- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 1/3] Revert "soc: hisilicon: hisi_hbmdev: Add hbm acls repair and query methods"
by Zhang Zekun 16 Aug '24

16 Aug '24

hulk inclusion category: freature bugzilla: https://gitee.com/openeuler/kernel/issues/IAKLPG ----------------------------------------- This reverts commit 4b3a359dbd757d7be787bce99d221eb213ebb39d. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/soc/hisilicon/Kconfig | 11 --- drivers/soc/hisilicon/hisi_hbmdev.c | 134 ---------------------------- 2 files changed, 145 deletions(-) diff --git a/drivers/soc/hisilicon/Kconfig b/drivers/soc/hisilicon/Kconfig index 90d8036ae658..c21612f0a52e 100644 --- a/drivers/soc/hisilicon/Kconfig +++ b/drivers/soc/hisilicon/Kconfig @@ -44,16 +44,6 @@ config HISI_HBMCACHE To compile the driver as a module, choose M here: the module will be called hisi_hbmcache. -config HISI_HBMDEV_ACLS - bool "Add support for HISI ACLS repair" - depends on HISI_HBMDEV - help - Add ACLS support for hbm device, which can be used to query and - repair hardware error in HBM devices. This feature need to work with - hardware firmwares. - - If not sure say no. - config HISI_L3T tristate "Add support for l3t" depends on ARM64 && ACPI @@ -71,5 +61,4 @@ config HISI_L0 for user to alloc and lock memory If not sure say no. - endmenu diff --git a/drivers/soc/hisilicon/hisi_hbmdev.c b/drivers/soc/hisilicon/hisi_hbmdev.c index 9fa464c94bbc..af487c439a90 100644 --- a/drivers/soc/hisilicon/hisi_hbmdev.c +++ b/drivers/soc/hisilicon/hisi_hbmdev.c @@ -11,7 +11,6 @@ #include <linux/node.h> #include <linux/arch_topology.h> #include <linux/memory_hotplug.h> -#include <linux/mm.h> #include "hisi_internal.h" @@ -26,9 +25,6 @@ struct cdev_node { struct memory_dev { struct kobject *memdev_kobj; struct kobject *topo_kobj; -#ifdef CONFIG_HISI_HBMDEV_ACLS - struct kobject *acls_kobj; -#endif struct cdev_node cdev_list; nodemask_t cluster_cpumask[MAX_NUMNODES]; }; @@ -89,134 +85,6 @@ static void memory_topo_init(void) kobject_put(mdev->topo_kobj); } -#ifdef CONFIG_HISI_HBMDEV_ACLS -static struct acpi_device *paddr_to_acpi_device(u64 paddr) -{ - unsigned long pfn; - int nid; - - pfn = __phys_to_pfn(paddr); - if (!pfn_valid(pfn)) - return NULL; - - nid = pfn_to_nid(pfn); - if (nid < 0 && nid >= MAX_NUMNODES) - return NULL; - - return hotplug_mdev[nid]; -} - -static ssize_t acls_query_store(struct kobject *kobj, - struct kobj_attribute *attr, - const char *buf, size_t count) -{ - struct acpi_object_list arg_list; - struct acpi_device *adev; - union acpi_object obj; - acpi_status status; - u64 paddr, res; - - if (kstrtoull(buf, 16, &paddr)) - return -EINVAL; - - adev = paddr_to_acpi_device(paddr); - if (!adev) - return -EINVAL; - - obj.type = ACPI_TYPE_INTEGER; - obj.integer.value = paddr; - arg_list.count = 1; - arg_list.pointer = &obj; - - status = acpi_evaluate_integer(adev->handle, "AQRY", &arg_list, &res); - if (ACPI_FAILURE(status)) - return -ENODEV; - - /* AQRY will return a positive error code to represent error status */ - if (IS_ERR_VALUE(-res)) - return -res; - else if (res) - return -ENODEV; - - return count; -} - -static struct kobj_attribute acls_query_store_attribute = - __ATTR(acls_query, 0200, NULL, acls_query_store); - -static ssize_t acls_repair_store(struct kobject *kobj, - struct kobj_attribute *attr, - const char *buf, size_t count) -{ - struct acpi_object_list arg_list; - struct acpi_device *adev; - union acpi_object obj; - acpi_status status; - u64 paddr, res; - - if (kstrtoull(buf, 16, &paddr)) - return -EINVAL; - - adev = paddr_to_acpi_device(paddr); - if (!adev) - return -EINVAL; - - obj.type = ACPI_TYPE_INTEGER; - obj.integer.value = paddr; - arg_list.count = 1; - arg_list.pointer = &obj; - - status = acpi_evaluate_integer(adev->handle, "AREP", &arg_list, &res); - if (ACPI_FAILURE(status)) - return -ENODEV; - - /* AREP will return a positive error code to represent error status */ - if (IS_ERR_VALUE(-res)) - return -res; - else if (res) - return -ENODEV; - - return count; -} -static struct kobj_attribute acls_repair_store_attribute = - __ATTR(acls_repair, 0200, NULL, acls_repair_store); - -static struct attribute *acls_attrs[] = { - &acls_query_store_attribute.attr, - &acls_repair_store_attribute.attr, - NULL, -}; - -static struct attribute_group acls_attr_group = { - .attrs = acls_attrs, -}; - -static void acls_init(void) -{ - int ret = -ENOMEM; - - mdev->acls_kobj = kobject_create_and_add("acls", mdev->memdev_kobj); - if (!mdev->acls_kobj) - goto out; - - ret = sysfs_create_group(mdev->acls_kobj, &acls_attr_group); - if (ret) - kobject_put(mdev->acls_kobj); - -out: - if (ret) - pr_err("ACLS hot repair is not enabled\n"); -} - -static void acls_remove(void) -{ - kobject_put(mdev->acls_kobj); -} -#else -static void acls_init(void) {} -static void acls_remove(void) {} -#endif - static int get_pxm(struct acpi_device *acpi_device, void *arg) { acpi_handle handle = acpi_device->handle; @@ -404,7 +272,6 @@ static int __init mdev_init(void) } memory_topo_init(); - acls_init(); return ret; } module_init(mdev_init); @@ -414,7 +281,6 @@ static void __exit mdev_exit(void) container_remove(); kobject_put(mdev->memdev_kobj); kobject_put(mdev->topo_kobj); - acls_remove(); kfree(mdev); } module_exit(mdev_exit); -- 2.17.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2023-52868
by Chen Ridong 16 Aug '24

16 Aug '24

CVE-2023-52868 Dan Carpenter (1): thermal: core: prevent potential string overflow drivers/thermal/thermal_core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS 0/4] openeuler lts backport
by Xiaomeng Zhang 16 Aug '24

16 Aug '24

Haifeng Xu (1): perf/core: Fix missing wakeup when waiting for context reference Jeff Johnson (1): tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test Rik van Riel (1): fs/proc: fix softlockup in __read_vmcore Steven Rostedt (1): ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value fs/proc/vmcore.c | 2 ++ include/trace/events/asoc.h | 2 ++ kernel/events/core.c | 13 +++++++++++++ kernel/trace/preemptirq_delay_test.c | 1 + 4 files changed, 18 insertions(+) -- 2.34.1

2 5

[PATCH openEuler-22.03-LTS-SP1 0/2] Fix CVE-2024-36880
by Yi Yang 16 Aug '24

16 Aug '24

Fix CVE-2024-36880 for openEuler-22.03-LTS-SP1 Johan Hovold (2): Bluetooth: qca: add missing firmware sanity checks Bluetooth: qca: fix firmware check error path drivers/bluetooth/btqca.c | 36 ++++++++++++++++++++++++++++++------ 1 file changed, 30 insertions(+), 6 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 0/2] Fix CVE-2024-36880
by Yi Yang 16 Aug '24

16 Aug '24

Fix CVE-2024-36880 for OLK-5.10 Johan Hovold (2): Bluetooth: qca: add missing firmware sanity checks Bluetooth: qca: fix firmware check error path drivers/bluetooth/btqca.c | 36 ++++++++++++++++++++++++++++++------ 1 file changed, 30 insertions(+), 6 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2023-52868
by Chen Ridong 16 Aug '24

16 Aug '24

*** BLURB HERE *** Dan Carpenter (1): thermal: core: prevent potential string overflow drivers/thermal/thermal_core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[openeuler:openEuler-1.0-LTS 9263/23498] drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dml1_display_rq_dlg_calc.o: warning: objtool: dml1_rq_dlg_get_dlg_params()+0x2f1c: unreachable instruction
by kernel test robot 16 Aug '24

16 Aug '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: c75f813072b1d42cc638d175e1a8e84835f383ee commit: f25433cb156a967d9b426ebaadf197c2369398e7 [9263/23498] drm/amd/display: readd -msse2 to prevent Clang from emitting libcalls to undefined SW FP routines config: x86_64-randconfig-104-20240816 (https://download.01.org/0day-ci/archive/20240816/202408161225.VySIKip3-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240816/202408161225.VySIKip3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408161225.VySIKip3-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dml1_display_rq_dlg_calc.c:26: In file included from drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dml1_display_rq_dlg_calc.h:29: In file included from drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dml_common_defs.h:29: In file included from drivers/gpu/drm/amd/amdgpu/../display/dc/dm_services.h:35: In file included from drivers/gpu/drm/amd/amdgpu/../display/dc/dm_services_types.h:29: In file included from drivers/gpu/drm/amd/amdgpu/../display/dc/os_types.h:31: In file included from include/drm/drmP.h:62: In file included from arch/x86/include/asm/pgalloc.h:7: include/linux/pagemap.h:401:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 401 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. >> drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dml1_display_rq_dlg_calc.o: warning: objtool: dml1_rq_dlg_get_dlg_params()+0x2f1c: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1 0/4] Fix CVE-2024-36031
by Yi Yang 16 Aug '24

16 Aug '24

Fix CVE-2024-36031 for openEuler-22.03-LTS-SP1 David Howells (2): keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry keys, dns: Fix size check of V1 server-list header Edward Adam Davis (1): keys, dns: Fix missing size check of V1 server-list header Silvio Gissi (1): keys: Fix overwrite of key expiration on instantiation include/linux/key-type.h | 1 + net/dns_resolver/dns_key.c | 25 ++++++++++++++++--------- security/keys/gc.c | 31 +++++++++++++++++++++---------- security/keys/internal.h | 11 ++++++++++- security/keys/key.c | 16 ++++++---------- security/keys/proc.c | 2 +- 6 files changed, 55 insertions(+), 31 deletions(-) -- 2.25.1

2 5

[PATCH openEuler-22.03-LTS-SP1] usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
by Zeng Heng 16 Aug '24

16 Aug '24

From: Lee Jones <lee(a)kernel.org> mainline inclusion from mainline-v6.10 commit 6d3c721e686ea6c59e18289b400cc95c76e927e0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAILHF CVE: CVE-2024-42236 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Userspace provided string 's' could trivially have the length zero. Left unchecked this will firstly result in an OOB read in the form `if (str[0 - 1] == '\n') followed closely by an OOB write in the form `str[0 - 1] = '\0'`. There is already a validating check to catch strings that are too long. Let's supply an additional check for invalid strings that are too short. Signed-off-by: Lee Jones <lee(a)kernel.org> Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/20240705074339.633717-1-lee@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: dengquan <dengquan9(a)huawei.com> --- drivers/usb/gadget/configfs.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c index d51ea1c052f2..6bb69a4e6470 100644 --- a/drivers/usb/gadget/configfs.c +++ b/drivers/usb/gadget/configfs.c @@ -104,9 +104,12 @@ static int usb_string_copy(const char *s, char **s_copy) int ret; char *str; char *copy = *s_copy; + ret = strlen(s); if (ret > USB_MAX_STRING_LEN) return -EOVERFLOW; + if (ret < 1) + return -EINVAL; if (copy) { str = copy; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
by Zeng Heng 16 Aug '24

16 Aug '24

From: Lee Jones <lee(a)kernel.org> mainline inclusion from mainline-v6.10 commit 6d3c721e686ea6c59e18289b400cc95c76e927e0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAILHF CVE: CVE-2024-42236 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Userspace provided string 's' could trivially have the length zero. Left unchecked this will firstly result in an OOB read in the form `if (str[0 - 1] == '\n') followed closely by an OOB write in the form `str[0 - 1] = '\0'`. There is already a validating check to catch strings that are too long. Let's supply an additional check for invalid strings that are too short. Signed-off-by: Lee Jones <lee(a)kernel.org> Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/20240705074339.633717-1-lee@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: dengquan <dengquan9(a)huawei.com> --- drivers/usb/gadget/configfs.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c index c85e64c0c39e..39a483b66484 100644 --- a/drivers/usb/gadget/configfs.c +++ b/drivers/usb/gadget/configfs.c @@ -114,9 +114,12 @@ static int usb_string_copy(const char *s, char **s_copy) int ret; char *str; char *copy = *s_copy; + ret = strlen(s); if (ret > 126) return -EOVERFLOW; + if (ret < 1) + return -EINVAL; str = kstrdup(s, GFP_KERNEL); if (!str) -- 2.25.1

2 1