- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 1835/13946] mm/page_cache_limit.c:103:52: sparse: sparse: incorrect type in argument 3 (different address spaces)
by kernel test robot 14 Sep '24

14 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 2e4beeb328d26e30afadf237e39b47aba637a978 commit: 7d1031b36ebd6c273d9aad316fd9e3e2daa01a85 [1835/13946] mm: support pagecache limit config: loongarch-randconfig-r133-20240913 (https://download.01.org/0day-ci/archive/20240914/202409141518.G41e90PW-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240914/202409141518.G41e90PW-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409141518.G41e90PW-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/page_cache_limit.c:61:5: sparse: sparse: symbol 'cache_reclaim_enable_handler' was not declared. Should it be static? mm/page_cache_limit.c:77:5: sparse: sparse: symbol 'cache_reclaim_sysctl_handler' was not declared. Should it be static? >> mm/page_cache_limit.c:103:52: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void * @@ got void [noderef] __user *buffer @@ mm/page_cache_limit.c:103:52: sparse: expected void * mm/page_cache_limit.c:103:52: sparse: got void [noderef] __user *buffer >> mm/page_cache_limit.c:94:5: sparse: sparse: symbol 'cache_limit_mbytes_sysctl_handler' was not declared. Should it be static? >> mm/page_cache_limit.c:187:35: sparse: sparse: incorrect type in initializer (incompatible argument 3 (different address spaces)) @@ expected int ( [usertype] *proc_handler )( ... ) @@ got int ( * )( ... ) @@ mm/page_cache_limit.c:187:35: sparse: expected int ( [usertype] *proc_handler )( ... ) mm/page_cache_limit.c:187:35: sparse: got int ( * )( ... ) vim +103 mm/page_cache_limit.c 93 > 94 int cache_limit_mbytes_sysctl_handler(struct ctl_table *table, int write, 95 void __user *buffer, size_t *length, loff_t *ppos) 96 { 97 int ret; 98 unsigned long vm_cache_limit_mbytes_max; 99 unsigned long origin_mbytes = vm_cache_limit_mbytes; 100 int nr_retries = MAX_RECLAIM_RETRIES; 101 102 vm_cache_limit_mbytes_max = totalram_pages() >> (20 - PAGE_SHIFT); > 103 ret = proc_doulongvec_minmax(table, write, buffer, length, ppos); 104 if (ret || !write) 105 return ret; 106 107 if (vm_cache_limit_mbytes > vm_cache_limit_mbytes_max) { 108 vm_cache_limit_mbytes = origin_mbytes; 109 return -EINVAL; 110 } 111 112 if (write) { 113 while (should_reclaim_page_cache() && page_cache_over_limit() && 114 nr_retries--) { 115 if (signal_pending(current)) 116 return -EINTR; 117 118 shrink_memory(node_reclaim_num(), false); 119 } 120 } 121 122 return 0; 123 } 124 125 static void shrink_shepherd(struct work_struct *w) 126 { 127 int node; 128 129 if (!should_periodical_reclaim()) 130 return; 131 132 for_each_online_node(node) { 133 if (!work_pending(&vmscan_works[node])) 134 queue_work_node(node, system_unbound_wq, &vmscan_works[node]); 135 } 136 137 queue_delayed_work(system_unbound_wq, &shepherd, 138 round_jiffies_relative((unsigned long)vm_cache_reclaim_s * HZ)); 139 } 140 141 static void shrink_page_work(struct work_struct *w) 142 { 143 shrink_memory(node_reclaim_num(), true); 144 } 145 146 static void shrink_shepherd_timer(void) 147 { 148 int i; 149 150 for (i = 0; i < MAX_NUMNODES; i++) 151 INIT_WORK(&vmscan_works[i], shrink_page_work); 152 } 153 154 static struct ctl_table page_cache_limit_table[] = { 155 { 156 .procname = "cache_reclaim_s", 157 .data = &vm_cache_reclaim_s, 158 .maxlen = sizeof(vm_cache_reclaim_s), 159 .mode = 0644, 160 .proc_handler = cache_reclaim_sysctl_handler, 161 .extra1 = SYSCTL_ZERO, 162 .extra2 = &vm_cache_reclaim_s_max, 163 }, 164 { 165 .procname = "cache_reclaim_weight", 166 .data = &vm_cache_reclaim_weight, 167 .maxlen = sizeof(vm_cache_reclaim_weight), 168 .mode = 0644, 169 .proc_handler = proc_dointvec_minmax, 170 .extra1 = SYSCTL_ONE, 171 .extra2 = &vm_cache_reclaim_weight_max, 172 }, 173 { 174 .procname = "cache_reclaim_enable", 175 .data = &vm_cache_reclaim_enable, 176 .maxlen = sizeof(vm_cache_reclaim_enable), 177 .mode = 0644, 178 .proc_handler = cache_reclaim_enable_handler, 179 .extra1 = SYSCTL_ZERO, 180 .extra2 = SYSCTL_ONE, 181 }, 182 { 183 .procname = "cache_limit_mbytes", 184 .data = &vm_cache_limit_mbytes, 185 .maxlen = sizeof(vm_cache_limit_mbytes), 186 .mode = 0644, > 187 .proc_handler = cache_limit_mbytes_sysctl_handler, 188 }, 189 }; 190 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] iommu: Restore lost return in iommu_report_device_fault()
by Lin Ruifeng 14 Sep '24

14 Sep '24

From: Barak Biber <bbiber(a)nvidia.com> stable inclusion from stable-v6.10.7 commit cc6bc2ab1663ec9353636416af22452b078510e9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZS CVE: CVE-2024-44994 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fca5b78511e98bdff2cdd55c172b23200a7b3404 ] When iommu_report_device_fault gets called with a partial fault it is supposed to collect the fault into the group and then return. Instead the return was accidently deleted which results in trying to process the fault and an eventual crash. Deleting the return was a typo, put it back. Fixes: 3dfa64aecbaf ("iommu: Make iommu_report_device_fault() return void") Signed-off-by: Barak Biber <bbiber(a)nvidia.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Reviewed-by: Lu Baolu <baolu.lu(a)linux.intel.com> Link: https://lore.kernel.org/r/0-v1-e7153d9c8cee+1c6-iommu_fault_fix_jgg@nvidia.… Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/iommu/io-pgfault.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/iommu/io-pgfault.c b/drivers/iommu/io-pgfault.c index 06d78fcc79fd..f2c87c695a17 100644 --- a/drivers/iommu/io-pgfault.c +++ b/drivers/iommu/io-pgfault.c @@ -192,6 +192,7 @@ void iommu_report_device_fault(struct device *dev, struct iopf_fault *evt) report_partial_fault(iopf_param, fault); iopf_put_dev_fault_param(iopf_param); /* A request that is not the last does not need to be ack'd */ + return; } /* -- 2.17.1

2 1

[PATCH OLK-5.10 0/7] Backport bugfix from mainline
by Liu Shixin 14 Sep '24

14 Sep '24

Gavin Shan (1): mm: migrate: fix THP's mapcount on isolation Kemeng Shi (1): mm/compaction: correctly return failure with bogus compound_order in strict mode Liu Shixin (2): bootmem: remove the vmemmap pages from kmemleak in free_bootmem_page bootmem: use kmemleak_free_part_phys in free_bootmem_page Naoya Horiguchi (1): mm/huge_memory: use pfn_to_online_page() in split_huge_pages_all() Xueshi Hu (1): mm/hugetlb: fix nodes huge page allocation when there are surplus pages Yuan Can (1): mm: hugetlb_vmemmap: fix hugetlb page number decrease failed on movable nodes include/linux/bootmem_info.h | 2 ++ mm/compaction.c | 28 ++++++++++++++-------------- mm/huge_memory.c | 7 ++----- mm/hugetlb.c | 4 +++- mm/hugetlb_vmemmap.c | 2 +- 5 files changed, 22 insertions(+), 21 deletions(-) -- 2.34.1

2 8

[openeuler:OLK-6.6 1870/13938] drivers/cpufreq/cppc_cpufreq.c:852:19: error: incomplete definition of type 'struct fb_ctr_pair'
by kernel test robot 14 Sep '24

14 Sep '24

Hi Zeng, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 292de9750592324fa903dc314670538f50b4c19a commit: 12f136b2134d4ded731c3ef23ac08c85b9c0b1fa [1870/13938] cpufreq: CPPC: Keep the target core awake when reading its cpufreq rate config: arm64-randconfig-001-20240913 (https://download.01.org/0day-ci/archive/20240914/202409141237.GV6bZXKN-lkp@…) compiler: clang version 15.0.7 (https://github.com/llvm/llvm-project 8dfdcc7b7bf66834a761bd8de445840ef68e4d1a) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240914/202409141237.GV6bZXKN-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409141237.GV6bZXKN-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/cpufreq/cppc_cpufreq.c:852:19: error: incomplete definition of type 'struct fb_ctr_pair' int cpu = fb_ctrs->cpu; ~~~~~~~^ drivers/cpufreq/cppc_cpufreq.c:851:9: note: forward declaration of 'struct fb_ctr_pair' struct fb_ctr_pair *fb_ctrs = val; ^ drivers/cpufreq/cppc_cpufreq.c:855:40: error: incomplete definition of type 'struct fb_ctr_pair' ret = cppc_get_perf_ctrs(cpu, &fb_ctrs->fb_ctrs_t0); ~~~~~~~^ drivers/cpufreq/cppc_cpufreq.c:851:9: note: forward declaration of 'struct fb_ctr_pair' struct fb_ctr_pair *fb_ctrs = val; ^ drivers/cpufreq/cppc_cpufreq.c:861:41: error: incomplete definition of type 'struct fb_ctr_pair' return cppc_get_perf_ctrs(cpu, &fb_ctrs->fb_ctrs_t1); ~~~~~~~^ drivers/cpufreq/cppc_cpufreq.c:851:9: note: forward declaration of 'struct fb_ctr_pair' struct fb_ctr_pair *fb_ctrs = val; ^ >> drivers/cpufreq/cppc_cpufreq.c:866:21: error: variable has incomplete type 'struct fb_ctr_pair' struct fb_ctr_pair fb_ctrs = { .cpu = cpu, }; ^ drivers/cpufreq/cppc_cpufreq.c:866:9: note: forward declaration of 'struct fb_ctr_pair' struct fb_ctr_pair fb_ctrs = { .cpu = cpu, }; ^ 4 errors generated. vim +852 drivers/cpufreq/cppc_cpufreq.c 848 849 static int cppc_get_perf_ctrs_pair(void *val) 850 { 851 struct fb_ctr_pair *fb_ctrs = val; > 852 int cpu = fb_ctrs->cpu; 853 int ret; 854 855 ret = cppc_get_perf_ctrs(cpu, &fb_ctrs->fb_ctrs_t0); 856 if (ret) 857 return ret; 858 859 udelay(2); /* 2usec delay between sampling */ 860 861 return cppc_get_perf_ctrs(cpu, &fb_ctrs->fb_ctrs_t1); 862 } 863 864 static unsigned int cppc_cpufreq_get_rate(unsigned int cpu) 865 { > 866 struct fb_ctr_pair fb_ctrs = { .cpu = cpu, }; 867 struct cpufreq_policy *policy = cpufreq_cpu_get(cpu); 868 struct cppc_cpudata *cpu_data = policy->driver_data; 869 u64 delivered_perf; 870 int ret; 871 872 cpufreq_cpu_put(policy); 873 874 if (cpu_has_amu_feat(cpu)) 875 ret = smp_call_on_cpu(cpu, cppc_get_perf_ctrs_pair, 876 &fb_ctrs, false); 877 else 878 ret = cppc_get_perf_ctrs_pair(&fb_ctrs); 879 880 if (ret) 881 return 0; 882 883 delivered_perf = cppc_perf_from_fbctrs(cpu_data, 884 &fb_ctrs.fb_ctrs_t0, 885 &fb_ctrs.fb_ctrs_t1); 886 887 return cppc_cpufreq_perf_to_khz(cpu_data, delivered_perf); 888 } 889 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] mm/ksm: fix possible UAF of stable_node
by Kaixiong Yu 14 Sep '24

14 Sep '24

From: Chengming Zhou <chengming.zhou(a)linux.dev> mainline inclusion from mainline-v6.10-rc1 commit 90e823498881fb8a91d83e9a8eed87c8c3ff2176 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IARC7N CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The commit 2c653d0ee2ae ("ksm: introduce ksm_max_page_sharing per page deduplication limit") introduced a possible failure case in the stable_tree_insert(), where we may free the new allocated stable_node_dup if we fail to prepare the missing chain node. Then that kfolio return and unlock with a freed stable_node set... And any MM activities can come in to access kfolio->mapping, so UAF. Fix it by moving folio_set_stable_node() to the end after stable_node is inserted successfully. Link: https://lkml.kernel.org/r/20240513-b4-ksm-stable-node-uaf-v1-1-f687de76f452… Fixes: 2c653d0ee2ae ("ksm: introduce ksm_max_page_sharing per page deduplication limit") Signed-off-by: Chengming Zhou <chengming.zhou(a)linux.dev> Acked-by: David Hildenbrand <david(a)redhat.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: Hugh Dickins <hughd(a)google.com> Cc: Stefan Roesch <shr(a)devkernel.io> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/ksm.c [HULK-4.19 didn't merge mainline inclusion commit 79899cce33e0887c06d41e767aa543aaaaef48e2("mm/ksm: convert chain series funcs and replace get_ksm_page")] Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- mm/ksm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mm/ksm.c b/mm/ksm.c index 341e09c376e6..fc6b6526099f 100644 --- a/mm/ksm.c +++ b/mm/ksm.c @@ -1904,7 +1904,6 @@ static struct stable_node *stable_tree_insert(struct page *kpage) INIT_HLIST_HEAD(&stable_node_dup->hlist); stable_node_dup->kpfn = kpfn; - set_page_stable_node(kpage, stable_node_dup); stable_node_dup->rmap_hlist_len = 0; DO_NUMA(stable_node_dup->nid = nid); if (!need_chain) { @@ -1923,6 +1922,8 @@ static struct stable_node *stable_tree_insert(struct page *kpage) stable_node_chain_add_dup(stable_node_dup, stable_node); } + set_page_stable_node(kpage, stable_node_dup); + return stable_node_dup; } -- 2.34.1

2 1

[PATCH OLK-6.6] mm/ksm: fix possible UAF of stable_node
by Kaixiong Yu 14 Sep '24

14 Sep '24

From: Chengming Zhou <chengming.zhou(a)linux.dev> mainline inclusion from mainline-v6.10-rc1 commit 90e823498881fb8a91d83e9a8eed87c8c3ff2176 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IARBRI CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The commit 2c653d0ee2ae ("ksm: introduce ksm_max_page_sharing per page deduplication limit") introduced a possible failure case in the stable_tree_insert(), where we may free the new allocated stable_node_dup if we fail to prepare the missing chain node. Then that kfolio return and unlock with a freed stable_node set... And any MM activities can come in to access kfolio->mapping, so UAF. Fix it by moving folio_set_stable_node() to the end after stable_node is inserted successfully. Link: https://lkml.kernel.org/r/20240513-b4-ksm-stable-node-uaf-v1-1-f687de76f452… Fixes: 2c653d0ee2ae ("ksm: introduce ksm_max_page_sharing per page deduplication limit") Signed-off-by: Chengming Zhou <chengming.zhou(a)linux.dev> Acked-by: David Hildenbrand <david(a)redhat.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: Hugh Dickins <hughd(a)google.com> Cc: Stefan Roesch <shr(a)devkernel.io> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/ksm.c [OLK-6.6 didn't merge mainline inclusion commit 79899cce33e0887c06d41e767aa543aaaaef48e2("mm/ksm: convert chain series funcs and replace get_ksm_page")] Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- mm/ksm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mm/ksm.c b/mm/ksm.c index c828630985c0..7d5c76746712 100644 --- a/mm/ksm.c +++ b/mm/ksm.c @@ -1965,7 +1965,6 @@ static struct ksm_stable_node *stable_tree_insert(struct page *kpage) INIT_HLIST_HEAD(&stable_node_dup->hlist); stable_node_dup->kpfn = kpfn; - set_page_stable_node(kpage, stable_node_dup); stable_node_dup->rmap_hlist_len = 0; DO_NUMA(stable_node_dup->nid = nid); if (!need_chain) { @@ -1984,6 +1983,8 @@ static struct ksm_stable_node *stable_tree_insert(struct page *kpage) stable_node_chain_add_dup(stable_node_dup, stable_node); } + set_page_stable_node(kpage, stable_node_dup); + return stable_node_dup; } -- 2.34.1

2 1

[PATCH OLK-5.10] mm/ksm: fix possible UAF of stable_node
by Kaixiong Yu 14 Sep '24

14 Sep '24

From: Chengming Zhou <chengming.zhou(a)linux.dev> mainline inclusion from mainline-v6.10-rc1 commit 90e823498881fb8a91d83e9a8eed87c8c3ff2176 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IARCIF CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The commit 2c653d0ee2ae ("ksm: introduce ksm_max_page_sharing per page deduplication limit") introduced a possible failure case in the stable_tree_insert(), where we may free the new allocated stable_node_dup if we fail to prepare the missing chain node. Then that kfolio return and unlock with a freed stable_node set... And any MM activities can come in to access kfolio->mapping, so UAF. Fix it by moving folio_set_stable_node() to the end after stable_node is inserted successfully. Link: https://lkml.kernel.org/r/20240513-b4-ksm-stable-node-uaf-v1-1-f687de76f452… Fixes: 2c653d0ee2ae ("ksm: introduce ksm_max_page_sharing per page deduplication limit") Signed-off-by: Chengming Zhou <chengming.zhou(a)linux.dev> Acked-by: David Hildenbrand <david(a)redhat.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: Hugh Dickins <hughd(a)google.com> Cc: Stefan Roesch <shr(a)devkernel.io> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/ksm.c [OLK-5.10 merged commit 6584e73a2ca62cf3b0bed42204f79f082801c3f7 ("[Huawei] mm: transplant ksm hugepage feature for kernel 5.10")] Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- mm/ksm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mm/ksm.c b/mm/ksm.c index 21bb3e7cf3bc..b2cdbe6caa71 100644 --- a/mm/ksm.c +++ b/mm/ksm.c @@ -1922,7 +1922,6 @@ static struct stable_node *stable_tree_insert(struct page *kpage) INIT_HLIST_HEAD(&stable_node_dup->hlist); stable_node_dup->kpfn = kpfn; - set_page_stable_node(kpage, stable_node_dup); stable_node_dup->rmap_hlist_len = 0; DO_NUMA(stable_node_dup->nid = nid); if (!need_chain) { @@ -1941,6 +1940,8 @@ static struct stable_node *stable_tree_insert(struct page *kpage) stable_node_chain_add_dup(stable_node_dup, stable_node); } + set_page_stable_node(kpage, stable_node_dup); + return stable_node_dup; } -- 2.34.1

2 1

[openeuler:OLK-6.6 1834/13938] mm/page_cache_limit.c:35:5: sparse: sparse: symbol 'cache_reclaim_enable_handler' was not declared. Should it be static?
by kernel test robot 14 Sep '24

14 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 292de9750592324fa903dc314670538f50b4c19a commit: 621647ce254f1d347ae9bc3d328c09cbb2732487 [1834/13938] mm: support periodical memory reclaim config: loongarch-randconfig-r133-20240913 (https://download.01.org/0day-ci/archive/20240914/202409141142.ffRDmgO2-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240914/202409141142.ffRDmgO2-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409141142.ffRDmgO2-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/page_cache_limit.c:35:5: sparse: sparse: symbol 'cache_reclaim_enable_handler' was not declared. Should it be static? >> mm/page_cache_limit.c:51:5: sparse: sparse: symbol 'cache_reclaim_sysctl_handler' was not declared. Should it be static? vim +/cache_reclaim_enable_handler +35 mm/page_cache_limit.c 34 > 35 int cache_reclaim_enable_handler(struct ctl_table *table, int write, 36 void *buffer, size_t *length, loff_t *ppos) 37 { 38 int ret; 39 40 ret = proc_dointvec_minmax(table, write, buffer, length, ppos); 41 if (ret || !write) 42 return ret; 43 44 if (should_periodical_reclaim()) 45 schedule_delayed_work(&shepherd, round_jiffies_relative( 46 (unsigned long)vm_cache_reclaim_s * HZ)); 47 48 return 0; 49 } 50 > 51 int cache_reclaim_sysctl_handler(struct ctl_table *table, int write, 52 void *buffer, size_t *length, loff_t *ppos) 53 { 54 int ret; 55 56 ret = proc_dointvec_minmax(table, write, buffer, length, ppos); 57 if (ret || !write) 58 return ret; 59 60 if (should_periodical_reclaim()) 61 mod_delayed_work(system_unbound_wq, &shepherd, 62 round_jiffies_relative( 63 (unsigned long)vm_cache_reclaim_s * HZ)); 64 65 return ret; 66 } 67 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
by Peng Zhang 14 Sep '24

14 Sep '24

From: Mathias Nyman <mathias.nyman(a)linux.intel.com> stable inclusion from stable-v4.19.321 commit ef0a0e616b2789bb804a0ce5e161db03170a85b6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZE CVE: CVE-2024-45006 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit af8e119f52e9c13e556be9e03f27957554a84656 upstream. re-enumerating full-speed devices after a failed address device command can trigger a NULL pointer dereference. Full-speed devices may need to reconfigure the endpoint 0 Max Packet Size value during enumeration. Usb core calls usb_ep0_reinit() in this case, which ends up calling xhci_configure_endpoint(). On Panther point xHC the xhci_configure_endpoint() function will additionally check and reserve bandwidth in software. Other hosts do this in hardware If xHC address device command fails then a new xhci_virt_device structure is allocated as part of re-enabling the slot, but the bandwidth table pointers are not set up properly here. This triggers the NULL pointer dereference the next time usb_ep0_reinit() is called and xhci_configure_endpoint() tries to check and reserve bandwidth [46710.713538] usb 3-1: new full-speed USB device number 5 using xhci_hcd [46710.713699] usb 3-1: Device not responding to setup address. [46710.917684] usb 3-1: Device not responding to setup address. [46711.125536] usb 3-1: device not accepting address 5, error -71 [46711.125594] BUG: kernel NULL pointer dereference, address: 0000000000000008 [46711.125600] #PF: supervisor read access in kernel mode [46711.125603] #PF: error_code(0x0000) - not-present page [46711.125606] PGD 0 P4D 0 [46711.125610] Oops: Oops: 0000 [#1] PREEMPT SMP PTI [46711.125615] CPU: 1 PID: 25760 Comm: kworker/1:2 Not tainted 6.10.3_2 #1 [46711.125620] Hardware name: Gigabyte Technology Co., Ltd. [46711.125623] Workqueue: usb_hub_wq hub_event [usbcore] [46711.125668] RIP: 0010:xhci_reserve_bandwidth (drivers/usb/host/xhci.c Fix this by making sure bandwidth table pointers are set up correctly after a failed address device command, and additionally by avoiding checking for bandwidth in cases like this where no actual endpoints are added or removed, i.e. only context for default control endpoint 0 is evaluated. Reported-by: Karel Balej <balejk(a)matfyz.cz> Closes: https://lore.kernel.org/linux-usb/D3CKQQAETH47.1MUO22RTCH2O3@matfyz.cz/ Cc: stable(a)vger.kernel.org Fixes: 651aaf36a7d7 ("usb: xhci: Handle USB transaction error on address command") Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> Link: https://lore.kernel.org/r/20240815141117.2702314-2-mathias.nyman@linux.inte… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- drivers/usb/host/xhci.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c index 1cb66cbe6487..22e47392f16c 100644 --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -2748,7 +2748,7 @@ static int xhci_configure_endpoint(struct xhci_hcd *xhci, xhci->num_active_eps); return -ENOMEM; } - if ((xhci->quirks & XHCI_SW_BW_CHECKING) && + if ((xhci->quirks & XHCI_SW_BW_CHECKING) && !ctx_change && xhci_reserve_bandwidth(xhci, virt_dev, command->in_ctx)) { if ((xhci->quirks & XHCI_EP_LIMIT_QUIRK)) xhci_free_host_resources(xhci, ctrl_ctx); @@ -4094,8 +4094,10 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev, mutex_unlock(&xhci->mutex); ret = xhci_disable_slot(xhci, udev->slot_id); xhci_free_virt_device(xhci, udev->slot_id); - if (!ret) - xhci_alloc_dev(hcd, udev); + if (!ret) { + if (xhci_alloc_dev(hcd, udev) == 1) + xhci_setup_addressable_virt_dev(xhci, udev); + } kfree(command->completion); kfree(command); return -EPROTO; -- 2.25.1

2 1

[openeuler:OLK-5.10 2820/30000] drivers/tty/tty_buffer.c:175:2: error: implicit declaration of function 'printk_safe_enter'
by kernel test robot 14 Sep '24

14 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 5a1d9701155c6908c76c68951170f10279685143 commit: 923efc4dc37c1a7cc91f0dd5dbdc87e0943ad1ae [2820/30000] tty: fix possible deadlock in console_unlock config: x86_64-buildonly-randconfig-003-20240914 (https://download.01.org/0day-ci/archive/20240914/202409141036.Dno2bUGL-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240914/202409141036.Dno2bUGL-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409141036.Dno2bUGL-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/tty/tty_buffer.c:175:2: error: implicit declaration of function 'printk_safe_enter' [-Werror,-Wimplicit-function-declaration] 175 | printk_safe_enter(); | ^ drivers/tty/tty_buffer.c:175:2: note: did you mean 'printk_nmi_enter'? include/linux/printk.h:158:20: note: 'printk_nmi_enter' declared here 158 | static inline void printk_nmi_enter(void) { } | ^ >> drivers/tty/tty_buffer.c:177:2: error: implicit declaration of function 'printk_safe_exit' [-Werror,-Wimplicit-function-declaration] 177 | printk_safe_exit(); | ^ 2 errors generated. vim +/printk_safe_enter +175 drivers/tty/tty_buffer.c 142 143 /** 144 * tty_buffer_alloc - allocate a tty buffer 145 * @port: tty port 146 * @size: desired size (characters) 147 * 148 * Allocate a new tty buffer to hold the desired number of characters. 149 * We round our buffers off in 256 character chunks to get better 150 * allocation behaviour. 151 * Return NULL if out of memory or the allocation would exceed the 152 * per device queue 153 */ 154 155 static struct tty_buffer *tty_buffer_alloc(struct tty_port *port, size_t size) 156 { 157 struct llist_node *free; 158 struct tty_buffer *p; 159 160 /* Round the buffer size out */ 161 size = __ALIGN_MASK(size, TTYB_ALIGN_MASK); 162 163 if (size <= MIN_TTYB_SIZE) { 164 free = llist_del_first(&port->buf.free); 165 if (free) { 166 p = llist_entry(free, struct tty_buffer, free); 167 goto found; 168 } 169 } 170 171 /* Should possibly check if this fails for the largest buffer we 172 have queued and recycle that ? */ 173 if (atomic_read(&port->buf.mem_used) > port->buf.mem_limit) 174 return NULL; > 175 printk_safe_enter(); 176 p = kmalloc(sizeof(struct tty_buffer) + 2 * size, GFP_ATOMIC); > 177 printk_safe_exit(); 178 if (p == NULL) 179 return NULL; 180 181 found: 182 tty_buffer_reset(p, size); 183 atomic_add(size, &port->buf.mem_used); 184 return p; 185 } 186 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0