- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] bpf: Remove tst_run from lwt_seg6local_prog_ops.
by Liu Jian 12 Oct '24

12 Oct '24

From: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> mainline inclusion from mainline-v6.11-rc1 commit c13fda93aca118b8e5cd202e339046728ee7dddb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX44 CVE: CVE-2024-46754 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- The syzbot reported that the lwt_seg6 related BPF ops can be invoked via bpf_test_run() without without entering input_action_end_bpf() first. Martin KaFai Lau said that self test for BPF_PROG_TYPE_LWT_SEG6LOCAL probably didn't work since it was introduced in commit 04d4b274e2a ("ipv6: sr: Add seg6local action End.BPF"). The reason is that the per-CPU variable seg6_bpf_srh_states::srh is never assigned in the self test case but each BPF function expects it. Remove test_run for BPF_PROG_TYPE_LWT_SEG6LOCAL. Suggested-by: Martin KaFai Lau <martin.lau(a)linux.dev> Reported-by: syzbot+608a2acde8c5a101d07d(a)syzkaller.appspotmail.com Fixes: d1542d4ae4df ("seg6: Use nested-BH locking for seg6_bpf_srh_states.") Fixes: 004d4b274e2a ("ipv6: sr: Add seg6local action End.BPF") Signed-off-by: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Acked-by: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://lore.kernel.org/r/20240710141631.FbmHcQaX@linutronix.de Signed-off-by: Martin KaFai Lau <martin.lau(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/core/filter.c | 1 - 1 file changed, 1 deletion(-) diff --git a/net/core/filter.c b/net/core/filter.c index aa4cd4143ac7..e16d746c23da 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -11094,7 +11094,6 @@ const struct bpf_verifier_ops lwt_seg6local_verifier_ops = { }; const struct bpf_prog_ops lwt_seg6local_prog_ops = { - .test_run = bpf_prog_test_run_skb, }; const struct bpf_verifier_ops cg_sock_verifier_ops = { -- 2.34.1

2 7

[PATCH OLK-5.10] bpf: Remove tst_run from lwt_seg6local_prog_ops.
by Liu Jian 12 Oct '24

12 Oct '24

From: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> mainline inclusion from mainline-v6.11-rc1 commit c13fda93aca118b8e5cd202e339046728ee7dddb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX44 CVE: CVE-2024-46754 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- The syzbot reported that the lwt_seg6 related BPF ops can be invoked via bpf_test_run() without without entering input_action_end_bpf() first. Martin KaFai Lau said that self test for BPF_PROG_TYPE_LWT_SEG6LOCAL probably didn't work since it was introduced in commit 04d4b274e2a ("ipv6: sr: Add seg6local action End.BPF"). The reason is that the per-CPU variable seg6_bpf_srh_states::srh is never assigned in the self test case but each BPF function expects it. Remove test_run for BPF_PROG_TYPE_LWT_SEG6LOCAL. Suggested-by: Martin KaFai Lau <martin.lau(a)linux.dev> Reported-by: syzbot+608a2acde8c5a101d07d(a)syzkaller.appspotmail.com Fixes: d1542d4ae4df ("seg6: Use nested-BH locking for seg6_bpf_srh_states.") Fixes: 004d4b274e2a ("ipv6: sr: Add seg6local action End.BPF") Signed-off-by: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Acked-by: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://lore.kernel.org/r/20240710141631.FbmHcQaX@linutronix.de Signed-off-by: Martin KaFai Lau <martin.lau(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/core/filter.c | 1 - 1 file changed, 1 deletion(-) diff --git a/net/core/filter.c b/net/core/filter.c index a4d96f0231b2..62d09520a55d 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -9990,7 +9990,6 @@ const struct bpf_verifier_ops lwt_seg6local_verifier_ops = { }; const struct bpf_prog_ops lwt_seg6local_prog_ops = { - .test_run = bpf_prog_test_run_skb, }; const struct bpf_verifier_ops cg_sock_verifier_ops = { -- 2.34.1

2 5

[PATCH openEuler-22.03-LTS-SP1 0/7] CVE-2022-48878
by Yuan Can 12 Oct '24

12 Oct '24

Fix patch of CVE-2022-48878 and its pre requests and new fix patches. Krzysztof Kozlowski (1): Bluetooth: hci_qca: Fix driver shutdown on closed serdev Venkata Lakshmi Narayana Gubba (4): Bluetooth: hci_qca: Wait for timeout during suspend Bluetooth: hci_qca: Wait for SSR completion during suspend Bluetooth: hci_qca: check for SSR triggered flag while suspend Bluetooth: hci_qca: Fixed issue during suspend Yang Yingliang (1): Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave() Zijun Hu (1): Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot drivers/bluetooth/hci_qca.c | 82 ++++++++++++++++++++++++++++++++----- 1 file changed, 72 insertions(+), 10 deletions(-) -- 2.17.1

2 8

[PATCH OLK-5.10] arm64/mpam: Be compatible with MPAM architecture v1.x
by Zeng Heng 12 Oct '24

12 Oct '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAWM0R -------------------------------- Modified to be compatible with MPAM architecture version 1.x instead of version 1.0 only, otherwise the probe function would fail to initialize MPAM resource. Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_device.c | 6 ++++-- arch/arm64/kernel/mpam/mpam_resource.h | 4 ++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kernel/mpam/mpam_device.c b/arch/arm64/kernel/mpam/mpam_device.c index c8f2d66da051..deaf990d0c74 100644 --- a/arch/arm64/kernel/mpam/mpam_device.c +++ b/arch/arm64/kernel/mpam/mpam_device.c @@ -127,12 +127,14 @@ mpam_probe_update_sysprops(u16 max_partid, u16 max_pmg) static int mpam_device_probe(struct mpam_device *dev) { + u64 idr; u32 hwfeatures, part_sel; u16 max_intpartid = 0; u16 max_partid, max_pmg; - if (mpam_read_reg(dev, MPAMF_AIDR) != MPAM_ARCHITECTURE_V1) { - pr_err_once("device at 0x%llx does not match MPAM architecture v1.0\n", + idr = mpam_read_reg(dev, MPAMF_AIDR); + if ((idr & MPAMF_AIDR_ARCH_MAJOR_REV) != MPAM_ARCHITECTURE_V1) { + pr_err_once("device at 0x%llx does not match MPAM architecture v1.x\n", dev->hwpage_address); return -EIO; } diff --git a/arch/arm64/kernel/mpam/mpam_resource.h b/arch/arm64/kernel/mpam/mpam_resource.h index 93452498c8d1..7a644634c826 100644 --- a/arch/arm64/kernel/mpam/mpam_resource.h +++ b/arch/arm64/kernel/mpam/mpam_resource.h @@ -48,6 +48,10 @@ #define HAS_MSMON BIT(30) #define HAS_PARTID_NRW BIT(31) +/* MPAMF_AIDR - MPAM architecture ID register */ +#define MPAMF_AIDR_ARCH_MAJOR_REV GENMASK(7, 4) +#define MPAMF_AIDR_ARCH_MINOR_REV GENMASK(3, 0) + /* MPAMF_IDR */ #define MPAMF_IDR_PMG_MAX_MASK ((BIT(8) - 1) << 16) #define MPAMF_IDR_PMG_MAX_SHIFT 16 -- 2.25.1

2 1

[PATCH OLK-5.10] arm64/mpam: Be compatible with MPAM architecture v1.x
by Zeng Heng 12 Oct '24

12 Oct '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAWM0R -------------------------------- Modified to be compatible with MPAM architecture version 1.x instead of just version 1.0, otherwise the probe function would fail to initialize MPAM resource. Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_device.c | 6 ++++-- arch/arm64/kernel/mpam/mpam_resource.h | 4 ++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kernel/mpam/mpam_device.c b/arch/arm64/kernel/mpam/mpam_device.c index c8f2d66da051..deaf990d0c74 100644 --- a/arch/arm64/kernel/mpam/mpam_device.c +++ b/arch/arm64/kernel/mpam/mpam_device.c @@ -127,12 +127,14 @@ mpam_probe_update_sysprops(u16 max_partid, u16 max_pmg) static int mpam_device_probe(struct mpam_device *dev) { + u64 idr; u32 hwfeatures, part_sel; u16 max_intpartid = 0; u16 max_partid, max_pmg; - if (mpam_read_reg(dev, MPAMF_AIDR) != MPAM_ARCHITECTURE_V1) { - pr_err_once("device at 0x%llx does not match MPAM architecture v1.0\n", + idr = mpam_read_reg(dev, MPAMF_AIDR); + if ((idr & MPAMF_AIDR_ARCH_MAJOR_REV) != MPAM_ARCHITECTURE_V1) { + pr_err_once("device at 0x%llx does not match MPAM architecture v1.x\n", dev->hwpage_address); return -EIO; } diff --git a/arch/arm64/kernel/mpam/mpam_resource.h b/arch/arm64/kernel/mpam/mpam_resource.h index 93452498c8d1..7a644634c826 100644 --- a/arch/arm64/kernel/mpam/mpam_resource.h +++ b/arch/arm64/kernel/mpam/mpam_resource.h @@ -48,6 +48,10 @@ #define HAS_MSMON BIT(30) #define HAS_PARTID_NRW BIT(31) +/* MPAMF_AIDR - MPAM architecture ID register */ +#define MPAMF_AIDR_ARCH_MAJOR_REV GENMASK(7, 4) +#define MPAMF_AIDR_ARCH_MINOR_REV GENMASK(3, 0) + /* MPAMF_IDR */ #define MPAMF_IDR_PMG_MAX_MASK ((BIT(8) - 1) << 16) #define MPAMF_IDR_PMG_MAX_SHIFT 16 -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] CVE-2024-43855
by Li Nan 12 Oct '24

12 Oct '24

Li Nan (1): md: ensure child flush IO does not affect origin bio->bi_status Yu Kuai (1): md: Remove flush handling drivers/md/md.h | 10 ---- drivers/md/md.c | 134 +++++++++++------------------------------------- 2 files changed, 31 insertions(+), 113 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-22.03-LTS-SP1] bpf: Remove tst_run from lwt_seg6local_prog_ops.
by Liu Jian 12 Oct '24

12 Oct '24

From: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> mainline inclusion from mainline-v6.11-rc1 commit c13fda93aca118b8e5cd202e339046728ee7dddb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX44 CVE: CVE-2024-46754 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- The syzbot reported that the lwt_seg6 related BPF ops can be invoked via bpf_test_run() without without entering input_action_end_bpf() first. Martin KaFai Lau said that self test for BPF_PROG_TYPE_LWT_SEG6LOCAL probably didn't work since it was introduced in commit 04d4b274e2a ("ipv6: sr: Add seg6local action End.BPF"). The reason is that the per-CPU variable seg6_bpf_srh_states::srh is never assigned in the self test case but each BPF function expects it. Remove test_run for BPF_PROG_TYPE_LWT_SEG6LOCAL. Suggested-by: Martin KaFai Lau <martin.lau(a)linux.dev> Reported-by: syzbot+608a2acde8c5a101d07d(a)syzkaller.appspotmail.com Fixes: d1542d4ae4df ("seg6: Use nested-BH locking for seg6_bpf_srh_states.") Fixes: 004d4b274e2a ("ipv6: sr: Add seg6local action End.BPF") Signed-off-by: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Acked-by: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://lore.kernel.org/r/20240710141631.FbmHcQaX@linutronix.de Signed-off-by: Martin KaFai Lau <martin.lau(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/core/filter.c | 1 - 1 file changed, 1 deletion(-) diff --git a/net/core/filter.c b/net/core/filter.c index 8a61914d35c5..3cdca0279b2d 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -9881,7 +9881,6 @@ const struct bpf_verifier_ops lwt_seg6local_verifier_ops = { }; const struct bpf_prog_ops lwt_seg6local_prog_ops = { - .test_run = bpf_prog_test_run_skb, }; const struct bpf_verifier_ops cg_sock_verifier_ops = { -- 2.34.1

2 5

[PATCH openEuler-22.03-LTS-SP1 0/3] CVE-2024-43855
by Li Nan 12 Oct '24

12 Oct '24

Li Nan (1): md: ensure child flush IO does not affect origin bio->bi_status Mikulas Patocka (1): md: fix a crash in mempool_free Yu Kuai (1): md: Remove flush handling drivers/md/md.h | 10 ---- drivers/md/md.c | 137 ++++++++++++------------------------------------ 2 files changed, 34 insertions(+), 113 deletions(-) -- 2.39.2

2 4

[PATCH OLK-5.10] md/raid1: don't free conf on raid0_run failure
by Zheng Qixing 12 Oct '24

12 Oct '24

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-v6.11-rc1 commit 17f91ac0843b50462a9c9c8f18df962338bd3db2 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAUQ97 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The core md code calls the ->free method which already frees conf. Fixes: 07f1a6850c5d ("md/raid1: fail run raid1 array when active disk less than one") Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Song Liu <song(a)kernel.org> Link: https://lore.kernel.org/r/20240604172607.3185916-3-hch@lst.de Conflicts: drivers/md/raid1.c [The conflicts here are due to inconsistencies in the context.] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/raid1.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index 4584fba5a010..333b611aa152 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -3069,7 +3069,6 @@ static struct r1conf *setup_conf(struct mddev *mddev) return ERR_PTR(err); } -static void raid1_free(struct mddev *mddev, void *priv); static int raid1_run(struct mddev *mddev) { struct r1conf *conf; @@ -3128,8 +3127,7 @@ static int raid1_run(struct mddev *mddev) */ if (conf->raid_disks - mddev->degraded < 1) { md_unregister_thread(&conf->thread); - ret = -EINVAL; - goto abort; + return -EINVAL; } if (conf->raid_disks - mddev->degraded == 1) @@ -3162,14 +3160,8 @@ static int raid1_run(struct mddev *mddev) } ret = md_integrity_register(mddev); - if (ret) { + if (ret) md_unregister_thread(&mddev->thread); - goto abort; - } - return 0; - -abort: - raid1_free(mddev, conf); return ret; } -- 2.39.2

2 1

[PATCH OLK-5.10] fix: fix version showed in ethtool
by s00851154 12 Oct '24

12 Oct '24

From: Shi Jing <shijing34(a)huawei.com> driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAWGUW CVE: NA -------------------------------- Fix the version in the output of ethtool commands from empty to the kernel version. Use the macro HINIC3_NIC_DRV_VERSION to record driver changes for developers. The last number 1.0.X grow as minor changes, like this revision which does not affect the main functions. The middle number 1.X.1 iterates with changes to drivers functionality and fixing of serious bugs, and the first one X.0.1 means the number of releases of the driver. Signed-off-by: Shi Jing <shijing34(a)huawei.com> --- drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c | 1 - drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c index 2b3561e..696d441 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c @@ -45,7 +45,6 @@ static void hinic3_get_drvinfo(struct net_device *netdev, int err; strlcpy(info->driver, HINIC3_NIC_DRV_NAME, sizeof(info->driver)); - strlcpy(info->version, HINIC3_NIC_DRV_VERSION, sizeof(info->version)); strlcpy(info->bus_info, pci_name(pdev), sizeof(info->bus_info)); err = hinic3_get_mgmt_version(nic_dev->hwdev, mgmt_ver, diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h index 2967311..5868187 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h @@ -17,7 +17,7 @@ #include "hinic3_dcb.h" #define HINIC3_NIC_DRV_NAME "hinic3" -#define HINIC3_NIC_DRV_VERSION "" +#define HINIC3_NIC_DRV_VERSION "1.0.1" #define HINIC3_FUNC_IS_VF(hwdev) (hinic3_func_type(hwdev) == TYPE_VF) -- 2.28.0.windows.1

2 1