dd7d17655923862792a0b9d60c8785fdc1bb8da8b76daedb205c4b10 6,036,926 instructions docker/66166578dd7d17655923862792a0b9d60c8785fdc1bb8da8b76daedb205c4b10 # 0.82 insn per cycle 1.004999462 seconds time elapsed How to integrate via bpf? ======================== If you are interested in process sampling, please check the following bpf progs: tools/perf/util/bpf_skel/bperf_leader.bpf.c tools/perf/util/bpf_skel/bperf_follower.bpf.c And if you are interested in container sampling, please check the following bpf prog: tools/perf/util/bpf_skel/bperf_cgroup.bpf.c There have some documents in tools/perf/util/bpf_counter.c, search the keywords 'bperf: share hardware PMCs with BPF' in it and see how bperf works. That's all. Enjoy. Namhyung Kim (9): bpf: Allow bpf_get_current_ancestor_cgroup_id for tracing perf core: Factor out __perf_sw_event_sched perf core: Add PERF_COUNT_SW_CGROUP_SWITCHES event perf tools: Add 'cgroup-switches' software event perf tools: Add read_cgroup_id() function perf tools: Add cgroup_is_v2() helper perf bpf_counter: Move common functions to bpf_counter.h perf stat: Enable BPF counter with --for-each-cgroup perf stat: Fix BPF program section name Song Liu (12): bpftool: Add Makefile target bootstrap perf build: Support build BPF skeletons with perf perf stat: Enable counting events for BPF programs perf stat: Introduce 'bperf' to share hardware PMCs with BPF perf stat: Measure 't0' and 'ref_time' after enable_counters() perf util: Move bpf_perf definitions to a libperf header perf bpf: check perf_attr_map is compatible with the perf binary perf stat: Introduce config stat.bpf-counter-events perf stat: Introduce ':b' modifier perf stat: Introduce bpf_counter_ops->disable() perf bpf: Fix building perf with BUILD_BPF_SKEL=1 by default in more distros perf bpf_skel: Do not use typedef to avoid error on old clang Tengda Wu (1): perf stat: Support inherit events during fork() for bperf Xiaomeng Zhang (1): perf stat: Increase perf_attr_map entries include/linux/perf_event.h | 40 +- include/uapi/linux/perf_event.h | 1 + kernel/trace/bpf_trace.c | 2 + tools/bpf/bpftool/Makefile | 2 + tools/build/Makefile.feature | 4 +- tools/include/uapi/linux/perf_event.h | 7 + tools/lib/perf/include/perf/bpf_perf.h | 31 + tools/perf/Documentation/perf-stat.txt | 31 + tools/perf/Makefile.config | 9 + tools/perf/Makefile.perf | 65 +- tools/perf/builtin-stat.c | 111 ++- tools/perf/util/Build | 2 + tools/perf/util/bpf_counter.c | 828 ++++++++++++++++++ tools/perf/util/bpf_counter.h | 131 +++ tools/perf/util/bpf_counter_cgroup.c | 307 +++++++ tools/perf/util/bpf_skel/.gitignore | 3 + tools/perf/util/bpf_skel/bperf_cgroup.bpf.c | 191 ++++ tools/perf/util/bpf_skel/bperf_follower.bpf.c | 162 ++++ tools/perf/util/bpf_skel/bperf_leader.bpf.c | 55 ++ tools/perf/util/bpf_skel/bperf_u.h | 19 + .../util/bpf_skel/bpf_prog_profiler.bpf.c | 93 ++ tools/perf/util/cgroup.c | 47 + tools/perf/util/cgroup.h | 13 + tools/perf/util/config.c | 4 + tools/perf/util/evlist.c | 4 + tools/perf/util/evsel.c | 27 + tools/perf/util/evsel.h | 32 + tools/perf/util/parse-events.c | 12 +- tools/perf/util/parse-events.l | 3 +- tools/perf/util/python.c | 27 + tools/perf/util/stat-display.c | 4 +- tools/perf/util/stat.c | 2 +- tools/perf/util/target.c | 34 +- tools/perf/util/target.h | 8 + tools/scripts/Makefile.include | 1 + 35 files changed, 2266 insertions(+), 46 deletions(-) create mode 100644 tools/lib/perf/include/perf/bpf_perf.h create mode 100644 tools/perf/util/bpf_counter.c create mode 100644 tools/perf/util/bpf_counter.h create mode 100644 tools/perf/util/bpf_counter_cgroup.c create mode 100644 tools/perf/util/bpf_skel/.gitignore create mode 100644 tools/perf/util/bpf_skel/bperf_cgroup.bpf.c create mode 100644 tools/perf/util/bpf_skel/bperf_follower.bpf.c create mode 100644 tools/perf/util/bpf_skel/bperf_leader.bpf.c create mode 100644 tools/perf/util/bpf_skel/bperf_u.h create mode 100644 tools/perf/util/bpf_skel/bpf_prog_profiler.bpf.c -- 2.34.1

2 24

[PATCH OLK-6.6] btrfs: fix use-after-free when attempting to join an aborted transaction
by Long Li 05 Mar '25

05 Mar '25

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.10-rc2 commit e2f0943cf37305dbdeaf9846e3c941451bcdef63 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPCA5 CVE: CVE-2025-21753 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When we are trying to join the current transaction and if it's aborted, we read its 'aborted' field after unlocking fs_info->trans_lock and without holding any extra reference count on it. This means that a concurrent task that is aborting the transaction may free the transaction before we read its 'aborted' field, leading to a use-after-free. Fix this by reading the 'aborted' field while holding fs_info->trans_lock since any freeing task must first acquire that lock and set fs_info->running_transaction to NULL before freeing the transaction. This was reported by syzbot and Dmitry with the following stack traces from KASAN: ================================================================== BUG: KASAN: slab-use-after-free in join_transaction+0xd9b/0xda0 fs/btrfs/transaction.c:278 Read of size 4 at addr ffff888011839024 by task kworker/u4:9/1128 CPU: 0 UID: 0 PID: 1128 Comm: kworker/u4:9 Not tainted 6.13.0-rc7-syzkaller-00019-gc45323b7560e #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Workqueue: events_unbound btrfs_async_reclaim_data_space Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 join_transaction+0xd9b/0xda0 fs/btrfs/transaction.c:278 start_transaction+0xaf8/0x1670 fs/btrfs/transaction.c:697 flush_space+0x448/0xcf0 fs/btrfs/space-info.c:803 btrfs_async_reclaim_data_space+0x159/0x510 fs/btrfs/space-info.c:1321 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317 worker_thread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Allocated by task 5315: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329 kmalloc_noprof include/linux/slab.h:901 [inline] join_transaction+0x144/0xda0 fs/btrfs/transaction.c:308 start_transaction+0xaf8/0x1670 fs/btrfs/transaction.c:697 btrfs_create_common+0x1b2/0x2e0 fs/btrfs/inode.c:6572 lookup_open fs/namei.c:3649 [inline] open_last_lookups fs/namei.c:3748 [inline] path_openat+0x1c03/0x3590 fs/namei.c:3984 do_filp_open+0x27f/0x4e0 fs/namei.c:4014 do_sys_openat2+0x13e/0x1d0 fs/open.c:1402 do_sys_open fs/open.c:1417 [inline] __do_sys_creat fs/open.c:1495 [inline] __se_sys_creat fs/open.c:1489 [inline] __x64_sys_creat+0x123/0x170 fs/open.c:1489 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5336: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2353 [inline] slab_free mm/slub.c:4613 [inline] kfree+0x196/0x430 mm/slub.c:4761 cleanup_transaction fs/btrfs/transaction.c:2063 [inline] btrfs_commit_transaction+0x2c97/0x3720 fs/btrfs/transaction.c:2598 insert_balance_item+0x1284/0x20b0 fs/btrfs/volumes.c:3757 btrfs_balance+0x992/0x10c0 fs/btrfs/volumes.c:4633 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3670 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888011839000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 36 bytes inside of freed 2048-byte region [ffff888011839000, ffff888011839800) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11838 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801ac42000 ffffea0000493400 dead000000000002 raw: 0000000000000000 0000000000080008 00000001f5000000 0000000000000000 head: 00fff00000000040 ffff88801ac42000 ffffea0000493400 dead000000000002 head: 0000000000000000 0000000000080008 00000001f5000000 0000000000000000 head: 00fff00000000003 ffffea0000460e01 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 57, tgid 57 (kworker/0:2), ts 67248182943, free_ts 67229742023 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1558 prep_new_page mm/page_alloc.c:1566 [inline] get_page_from_freelist+0x365c/0x37a0 mm/page_alloc.c:3476 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4753 alloc_pages_mpol_noprof+0x3e1/0x780 mm/mempolicy.c:2269 alloc_slab_page+0x6a/0x110 mm/slub.c:2423 allocate_slab+0x5a/0x2b0 mm/slub.c:2589 new_slab mm/slub.c:2642 [inline] ___slab_alloc+0xc27/0x14a0 mm/slub.c:3830 __slab_alloc+0x58/0xa0 mm/slub.c:3920 __slab_alloc_node mm/slub.c:3995 [inline] slab_alloc_node mm/slub.c:4156 [inline] __do_kmalloc_node mm/slub.c:4297 [inline] __kmalloc_node_track_caller_noprof+0x2e9/0x4c0 mm/slub.c:4317 kmalloc_reserve+0x111/0x2a0 net/core/skbuff.c:609 __alloc_skb+0x1f3/0x440 net/core/skbuff.c:678 alloc_skb include/linux/skbuff.h:1323 [inline] alloc_skb_with_frags+0xc3/0x820 net/core/skbuff.c:6612 sock_alloc_send_pskb+0x91a/0xa60 net/core/sock.c:2884 sock_alloc_send_skb include/net/sock.h:1803 [inline] mld_newpack+0x1c3/0xaf0 net/ipv6/mcast.c:1747 add_grhead net/ipv6/mcast.c:1850 [inline] add_grec+0x1492/0x19a0 net/ipv6/mcast.c:1988 mld_send_cr net/ipv6/mcast.c:2114 [inline] mld_ifc_work+0x691/0xd90 net/ipv6/mcast.c:2651 page last free pid 5300 tgid 5300 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1127 [inline] free_unref_page+0xd3f/0x1010 mm/page_alloc.c:2659 __slab_free+0x2c2/0x380 mm/slub.c:4524 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x9a/0x140 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4119 [inline] slab_alloc_node mm/slub.c:4168 [inline] __do_kmalloc_node mm/slub.c:4297 [inline] __kmalloc_noprof+0x236/0x4c0 mm/slub.c:4310 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1037 [inline] fib_create_info+0xc14/0x25b0 net/ipv4/fib_semantics.c:1435 fib_table_insert+0x1f6/0x1f20 net/ipv4/fib_trie.c:1231 fib_magic+0x3d8/0x620 net/ipv4/fib_frontend.c:1112 fib_add_ifaddr+0x40c/0x5e0 net/ipv4/fib_frontend.c:1156 fib_netdev_event+0x375/0x490 net/ipv4/fib_frontend.c:1494 notifier_call_chain+0x1a5/0x3f0 kernel/notifier.c:85 __dev_notify_flags+0x207/0x400 dev_change_flags+0xf0/0x1a0 net/core/dev.c:9045 do_setlink+0xc90/0x4210 net/core/rtnetlink.c:3109 rtnl_changelink net/core/rtnetlink.c:3723 [inline] __rtnl_newlink net/core/rtnetlink.c:3875 [inline] rtnl_newlink+0x1bb6/0x2210 net/core/rtnetlink.c:4012 Memory state around the buggy address: ffff888011838f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888011838f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888011839000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888011839080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888011839100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Reported-by: syzbot+45212e9d87a98c3f5b42(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/678e7da5.050a0220.303755.007c.GAE@googl… Reported-by: Dmitry Vyukov <dvyukov(a)google.com> Link: https://lore.kernel.org/linux-btrfs/CACT4Y+ZFBdo7pT8L2AzM=vegZwjp-wNkVJZQf0… Fixes: 871383be592b ("btrfs: add missing unlocks to transaction abort paths") Reviewed-by: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/btrfs/transaction.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c index 0548072c642f..aa03db69a016 100644 --- a/fs/btrfs/transaction.c +++ b/fs/btrfs/transaction.c @@ -278,8 +278,10 @@ static noinline int join_transaction(struct btrfs_fs_info *fs_info, cur_trans = fs_info->running_transaction; if (cur_trans) { if (TRANS_ABORTED(cur_trans)) { + const int abort_error = cur_trans->aborted; + spin_unlock(&fs_info->trans_lock); - return cur_trans->aborted; + return abort_error; } if (btrfs_blocked_trans_types[cur_trans->state] & type) { spin_unlock(&fs_info->trans_lock); -- 2.39.2

2 1

[PATCH OLK-6.6] partitions: mac: fix handling of bogus partition table
by Long Li 05 Mar '25

05 Mar '25

From: Jann Horn <jannh(a)google.com> mainline inclusion from mainline-v6.10-rc2 commit 80e648042e512d5a767da251d44132553fe04ae0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5K CVE: CVE-2025-21772 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fix several issues in partition probing: - The bailout for a bad partoffset must use put_dev_sector(), since the preceding read_part_sector() succeeded. - If the partition table claims a silly sector size like 0xfff bytes (which results in partition table entries straddling sector boundaries), bail out instead of accessing out-of-bounds memory. - We must not assume that the partition table contains proper NUL termination - use strnlen() and strncmp() instead of strlen() and strcmp(). Cc: stable(a)vger.kernel.org Signed-off-by: Jann Horn <jannh(a)google.com> Link: https://lore.kernel.org/r/20250214-partition-mac-v1-1-c1c626dffbd5@google.c… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- block/partitions/mac.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/block/partitions/mac.c b/block/partitions/mac.c index 7b521df00a39..6415213cd184 100644 --- a/block/partitions/mac.c +++ b/block/partitions/mac.c @@ -51,13 +51,25 @@ int mac_partition(struct parsed_partitions *state) } secsize = be16_to_cpu(md->block_size); put_dev_sector(sect); + + /* + * If the "block size" is not a power of 2, things get weird - we might + * end up with a partition straddling a sector boundary, so we wouldn't + * be able to read a partition entry with read_part_sector(). + * Real block sizes are probably (?) powers of two, so just require + * that. + */ + if (!is_power_of_2(secsize)) + return -1; datasize = round_down(secsize, 512); data = read_part_sector(state, datasize / 512, &sect); if (!data) return -1; partoffset = secsize % 512; - if (partoffset + sizeof(*part) > datasize) + if (partoffset + sizeof(*part) > datasize) { + put_dev_sector(sect); return -1; + } part = (struct mac_partition *) (data + partoffset); if (be16_to_cpu(part->signature) != MAC_PARTITION_MAGIC) { put_dev_sector(sect); @@ -110,8 +122,8 @@ int mac_partition(struct parsed_partitions *state) int i, l; goodness++; - l = strlen(part->name); - if (strcmp(part->name, "/") == 0) + l = strnlen(part->name, sizeof(part->name)); + if (strncmp(part->name, "/", sizeof(part->name)) == 0) goodness++; for (i = 0; i <= l - 4; ++i) { if (strncasecmp(part->name + i, "root", -- 2.39.2

2 1