- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 v2] gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
by Baokun Li 28 Feb '24

28 Feb '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v5.10.209 commit 5c28478af371a1c3fdb570ca67f110e1ae60fc37 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932W3 CVE: CVE-2023-52448 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8877243beafa7c6bfc42022cbfdf9e39b25bd4fa ] Syzkaller has reported a NULL pointer dereference when accessing rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating rgd->rd_gl fails in read_rindex_entry(). Add a NULL pointer check in gfs2_rgrp_dump() to prevent that. Reported-and-tested-by: syzbot+da0fc229cc1ff4bb2e6d(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=da0fc229cc1ff4bb2e6d Fixes: 72244b6bc752 ("gfs2: improve debug information when lvb mismatches are found") Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Andreas Gruenbacher <agruenba(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/gfs2/rgrp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c index c5bde789a16d..4e760a3fb661 100644 --- a/fs/gfs2/rgrp.c +++ b/fs/gfs2/rgrp.c @@ -2231,7 +2231,7 @@ void gfs2_rgrp_dump(struct seq_file *seq, struct gfs2_rgrpd *rgd, (unsigned long long)rgd->rd_addr, rgd->rd_flags, rgd->rd_free, rgd->rd_free_clone, rgd->rd_dinodes, rgd->rd_reserved, rgd->rd_extfail_pt); - if (rgd->rd_sbd->sd_args.ar_rgrplvb) { + if (rgd->rd_sbd->sd_args.ar_rgrplvb && rgd->rd_rgl) { struct gfs2_rgrp_lvb *rgl = rgd->rd_rgl; gfs2_print_dbg(seq, "%s L: f:%02x b:%u i:%u\n", fs_id_buf, -- 2.31.1

2 1

[PATCH OLK-6.6 v2 0/2] fix CVE-2024-26590
by Baokun Li 28 Feb '24

28 Feb '24

Gao Xiang (2): erofs: simplify compression configuration parser erofs: fix inconsistent per-file compression format fs/erofs/compress.h | 6 +++ fs/erofs/decompressor.c | 62 ++++++++++++++++++++++++++-- fs/erofs/decompressor_deflate.c | 5 ++- fs/erofs/decompressor_lzma.c | 4 +- fs/erofs/internal.h | 38 +---------------- fs/erofs/super.c | 72 ++++----------------------------- fs/erofs/zmap.c | 23 ++++++----- 7 files changed, 92 insertions(+), 118 deletions(-) -- 2.31.1

2 3

[PATCH v1 OLK-6.6 0/3] kworker: Fix the problem of ipsan performance degradation on ARM architecture
by jiangdongxu 28 Feb '24

28 Feb '24

From: shaodenghui <shaodenghui(a)huawei.com> When the current downstream FS tests IPSAN, it is found that the performance on ARM is much worse than that on X86, and the test data of IPSAN fluctuates greatly. After analysis, the reason is that when iscsi issues IO, the task is sent to kworker for processing by iscsi_xmitworker. The workqueue created by iscsi can automatically identify the CPU of the soft interrupt currently processed by iscsi, and automatically schedule the workqueue to the corresponding NUMA node. shaodenghui (3): iscsi: add member for NUMA aware order workqueue workqueue: implement NUMA affinity for single thread workqueue iscsi: use dynamic single thread workqueue to improve performance drivers/scsi/iscsi_tcp.c | 9 +++++++++ drivers/scsi/libiscsi.c | 17 ++++++++++++----- include/linux/workqueue.h | 1 + include/scsi/libiscsi.h | 1 + kernel/workqueue.c | 15 ++++++++++----- 5 files changed, 33 insertions(+), 10 deletions(-) -- 2.33.0

2 4

[PATCH OLK-6.6 v2] gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
by Baokun Li 28 Feb '24

28 Feb '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v6.6.14 commit 067a7c48c2c70f05f9460d6f0e8423e234729f05 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932W3 CVE: CVE-2023-52448 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8877243beafa7c6bfc42022cbfdf9e39b25bd4fa ] Syzkaller has reported a NULL pointer dereference when accessing rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating rgd->rd_gl fails in read_rindex_entry(). Add a NULL pointer check in gfs2_rgrp_dump() to prevent that. Reported-and-tested-by: syzbot+da0fc229cc1ff4bb2e6d(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=da0fc229cc1ff4bb2e6d Fixes: 72244b6bc752 ("gfs2: improve debug information when lvb mismatches are found") Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Andreas Gruenbacher <agruenba(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/gfs2/rgrp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c index 9308190895c8..307b952a41f8 100644 --- a/fs/gfs2/rgrp.c +++ b/fs/gfs2/rgrp.c @@ -2306,7 +2306,7 @@ void gfs2_rgrp_dump(struct seq_file *seq, struct gfs2_rgrpd *rgd, (unsigned long long)rgd->rd_addr, rgd->rd_flags, rgd->rd_free, rgd->rd_free_clone, rgd->rd_dinodes, rgd->rd_requested, rgd->rd_reserved, rgd->rd_extfail_pt); - if (rgd->rd_sbd->sd_args.ar_rgrplvb) { + if (rgd->rd_sbd->sd_args.ar_rgrplvb && rgd->rd_rgl) { struct gfs2_rgrp_lvb *rgl = rgd->rd_rgl; gfs2_print_dbg(seq, "%s L: f:%02x b:%u i:%u\n", fs_id_buf, -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS V1] media: pvrusb2: fix use after free on context disconnection
by Guan Jing 28 Feb '24

28 Feb '24

From: "Ricardo B. Marliere" <ricardo(a)marliere.net> stable inclusion from stable-v5.10.209 commit 3233d8bf7893550045682192cb227af7fa3defeb category: bugfix bugzilla: 189571 CVE: CVE-2023-52445 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ded85b0c0edd8f45fec88783d7555a5b982449c1 ] Upon module load, a kthread is created targeting the pvr2_context_thread_func function, which may call pvr2_context_destroy and thus call kfree() on the context object. However, that might happen before the usb hub_event handler is able to notify the driver. This patch adds a sanity check before the invalid read reported by syzbot, within the context disconnection call stack. Reported-and-tested-by: syzbot+621409285c4156a009b3(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000a02a4205fff8eb92@google.com/ Fixes: e5be15c63804 ("V4L/DVB (7711): pvrusb2: Fix race on module unload") Signed-off-by: Ricardo B. Marliere <ricardo(a)marliere.net> Acked-by: Mike Isely <isely(a)pobox.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Guan Jing <guanjing6(a)huawei.com> --- drivers/media/usb/pvrusb2/pvrusb2-context.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/media/usb/pvrusb2/pvrusb2-context.c b/drivers/media/usb/pvrusb2/pvrusb2-context.c index d9e8481e9e28..9236463ba269 100644 --- a/drivers/media/usb/pvrusb2/pvrusb2-context.c +++ b/drivers/media/usb/pvrusb2/pvrusb2-context.c @@ -277,7 +277,8 @@ void pvr2_context_disconnect(struct pvr2_context *mp) { pvr2_hdw_disconnect(mp->hdw); mp->disconnect_flag = !0; - pvr2_context_notify(mp); + if (!pvr2_context_shutok()) + pvr2_context_notify(mp); } -- 2.34.1

2 1

[PATCH OLK-6.6 0/5] Support PV-sched feature
by lishusen 28 Feb '24

28 Feb '24

PV sched supports the vCPU preemption check to enhance lock performance on overcommitted hosts Zengruan Ye (5): KVM: arm64: Document PV-sched interface KVM: arm64: Implement PV_SCHED_FEATURES call KVM: arm64: Support pvsched preempted via shared structure KVM: arm64: Add interface to support vCPU preempted check KVM: arm64: Support the vCPU preemption check Documentation/virt/kvm/arm/pvsched.rst | 58 +++++++++++++ arch/arm64/Kconfig | 11 +++ arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/kvm_host.h | 34 ++++++++ arch/arm64/include/asm/paravirt.h | 13 +++ arch/arm64/include/asm/pvsched-abi.h | 18 +++++ arch/arm64/include/asm/spinlock.h | 8 ++ arch/arm64/kernel/Makefile | 2 +- arch/arm64/kernel/paravirt-spinlocks.c | 18 +++++ arch/arm64/kernel/paravirt.c | 108 +++++++++++++++++++++++++ arch/arm64/kvm/Makefile | 2 +- arch/arm64/kvm/arm.c | 10 +++ arch/arm64/kvm/hypercalls.c | 21 +++++ arch/arm64/kvm/pvsched.c | 54 +++++++++++++ include/linux/arm-smccc.h | 21 +++++ include/linux/cpuhotplug.h | 1 + 16 files changed, 378 insertions(+), 2 deletions(-) create mode 100644 Documentation/virt/kvm/arm/pvsched.rst create mode 100644 arch/arm64/include/asm/pvsched-abi.h create mode 100644 arch/arm64/kernel/paravirt-spinlocks.c create mode 100644 arch/arm64/kvm/pvsched.c -- 2.33.0

2 6

[PATCH OLK-6.6 00/14] LoongArch: fix some known bug and update defconfig
by Hongchen Zhang 28 Feb '24

28 Feb '24

Bibo Mao (1): LoongArch: Implement constant timer shutdown interface Chong Qiao (1): irqchip/loongson-pch-pic: 7a1000 int_clear reg must use 64bit write. Hongchen Zhang (3): LoongArch: fix compile error caused by arch_trigger_cpumask_backtrace usb: xhci: add XHCI_NO_SOFT_RETRY quirk for EJ188 net: stmmac: fix potential double free of dma descriptor resources Huacai Chen (1): drm/radeon: Workaround radeon driver bug for Loongson Jianmin Lv (1): LoongArch: Remove generic irq migration Tianli Xiong (1): irqchip/loongson-liointc: Set different isr for differnt core Yingkun Meng (1): LoongArch: defconfig: Enable a large number of configurations Youling Tang (4): LoongArch: kdump: Add memory reservation for old kernel LoongArch: kexec: Add compatibility with old interfaces LoongArch: Fix kdump failure on v40 interface specification LoongArch: kdump: Add high memory reservation zhangtianyang (1): LoongArch: Adapted SECTION_SIZE_BITS with page size arch/loongarch/Kconfig | 1 - arch/loongarch/configs/loongson3_defconfig | 1576 +++++++++++++++-- arch/loongarch/include/asm/irq.h | 3 +- arch/loongarch/include/asm/sparsemem.h | 2 +- arch/loongarch/kernel/irq.c | 36 + arch/loongarch/kernel/machine_kexec.c | 45 +- arch/loongarch/kernel/process.c | 3 +- arch/loongarch/kernel/setup.c | 94 +- arch/loongarch/kernel/smp.c | 3 +- arch/loongarch/kernel/time.c | 23 +- drivers/gpu/drm/radeon/cik.c | 3 + drivers/gpu/drm/radeon/evergreen.c | 3 + drivers/gpu/drm/radeon/r600.c | 3 + drivers/gpu/drm/radeon/si.c | 3 + drivers/irqchip/irq-loongson-liointc.c | 4 +- drivers/irqchip/irq-loongson-pch-pic.c | 16 +- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 11 + drivers/usb/host/xhci-pci.c | 6 + kernel/irq/Kconfig | 4 +- 19 files changed, 1639 insertions(+), 200 deletions(-) -- 2.33.0

2 15

[PATCH OLK-6.6 0/6] Export vcpu stat via debugfs
by liangtian 28 Feb '24

28 Feb '24

Create debugfs entry for vcpu stat. chenjiajun (6): kvm: debugfs: Export vcpu stat via debugfs kvm: debugfs: export remaining aarch64 kvm exit reasons to debugfs kvm: debugfs: aarch64 export cpu time related items to debugfs kvm: debugfs: Export x86 kvm exits to vcpu_stat kvm: debugfs: add fastpath msr_wr exits to debugfs statistics kvm: debugfs: add EXIT_REASON_PREEMPTION_TIMER to vcpu_stat arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/kvm_host.h | 21 ++++ arch/arm64/kvm/Kconfig | 9 ++ arch/arm64/kvm/arm.c | 31 ++++++ arch/arm64/kvm/guest.c | 40 +++++++- arch/arm64/kvm/handle_exit.c | 8 ++ arch/arm64/kvm/hyp/include/hyp/switch.h | 2 + arch/arm64/kvm/mmu.c | 1 + arch/arm64/kvm/sys_regs.c | 9 ++ arch/x86/configs/openeuler_defconfig | 1 + arch/x86/include/asm/kvm_host.h | 17 ++++ arch/x86/kvm/Kconfig | 9 ++ arch/x86/kvm/vmx/vmx.c | 8 ++ arch/x86/kvm/x86.c | 87 ++++++++++++++++ include/linux/kvm_host.h | 44 ++++++++ include/uapi/linux/kvm.h | 1 + virt/kvm/kvm_main.c | 130 ++++++++++++++++++++++++ 17 files changed, 418 insertions(+), 1 deletion(-) -- 2.33.0

2 7

[PATCH OLK-6.6] x86/fpu: Stop relying on userspace for info to fault in xsave buffer
by liwei 28 Feb '24

28 Feb '24

From: Andrei Vagin <avagin(a)google.com> mainline inclusion from mainline-v6.8-rc4 commit d877550eaf2dc9090d782864c96939397a3c6835 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93HD8 CVE: CVE-2024-26603 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Before this change, the expected size of the user space buffer was taken from fx_sw->xstate_size. fx_sw->xstate_size can be changed from user-space, so it is possible construct a sigreturn frame where: * fx_sw->xstate_size is smaller than the size required by valid bits in fx_sw->xfeatures. * user-space unmaps parts of the sigrame fpu buffer so that not all of the buffer required by xrstor is accessible. In this case, xrstor tries to restore and accesses the unmapped area which results in a fault. But fault_in_readable succeeds because buf + fx_sw->xstate_size is within the still mapped area, so it goes back and tries xrstor again. It will spin in this loop forever. Instead, fault in the maximum size which can be touched by XRSTOR (taken from fpstate->user_size). [ dhansen: tweak subject / changelog ] Fixes: fcb3635f5018 ("x86/fpu/signal: Handle #PF in the direct restore path") Reported-by: Konstantin Bogomolov <bogomolov(a)google.com> Suggested-by: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Andrei Vagin <avagin(a)google.com> Signed-off-by: Dave Hansen <dave.hansen(a)linux.intel.com> Cc:stable@vger.kernel.org Link: https://lore.kernel.org/all/20240130063603.3392627-1-avagin%40google.com Signed-off-by: liwei <liwei728(a)huawei.com> --- arch/x86/kernel/fpu/signal.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c index 558076dbde5b..247f2225aa9f 100644 --- a/arch/x86/kernel/fpu/signal.c +++ b/arch/x86/kernel/fpu/signal.c @@ -274,12 +274,13 @@ static int __restore_fpregs_from_user(void __user *buf, u64 ufeatures, * Attempt to restore the FPU registers directly from user memory. * Pagefaults are handled and any errors returned are fatal. */ -static bool restore_fpregs_from_user(void __user *buf, u64 xrestore, - bool fx_only, unsigned int size) +static bool restore_fpregs_from_user(void __user *buf, u64 xrestore, bool fx_only) { struct fpu *fpu = &current->thread.fpu; int ret; + /* Restore enabled features only. */ + xrestore &= fpu->fpstate->user_xfeatures; retry: fpregs_lock(); /* Ensure that XFD is up to date */ @@ -309,7 +310,7 @@ static bool restore_fpregs_from_user(void __user *buf, u64 xrestore, if (ret != X86_TRAP_PF) return false; - if (!fault_in_readable(buf, size)) + if (!fault_in_readable(buf, fpu->fpstate->user_size)) goto retry; return false; } @@ -339,7 +340,6 @@ static bool __fpu_restore_sig(void __user *buf, void __user *buf_fx, struct user_i387_ia32_struct env; bool success, fx_only = false; union fpregs_state *fpregs; - unsigned int state_size; u64 user_xfeatures = 0; if (use_xsave()) { @@ -349,17 +349,14 @@ static bool __fpu_restore_sig(void __user *buf, void __user *buf_fx, return false; fx_only = !fx_sw_user.magic1; - state_size = fx_sw_user.xstate_size; user_xfeatures = fx_sw_user.xfeatures; } else { user_xfeatures = XFEATURE_MASK_FPSSE; - state_size = fpu->fpstate->user_size; } if (likely(!ia32_fxstate)) { /* Restore the FPU registers directly from user memory. */ - return restore_fpregs_from_user(buf_fx, user_xfeatures, fx_only, - state_size); + return restore_fpregs_from_user(buf_fx, user_xfeatures, fx_only); } /* -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS v3] Revert "memcg: fix a UAF problem in drain_all_stock()"
by GONG, Ruiqi 28 Feb '24

28 Feb '24

hulk inclusion category: bugfix bugzilla: 189183, https://gitee.com/openeuler/kernel/issues/I7Z1ZU CVE: NA -------------------------------- This reverts commit 616e708277a2 ("memcg: fix a UAF problem in drain_all_stock()"), which was produced based on in-house 3.10 and later was found to be not suitable for in-house 4.18/4.19, as both of them use async version of drain_all_stock() whose actual draining could be delayed, and some of them even removed drain_all_stock() from memcg's offline process. In these cases the commit doesn't fix the original problem. Fixes: 616e708277a2 ("memcg: fix a UAF problem in drain_all_stock()") Signed-off-by: GONG, Ruiqi <gongruiqi1(a)huawei.com> --- mm/memcontrol.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 29d430885b1a..7dc68b1792ef 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -2232,7 +2232,8 @@ static void drain_all_stock(struct mem_cgroup *root_memcg) rcu_read_lock(); memcg = stock->cached; - if (memcg && mem_cgroup_is_descendant(memcg, root_memcg)) + if (memcg && stock->nr_pages && + mem_cgroup_is_descendant(memcg, root_memcg)) flush = true; rcu_read_unlock(); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] drivers/amd/pm: fix a use-after-free in kv_parse_power_table
by Hui Tang 28 Feb '24

28 Feb '24

From: Zhipeng Lu <alexious(a)zju.edu.cn> stable inclusion from stable-v4.19.305 commit 8a27d9d9fc9b5564b8904c3a77a7dea482bfa34e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I94FUJ CVE: CVE-2023-52469 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 28dd788382c43b330480f57cd34cde0840896743 ] When ps allocated by kzalloc equals to NULL, kv_parse_power_table frees adev->pm.dpm.ps that allocated before. However, after the control flow goes through the following call chains: kv_parse_power_table |-> kv_dpm_init |-> kv_dpm_sw_init |-> kv_dpm_fini The adev->pm.dpm.ps is used in the for loop of kv_dpm_fini after its first free in kv_parse_power_table and causes a use-after-free bug. Fixes: a2e73f56fa62 ("drm/amdgpu: Add support for CIK parts") Signed-off-by: Zhipeng Lu <alexious(a)zju.edu.cn> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/kv_dpm.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c index cb79a93c2eb7..f046348362e3 100644 --- a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c +++ b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c @@ -2746,10 +2746,8 @@ static int kv_parse_power_table(struct amdgpu_device *adev) non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *) &non_clock_info_array->nonClockInfo[non_clock_array_index]; ps = kzalloc(sizeof(struct kv_ps), GFP_KERNEL); - if (ps == NULL) { - kfree(adev->pm.dpm.ps); + if (ps == NULL) return -ENOMEM; - } adev->pm.dpm.ps[i].ps_priv = ps; k = 0; idx = (u8 *)&power_state->v2.clockInfoIndex[0]; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2023-52451 backport to 4.19
by Lin Yujun 28 Feb '24

28 Feb '24

*** BLURB HERE *** Laurent Dufour (1): powerpc/pseries/memhotplug: Quieten some DLPAR operations Nathan Lynch (1): powerpc/pseries/memhp: Fix access beyond end of drmem array .../platforms/pseries/hotplug-memory.c | 21 ++++++++++--------- 1 file changed, 11 insertions(+), 10 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS v2] Revert "memcg: fix a UAF problem in drain_all_stock()"
by GONG, Ruiqi 28 Feb '24

28 Feb '24

hulk inclusion category: bugfix bugzilla: 189183, https://gitee.com/openeuler/kernel/issues/I7Z1ZU CVE: NA -------------------------------- This reverts commit 616e708277a2 ("memcg: fix a UAF problem in drain_all_stock()"), which was produced based on HULK-7.5 and later was found to be not suitable for HULK-8.1/4.19. Fixes: 616e708277a2 ("memcg: fix a UAF problem in drain_all_stock()") Signed-off-by: GONG, Ruiqi <gongruiqi1(a)huawei.com> --- mm/memcontrol.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 29d430885b1a..7dc68b1792ef 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -2232,7 +2232,8 @@ static void drain_all_stock(struct mem_cgroup *root_memcg) rcu_read_lock(); memcg = stock->cached; - if (memcg && mem_cgroup_is_descendant(memcg, root_memcg)) + if (memcg && stock->nr_pages && + mem_cgroup_is_descendant(memcg, root_memcg)) flush = true; rcu_read_unlock(); -- 2.25.1

2 1

[PATCH OLK-5.10] x86/fpu: Stop relying on userspace for info to fault in xsave buffer
by liwei 28 Feb '24

28 Feb '24

From: Andrei Vagin <avagin(a)google.com> mainline inclusion from mainline-v6.8-rc4 commit d877550eaf2dc9090d782864c96939397a3c6835 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93HD8 CVE: CVE-2024-26603 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Before this change, the expected size of the user space buffer was taken from fx_sw->xstate_size. fx_sw->xstate_size can be changed from user-space, so it is possible construct a sigreturn frame where: * fx_sw->xstate_size is smaller than the size required by valid bits in fx_sw->xfeatures. * user-space unmaps parts of the sigrame fpu buffer so that not all of the buffer required by xrstor is accessible. In this case, xrstor tries to restore and accesses the unmapped area which results in a fault. But fault_in_readable succeeds because buf + fx_sw->xstate_size is within the still mapped area, so it goes back and tries xrstor again. It will spin in this loop forever. Instead, fault in the maximum size which can be touched by XRSTOR (taken from fpstate->user_size). [ dhansen: tweak subject / changelog ] Fixes: fcb3635f5018 ("x86/fpu/signal: Handle #PF in the direct restore path") Reported-by: Konstantin Bogomolov <bogomolov(a)google.com> Suggested-by: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Andrei Vagin <avagin(a)google.com> Signed-off-by: Dave Hansen <dave.hansen(a)linux.intel.com> Cc:stable@vger.kernel.org Link: https://lore.kernel.org/all/20240130063603.3392627-1-avagin%40google.com Conflicts: arch/x86/kernel/fpu/signal.c Signed-off-by: liwei <liwei728(a)huawei.com> --- arch/x86/kernel/fpu/signal.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c index b35643ad17f5..e32d461b7d2f 100644 --- a/arch/x86/kernel/fpu/signal.c +++ b/arch/x86/kernel/fpu/signal.c @@ -274,12 +274,13 @@ static int __restore_fpregs_from_user(void __user *buf, u64 ufeatures, * Attempt to restore the FPU registers directly from user memory. * Pagefaults are handled and any errors returned are fatal. */ -static bool restore_fpregs_from_user(void __user *buf, u64 xrestore, - bool fx_only, unsigned int size) +static bool restore_fpregs_from_user(void __user *buf, u64 xrestore, bool fx_only) { struct fpu *fpu = &current->thread.fpu; int ret; + /* Restore enabled features only. */ + xrestore &= fpu->fpstate->user_xfeatures; retry: fpregs_lock(); /* Ensure that XFD is up to date */ @@ -309,7 +310,7 @@ static bool restore_fpregs_from_user(void __user *buf, u64 xrestore, if (ret != X86_TRAP_PF) return false; - if (!fault_in_pages_readable(buf, size)) + if (!fault_in_pages_readable(buf, fpu->fpstate->user_size)) goto retry; return false; } @@ -339,7 +340,6 @@ static bool __fpu_restore_sig(void __user *buf, void __user *buf_fx, struct user_i387_ia32_struct env; bool success, fx_only = false; union fpregs_state *fpregs; - unsigned int state_size; u64 user_xfeatures = 0; if (use_xsave()) { @@ -349,17 +349,14 @@ static bool __fpu_restore_sig(void __user *buf, void __user *buf_fx, return false; fx_only = !fx_sw_user.magic1; - state_size = fx_sw_user.xstate_size; user_xfeatures = fx_sw_user.xfeatures; } else { user_xfeatures = XFEATURE_MASK_FPSSE; - state_size = fpu->fpstate->user_size; } if (likely(!ia32_fxstate)) { /* Restore the FPU registers directly from user memory. */ - return restore_fpregs_from_user(buf_fx, user_xfeatures, fx_only, - state_size); + return restore_fpregs_from_user(buf_fx, user_xfeatures, fx_only); } /* -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] CVE-2023-52451 backport to OLK-5.10
by Lin Yujun 28 Feb '24

28 Feb '24

*** BLURB HERE *** Laurent Dufour (1): powerpc/pseries/memhotplug: Quieten some DLPAR operations Nathan Lynch (1): powerpc/pseries/memhp: Fix access beyond end of drmem array .../platforms/pseries/hotplug-memory.c | 21 ++++++++++--------- 1 file changed, 11 insertions(+), 10 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2023-52451
by Lin Yujun 28 Feb '24

28 Feb '24

*** BLURB HERE *** Laurent Dufour (1): powerpc/pseries/memhotplug: Quieten some DLPAR operations Nathan Lynch (1): powerpc/pseries/memhp: Fix access beyond end of drmem array .../platforms/pseries/hotplug-memory.c | 21 ++++++++++--------- 1 file changed, 11 insertions(+), 10 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] reserve space for arch related structures
by Liao Chen 28 Feb '24

28 Feb '24

reserve space for struct irq_work reserve space for struct mfd_cell Liao Chen (2): kabi: reserve space for struct irq_work kabi: reserve space for struct mfd_cell include/linux/irq_work.h | 5 +++++ include/linux/mfd/core.h | 6 ++++++ 2 files changed, 11 insertions(+) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] kabi: reserve space for arch related
by Liao Chen 28 Feb '24

28 Feb '24

reserve space for struct irq_work reserve space for struct mfd_cell Liao Chen (2): kabi: reserve space for struct irq_work kabi: reserve space for struct mfd_cell include/linux/irq_work.h | 5 +++++ include/linux/mfd/core.h | 6 ++++++ 2 files changed, 11 insertions(+) -- 2.34.1

2 5

[PATCH openEuler-1.0-LTS] lib/scatterlist.c: adjust indentation in __sg_alloc_table
by Liu Chuang 28 Feb '24

28 Feb '24

From: Nathan Chancellor <natechancellor(a)gmail.com> stable inclusion from stable-v4.19.307 commit acaf62810c91f2a733f784e62b126466ec7950a7 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I94AKF CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… [ Upstream commit 4e456fee215677584cafa7f67298a76917e89c64 ] Clang warns: ../lib/scatterlist.c:314:5: warning: misleading indentation; statement is not part of the previous 'if' [-Wmisleading-indentation] return -ENOMEM; ^ ../lib/scatterlist.c:311:4: note: previous statement is here if (prv) ^ 1 warning generated. This warning occurs because there is a space before the tab on this line. Remove it so that the indentation is consistent with the Linux kernel coding style and clang no longer warns. Link: http://lkml.kernel.org/r/20191218033606.11942-1-natechancellor@gmail.com Link: https://github.com/ClangBuiltLinux/linux/issues/830 Fixes: edce6820a9fd ("scatterlist: prevent invalid free when alloc fails") Signed-off-by: Nathan Chancellor <natechancellor(a)gmail.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- lib/scatterlist.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/scatterlist.c b/lib/scatterlist.c index 8c3036c37ba0..60e7eca2f4be 100644 --- a/lib/scatterlist.c +++ b/lib/scatterlist.c @@ -305,7 +305,7 @@ int __sg_alloc_table(struct sg_table *table, unsigned int nents, if (prv) table->nents = ++table->orig_nents; - return -ENOMEM; + return -ENOMEM; } sg_init_table(sg, alloc_size); -- 2.34.1

2 1

[PATCH OLK-5.10] [Backport] binder: signal epoll threads of self-work
by Zhang Xiaoxu 28 Feb '24

28 Feb '24

From: Carlos Llamas <cmllamas(a)google.com> stable inclusion from stable-v5.10.210 commit a423042052ec2bdbf1e552e621e6a768922363cc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93X0G CVE: CVE-2024-26606 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 97830f3c3088638ff90b20dfba2eb4d487bf14d7 upstream. In (e)poll mode, threads often depend on I/O events to determine when data is ready for consumption. Within binder, a thread may initiate a command via BINDER_WRITE_READ without a read buffer and then make use of epoll_wait() or similar to consume any responses afterwards. It is then crucial that epoll threads are signaled via wakeup when they queue their own work. Otherwise, they risk waiting indefinitely for an event leaving their work unhandled. What is worse, subsequent commands won't trigger a wakeup either as the thread has pending work. Fixes: 457b9a6f09f0 ("Staging: android: add binder driver") Cc: Arve Hjønnevåg <arve(a)android.com> Cc: Martijn Coenen <maco(a)android.com> Cc: Alice Ryhl <aliceryhl(a)google.com> Cc: Steven Moreland <smoreland(a)google.com> Cc: stable(a)vger.kernel.org # v4.19+ Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Link: https://lore.kernel.org/r/20240131215347.1808751-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> --- drivers/android/binder.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 2aaccb78235b..f484304a2321 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -836,6 +836,16 @@ binder_enqueue_thread_work_ilocked(struct binder_thread *thread, { WARN_ON(!list_empty(&thread->waiting_thread_node)); binder_enqueue_work_ilocked(work, &thread->todo); + + /* (e)poll-based threads require an explicit wakeup signal when + * queuing their own work; they rely on these events to consume + * messages without I/O block. Without it, threads risk waiting + * indefinitely without handling the work. + */ + if (thread->looper & BINDER_LOOPER_STATE_POLL && + thread->pid == current->pid && !thread->process_todo) + wake_up_interruptible_sync(&thread->wait); + thread->process_todo = true; } -- 2.34.1

2 1

[PATCH openEuler 1.0-LTS] lib/scatterlist.c: adjust indentation in __sg_alloc_table
by Liu Chuang 28 Feb '24

28 Feb '24

From: Nathan Chancellor <natechancellor(a)gmail.com> stable inclusion from stable-v4.19.307 commit acaf62810c91f2a733f784e62b126466ec7950a7 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I94AKF CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… [ Upstream commit 4e456fee215677584cafa7f67298a76917e89c64 ] Clang warns: ../lib/scatterlist.c:314:5: warning: misleading indentation; statement is not part of the previous 'if' [-Wmisleading-indentation] return -ENOMEM; ^ ../lib/scatterlist.c:311:4: note: previous statement is here if (prv) ^ 1 warning generated. This warning occurs because there is a space before the tab on this line. Remove it so that the indentation is consistent with the Linux kernel coding style and clang no longer warns. Link: http://lkml.kernel.org/r/20191218033606.11942-1-natechancellor@gmail.com Link: https://github.com/ClangBuiltLinux/linux/issues/830 Fixes: edce6820a9fd ("scatterlist: prevent invalid free when alloc fails") Signed-off-by: Nathan Chancellor <natechancellor(a)gmail.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- lib/scatterlist.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/scatterlist.c b/lib/scatterlist.c index 8c3036c37ba0..60e7eca2f4be 100644 --- a/lib/scatterlist.c +++ b/lib/scatterlist.c @@ -305,7 +305,7 @@ int __sg_alloc_table(struct sg_table *table, unsigned int nents, if (prv) table->nents = ++table->orig_nents; - return -ENOMEM; + return -ENOMEM; } sg_init_table(sg, alloc_size); -- 2.34.1

1 0

[PATCH OLK-6.6 0/5] Support PV sched feature
by lishusen 28 Feb '24

28 Feb '24

PV sched supports the vCPU preemption check to enhance lock performance on overcommitted hosts Zengruan Ye (5): KVM: arm64: Document PV-sched interface KVM: arm64: Implement PV_SCHED_FEATURES call KVM: arm64: Support pvsched preempted via shared structure KVM: arm64: Add interface to support vCPU preempted check KVM: arm64: Support the vCPU preemption check Documentation/virt/kvm/arm/pvsched.rst | 58 ++++++++++++++ arch/arm64/Kconfig | 11 +++ arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/kvm_host.h | 32 ++++++++ arch/arm64/include/asm/paravirt.h | 11 +++ arch/arm64/include/asm/pvsched-abi.h | 16 ++++ arch/arm64/include/asm/spinlock.h | 8 ++ arch/arm64/kernel/Makefile | 2 +- arch/arm64/kernel/paravirt-spinlocks.c | 16 ++++ arch/arm64/kernel/paravirt.c | 107 +++++++++++++++++++++++++ arch/arm64/kvm/Makefile | 2 +- arch/arm64/kvm/arm.c | 10 +++ arch/arm64/kvm/hypercalls.c | 17 ++++ arch/arm64/kvm/pvsched.c | 54 +++++++++++++ include/linux/arm-smccc.h | 19 +++++ include/linux/cpuhotplug.h | 1 + 16 files changed, 363 insertions(+), 2 deletions(-) create mode 100644 Documentation/virt/kvm/arm/pvsched.rst create mode 100644 arch/arm64/include/asm/pvsched-abi.h create mode 100644 arch/arm64/kernel/paravirt-spinlocks.c create mode 100644 arch/arm64/kvm/pvsched.c -- 2.33.0

2 6

[PATCH openEuler-1.0-LTS] i2c: Fix a potential use after free
by Liu Chuang 28 Feb '24

28 Feb '24

From: Xu Wang <vulab(a)iscas.ac.cn> stable inclusion from stable-v4.19.307 commit 23a191b132cd87f746c62f3dc27da33683d85829 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I946KM CVE: CVE-2019-25162 Reference: https://git.kernel.org/stable/c/23a191b132cd87f746c62f3dc27da33683d85829 --------------------------------------------------------------- [ Upstream commit e4c72c06c367758a14f227c847f9d623f1994ecf ] Free the adap structure only after we are done using it. This patch just moves the put_device() down a bit to avoid the use after free. Fixes: 611e12ea0f12 ("i2c: core: manage i2c bus device refcount in i2c_[get|put]_adapter") Signed-off-by: Xu Wang <vulab(a)iscas.ac.cn> [wsa: added comment to the code, added Fixes tag] Signed-off-by: Wolfram Sang <wsa(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/i2c/i2c-core-base.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index 2a43f4e46af0..9079be0d51d1 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -2273,8 +2273,9 @@ void i2c_put_adapter(struct i2c_adapter *adap) if (!adap) return; - put_device(&adap->dev); module_put(adap->owner); + /* Should be last, otherwise we risk use-after-free with 'adap' */ + put_device(&adap->dev); } EXPORT_SYMBOL(i2c_put_adapter); -- 2.34.1

2 1

[PATCH OLK-5.10 V2 0/2] Remove WQ_FLAG_BOOKMARK flag
by Zizhi Wo 27 Feb '24

27 Feb '24

Fix softlockup by removing the wait_queue flag: WQ_FLAG_BOOKMARK. Matthew Wilcox (Oracle) (2): filemap: remove use of wait bookmarks sched: remove wait bookmarks include/linux/wait.h | 7 ++---- kernel/sched/wait.c | 57 +++++++------------------------------------- mm/filemap.c | 21 +--------------- 3 files changed, 11 insertions(+), 74 deletions(-) -- 2.39.2

2 3

[PATCH] i2c: Fix a potential use after free
by Liu Chuang 27 Feb '24

27 Feb '24

From: Xu Wang <vulab(a)iscas.ac.cn> stable inclusion from stable-v4.19.307 commit 23a191b132cd87f746c62f3dc27da33683d85829 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I946KM CVE: CVE-2019-25162 Reference: https://git.kernel.org/stable/c/23a191b132cd87f746c62f3dc27da33683d85829 --------------------------------------------------------------- [ Upstream commit e4c72c06c367758a14f227c847f9d623f1994ecf ] Free the adap structure only after we are done using it. This patch just moves the put_device() down a bit to avoid the use after free. Fixes: 611e12ea0f12 ("i2c: core: manage i2c bus device refcount in i2c_[get|put]_adapter") Signed-off-by: Xu Wang <vulab(a)iscas.ac.cn> [wsa: added comment to the code, added Fixes tag] Signed-off-by: Wolfram Sang <wsa(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/i2c/i2c-core-base.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index 2a43f4e46af0..9079be0d51d1 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -2273,8 +2273,9 @@ void i2c_put_adapter(struct i2c_adapter *adap) if (!adap) return; - put_device(&adap->dev); module_put(adap->owner); + /* Should be last, otherwise we risk use-after-free with 'adap' */ + put_device(&adap->dev); } EXPORT_SYMBOL(i2c_put_adapter); -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS] binder: signal epoll threads of self-work
by Zhang Xiaoxu 27 Feb '24

27 Feb '24

From: Carlos Llamas <cmllamas(a)google.com> stable inclusion from stable-v4.19.307 commit dd64bb8329ce0ea27bc557e4160c2688835402ac category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93X0G CVE: CVE-2024-26606 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 97830f3c3088638ff90b20dfba2eb4d487bf14d7 upstream. In (e)poll mode, threads often depend on I/O events to determine when data is ready for consumption. Within binder, a thread may initiate a command via BINDER_WRITE_READ without a read buffer and then make use of epoll_wait() or similar to consume any responses afterwards. It is then crucial that epoll threads are signaled via wakeup when they queue their own work. Otherwise, they risk waiting indefinitely for an event leaving their work unhandled. What is worse, subsequent commands won't trigger a wakeup either as the thread has pending work. Fixes: 457b9a6f09f0 ("Staging: android: add binder driver") Cc: Arve Hjønnevåg <arve(a)android.com> Cc: Martijn Coenen <maco(a)android.com> Cc: Alice Ryhl <aliceryhl(a)google.com> Cc: Steven Moreland <smoreland(a)google.com> Cc: stable(a)vger.kernel.org # v4.19+ Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Link: https://lore.kernel.org/r/20240131215347.1808751-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> --- drivers/android/binder.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 98c785ebfa5d..f98d84c5c695 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -880,6 +880,16 @@ binder_enqueue_thread_work_ilocked(struct binder_thread *thread, { WARN_ON(!list_empty(&thread->waiting_thread_node)); binder_enqueue_work_ilocked(work, &thread->todo); + + /* (e)poll-based threads require an explicit wakeup signal when + * queuing their own work; they rely on these events to consume + * messages without I/O block. Without it, threads risk waiting + * indefinitely without handling the work. + */ + if (thread->looper & BINDER_LOOPER_STATE_POLL && + thread->pid == current->pid && !thread->process_todo) + wake_up_interruptible_sync(&thread->wait); + thread->process_todo = true; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2023-52451
by Lin Yujun 27 Feb '24

27 Feb '24

*** BLURB HERE *** Laurent Dufour (1): powerpc/pseries/memhotplug: Quieten some DLPAR operations Nathan Lynch (1): powerpc/pseries/memhp: Fix access beyond end of drmem array .../platforms/pseries/hotplug-memory.c | 21 ++++++++++--------- 1 file changed, 11 insertions(+), 10 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] block: add check that partition length needs to be aligned with block size
by Li Lingfeng 27 Feb '24

27 Feb '24

From: Min Li <min15.li(a)samsung.com> mainline inclusion from mainline-v6.8-rc1 commit 6f64f866aa1ae6975c95d805ed51d7e9433a0016 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EC9 CVE: CVE-2023-52458 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Before calling add partition or resize partition, there is no check on whether the length is aligned with the logical block size. If the logical block size of the disk is larger than 512 bytes, then the partition size maybe not the multiple of the logical block size, and when the last sector is read, bio_truncate() will adjust the bio size, resulting in an IO error if the size of the read command is smaller than the logical block size.If integrity data is supported, this will also result in a null pointer dereference when calling bio_integrity_free. Cc: <stable(a)vger.kernel.org> Signed-off-by: Min Li <min15.li(a)samsung.com> Reviewed-by: Damien Le Moal <dlemoal(a)kernel.org> Reviewed-by: Chaitanya Kulkarni <kch(a)nvidia.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20230629142517.121241-1-min15.li@samsung.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflict: block/ioctl.c commit 1a721de8489f ("block: don't add or resize partition on the disk with GENHD_FL_NO_PART") from mainline add check of GENHD_FL_NO_PART; commit 5fb889f587fa ("compat_ioctl: block: simplify compat_blkpg_ioctl()") from mainline remove blkpg_ioctl_arg; commit 1ae011cf0aa0 ("block: Fix the partition start may overflow in add_partition()") from hulk add check of start and length. Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- block/ioctl.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/block/ioctl.c b/block/ioctl.c index 9d0eeb1b0bbd..1d2b7f701288 100644 --- a/block/ioctl.c +++ b/block/ioctl.c @@ -16,7 +16,7 @@ static int blkpg_ioctl(struct block_device *bdev, struct blkpg_ioctl_arg __user { struct blkpg_ioctl_arg a; struct blkpg_partition p; - long long start, length; + sector_t start, length; if (!capable(CAP_SYS_ADMIN)) return -EACCES; @@ -35,6 +35,9 @@ static int blkpg_ioctl(struct block_device *bdev, struct blkpg_ioctl_arg __user if (p.start < 0 || p.length <= 0 || p.start + p.length < 0) return -EINVAL; + /* Check that the partition is aligned to the block size */ + if (!IS_ALIGNED(p.start | p.length, bdev_logical_block_size(bdev))) + return -EINVAL; start = p.start >> SECTOR_SHIFT; length = p.length >> SECTOR_SHIFT; @@ -54,9 +57,6 @@ static int blkpg_ioctl(struct block_device *bdev, struct blkpg_ioctl_arg __user switch (a.op) { case BLKPG_ADD_PARTITION: - /* check if partition is aligned to blocksize */ - if (p.start & (bdev_logical_block_size(bdev) - 1)) - return -EINVAL; return bdev_add_partition(bdev, p.pno, start, length); case BLKPG_RESIZE_PARTITION: return bdev_resize_partition(bdev, p.pno, start, length); -- 2.31.1

2 1

[PATCH] i2c: Fix a potential use after free
by Liu Chuang 27 Feb '24

27 Feb '24

From: Xu Wang <vulab(a)iscas.ac.cn> stable inclusion from stable-v4.19.307 commit 23a191b132cd87f746c62f3dc27da33683d85829 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I946KM CVE: CVE-2019-25162 --------------------------------------------------------------- [ Upstream commit e4c72c06c367758a14f227c847f9d623f1994ecf ] Free the adap structure only after we are done using it. This patch just moves the put_device() down a bit to avoid the use after free. Fixes: 611e12ea0f12 ("i2c: core: manage i2c bus device refcount in i2c_[get|put]_adapter") Signed-off-by: Xu Wang <vulab(a)iscas.ac.cn> [wsa: added comment to the code, added Fixes tag] Signed-off-by: Wolfram Sang <wsa(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/i2c/i2c-core-base.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index 2a43f4e46af0..9079be0d51d1 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -2273,8 +2273,9 @@ void i2c_put_adapter(struct i2c_adapter *adap) if (!adap) return; - put_device(&adap->dev); module_put(adap->owner); + /* Should be last, otherwise we risk use-after-free with 'adap' */ + put_device(&adap->dev); } EXPORT_SYMBOL(i2c_put_adapter); -- 2.34.1

1 0

[PATCH OLK-5.10] KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
by Jinjie Ruan 27 Feb '24

27 Feb '24

From: Oliver Upton <oliver.upton(a)linux.dev> stable inclusion from stable-v5.10.209 commit ba7be666740847d967822bed15500656b26bc703 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EEI CVE: CVE-2024-26598 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- There is a potential UAF scenario in the case of an LPI translation cache hit racing with an operation that invalidates the cache, such as a DISCARD ITS command. The root of the problem is that vgic_its_check_cache() does not elevate the refcount on the vgic_irq before dropping the lock that serializes refcount changes. Have vgic_its_check_cache() raise the refcount on the returned vgic_irq and add the corresponding decrement after queueing the interrupt. Cc: stable(a)vger.kernel.org Signed-off-by: Oliver Upton <oliver.upton(a)linux.dev> Signed-off-by: Marc Zyngier <maz(a)kernel.org> Link: https://lore.kernel.org/r/20240104183233.3560639-1-oliver.upton@linux.dev --- arch/arm64/kvm/vgic/vgic-its.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c index ee3b9df60a59..9c7bd5a8aa35 100644 --- a/arch/arm64/kvm/vgic/vgic-its.c +++ b/arch/arm64/kvm/vgic/vgic-its.c @@ -601,7 +601,11 @@ static struct vgic_irq *vgic_its_check_cache(struct kvm *kvm, phys_addr_t db, cacheid = cpu % LPI_TRANS_CACHES_NUM; raw_spin_lock_irqsave(&dist->lpi_translation_cache[cacheid].lpi_cache_lock, flags); + irq = __vgic_its_check_cache(dist, db, devid, eventid, cacheid); + if (irq) + vgic_get_irq_kref(irq); + raw_spin_unlock_irqrestore(&dist->lpi_translation_cache[cacheid].lpi_cache_lock, flags); return irq; @@ -778,6 +782,7 @@ static int vgic_its_trigger_msi(struct kvm *kvm, struct vgic_its *its, raw_spin_lock_irqsave(&irq->irq_lock, flags); irq->pending_latch = true; vgic_queue_irq_unlock(kvm, irq, flags); + vgic_put_irq(kvm, irq); return 0; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
by Jinjie Ruan 27 Feb '24

27 Feb '24

From: Oliver Upton <oliver.upton(a)linux.dev> stable inclusion from stable-v5.10.209 commit ba7be666740847d967822bed15500656b26bc703 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EEI CVE: CVE-2024-26598 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- There is a potential UAF scenario in the case of an LPI translation cache hit racing with an operation that invalidates the cache, such as a DISCARD ITS command. The root of the problem is that vgic_its_check_cache() does not elevate the refcount on the vgic_irq before dropping the lock that serializes refcount changes. Have vgic_its_check_cache() raise the refcount on the returned vgic_irq and add the corresponding decrement after queueing the interrupt. Cc: stable(a)vger.kernel.org Signed-off-by: Oliver Upton <oliver.upton(a)linux.dev> Signed-off-by: Marc Zyngier <maz(a)kernel.org> Link: https://lore.kernel.org/r/20240104183233.3560639-1-oliver.upton@linux.dev Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- virt/kvm/arm/vgic/vgic-its.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c index e9a571673d87..392e02fca470 100644 --- a/virt/kvm/arm/vgic/vgic-its.c +++ b/virt/kvm/arm/vgic/vgic-its.c @@ -613,7 +613,11 @@ static struct vgic_irq *vgic_its_check_cache(struct kvm *kvm, phys_addr_t db, cacheid = cpu % LPI_TRANS_CACHES_NUM; raw_spin_lock_irqsave(&dist->lpi_translation_cache[cacheid].lpi_cache_lock, flags); + irq = __vgic_its_check_cache(dist, db, devid, eventid, cacheid); + if (irq) + vgic_get_irq_kref(irq); + raw_spin_unlock_irqrestore(&dist->lpi_translation_cache[cacheid].lpi_cache_lock, flags); return irq; @@ -809,6 +813,7 @@ int vgic_its_inject_cached_translation(struct kvm *kvm, struct kvm_msi *msi) raw_spin_lock_irqsave(&irq->irq_lock, flags); irq->pending_latch = true; vgic_queue_irq_unlock(kvm, irq, flags); + vgic_put_irq(kvm, irq); return 0; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] Revert "memcg: fix a UAF problem in drain_all_stock()"
by GONG, Ruiqi 27 Feb '24

27 Feb '24

hulk inclusion category: bugfix bugzilla: 189183, https://gitee.com/openeuler/kernel/issues/I7Z1ZU CVE: NA -------------------------------- This reverts commit 616e708277a2 ("memcg: fix a UAF problem in drain_all_stock()"), which was produced based on HULK-7.5 and later was found to be not suitable for HULK-8.1/4.19. Signed-off-by: GONG, Ruiqi <gongruiqi1(a)huawei.com> --- mm/memcontrol.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 29d430885b1a..7dc68b1792ef 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -2232,7 +2232,8 @@ static void drain_all_stock(struct mem_cgroup *root_memcg) rcu_read_lock(); memcg = stock->cached; - if (memcg && mem_cgroup_is_descendant(memcg, root_memcg)) + if (memcg && stock->nr_pages && + mem_cgroup_is_descendant(memcg, root_memcg)) flush = true; rcu_read_unlock(); -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] Backport etmem swapcache recalim feature to OLK 6.6
by Yuchen Tang 27 Feb '24

27 Feb '24

From: tangyuchen <tangyuchen5(a)huawei.com> Yuchen Tang (2): etmem: Expose symbol reclaim_folio_list etmem: add swapcache reclaim to etmem fs/proc/etmem_swap.c | 173 ++++++++++++++++++++++++++++++++++++++++++ include/linux/etmem.h | 37 +++++++++ include/linux/swap.h | 2 + mm/etmem.c | 166 ++++++++++++++++++++++++++++++++++++++++ mm/vmscan.c | 2 +- 5 files changed, 379 insertions(+), 1 deletion(-) -- 2.33.0

2 3

[PATCH OLK-6.6 0/6] Export vcpu stat via debugfs
by liangtian 27 Feb '24

27 Feb '24

Create debugfs entry for vcpu stat. chenjiajun (6): kvm: debugfs: Export vcpu stat via debugfs kvm: debugfs: export remaining aarch64 kvm exit reasons to debugfs kvm: debugfs: aarch64 export cpu time related items to debugfs kvm: debugfs: Export x86 kvm exits to vcpu_stat kvm: debugfs: add fastpath msr_wr exits to debugfs statistics kvm: debugfs: add EXIT_REASON_PREEMPTION_TIMER to vcpu_stat arch/arm64/Kconfig | 3 + arch/arm64/include/asm/kvm_host.h | 21 ++++ arch/arm64/kvm/arm.c | 31 ++++++ arch/arm64/kvm/guest.c | 40 +++++++- arch/arm64/kvm/handle_exit.c | 8 ++ arch/arm64/kvm/hyp/include/hyp/switch.h | 2 + arch/arm64/kvm/mmu.c | 1 + arch/arm64/kvm/sys_regs.c | 9 ++ arch/x86/Kconfig | 3 + arch/x86/include/asm/kvm_host.h | 17 ++++ arch/x86/kvm/vmx/vmx.c | 8 ++ arch/x86/kvm/x86.c | 87 ++++++++++++++++ include/linux/kvm_host.h | 44 ++++++++ include/uapi/linux/kvm.h | 1 + virt/kvm/kvm_main.c | 130 ++++++++++++++++++++++++ 15 files changed, 404 insertions(+), 1 deletion(-) -- 2.33.0

2 7

[PATCH OLK-5.10] block: add check that partition length needs to be aligned with block size
by Li Lingfeng 27 Feb '24

27 Feb '24

From: Min Li <min15.li(a)samsung.com> mainline inclusion from mainline-v6.8-rc1 commit 6f64f866aa1ae6975c95d805ed51d7e9433a0016 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EC9 CVE: CVE-2023-52458 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Before calling add partition or resize partition, there is no check on whether the length is aligned with the logical block size. If the logical block size of the disk is larger than 512 bytes, then the partition size maybe not the multiple of the logical block size, and when the last sector is read, bio_truncate() will adjust the bio size, resulting in an IO error if the size of the read command is smaller than the logical block size.If integrity data is supported, this will also result in a null pointer dereference when calling bio_integrity_free. Cc: <stable(a)vger.kernel.org> Signed-off-by: Min Li <min15.li(a)samsung.com> Reviewed-by: Damien Le Moal <dlemoal(a)kernel.org> Reviewed-by: Chaitanya Kulkarni <kch(a)nvidia.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20230629142517.121241-1-min15.li@samsung.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflict: block/ioctl.c commit 1a721de8489f ("block: don't add or resize partition on the disk with GENHD_FL_NO_PART") from mainline add check of GENHD_FL_NO_PART; commit 1ae011cf0aa0 ("block: Fix the partition start may overflow in add_partition()") from hulk add check of start and length. Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- block/ioctl.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/block/ioctl.c b/block/ioctl.c index f2a3524ed0ac..c8945df2e283 100644 --- a/block/ioctl.c +++ b/block/ioctl.c @@ -17,7 +17,7 @@ static int blkpg_do_ioctl(struct block_device *bdev, struct blkpg_partition __user *upart, int op) { struct blkpg_partition p; - long long start, length; + sector_t start, length; if (!capable(CAP_SYS_ADMIN)) return -EACCES; @@ -34,6 +34,9 @@ static int blkpg_do_ioctl(struct block_device *bdev, if (p.start < 0 || p.length <= 0 || p.start + p.length < 0) return -EINVAL; + /* Check that the partition is aligned to the block size */ + if (!IS_ALIGNED(p.start | p.length, bdev_logical_block_size(bdev))) + return -EINVAL; start = p.start >> SECTOR_SHIFT; length = p.length >> SECTOR_SHIFT; @@ -53,9 +56,6 @@ static int blkpg_do_ioctl(struct block_device *bdev, switch (op) { case BLKPG_ADD_PARTITION: - /* check if partition is aligned to blocksize */ - if (p.start & (bdev_logical_block_size(bdev) - 1)) - return -EINVAL; return bdev_add_partition(bdev, p.pno, start, length); case BLKPG_RESIZE_PARTITION: return bdev_resize_partition(bdev, p.pno, start, length); -- 2.31.1

2 1

[PATCH OLK-6.6 0/7] Introduce smart halt polling
by liangtian 27 Feb '24

27 Feb '24

Introduce smart halt polling Peng Liang (1): cpuidle: haltpoll: Only check boot_option_idle_override in x86 Xiangyou Xie (6): sched/idle: introduce smart halt polling cpuidle: add cpuidle-haltpoll driver module parameter arm64: Add some definitions of kvm_para* ARM: cpuidle: Add support for cpuidle-haltpoll driver for ARM config: enable CONFIG_CPU_IDLE_GOV_HALTPOLL and CONFIG_HALTPOLL_CPUIDLE for arm arm64: Optimize ttwu IPI arch/arm64/Kconfig | 3 + arch/arm64/configs/openeuler_defconfig | 3 + arch/arm64/include/asm/thread_info.h | 2 + arch/arm64/kernel/process.c | 4 ++ drivers/cpuidle/Kconfig | 4 +- drivers/cpuidle/cpuidle-haltpoll.c | 97 ++++++++++++++++++++++---- drivers/cpuidle/governors/haltpoll.c | 6 +- drivers/cpuidle/poll_state.c | 3 + include/asm-generic/kvm_para.h | 1 + include/linux/kernel.h | 1 + kernel/sched/idle.c | 30 +++++++- kernel/sysctl.c | 7 ++ 12 files changed, 142 insertions(+), 19 deletions(-) -- 2.33.0

2 8

[PATCH v1 OLK-6.6 0/3] kworker: Fix the problem of ipsan performance degradation on ARM architecture
by jiangdongxu 27 Feb '24

27 Feb '24

From: shaodenghui <shaodenghui(a)huawei.com> When the current downstream FS tests IPSAN, it is found that the performance on ARM is much worse than that on X86, and the test data of IPSAN fluctuates greatly. After analysis, the reason is that when iscsi issues IO, the task is sent to kworker for processing by iscsi_xmitworker. The workqueue created by iscsi can automatically identify the CPU of the soft interrupt currently processed by iscsi, and automatically schedule the workqueue to the corresponding NUMA node. shaodenghui (3): iscsi: add member for NUMA aware order workqueue workqueue: implement NUMA affinity for single thread workqueue iscsi: use dynamic single thread workqueue to improve performance drivers/scsi/iscsi_tcp.c | 9 +++++++++ drivers/scsi/libiscsi.c | 17 ++++++++++++----- include/linux/workqueue.h | 1 + include/scsi/libiscsi.h | 1 + kernel/workqueue.c | 15 ++++++++++----- 5 files changed, 33 insertions(+), 10 deletions(-) -- 2.33.0

2 4

[PATCH OLK-6.6 0/3] add cgroup/cpuset exclusive
by Chen Ridong 27 Feb '24

27 Feb '24

Chen Ridong (1): cgroup/cpuset: Add cpuset.cpus.exclusive.effective for v2 Waiman Long (2): cgroup/cpuset: Add cpuset.cpus.exclusive for v2 cgroup/cpuset: Introduce remote partition kernel/cgroup/cpuset.c | 1248 +++++++++++++++++++++++++++++----------- 1 file changed, 922 insertions(+), 326 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6] blk-mq: fix IO hang from sbitmap wakeup race
by Li Lingfeng 27 Feb '24

27 Feb '24

From: Ming Lei <ming.lei(a)redhat.com> mainline inclusion from mainline-v6.8-rc1 commit 5266caaf5660529e3da53004b8b7174cab6374ed category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I943X7 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered with the following blk_mq_get_driver_tag() in case of getting driver tag failure. Then in __sbitmap_queue_wake_up(), waitqueue_active() may not observe the added waiter in blk_mq_mark_tag_wait() and wake up nothing, meantime blk_mq_mark_tag_wait() can't get driver tag successfully. This issue can be reproduced by running the following test in loop, and fio hang can be observed in < 30min when running it on my test VM in laptop. modprobe -r scsi_debug modprobe scsi_debug delay=0 dev_size_mb=4096 max_queue=1 host_max_queue=1 submit_queues=4 dev=`ls -d /sys/bus/pseudo/drivers/scsi_debug/adapter*/host*/target*/*/block/* | head -1 | xargs basename` fio --filename=/dev/"$dev" --direct=1 --rw=randrw --bs=4k --iodepth=1 \ --runtime=100 --numjobs=40 --time_based --name=test \ --ioengine=libaio Fix the issue by adding one explicit barrier in blk_mq_mark_tag_wait(), which is just fine in case of running out of tag. Cc: Jan Kara <jack(a)suse.cz> Cc: Kemeng Shi <shikemeng(a)huaweicloud.com> Reported-by: Changhui Zhong <czhong(a)redhat.com> Signed-off-by: Ming Lei <ming.lei(a)redhat.com> Link: https://lore.kernel.org/r/20240112122626.4181044-1-ming.lei@redhat.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- block/blk-mq.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/block/blk-mq.c b/block/blk-mq.c index 0f15ef068f14..d0085388aa4a 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -1868,6 +1868,22 @@ static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx *hctx, wait->flags &= ~WQ_FLAG_EXCLUSIVE; __add_wait_queue(wq, wait); + /* + * Add one explicit barrier since blk_mq_get_driver_tag() may + * not imply barrier in case of failure. + * + * Order adding us to wait queue and allocating driver tag. + * + * The pair is the one implied in sbitmap_queue_wake_up() which + * orders clearing sbitmap tag bits and waitqueue_active() in + * __sbitmap_queue_wake_up(), since waitqueue_active() is lockless + * + * Otherwise, re-order of adding wait queue and getting driver tag + * may cause __sbitmap_queue_wake_up() to wake up nothing because + * the waitqueue_active() may not observe us in wait queue. + */ + smp_mb(); + /* * It's possible that a tag was freed in the window between the * allocation failure and adding the hardware queue to the wait -- 2.31.1

2 1

[PATCH OLK-5.10] blk-mq: fix IO hang from sbitmap wakeup race
by Li Lingfeng 27 Feb '24

27 Feb '24

From: Ming Lei <ming.lei(a)redhat.com> mainline inclusion from mainline-v6.8-rc1 commit 5266caaf5660529e3da53004b8b7174cab6374ed category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I943Q7 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered with the following blk_mq_get_driver_tag() in case of getting driver tag failure. Then in __sbitmap_queue_wake_up(), waitqueue_active() may not observe the added waiter in blk_mq_mark_tag_wait() and wake up nothing, meantime blk_mq_mark_tag_wait() can't get driver tag successfully. This issue can be reproduced by running the following test in loop, and fio hang can be observed in < 30min when running it on my test VM in laptop. modprobe -r scsi_debug modprobe scsi_debug delay=0 dev_size_mb=4096 max_queue=1 host_max_queue=1 submit_queues=4 dev=`ls -d /sys/bus/pseudo/drivers/scsi_debug/adapter*/host*/target*/*/block/* | head -1 | xargs basename` fio --filename=/dev/"$dev" --direct=1 --rw=randrw --bs=4k --iodepth=1 \ --runtime=100 --numjobs=40 --time_based --name=test \ --ioengine=libaio Fix the issue by adding one explicit barrier in blk_mq_mark_tag_wait(), which is just fine in case of running out of tag. Cc: Jan Kara <jack(a)suse.cz> Cc: Kemeng Shi <shikemeng(a)huaweicloud.com> Reported-by: Changhui Zhong <czhong(a)redhat.com> Signed-off-by: Ming Lei <ming.lei(a)redhat.com> Link: https://lore.kernel.org/r/20240112122626.4181044-1-ming.lei@redhat.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- block/blk-mq.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/block/blk-mq.c b/block/blk-mq.c index 9ec937a6ae6c..a28957dfb757 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -1277,6 +1277,22 @@ static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx *hctx, wait->flags &= ~WQ_FLAG_EXCLUSIVE; __add_wait_queue(wq, wait); + /* + * Add one explicit barrier since blk_mq_get_driver_tag() may + * not imply barrier in case of failure. + * + * Order adding us to wait queue and allocating driver tag. + * + * The pair is the one implied in sbitmap_queue_wake_up() which + * orders clearing sbitmap tag bits and waitqueue_active() in + * __sbitmap_queue_wake_up(), since waitqueue_active() is lockless + * + * Otherwise, re-order of adding wait queue and getting driver tag + * may cause __sbitmap_queue_wake_up() to wake up nothing because + * the waitqueue_active() may not observe us in wait queue. + */ + smp_mb(); + /* * It's possible that a tag was freed in the window between the * allocation failure and adding the hardware queue to the wait -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] blk-mq: fix IO hang from sbitmap wakeup race
by Li Lingfeng 27 Feb '24

27 Feb '24

From: Ming Lei <ming.lei(a)redhat.com> mainline inclusion from mainline-v6.8-rc1 commit 5266caaf5660529e3da53004b8b7174cab6374ed category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I943P5 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered with the following blk_mq_get_driver_tag() in case of getting driver tag failure. Then in __sbitmap_queue_wake_up(), waitqueue_active() may not observe the added waiter in blk_mq_mark_tag_wait() and wake up nothing, meantime blk_mq_mark_tag_wait() can't get driver tag successfully. This issue can be reproduced by running the following test in loop, and fio hang can be observed in < 30min when running it on my test VM in laptop. modprobe -r scsi_debug modprobe scsi_debug delay=0 dev_size_mb=4096 max_queue=1 host_max_queue=1 submit_queues=4 dev=`ls -d /sys/bus/pseudo/drivers/scsi_debug/adapter*/host*/target*/*/block/* | head -1 | xargs basename` fio --filename=/dev/"$dev" --direct=1 --rw=randrw --bs=4k --iodepth=1 \ --runtime=100 --numjobs=40 --time_based --name=test \ --ioengine=libaio Fix the issue by adding one explicit barrier in blk_mq_mark_tag_wait(), which is just fine in case of running out of tag. Cc: Jan Kara <jack(a)suse.cz> Cc: Kemeng Shi <shikemeng(a)huaweicloud.com> Reported-by: Changhui Zhong <czhong(a)redhat.com> Signed-off-by: Ming Lei <ming.lei(a)redhat.com> Link: https://lore.kernel.org/r/20240112122626.4181044-1-ming.lei@redhat.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- block/blk-mq.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/block/blk-mq.c b/block/blk-mq.c index 96debbe63ad2..aa4b3c608249 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -1137,6 +1137,22 @@ static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx *hctx, wait->flags &= ~WQ_FLAG_EXCLUSIVE; __add_wait_queue(wq, wait); + /* + * Add one explicit barrier since blk_mq_get_driver_tag() may + * not imply barrier in case of failure. + * + * Order adding us to wait queue and allocating driver tag. + * + * The pair is the one implied in sbitmap_queue_wake_up() which + * orders clearing sbitmap tag bits and waitqueue_active() in + * __sbitmap_queue_wake_up(), since waitqueue_active() is lockless + * + * Otherwise, re-order of adding wait queue and getting driver tag + * may cause __sbitmap_queue_wake_up() to wake up nothing because + * the waitqueue_active() may not observe us in wait queue. + */ + smp_mb(); + /* * It's possible that a tag was freed in the window between the * allocation failure and adding the hardware queue to the wait -- 2.31.1

2 1

[PATCH OLK-6.6 0/3] kabi: reserve space for arch related
by Liao Chen 27 Feb '24

27 Feb '24

reserve space for struct irq_work reserve space for enum irq_domain_bus_token reserve space for struct mfd_cell Liao Chen (3): kabi: reserve space for struct irq_work kabi: reserve space for enum irq_domain_bus_token kabi: reserve space for struct mfd_cell include/linux/irq_work.h | 5 +++++ include/linux/irqdomain_defs.h | 8 ++++++++ include/linux/mfd/core.h | 6 ++++++ 3 files changed, 19 insertions(+) -- 2.34.1

2 4

[openeuler:OLK-6.6] BUILD REGRESSION 038c00b1896898752288ca81d9cac182afc6d6ab
by kernel test robot 27 Feb '24

27 Feb '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 038c00b1896898752288ca81d9cac182afc6d6ab !4660 Intel: Backport to fix In Field Scan(IFS) SAF for GNR & SRF Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202402271032.NbR2jDIl-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) drivers/infiniband/hw/hns/hns_roce_hw_v2.c:4835:5: warning: no previous prototype for 'hns_roce_hw_v2_get_dscp' [-Wmissing-prototypes] Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- aarch64-linux-ld:arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- aarch64-linux-ld:arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):dangerous-relocation:unsupported-relocation | `-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support |-- arm64-randconfig-002-20240227 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- arm64-randconfig-003-20240227 | |-- aarch64-linux-ld:arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- aarch64-linux-ld:arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- arm64-randconfig-r111-20240227 | |-- fs-userfaultfd.c:sparse:sparse:invalid-assignment: | |-- include-linux-userfaultfd_k.h:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-restricted-uffd_flags_t-usertype-flags-got-unsigned-int-enum-mfill_atomic_mode-mode | |-- include-linux-userfaultfd_k.h:sparse:sparse:restricted-uffd_flags_t-degrades-to-integer | `-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static |-- loongarch-allmodconfig | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-infiniband-hw-hns-hns_roce_hw_v2.c:warning:no-previous-prototype-for-hns_roce_hw_v2_get_dscp | `-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-ima_get_hash_algo |-- loongarch-randconfig-001-20240227 | |-- kernel-sched-core.c:warning:format-llu-expects-argument-of-type-long-long-unsigned-int-but-argument-has-type-int | `-- kernel-sched-fair.c:error:hundred_thousand-undeclared-here-(not-in-a-function) |-- loongarch-randconfig-002-20240227 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | `-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-ima_get_hash_algo |-- x86_64-buildonly-randconfig-002-20240226 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-buildonly-randconfig-003-20240226 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-buildonly-randconfig-005-20240226 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-006-20240226 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-072-20240226 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-073-20240226 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-075-20240226 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device `-- x86_64-randconfig-161-20240227 `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device clang_recent_errors |-- arm64-allmodconfig | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_config_pix_clock | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_fb_format_check | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_plane_get_cursor_format | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_plane_get_primary_format | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_reset | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_update_cursor_hi_addr | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_update_primary_hi_addr | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_vram_init | |-- drivers-gpu-drm-phytium-pe22_dp.c:warning:no-previous-prototype-for-function-pe22_dp_hw_get_source_lane_count | |-- drivers-gpu-drm-phytium-pe22_dp.c:warning:no-previous-prototype-for-function-pe22_dp_hw_reset | |-- drivers-gpu-drm-phytium-pe22_dp.c:warning:no-previous-prototype-for-function-pe22_dp_hw_spread_is_enable | |-- drivers-gpu-drm-phytium-phytium_crtc.c:warning:no-previous-prototype-for-function-phytium_crtc_atomic_destroy_state | |-- drivers-gpu-drm-phytium-phytium_crtc.c:warning:no-previous-prototype-for-function-phytium_crtc_atomic_duplicate_state | |-- drivers-gpu-drm-phytium-phytium_debugfs.c:warning:no-previous-prototype-for-function-phytium_debugfs_connector_add | |-- drivers-gpu-drm-phytium-phytium_debugfs.c:warning:no-previous-prototype-for-function-phytium_debugfs_display_register | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_adjust_link_train_parameter | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_coding_8b10b_need_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_dpcd_sink_dpms | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_encoder_destroy | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_fast_link_train | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_get_link_train_fallback_values | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hpd_poll_handler | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_config_video | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_disable_input_source | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_disable_output | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_disable_video | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_audio | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_input_source | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_output | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_video | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_hpd_irq_setup | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_init | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_output_is_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_video_is_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_scrambled_need_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_start_link_train | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_encoder_mode_valid | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_get_encoder_crtc_mask | |-- drivers-gpu-drm-phytium-phytium_fbdev.c:warning:no-previous-prototype-for-function-phytium_drm_fbdev_fini | |-- drivers-gpu-drm-phytium-phytium_fbdev.c:warning:no-previous-prototype-for-function-phytium_drm_fbdev_init | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_dma_transfer | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_gem_prime_vmap | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_gem_prime_vunmap | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_memory_pool_alloc | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_memory_pool_free | |-- drivers-gpu-drm-phytium-phytium_panel.c:warning:no-previous-prototype-for-function-phytium_dp_panel_release_backlight_funcs | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_dma_fini | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_dma_init | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_vram_fini | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_vram_hw_init | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_vram_init | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_atomic_destroy_state | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_atomic_duplicate_state | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_atomic_set_property | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_destroy | |-- drivers-gpu-drm-phytium-phytium_platform.c:warning:no-previous-prototype-for-function-phytium_platform_carveout_mem_fini | |-- drivers-gpu-drm-phytium-phytium_platform.c:warning:no-previous-prototype-for-function-phytium_platform_carveout_mem_init | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_clear_msi_irq | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_config_pix_clock | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_disable | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_fb_format_check | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_plane_get_cursor_format | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_plane_get_primary_format | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_update_dcreq | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_update_primary_hi_addr | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_vram_init | |-- drivers-gpu-drm-phytium-px210_dp.c:warning:no-previous-prototype-for-function-px210_dp_hw_get_source_lane_count | |-- drivers-gpu-drm-phytium-px210_dp.c:warning:no-previous-prototype-for-function-px210_dp_hw_reset | |-- drivers-gpu-drm-phytium-px210_dp.c:warning:no-previous-prototype-for-function-px210_dp_hw_spread_is_enable | |-- drivers-iommu-arm-arm-smmu-v3-arm-smmu-v3.c:warning:variable-pre_addr-is-uninitialized-when-used-here | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- arm64-randconfig-001-20240227 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-allyesconfig | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-sm3_generic_block_fn | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-zx_sm3_finup | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-zx_sm3_update | |-- arch-x86-crypto-sm4-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-gmi_sm4_set_key | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-base_offset-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-pin-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-value_back-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-value_read-set-but-not-used | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- x86_64-buildonly-randconfig-004-20240226 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | `-- ld.lld:error:undefined-symbol:lockdep_is_cpus_held |-- x86_64-randconfig-003-20240226 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-004-20240226 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | `-- ld.lld:error:undefined-symbol:lockdep_is_cpus_held |-- x86_64-randconfig-005-20240226 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-011-20240226 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-012-20240226 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-013-20240226 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-014-20240226 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-015-20240226 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-016-20240226 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-071-20240226 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-074-20240226 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-076-20240226 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-randconfig-121-20240227 | `-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static |-- x86_64-randconfig-122-20240227 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | `-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static |-- x86_64-randconfig-123-20240227 | |-- fs-userfaultfd.c:sparse:sparse:invalid-assignment: | |-- include-linux-userfaultfd_k.h:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-restricted-uffd_flags_t-usertype-flags-got-unsigned-int-enum-mfill_atomic_mode-mode | |-- include-linux-userfaultfd_k.h:sparse:sparse:restricted-uffd_flags_t-degrades-to-integer | |-- ld.lld:error:undefined-symbol:lockdep_is_cpus_held | `-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static `-- x86_64-rhel-8.3-rust `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device elapsed time: 1189m configs tested: 40 configs skipped: 143 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240227 clang arm64 randconfig-002-20240227 gcc arm64 randconfig-003-20240227 gcc arm64 randconfig-004-20240227 gcc loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240227 gcc loongarch randconfig-002-20240227 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240226 clang x86_64 buildonly-randconfig-002-20240226 gcc x86_64 buildonly-randconfig-003-20240226 gcc x86_64 buildonly-randconfig-004-20240226 clang x86_64 buildonly-randconfig-005-20240226 gcc x86_64 buildonly-randconfig-006-20240226 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240226 gcc x86_64 randconfig-002-20240226 gcc x86_64 randconfig-003-20240226 clang x86_64 randconfig-004-20240226 clang x86_64 randconfig-005-20240226 clang x86_64 randconfig-006-20240226 gcc x86_64 randconfig-011-20240226 clang x86_64 randconfig-012-20240226 clang x86_64 randconfig-013-20240226 clang x86_64 randconfig-014-20240226 clang x86_64 randconfig-015-20240226 clang x86_64 randconfig-016-20240226 clang x86_64 randconfig-071-20240226 clang x86_64 randconfig-072-20240226 gcc x86_64 randconfig-073-20240226 gcc x86_64 randconfig-074-20240226 clang x86_64 randconfig-075-20240226 gcc x86_64 randconfig-076-20240226 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3384/3397] drivers/infiniband/hw/hns/hns_roce_hw_v2.c:4835:5: warning: no previous prototype for 'hns_roce_hw_v2_get_dscp'
by kernel test robot 27 Feb '24

27 Feb '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 038c00b1896898752288ca81d9cac182afc6d6ab commit: d0acb51bbfac2c66a43ca337314ba8611701b6c8 [3384/3397] RDMA/hns: Support DSCP of userspace config: loongarch-allmodconfig (https://download.01.org/0day-ci/archive/20240227/202402271032.NbR2jDIl-lkp@…) compiler: loongarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240227/202402271032.NbR2jDIl-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402271032.NbR2jDIl-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/infiniband/hw/hns/hns_roce_hw_v2.c:4835:5: warning: no previous prototype for 'hns_roce_hw_v2_get_dscp' [-Wmissing-prototypes] 4835 | int hns_roce_hw_v2_get_dscp(struct hns_roce_dev *hr_dev, u8 dscp, | ^~~~~~~~~~~~~~~~~~~~~~~ vim +/hns_roce_hw_v2_get_dscp +4835 drivers/infiniband/hw/hns/hns_roce_hw_v2.c 4834 > 4835 int hns_roce_hw_v2_get_dscp(struct hns_roce_dev *hr_dev, u8 dscp, 4836 u8 *tc_mode, u8 *priority) 4837 { 4838 struct hns_roce_v2_priv *priv = hr_dev->priv; 4839 struct hnae3_handle *handle = priv->handle; 4840 const struct hnae3_ae_ops *ops = handle->ae_algo->ops; 4841 4842 if (!ops->get_dscp_prio) 4843 return -EOPNOTSUPP; 4844 4845 return ops->get_dscp_prio(handle, dscp, tc_mode, priority); 4846 } 4847 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] coresight: trbe: Enable ACPI based devices
by Junhao He 27 Feb '24

27 Feb '24

This series enables detection of ACPI based TRBE devices via a stand alone purpose built representative platform device. But as a pre-requisite this changes coresight_platform_data structure assignment for the TRBE device. Anshuman Khandual (2): coresight: trbe: Add a representative coresight_platform_data for TRBE coresight: trbe: Enable ACPI based TRBE devices drivers/hwtracing/coresight/coresight-trbe.c | 23 ++++++++++++++++++-- drivers/hwtracing/coresight/coresight-trbe.h | 2 ++ 2 files changed, 23 insertions(+), 2 deletions(-) -- 2.33.0

2 3

[PATCH OLK-5.10] serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed
by GUO Zihua 27 Feb '24

27 Feb '24

From: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> stable inclusion from stable-v5.10.209 commit bc57f3ef8a9eb0180606696f586a6dcfaa175ed0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EDC CVE: CVE-2023-52457 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ad90d0358bd3b4554f243a425168fc7cebe7d04e ] Returning an error code from .remove() makes the driver core emit the little helpful error message: remove callback returned a non-zero value. This will be ignored. and then remove the device anyhow. So all resources that were not freed are leaked in this case. Skipping serial8250_unregister_port() has the potential to keep enough of the UART around to trigger a use-after-free. So replace the error return (and with it the little helpful error message) by a more useful error message and continue to cleanup. Fixes: e3f0c638f428 ("serial: 8250: omap: Fix unpaired pm_runtime_put_sync() in omap8250_remove()") Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Reviewed-by: Tony Lindgren <tony(a)atomide.com> Link: https://lore.kernel.org/r/20231110152927.70601-2-u.kleine-koenig@pengutroni… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/tty/serial/8250/8250_omap.c Signed-off-by: GUO Zihua <guozihua(a)huawei.com> --- drivers/tty/serial/8250/8250_omap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c index e26ac3f42e05..1967bf314e7c 100644 --- a/drivers/tty/serial/8250/8250_omap.c +++ b/drivers/tty/serial/8250/8250_omap.c @@ -1485,7 +1485,7 @@ static int omap8250_remove(struct platform_device *pdev) err = pm_runtime_resume_and_get(&pdev->dev); if (err) - return err; + dev_err(&pdev->dev, "Failed to resume hardware\n"); pm_runtime_dont_use_autosuspend(&pdev->dev); pm_runtime_put_sync(&pdev->dev); -- 2.34.1

2 1

[PATCH OLK-6.6 00/14] LoongArch: fix some known issue and update defconfig
by Hongchen Zhang 27 Feb '24

27 Feb '24

Bibo Mao (1): LoongArch: Implement constant timer shutdown interface Chong Qiao (1): irqchip/loongson-pch-pic: 7a1000 int_clear reg must use 64bit write. Hongchen Zhang (3): LoongArch: fix compile error caused by arch_trigger_cpumask_backtrace usb: xhci: add XHCI_NO_SOFT_RETRY quirk for EJ188 net: stmmac: fix potential double free of dma descriptor resources Huacai Chen (1): drm/radeon: Workaround radeon driver bug for Loongson Jianmin Lv (1): LoongArch: Remove generic irq migration Tianli Xiong (1): irqchip/loongson-liointc: Set different isr for differnt core Yingkun Meng (1): LoongArch: defconfig: Enable a large number of configurations Youling Tang (4): LoongArch: kdump: Add memory reservation for old kernel LoongArch: kexec: Add compatibility with old interfaces LoongArch: Fix kdump failure on v40 interface specification LoongArch: kdump: Add high memory reservation zhangtianyang (1): LoongArch: Adapted SECTION_SIZE_BITS with page size arch/loongarch/Kconfig | 1 - arch/loongarch/configs/loongson3_defconfig | 1577 +++++++++++++++-- arch/loongarch/include/asm/irq.h | 3 +- arch/loongarch/include/asm/sparsemem.h | 2 +- arch/loongarch/kernel/irq.c | 36 + arch/loongarch/kernel/machine_kexec.c | 45 +- arch/loongarch/kernel/process.c | 3 +- arch/loongarch/kernel/setup.c | 94 +- arch/loongarch/kernel/smp.c | 3 +- arch/loongarch/kernel/time.c | 23 +- drivers/gpu/drm/radeon/cik.c | 3 + drivers/gpu/drm/radeon/evergreen.c | 3 + drivers/gpu/drm/radeon/r600.c | 3 + drivers/gpu/drm/radeon/si.c | 3 + drivers/irqchip/irq-loongson-liointc.c | 4 +- drivers/irqchip/irq-loongson-pch-pic.c | 16 +- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 11 + drivers/usb/host/xhci-pci.c | 6 + kernel/irq/Kconfig | 4 +- 19 files changed, 1639 insertions(+), 201 deletions(-) -- 2.33.0

2 15

[PATCH OLK-5.10] tls: fix race between tx work scheduling and socket close
by Zhengchao Shao 27 Feb '24

27 Feb '24

From: Jakub Kicinski <kuba(a)kernel.org> mainline inclusion from mainline-v6.8-rc5 commit e01e3934a1b2d122919f73bc6ddbe1cdafc4bbdb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I92REM CVE: CVE-2024-26585 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Similarly to previous commit, the submitting thread (recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete(). Reorder scheduling the work before calling complete(). This seems more logical in the first place, as it's the inverse order of what the submitting thread will do. Reported-by: valis <sec(a)valis.email> Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Reviewed-by: Sabrina Dubroca <sd(a)queasysnail.net> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/tls/tls_sw.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/tls/tls_sw.c | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c index 84e1f2af1a83..e2f4cc5c85bb 100644 --- a/net/tls/tls_sw.c +++ b/net/tls/tls_sw.c @@ -443,7 +443,6 @@ static void tls_encrypt_done(struct crypto_async_request *req, int err) struct scatterlist *sge; struct sk_msg *msg_en; struct tls_rec *rec; - bool ready = false; int pending; rec = container_of(aead_req, struct tls_rec, aead_req); @@ -475,8 +474,12 @@ static void tls_encrypt_done(struct crypto_async_request *req, int err) /* If received record is at head of tx_list, schedule tx */ first_rec = list_first_entry(&ctx->tx_list, struct tls_rec, list); - if (rec == first_rec) - ready = true; + if (rec == first_rec) { + /* Schedule the transmission */ + if (!test_and_set_bit(BIT_TX_SCHEDULED, + &ctx->tx_bitmask)) + schedule_delayed_work(&ctx->tx_work.work, 1); + } } spin_lock_bh(&ctx->encrypt_compl_lock); @@ -485,13 +488,6 @@ static void tls_encrypt_done(struct crypto_async_request *req, int err) if (!pending && ctx->async_notify) complete(&ctx->async_wait.completion); spin_unlock_bh(&ctx->encrypt_compl_lock); - - if (!ready) - return; - - /* Schedule the transmission */ - if (!test_and_set_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) - schedule_delayed_work(&ctx->tx_work.work, 1); } static int tls_do_encryption(struct sock *sk, -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS V2 0/2] Remove WQ_FLAG_BOOKMARK flag
by Zizhi Wo 26 Feb '24

26 Feb '24

Fix softlockup by removing the wait_queue flag: WQ_FLAG_BOOKMARK. Matthew Wilcox (Oracle) (2): filemap: remove use of wait bookmarks sched: remove wait bookmarks include/linux/wait.h | 3 --- kernel/sched/wait.c | 57 ++++++-------------------------------------- mm/filemap.c | 21 +--------------- 3 files changed, 8 insertions(+), 73 deletions(-) -- 2.39.2

2 3

[PATCH OLK-6.6 0/4] kabi: reserve space for arch related
by Liao Chen 26 Feb '24

26 Feb '24

kabi: reserve space for struct irq_work kabi: reserve space for struct irq_domain kabi: reserve space for enum irq_domain_bus_token kabi: reserve space for struct mfd_cell Liao Chen (4): kabi: reserve space for struct irq_work kabi: reserve space for struct irq_domain kabi: reserve space for enum irq_domain_bus_token kabi: reserve space for struct mfd_cell include/linux/irq_work.h | 5 +++++ include/linux/irqdomain.h | 4 ++++ include/linux/irqdomain_defs.h | 8 ++++++++ include/linux/mfd/core.h | 6 ++++++ 4 files changed, 23 insertions(+) -- 2.34.1

2 5

[PATCH OLK-6.6 0/5] Support PV sched feature
by lishusen 26 Feb '24

26 Feb '24

PV sched supports the vCPU preemption check to enhance lock performance on overcommitted hosts Zengruan Ye (5): KVM: arm64: Document PV-sched interface KVM: arm64: Implement PV_SCHED_FEATURES call KVM: arm64: Support pvsched preempted via shared structure KVM: arm64: Add interface to support vCPU preempted check KVM: arm64: Support the vCPU preemption check Documentation/virt/kvm/arm/pvsched.rst | 58 ++++++++++++++ arch/arm64/Kconfig | 11 +++ arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/kvm_host.h | 32 ++++++++ arch/arm64/include/asm/paravirt.h | 11 +++ arch/arm64/include/asm/pvsched-abi.h | 16 ++++ arch/arm64/include/asm/spinlock.h | 8 ++ arch/arm64/kernel/Makefile | 2 +- arch/arm64/kernel/paravirt-spinlocks.c | 16 ++++ arch/arm64/kernel/paravirt.c | 107 +++++++++++++++++++++++++ arch/arm64/kvm/Makefile | 2 +- arch/arm64/kvm/arm.c | 11 +++ arch/arm64/kvm/hypercalls.c | 17 ++++ arch/arm64/kvm/pvsched.c | 54 +++++++++++++ include/linux/arm-smccc.h | 19 +++++ include/linux/cpuhotplug.h | 1 + 16 files changed, 364 insertions(+), 2 deletions(-) create mode 100644 Documentation/virt/kvm/arm/pvsched.rst create mode 100644 arch/arm64/include/asm/pvsched-abi.h create mode 100644 arch/arm64/kernel/paravirt-spinlocks.c create mode 100644 arch/arm64/kvm/pvsched.c -- 2.33.0

2 6

[PATCH OLK-5.10] iomap: add support to track dirty state of sub pages
by Yu Kuai 26 Feb '24

26 Feb '24

hulk inclusion category: performance bugzilla: https://gitee.com/openeuler/kernel/issues/I93TU0 CVE: NA ------------------------------------------ commit 9dc55f1389f9 ("iomap: add support for sub-pagesize buffered I/O without buffer heads") replace the per-block structure buffer_head with the per-page structure iomap_page. However, iomap_page can't track the dirty state of sub pages, which will cause performance issue since sub pages will be writeback even if they are not dirty. For example, if block size is 4k and page size is 64k: dd if=/dev/zero of=testfile bs=4k count=16 oflag=sync With buffer_head implementation, the above dd cmd will writeback 4k in each round. However, with iomap_page implementation, the range of writeback in each round is from the start of the page to the end offset we just wrote. Thus add support to track dirty state in iomap_page. test environment: platform: arm64 pagesize: 64k blocksize: 4k test case: dd if=/dev/zero of=/mnt/testfile bs=1M count=128 fio --ioengine=sync --rw=randwrite --iodepth=64 --name=test \ --filename=/mnt/testfile --bs=4k --fsync=1 The test result is: xfs with patch: WRITE: bw=4609KiB/s (4720kB/s) xfs without patch WRITE: bw=2714KiB/s (2780kB/s) ext4: WRITE: bw=3840KiB/s (3932kB/s) Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- fs/iomap/buffered-io.c | 85 +++++++++++++++++++++++++++++++++--------- 1 file changed, 68 insertions(+), 17 deletions(-) diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c index d9092aa5c3fb..73524df884bb 100644 --- a/fs/iomap/buffered-io.c +++ b/fs/iomap/buffered-io.c @@ -25,13 +25,13 @@ /* * Structure allocated for each page or THP when block size < page size - * to track sub-page uptodate status and I/O completions. + * to track sub-page uptodate and dirty status and I/O completions. */ struct iomap_page { atomic_t read_bytes_pending; atomic_t write_bytes_pending; - spinlock_t uptodate_lock; - unsigned long uptodate[]; + spinlock_t state_lock; + unsigned long state[]; }; static inline struct iomap_page *to_iomap_page(struct page *page) @@ -59,11 +59,13 @@ iomap_page_create(struct inode *inode, struct page *page) if (iop || nr_blocks <= 1) return iop; - iop = kzalloc(struct_size(iop, uptodate, BITS_TO_LONGS(nr_blocks)), + iop = kzalloc(struct_size(iop, state, BITS_TO_LONGS(2 * nr_blocks)), GFP_NOFS | __GFP_NOFAIL); - spin_lock_init(&iop->uptodate_lock); + spin_lock_init(&iop->state_lock); if (PageUptodate(page)) - bitmap_fill(iop->uptodate, nr_blocks); + bitmap_set(iop->state, 0, nr_blocks); + if (PageDirty(page)) + bitmap_set(iop->state, nr_blocks, nr_blocks); attach_page_private(page, iop); return iop; } @@ -78,7 +80,7 @@ iomap_page_release(struct page *page) return; WARN_ON_ONCE(atomic_read(&iop->read_bytes_pending)); WARN_ON_ONCE(atomic_read(&iop->write_bytes_pending)); - WARN_ON_ONCE(bitmap_full(iop->uptodate, nr_blocks) != + WARN_ON_ONCE(bitmap_full(iop->state, nr_blocks) != PageUptodate(page)); kfree(iop); } @@ -109,7 +111,7 @@ iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop, /* move forward for each leading block marked uptodate */ for (i = first; i <= last; i++) { - if (!test_bit(i, iop->uptodate)) + if (!test_bit(i, iop->state)) break; *pos += block_size; poff += block_size; @@ -119,7 +121,7 @@ iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop, /* truncate len if we find any trailing uptodate block(s) */ for ( ; i <= last; i++) { - if (test_bit(i, iop->uptodate)) { + if (test_bit(i, iop->state)) { plen -= (last - i + 1) * block_size; last = i - 1; break; @@ -143,6 +145,53 @@ iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop, *lenp = plen; } +static void +iomap_set_range_dirty(struct page *page, unsigned int off, unsigned int len) +{ + struct inode *inode = page->mapping->host; + unsigned int nr_blocks = i_blocks_per_page(inode, page); + unsigned int first = off >> inode->i_blkbits; + unsigned int last = (off + len - 1) >> inode->i_blkbits; + unsigned long flags; + struct iomap_page *iop; + + if (PageError(page)) + return; + + if (len) + iomap_set_page_dirty(page); + + if (!page_has_private(page)) + return; + + iop = to_iomap_page(page); + spin_lock_irqsave(&iop->state_lock, flags); + bitmap_set(iop->state, first + nr_blocks, last - first + 1); + spin_unlock_irqrestore(&iop->state_lock, flags); +} + +static void +iomap_clear_range_dirty(struct page *page, unsigned int off, unsigned int len) +{ + struct inode *inode = page->mapping->host; + unsigned int nr_blocks = i_blocks_per_page(inode, page); + unsigned int first = off >> inode->i_blkbits; + unsigned int last = (off + len - 1) >> inode->i_blkbits; + unsigned long flags; + struct iomap_page *iop; + + if (PageError(page)) + return; + + if (!page_has_private(page)) + return; + + iop = to_iomap_page(page); + spin_lock_irqsave(&iop->state_lock, flags); + bitmap_clear(iop->state, first + nr_blocks, last - first + 1); + spin_unlock_irqrestore(&iop->state_lock, flags); +} + static void iomap_iop_set_range_uptodate(struct page *page, unsigned off, unsigned len) { @@ -152,11 +201,11 @@ iomap_iop_set_range_uptodate(struct page *page, unsigned off, unsigned len) unsigned last = (off + len - 1) >> inode->i_blkbits; unsigned long flags; - spin_lock_irqsave(&iop->uptodate_lock, flags); - bitmap_set(iop->uptodate, first, last - first + 1); - if (bitmap_full(iop->uptodate, i_blocks_per_page(inode, page))) + spin_lock_irqsave(&iop->state_lock, flags); + bitmap_set(iop->state, first, last - first + 1); + if (bitmap_full(iop->state, i_blocks_per_page(inode, page))) SetPageUptodate(page); - spin_unlock_irqrestore(&iop->uptodate_lock, flags); + spin_unlock_irqrestore(&iop->state_lock, flags); } static void @@ -451,7 +500,7 @@ iomap_is_partially_uptodate(struct page *page, unsigned long from, if (iop) { for (i = first; i <= last; i++) - if (!test_bit(i, iop->uptodate)) + if (!test_bit(i, iop->state)) return 0; return 1; } @@ -708,7 +757,7 @@ static size_t __iomap_write_end(struct inode *inode, loff_t pos, size_t len, if (unlikely(copied < len && !PageUptodate(page))) return 0; iomap_set_range_uptodate(page, offset_in_page(pos), len); - iomap_set_page_dirty(page); + iomap_set_range_dirty(page, offset_in_page(pos), len); return copied; } @@ -1024,7 +1073,7 @@ iomap_page_mkwrite_actor(struct inode *inode, loff_t pos, loff_t length, block_commit_write(page, 0, length); } else { WARN_ON_ONCE(!PageUptodate(page)); - set_page_dirty(page); + iomap_set_range_dirty(page, offset_in_page(pos), length); } return length; @@ -1407,6 +1456,7 @@ iomap_writepage_map(struct iomap_writepage_ctx *wpc, { struct iomap_page *iop = iomap_page_create(inode, page); struct iomap_ioend *ioend, *next; + unsigned int nr_blocks = i_blocks_per_page(inode, page); unsigned len = i_blocksize(inode); u64 file_offset; /* file offset of page */ int error = 0, count = 0, i; @@ -1422,7 +1472,7 @@ iomap_writepage_map(struct iomap_writepage_ctx *wpc, for (i = 0, file_offset = page_offset(page); i < (PAGE_SIZE >> inode->i_blkbits) && file_offset < end_offset; i++, file_offset += len) { - if (iop && !test_bit(i, iop->uptodate)) + if (iop && !test_bit(i + nr_blocks, iop->state)) continue; error = wpc->ops->map_blocks(wpc, inode, file_offset); @@ -1465,6 +1515,7 @@ iomap_writepage_map(struct iomap_writepage_ctx *wpc, } } + iomap_clear_range_dirty(page, 0, PAGE_SIZE); set_page_writeback(page); unlock_page(page); -- 2.39.2

2 1

[PATCH OLK-6.6 0/9] Support PV sched feature
by lishusen 26 Feb '24

26 Feb '24

PV sched supports the vCPU preemption check to enhance lock performance on overcommitted hosts Zengruan Ye (5): KVM: arm64: Document PV-sched interface KVM: arm64: Implement PV_SCHED_FEATURES call KVM: arm64: Support pvsched preempted via shared structure KVM: arm64: Add interface to support vCPU preempted check KVM: arm64: Support the vCPU preemption check Documentation/virt/kvm/arm/pvsched.rst | 58 ++++++++++++++ arch/arm64/Kconfig | 11 +++ arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/kvm_host.h | 32 ++++++++ arch/arm64/include/asm/paravirt.h | 11 +++ arch/arm64/include/asm/pvsched-abi.h | 16 ++++ arch/arm64/include/asm/spinlock.h | 8 ++ arch/arm64/kernel/Makefile | 2 +- arch/arm64/kernel/paravirt-spinlocks.c | 16 ++++ arch/arm64/kernel/paravirt.c | 107 +++++++++++++++++++++++++ arch/arm64/kvm/Makefile | 2 +- arch/arm64/kvm/arm.c | 11 +++ arch/arm64/kvm/hypercalls.c | 17 ++++ arch/arm64/kvm/pvsched.c | 54 +++++++++++++ include/linux/arm-smccc.h | 19 +++++ include/linux/cpuhotplug.h | 1 + 16 files changed, 364 insertions(+), 2 deletions(-) create mode 100644 Documentation/virt/kvm/arm/pvsched.rst create mode 100644 arch/arm64/include/asm/pvsched-abi.h create mode 100644 arch/arm64/kernel/paravirt-spinlocks.c create mode 100644 arch/arm64/kvm/pvsched.c -- 2.33.0

2 6

[PATCH v1 OLK-6.6 0/3] The workqueue created by iscsi can automatically identify the CPU of the soft interrupt currently processed by iscsi, and automatically schedule the workqueue to the corresponding NUMA node.
by jiangdongxu 26 Feb '24

26 Feb '24

From: shaodenghui <shaodenghui(a)huawei.com> When the current downstream FS tests IPSAN, it is found that the performance on ARM is much worse than that on X86, and the test data of IPSAN fluctuates greatly. After analysis, the reason is that when iscsi issues IO, the task is sent to kworker for processing by iscsi_xmitworker. shaodenghui (3): iscsi: add member for NUMA aware order workqueue workqueue: implement NUMA affinity for single thread workqueue iscsi: use dynamic single thread workqueue to improve performance drivers/scsi/iscsi_tcp.c | 9 +++++++++ drivers/scsi/libiscsi.c | 17 ++++++++++++----- include/linux/workqueue.h | 1 + include/scsi/libiscsi.h | 1 + kernel/workqueue.c | 15 ++++++++++----- 5 files changed, 33 insertions(+), 10 deletions(-) -- 2.33.0

2 4

[PATCH v1 OLK-6.6 1/3] iscsi: add member for NUMA aware order workqueue
by jiangdongxu 26 Feb '24

26 Feb '24

From: shaodenghui <shaodenghui(a)huawei.com> euleros inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4IZNO CVE: NA ------------------------------------------------- Add member to struct iscsi_conn. Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-By: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: BiaoXiang Ye <yebiaoxiang(a)huawei.com> Reviewed-by: fang yi <eric.fangyi(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Signed-off-by: shaodenghui <shaodenghui(a)huawei.com> --- include/linux/workqueue.h | 1 + include/scsi/libiscsi.h | 1 + 2 files changed, 2 insertions(+) diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h index 961909875..485c0f5b2 100644 --- a/include/linux/workqueue.h +++ b/include/linux/workqueue.h @@ -415,6 +415,7 @@ enum { __WQ_ORDERED = 1 << 17, /* internal: workqueue is ordered */ __WQ_LEGACY = 1 << 18, /* internal: create*_workqueue() */ __WQ_ORDERED_EXPLICIT = 1 << 19, /* internal: alloc_ordered_workqueue() */ + __WQ_DYNAMIC = 1 << 25, /* internal: only support single work order WQ */ WQ_MAX_ACTIVE = 512, /* I like 512, better ideas? */ WQ_UNBOUND_MAX_ACTIVE = WQ_MAX_ACTIVE, diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h index d253b82e9..ead17d222 100644 --- a/include/scsi/libiscsi.h +++ b/include/scsi/libiscsi.h @@ -266,6 +266,7 @@ struct iscsi_conn { /* custom statistics */ uint32_t eh_abort_cnt; uint32_t fmr_unalign_cnt; + int intimate_cpu; KABI_RESERVE(1) KABI_RESERVE(2) -- 2.33.0

2 4

[PATCH openEuler-22.03-LTS-SP2] gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
by Baokun Li 26 Feb '24

26 Feb '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v5.10.209 commit 5c28478af371a1c3fdb570ca67f110e1ae60fc37 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I93ODT CVE: CVE-2023-52448 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8877243beafa7c6bfc42022cbfdf9e39b25bd4fa ] Syzkaller has reported a NULL pointer dereference when accessing rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating rgd->rd_gl fails in read_rindex_entry(). Add a NULL pointer check in gfs2_rgrp_dump() to prevent that. Reported-and-tested-by: syzbot+da0fc229cc1ff4bb2e6d(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=da0fc229cc1ff4bb2e6d Fixes: 72244b6bc752 ("gfs2: improve debug information when lvb mismatches are found") Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Andreas Gruenbacher <agruenba(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/gfs2/rgrp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c index c5bde789a16d..4e760a3fb661 100644 --- a/fs/gfs2/rgrp.c +++ b/fs/gfs2/rgrp.c @@ -2231,7 +2231,7 @@ void gfs2_rgrp_dump(struct seq_file *seq, struct gfs2_rgrpd *rgd, (unsigned long long)rgd->rd_addr, rgd->rd_flags, rgd->rd_free, rgd->rd_free_clone, rgd->rd_dinodes, rgd->rd_reserved, rgd->rd_extfail_pt); - if (rgd->rd_sbd->sd_args.ar_rgrplvb) { + if (rgd->rd_sbd->sd_args.ar_rgrplvb && rgd->rd_rgl) { struct gfs2_rgrp_lvb *rgl = rgd->rd_rgl; gfs2_print_dbg(seq, "%s L: f:%02x b:%u i:%u\n", fs_id_buf, -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP1] gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
by Baokun Li 26 Feb '24

26 Feb '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v5.10.209 commit 5c28478af371a1c3fdb570ca67f110e1ae60fc37 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I93ODT CVE: CVE-2023-52448 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8877243beafa7c6bfc42022cbfdf9e39b25bd4fa ] Syzkaller has reported a NULL pointer dereference when accessing rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating rgd->rd_gl fails in read_rindex_entry(). Add a NULL pointer check in gfs2_rgrp_dump() to prevent that. Reported-and-tested-by: syzbot+da0fc229cc1ff4bb2e6d(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=da0fc229cc1ff4bb2e6d Fixes: 72244b6bc752 ("gfs2: improve debug information when lvb mismatches are found") Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Andreas Gruenbacher <agruenba(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/gfs2/rgrp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c index c5bde789a16d..4e760a3fb661 100644 --- a/fs/gfs2/rgrp.c +++ b/fs/gfs2/rgrp.c @@ -2231,7 +2231,7 @@ void gfs2_rgrp_dump(struct seq_file *seq, struct gfs2_rgrpd *rgd, (unsigned long long)rgd->rd_addr, rgd->rd_flags, rgd->rd_free, rgd->rd_free_clone, rgd->rd_dinodes, rgd->rd_reserved, rgd->rd_extfail_pt); - if (rgd->rd_sbd->sd_args.ar_rgrplvb) { + if (rgd->rd_sbd->sd_args.ar_rgrplvb && rgd->rd_rgl) { struct gfs2_rgrp_lvb *rgl = rgd->rd_rgl; gfs2_print_dbg(seq, "%s L: f:%02x b:%u i:%u\n", fs_id_buf, -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS] gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
by Baokun Li 26 Feb '24

26 Feb '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v5.10.209 commit 5c28478af371a1c3fdb570ca67f110e1ae60fc37 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I93ODT CVE: CVE-2023-52448 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8877243beafa7c6bfc42022cbfdf9e39b25bd4fa ] Syzkaller has reported a NULL pointer dereference when accessing rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating rgd->rd_gl fails in read_rindex_entry(). Add a NULL pointer check in gfs2_rgrp_dump() to prevent that. Reported-and-tested-by: syzbot+da0fc229cc1ff4bb2e6d(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=da0fc229cc1ff4bb2e6d Fixes: 72244b6bc752 ("gfs2: improve debug information when lvb mismatches are found") Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Andreas Gruenbacher <agruenba(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/gfs2/rgrp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c index c5bde789a16d..4e760a3fb661 100644 --- a/fs/gfs2/rgrp.c +++ b/fs/gfs2/rgrp.c @@ -2231,7 +2231,7 @@ void gfs2_rgrp_dump(struct seq_file *seq, struct gfs2_rgrpd *rgd, (unsigned long long)rgd->rd_addr, rgd->rd_flags, rgd->rd_free, rgd->rd_free_clone, rgd->rd_dinodes, rgd->rd_reserved, rgd->rd_extfail_pt); - if (rgd->rd_sbd->sd_args.ar_rgrplvb) { + if (rgd->rd_sbd->sd_args.ar_rgrplvb && rgd->rd_rgl) { struct gfs2_rgrp_lvb *rgl = rgd->rd_rgl; gfs2_print_dbg(seq, "%s L: f:%02x b:%u i:%u\n", fs_id_buf, -- 2.31.1

2 1

[PATCH OLK-5.10] gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
by Baokun Li 26 Feb '24

26 Feb '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v5.10.209 commit 5c28478af371a1c3fdb570ca67f110e1ae60fc37 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I93ODT CVE: CVE-2023-52448 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8877243beafa7c6bfc42022cbfdf9e39b25bd4fa ] Syzkaller has reported a NULL pointer dereference when accessing rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating rgd->rd_gl fails in read_rindex_entry(). Add a NULL pointer check in gfs2_rgrp_dump() to prevent that. Reported-and-tested-by: syzbot+da0fc229cc1ff4bb2e6d(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=da0fc229cc1ff4bb2e6d Fixes: 72244b6bc752 ("gfs2: improve debug information when lvb mismatches are found") Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Andreas Gruenbacher <agruenba(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/gfs2/rgrp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c index c5bde789a16d..4e760a3fb661 100644 --- a/fs/gfs2/rgrp.c +++ b/fs/gfs2/rgrp.c @@ -2231,7 +2231,7 @@ void gfs2_rgrp_dump(struct seq_file *seq, struct gfs2_rgrpd *rgd, (unsigned long long)rgd->rd_addr, rgd->rd_flags, rgd->rd_free, rgd->rd_free_clone, rgd->rd_dinodes, rgd->rd_reserved, rgd->rd_extfail_pt); - if (rgd->rd_sbd->sd_args.ar_rgrplvb) { + if (rgd->rd_sbd->sd_args.ar_rgrplvb && rgd->rd_rgl) { struct gfs2_rgrp_lvb *rgl = rgd->rd_rgl; gfs2_print_dbg(seq, "%s L: f:%02x b:%u i:%u\n", fs_id_buf, -- 2.31.1

2 1

[PATCH OLK-6.6 0/2] fix CVE-2024-26590
by Baokun Li 26 Feb '24

26 Feb '24

Gao Xiang (2): erofs: simplify compression configuration parser erofs: fix inconsistent per-file compression format fs/erofs/compress.h | 6 +++ fs/erofs/decompressor.c | 62 ++++++++++++++++++++++++++-- fs/erofs/decompressor_deflate.c | 5 ++- fs/erofs/decompressor_lzma.c | 4 +- fs/erofs/internal.h | 38 +---------------- fs/erofs/super.c | 72 ++++----------------------------- fs/erofs/zmap.c | 23 ++++++----- 7 files changed, 92 insertions(+), 118 deletions(-) -- 2.31.1

2 3

[PATCH openEuler-1.0-LTS 0/2] Remove WQ_FLAG_BOOKMARK flag
by Zizhi Wo 26 Feb '24

26 Feb '24

Fix softlockup by removing the wait_queue flag: WQ_FLAG_BOOKMARK. Matthew Wilcox (Oracle) (2): filemap: remove use of wait bookmarks sched: remove wait bookmarks include/linux/wait.h | 3 --- kernel/sched/wait.c | 57 ++++++-------------------------------------- mm/filemap.c | 21 +--------------- 3 files changed, 8 insertions(+), 73 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS 0/3] CVE-2021-46904 for openEuler1.0
by Liu Jian 26 Feb '24

26 Feb '24

Anirudh Rayabharam (1): net: hso: fix null-ptr-deref during tty device unregistration Johan Hovold (1): net: hso: fix NULL-deref on disconnect regression Rustam Kovhaev (1): usb: hso: check for return value in hso_serial_common_create() drivers/net/usb/hso.c | 38 ++++++++++++++++---------------------- 1 file changed, 16 insertions(+), 22 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6] mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
by ZhaoLong Wang 26 Feb '24

26 Feb '24

stable inclusion from stable-v6.6.14 commit cfd7c9d260dc0a3baaea05a122a19ab91e193c65 category: bugfix bugzilla: 189540, https://gitee.com/src-openeuler/kernel/issues/I932W5 CVE: CVE-2023-52449 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a43bdc376deab5fff1ceb93dca55bcab8dbdc1d6 ] If both ftl.ko and gluebi.ko are loaded, the notifier of ftl triggers NULL pointer dereference when trying to access ‘gluebi->desc’ in gluebi_read(). ubi_gluebi_init ubi_register_volume_notifier ubi_enumerate_volumes ubi_notify_all gluebi_notify nb->notifier_call() gluebi_create mtd_device_register mtd_device_parse_register add_mtd_device blktrans_notify_add not->add() ftl_add_mtd tr->add_mtd() scan_header mtd_read mtd_read_oob mtd_read_oob_std gluebi_read mtd->read() gluebi->desc - NULL Detailed reproduction information available at the Link [1], In the normal case, obtain gluebi->desc in the gluebi_get_device(), and access gluebi->desc in the gluebi_read(). However, gluebi_get_device() is not executed in advance in the ftl_add_mtd() process, which leads to NULL pointer dereference. The solution for the gluebi module is to run jffs2 on the UBI volume without considering working with ftl or mtdblock [2]. Therefore, this problem can be avoided by preventing gluebi from creating the mtdblock device after creating mtd partition of the type MTD_UBIVOLUME. Fixes: 2ba3d76a1e29 ("UBI: make gluebi a separate module") Link: https://bugzilla.kernel.org/show_bug.cgi?id=217992 [1] Link: https://lore.kernel.org/lkml/441107100.23734.1697904580252.JavaMail.zimbra@… [2] Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> Reviewed-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Acked-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Link: https://lore.kernel.org/linux-mtd/20231220024619.2138625-1-wangzhaolong1@hu… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- drivers/mtd/mtd_blkdevs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c index ff18636e0889..5bc32108ca03 100644 --- a/drivers/mtd/mtd_blkdevs.c +++ b/drivers/mtd/mtd_blkdevs.c @@ -463,7 +463,7 @@ static void blktrans_notify_add(struct mtd_info *mtd) { struct mtd_blktrans_ops *tr; - if (mtd->type == MTD_ABSENT) + if (mtd->type == MTD_ABSENT || mtd->type == MTD_UBIVOLUME) return; list_for_each_entry(tr, &blktrans_majors, list) @@ -503,7 +503,7 @@ int register_mtd_blktrans(struct mtd_blktrans_ops *tr) mutex_lock(&mtd_table_mutex); list_add(&tr->list, &blktrans_majors); mtd_for_each_device(mtd) - if (mtd->type != MTD_ABSENT) + if (mtd->type != MTD_ABSENT && mtd->type != MTD_UBIVOLUME) tr->add_mtd(tr, mtd); mutex_unlock(&mtd_table_mutex); return 0; -- 2.39.2

2 1

[PATCH OLK-6.6] gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
by Baokun Li 26 Feb '24

26 Feb '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v6.6.14 commit 067a7c48c2c70f05f9460d6f0e8423e234729f05 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I93ODT CVE: CVE-2023-52448 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8877243beafa7c6bfc42022cbfdf9e39b25bd4fa ] Syzkaller has reported a NULL pointer dereference when accessing rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating rgd->rd_gl fails in read_rindex_entry(). Add a NULL pointer check in gfs2_rgrp_dump() to prevent that. Reported-and-tested-by: syzbot+da0fc229cc1ff4bb2e6d(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=da0fc229cc1ff4bb2e6d Fixes: 72244b6bc752 ("gfs2: improve debug information when lvb mismatches are found") Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Andreas Gruenbacher <agruenba(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/gfs2/rgrp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c index 9308190895c8..307b952a41f8 100644 --- a/fs/gfs2/rgrp.c +++ b/fs/gfs2/rgrp.c @@ -2306,7 +2306,7 @@ void gfs2_rgrp_dump(struct seq_file *seq, struct gfs2_rgrpd *rgd, (unsigned long long)rgd->rd_addr, rgd->rd_flags, rgd->rd_free, rgd->rd_free_clone, rgd->rd_dinodes, rgd->rd_requested, rgd->rd_reserved, rgd->rd_extfail_pt); - if (rgd->rd_sbd->sd_args.ar_rgrplvb) { + if (rgd->rd_sbd->sd_args.ar_rgrplvb && rgd->rd_rgl) { struct gfs2_rgrp_lvb *rgl = rgd->rd_rgl; gfs2_print_dbg(seq, "%s L: f:%02x b:%u i:%u\n", fs_id_buf, -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
by ZhaoLong Wang 26 Feb '24

26 Feb '24

stable inclusion from stable-v4.19.306 commit aeba358bcc8ffddf9b4a9bd0e5ec9eb338d46022 category: bugfix bugzilla: 189540, https://gitee.com/src-openeuler/kernel/issues/I932W5 CVE: CVE-2023-52449 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a43bdc376deab5fff1ceb93dca55bcab8dbdc1d6 ] If both ftl.ko and gluebi.ko are loaded, the notifier of ftl triggers NULL pointer dereference when trying to access ‘gluebi->desc’ in gluebi_read(). ubi_gluebi_init ubi_register_volume_notifier ubi_enumerate_volumes ubi_notify_all gluebi_notify nb->notifier_call() gluebi_create mtd_device_register mtd_device_parse_register add_mtd_device blktrans_notify_add not->add() ftl_add_mtd tr->add_mtd() scan_header mtd_read mtd_read_oob mtd_read_oob_std gluebi_read mtd->read() gluebi->desc - NULL Detailed reproduction information available at the Link [1], In the normal case, obtain gluebi->desc in the gluebi_get_device(), and access gluebi->desc in the gluebi_read(). However, gluebi_get_device() is not executed in advance in the ftl_add_mtd() process, which leads to NULL pointer dereference. The solution for the gluebi module is to run jffs2 on the UBI volume without considering working with ftl or mtdblock [2]. Therefore, this problem can be avoided by preventing gluebi from creating the mtdblock device after creating mtd partition of the type MTD_UBIVOLUME. Fixes: 2ba3d76a1e29 ("UBI: make gluebi a separate module") Link: https://bugzilla.kernel.org/show_bug.cgi?id=217992 [1] Link: https://lore.kernel.org/lkml/441107100.23734.1697904580252.JavaMail.zimbra@… [2] Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> Reviewed-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Acked-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Link: https://lore.kernel.org/linux-mtd/20231220024619.2138625-1-wangzhaolong1@hu… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- drivers/mtd/mtd_blkdevs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c index 29c0bfd74e8a..40b2cbd8a0b5 100644 --- a/drivers/mtd/mtd_blkdevs.c +++ b/drivers/mtd/mtd_blkdevs.c @@ -521,7 +521,7 @@ static void blktrans_notify_add(struct mtd_info *mtd) { struct mtd_blktrans_ops *tr; - if (mtd->type == MTD_ABSENT) + if (mtd->type == MTD_ABSENT || mtd->type == MTD_UBIVOLUME) return; list_for_each_entry(tr, &blktrans_majors, list) @@ -564,7 +564,7 @@ int register_mtd_blktrans(struct mtd_blktrans_ops *tr) list_add(&tr->list, &blktrans_majors); mtd_for_each_device(mtd) - if (mtd->type != MTD_ABSENT) + if (mtd->type != MTD_ABSENT && mtd->type != MTD_UBIVOLUME) tr->add_mtd(tr, mtd); mutex_unlock(&mtd_table_mutex); -- 2.39.2

2 1

[PATCH OLK-5.10] mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
by ZhaoLong Wang 26 Feb '24

26 Feb '24

stable inclusion from stable-v5.10.209 commit 001a3f59d8c914ef8273461d4bf495df384cc5f8 category: bugfix bugzilla: 189540, https://gitee.com/src-openeuler/kernel/issues/I932W5 CVE: CVE-2023-52449 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a43bdc376deab5fff1ceb93dca55bcab8dbdc1d6 ] If both ftl.ko and gluebi.ko are loaded, the notifier of ftl triggers NULL pointer dereference when trying to access ‘gluebi->desc’ in gluebi_read(). ubi_gluebi_init ubi_register_volume_notifier ubi_enumerate_volumes ubi_notify_all gluebi_notify nb->notifier_call() gluebi_create mtd_device_register mtd_device_parse_register add_mtd_device blktrans_notify_add not->add() ftl_add_mtd tr->add_mtd() scan_header mtd_read mtd_read_oob mtd_read_oob_std gluebi_read mtd->read() gluebi->desc - NULL Detailed reproduction information available at the Link [1], In the normal case, obtain gluebi->desc in the gluebi_get_device(), and access gluebi->desc in the gluebi_read(). However, gluebi_get_device() is not executed in advance in the ftl_add_mtd() process, which leads to NULL pointer dereference. The solution for the gluebi module is to run jffs2 on the UBI volume without considering working with ftl or mtdblock [2]. Therefore, this problem can be avoided by preventing gluebi from creating the mtdblock device after creating mtd partition of the type MTD_UBIVOLUME. Fixes: 2ba3d76a1e29 ("UBI: make gluebi a separate module") Link: https://bugzilla.kernel.org/show_bug.cgi?id=217992 [1] Link: https://lore.kernel.org/lkml/441107100.23734.1697904580252.JavaMail.zimbra@… [2] Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> Reviewed-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Acked-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Link: https://lore.kernel.org/linux-mtd/20231220024619.2138625-1-wangzhaolong1@hu… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/mtd/mtd_blkdevs.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- drivers/mtd/mtd_blkdevs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c index 5b5504e123a6..3c79cd67478a 100644 --- a/drivers/mtd/mtd_blkdevs.c +++ b/drivers/mtd/mtd_blkdevs.c @@ -527,7 +527,7 @@ static void blktrans_notify_add(struct mtd_info *mtd) { struct mtd_blktrans_ops *tr; - if (mtd->type == MTD_ABSENT) + if (mtd->type == MTD_ABSENT || mtd->type == MTD_UBIVOLUME) return; list_for_each_entry(tr, &blktrans_majors, list) @@ -570,7 +570,7 @@ int register_mtd_blktrans(struct mtd_blktrans_ops *tr) list_add(&tr->list, &blktrans_majors); mtd_for_each_device(mtd) - if (mtd->type != MTD_ABSENT) + if (mtd->type != MTD_ABSENT && mtd->type != MTD_UBIVOLUME) tr->add_mtd(tr, mtd); mtd_table_mutex_unlock(); -- 2.39.2

2 1

[PATCH OLK-5.10 0/2] Remove WQ_FLAG_BOOKMARK flag
by Zizhi Wo 26 Feb '24

26 Feb '24

Fix softlockup by removing the wait_queue flag: WQ_FLAG_BOOKMARK. Matthew Wilcox (Oracle) (2): filemap: remove use of wait bookmarks sched: remove wait bookmarks include/linux/wait.h | 3 --- kernel/sched/wait.c | 59 ++++++++------------------------------------ mm/filemap.c | 21 +--------------- 3 files changed, 11 insertions(+), 72 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS 0/1] i2c: i801: Fix block process call transactions
by Liao Chen 26 Feb '24

26 Feb '24

According to the Intel datasheets, software must reset the block buffer index twice for block process call transactions: once before writing the outgoing data to the buffer, and once again before reading the incoming data from the buffer. The driver is currently missing the second reset, causing the wrong portion of the block buffer to be read. Jean Delvare (1): i2c: i801: Fix block process call transactions drivers/i2c/busses/i2c-i801.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
by ZhaoLong Wang 26 Feb '24

26 Feb '24

stable inclusion from stable-v4.19.306 commit aeba358bcc8ffddf9b4a9bd0e5ec9eb338d46022 category: bugfix bugzilla: 189540 CVE: CVE-2023-52449 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a43bdc376deab5fff1ceb93dca55bcab8dbdc1d6 ] If both ftl.ko and gluebi.ko are loaded, the notifier of ftl triggers NULL pointer dereference when trying to access ‘gluebi->desc’ in gluebi_read(). ubi_gluebi_init ubi_register_volume_notifier ubi_enumerate_volumes ubi_notify_all gluebi_notify nb->notifier_call() gluebi_create mtd_device_register mtd_device_parse_register add_mtd_device blktrans_notify_add not->add() ftl_add_mtd tr->add_mtd() scan_header mtd_read mtd_read_oob mtd_read_oob_std gluebi_read mtd->read() gluebi->desc - NULL Detailed reproduction information available at the Link [1], In the normal case, obtain gluebi->desc in the gluebi_get_device(), and access gluebi->desc in the gluebi_read(). However, gluebi_get_device() is not executed in advance in the ftl_add_mtd() process, which leads to NULL pointer dereference. The solution for the gluebi module is to run jffs2 on the UBI volume without considering working with ftl or mtdblock [2]. Therefore, this problem can be avoided by preventing gluebi from creating the mtdblock device after creating mtd partition of the type MTD_UBIVOLUME. Fixes: 2ba3d76a1e29 ("UBI: make gluebi a separate module") Link: https://bugzilla.kernel.org/show_bug.cgi?id=217992 [1] Link: https://lore.kernel.org/lkml/441107100.23734.1697904580252.JavaMail.zimbra@… [2] Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> Reviewed-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Acked-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Link: https://lore.kernel.org/linux-mtd/20231220024619.2138625-1-wangzhaolong1@hu… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- drivers/mtd/mtd_blkdevs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c index 29c0bfd74e8a..40b2cbd8a0b5 100644 --- a/drivers/mtd/mtd_blkdevs.c +++ b/drivers/mtd/mtd_blkdevs.c @@ -521,7 +521,7 @@ static void blktrans_notify_add(struct mtd_info *mtd) { struct mtd_blktrans_ops *tr; - if (mtd->type == MTD_ABSENT) + if (mtd->type == MTD_ABSENT || mtd->type == MTD_UBIVOLUME) return; list_for_each_entry(tr, &blktrans_majors, list) @@ -564,7 +564,7 @@ int register_mtd_blktrans(struct mtd_blktrans_ops *tr) list_add(&tr->list, &blktrans_majors); mtd_for_each_device(mtd) - if (mtd->type != MTD_ABSENT) + if (mtd->type != MTD_ABSENT && mtd->type != MTD_UBIVOLUME) tr->add_mtd(tr, mtd); mutex_unlock(&mtd_table_mutex); -- 2.39.2

2 1

[PATCH OLK-5.10] efivarfs: force RO when remounting if SetVariable is not supported
by Zhihao Cheng 26 Feb '24

26 Feb '24

From: Ilias Apalodimas <ilias.apalodimas(a)linaro.org> stable inclusion from stable-v5.10.210 commit 94c742324ed7e42c5bd6a9ed22e4ec6d764db4d8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EC7 CVE: CVE-2023-52463 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0e8d2444168dd519fea501599d150e62718ed2fe upstream. If SetVariable at runtime is not supported by the firmware we never assign a callback for that function. At the same time mount the efivarfs as RO so no one can call that. However, we never check the permission flags when someone remounts the filesystem as RW. As a result this leads to a crash looking like this: $ mount -o remount,rw /sys/firmware/efi/efivars $ efi-updatevar -f PK.auth PK [ 303.279166] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 303.280482] Mem abort info: [ 303.280854] ESR = 0x0000000086000004 [ 303.281338] EC = 0x21: IABT (current EL), IL = 32 bits [ 303.282016] SET = 0, FnV = 0 [ 303.282414] EA = 0, S1PTW = 0 [ 303.282821] FSC = 0x04: level 0 translation fault [ 303.283771] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004258c000 [ 303.284913] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 303.286076] Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP [ 303.286936] Modules linked in: qrtr tpm_tis tpm_tis_core crct10dif_ce arm_smccc_trng rng_core drm fuse ip_tables x_tables ipv6 [ 303.288586] CPU: 1 PID: 755 Comm: efi-updatevar Not tainted 6.3.0-rc1-00108-gc7d0c4695c68 #1 [ 303.289748] Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.04-00627-g88336918701d 04/01/2023 [ 303.291150] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 303.292123] pc : 0x0 [ 303.292443] lr : efivar_set_variable_locked+0x74/0xec [ 303.293156] sp : ffff800008673c10 [ 303.293619] x29: ffff800008673c10 x28: ffff0000037e8000 x27: 0000000000000000 [ 303.294592] x26: 0000000000000800 x25: ffff000002467400 x24: 0000000000000027 [ 303.295572] x23: ffffd49ea9832000 x22: ffff0000020c9800 x21: ffff000002467000 [ 303.296566] x20: 0000000000000001 x19: 00000000000007fc x18: 0000000000000000 [ 303.297531] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaac807ab54 [ 303.298495] x14: ed37489f673633c0 x13: 71c45c606de13f80 x12: 47464259e219acf4 [ 303.299453] x11: ffff000002af7b01 x10: 0000000000000003 x9 : 0000000000000002 [ 303.300431] x8 : 0000000000000010 x7 : ffffd49ea8973230 x6 : 0000000000a85201 [ 303.301412] x5 : 0000000000000000 x4 : ffff0000020c9800 x3 : 00000000000007fc [ 303.302370] x2 : 0000000000000027 x1 : ffff000002467400 x0 : ffff000002467000 [ 303.303341] Call trace: [ 303.303679] 0x0 [ 303.303938] efivar_entry_set_get_size+0x98/0x16c [ 303.304585] efivarfs_file_write+0xd0/0x1a4 [ 303.305148] vfs_write+0xc4/0x2e4 [ 303.305601] ksys_write+0x70/0x104 [ 303.306073] __arm64_sys_write+0x1c/0x28 [ 303.306622] invoke_syscall+0x48/0x114 [ 303.307156] el0_svc_common.constprop.0+0x44/0xec [ 303.307803] do_el0_svc+0x38/0x98 [ 303.308268] el0_svc+0x2c/0x84 [ 303.308702] el0t_64_sync_handler+0xf4/0x120 [ 303.309293] el0t_64_sync+0x190/0x194 [ 303.309794] Code: ???????? ???????? ???????? ???????? (????????) [ 303.310612] ---[ end trace 0000000000000000 ]--- Fix this by adding a .reconfigure() function to the fs operations which we can use to check the requested flags and deny anything that's not RO if the firmware doesn't implement SetVariable at runtime. Fixes: f88814cc2578 ("efi/efivars: Expose RT service availability via efivars abstraction") Signed-off-by: Ilias Apalodimas <ilias.apalodimas(a)linaro.org> Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> --- fs/efivarfs/super.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c index 15880a68faad..3626816b174a 100644 --- a/fs/efivarfs/super.c +++ b/fs/efivarfs/super.c @@ -13,6 +13,7 @@ #include <linux/ucs2_string.h> #include <linux/slab.h> #include <linux/magic.h> +#include <linux/printk.h> #include "internal.h" @@ -231,8 +232,19 @@ static int efivarfs_get_tree(struct fs_context *fc) return get_tree_single(fc, efivarfs_fill_super); } +static int efivarfs_reconfigure(struct fs_context *fc) +{ + if (!efivar_supports_writes() && !(fc->sb_flags & SB_RDONLY)) { + pr_err("Firmware does not support SetVariableRT. Can not remount with rw\n"); + return -EINVAL; + } + + return 0; +} + static const struct fs_context_operations efivarfs_context_ops = { .get_tree = efivarfs_get_tree, + .reconfigure = efivarfs_reconfigure, }; static int efivarfs_init_fs_context(struct fs_context *fc) -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS v2] mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path
by Zhengchao Shao 26 Feb '24

26 Feb '24

From: Ido Schimmel <idosch(a)nvidia.com> mainline inclusion from mainline-v6.8-rc1 commit efeb7dfea8ee10cdec11b6b6ba4e405edbe75809 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EE7 CVE: CVE-2024-26595 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When calling mlxsw_sp_acl_tcam_region_destroy() from an error path after failing to attach the region to an ACL group, we hit a NULL pointer dereference upon 'region->group->tcam' [1]. Fix by retrieving the 'tcam' pointer using mlxsw_sp_acl_to_tcam(). [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] RIP: 0010:mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0 [...] Call Trace: mlxsw_sp_acl_tcam_vchunk_get+0x88b/0xa20 mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b Fixes: 22a677661f56 ("mlxsw: spectrum: Introduce ACL core with simple TCAM implementation") Signed-off-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Amit Cohen <amcohen(a)nvidia.com> Reviewed-by: Jiri Pirko <jiri(a)nvidia.com> Signed-off-by: Petr Machata <petrm(a)nvidia.com> Acked-by: Paolo Abeni <pabeni(a)redhat.com> Link: https://lore.kernel.org/r/fb6a4542bbc9fcab5a523802d97059bffbca7126.17055020… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/mellanox/mlxsw/spectrum.h drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 1 + drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c | 5 +++++ drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 3 ++- 3 files changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h index 3cdb7aca90b7..7d2978223c16 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h @@ -491,6 +491,7 @@ enum mlxsw_sp_acl_profile { }; struct mlxsw_afk *mlxsw_sp_acl_afk(struct mlxsw_sp_acl *acl); +struct mlxsw_sp_acl_tcam *mlxsw_sp_acl_to_tcam(struct mlxsw_sp_acl *acl); struct mlxsw_sp *mlxsw_sp_acl_block_mlxsw_sp(struct mlxsw_sp_acl_block *block); unsigned int mlxsw_sp_acl_block_rule_count(struct mlxsw_sp_acl_block *block); void mlxsw_sp_acl_block_disable_inc(struct mlxsw_sp_acl_block *block); diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c index c99f5542da1e..22ba0600ccb5 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c @@ -38,6 +38,11 @@ struct mlxsw_afk *mlxsw_sp_acl_afk(struct mlxsw_sp_acl *acl) return acl->afk; } +struct mlxsw_sp_acl_tcam *mlxsw_sp_acl_to_tcam(struct mlxsw_sp_acl *acl) +{ + return &acl->tcam; +} + struct mlxsw_sp_acl_block_binding { struct list_head list; struct net_device *dev; diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c index 30931a2c025b..1c961fd5cffa 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c @@ -571,12 +571,13 @@ static void mlxsw_sp_acl_tcam_region_destroy(struct mlxsw_sp *mlxsw_sp, struct mlxsw_sp_acl_tcam_region *region) { + struct mlxsw_sp_acl_tcam *tcam = mlxsw_sp_acl_to_tcam(mlxsw_sp->acl); const struct mlxsw_sp_acl_tcam_ops *ops = mlxsw_sp->acl_tcam_ops; ops->region_fini(mlxsw_sp, region->priv); mlxsw_sp_acl_tcam_region_disable(mlxsw_sp, region); mlxsw_sp_acl_tcam_region_free(mlxsw_sp, region); - mlxsw_sp_acl_tcam_region_id_put(region->group->tcam, region->id); + mlxsw_sp_acl_tcam_region_id_put(tcam, region->id); mlxsw_afk_key_info_put(region->key_info); kfree(region); } -- 2.34.1

2 1

[PATCH OLK-6.6] efivarfs: force RO when remounting if SetVariable is not supported
by Zhihao Cheng 26 Feb '24

26 Feb '24

From: Ilias Apalodimas <ilias.apalodimas(a)linaro.org> stable inclusion from stable-v6.6.14 commit 0049fe7e4a85849bdd778cdb72e51a791ff3d737 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EC7 CVE: CVE-2023-52463 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit 0e8d2444168dd519fea501599d150e62718ed2fe upstream. If SetVariable at runtime is not supported by the firmware we never assign a callback for that function. At the same time mount the efivarfs as RO so no one can call that. However, we never check the permission flags when someone remounts the filesystem as RW. As a result this leads to a crash looking like this: $ mount -o remount,rw /sys/firmware/efi/efivars $ efi-updatevar -f PK.auth PK [ 303.279166] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 303.280482] Mem abort info: [ 303.280854] ESR = 0x0000000086000004 [ 303.281338] EC = 0x21: IABT (current EL), IL = 32 bits [ 303.282016] SET = 0, FnV = 0 [ 303.282414] EA = 0, S1PTW = 0 [ 303.282821] FSC = 0x04: level 0 translation fault [ 303.283771] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004258c000 [ 303.284913] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 303.286076] Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP [ 303.286936] Modules linked in: qrtr tpm_tis tpm_tis_core crct10dif_ce arm_smccc_trng rng_core drm fuse ip_tables x_tables ipv6 [ 303.288586] CPU: 1 PID: 755 Comm: efi-updatevar Not tainted 6.3.0-rc1-00108-gc7d0c4695c68 #1 [ 303.289748] Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.04-00627-g88336918701d 04/01/2023 [ 303.291150] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 303.292123] pc : 0x0 [ 303.292443] lr : efivar_set_variable_locked+0x74/0xec [ 303.293156] sp : ffff800008673c10 [ 303.293619] x29: ffff800008673c10 x28: ffff0000037e8000 x27: 0000000000000000 [ 303.294592] x26: 0000000000000800 x25: ffff000002467400 x24: 0000000000000027 [ 303.295572] x23: ffffd49ea9832000 x22: ffff0000020c9800 x21: ffff000002467000 [ 303.296566] x20: 0000000000000001 x19: 00000000000007fc x18: 0000000000000000 [ 303.297531] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaac807ab54 [ 303.298495] x14: ed37489f673633c0 x13: 71c45c606de13f80 x12: 47464259e219acf4 [ 303.299453] x11: ffff000002af7b01 x10: 0000000000000003 x9 : 0000000000000002 [ 303.300431] x8 : 0000000000000010 x7 : ffffd49ea8973230 x6 : 0000000000a85201 [ 303.301412] x5 : 0000000000000000 x4 : ffff0000020c9800 x3 : 00000000000007fc [ 303.302370] x2 : 0000000000000027 x1 : ffff000002467400 x0 : ffff000002467000 [ 303.303341] Call trace: [ 303.303679] 0x0 [ 303.303938] efivar_entry_set_get_size+0x98/0x16c [ 303.304585] efivarfs_file_write+0xd0/0x1a4 [ 303.305148] vfs_write+0xc4/0x2e4 [ 303.305601] ksys_write+0x70/0x104 [ 303.306073] __arm64_sys_write+0x1c/0x28 [ 303.306622] invoke_syscall+0x48/0x114 [ 303.307156] el0_svc_common.constprop.0+0x44/0xec [ 303.307803] do_el0_svc+0x38/0x98 [ 303.308268] el0_svc+0x2c/0x84 [ 303.308702] el0t_64_sync_handler+0xf4/0x120 [ 303.309293] el0t_64_sync+0x190/0x194 [ 303.309794] Code: ???????? ???????? ???????? ???????? (????????) [ 303.310612] ---[ end trace 0000000000000000 ]--- Fix this by adding a .reconfigure() function to the fs operations which we can use to check the requested flags and deny anything that's not RO if the firmware doesn't implement SetVariable at runtime. Fixes: f88814cc2578 ("efi/efivars: Expose RT service availability via efivars abstraction") Signed-off-by: Ilias Apalodimas <ilias.apalodimas(a)linaro.org> Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> --- fs/efivarfs/super.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c index 996271473609..05c01694e852 100644 --- a/fs/efivarfs/super.c +++ b/fs/efivarfs/super.c @@ -14,6 +14,7 @@ #include <linux/slab.h> #include <linux/magic.h> #include <linux/statfs.h> +#include <linux/printk.h> #include "internal.h" @@ -275,8 +276,19 @@ static int efivarfs_get_tree(struct fs_context *fc) return get_tree_single(fc, efivarfs_fill_super); } +static int efivarfs_reconfigure(struct fs_context *fc) +{ + if (!efivar_supports_writes() && !(fc->sb_flags & SB_RDONLY)) { + pr_err("Firmware does not support SetVariableRT. Can not remount with rw\n"); + return -EINVAL; + } + + return 0; +} + static const struct fs_context_operations efivarfs_context_ops = { .get_tree = efivarfs_get_tree, + .reconfigure = efivarfs_reconfigure, }; static int efivarfs_init_fs_context(struct fs_context *fc) -- 2.31.1

2 1

[PATCH OLK-5.10] efivarfs: force RO when remounting if SetVariable is not supported
by Zhihao Cheng 26 Feb '24

26 Feb '24

From: Ilias Apalodimas <ilias.apalodimas(a)linaro.org> stable inclusion from stable-v5.10.210 commit 94c742324ed7e42c5bd6a9ed22e4ec6d764db4d8 category: bugfix bugzilla: 189543 CVE: CVE-2023-52463 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0e8d2444168dd519fea501599d150e62718ed2fe upstream. If SetVariable at runtime is not supported by the firmware we never assign a callback for that function. At the same time mount the efivarfs as RO so no one can call that. However, we never check the permission flags when someone remounts the filesystem as RW. As a result this leads to a crash looking like this: $ mount -o remount,rw /sys/firmware/efi/efivars $ efi-updatevar -f PK.auth PK [ 303.279166] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 303.280482] Mem abort info: [ 303.280854] ESR = 0x0000000086000004 [ 303.281338] EC = 0x21: IABT (current EL), IL = 32 bits [ 303.282016] SET = 0, FnV = 0 [ 303.282414] EA = 0, S1PTW = 0 [ 303.282821] FSC = 0x04: level 0 translation fault [ 303.283771] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004258c000 [ 303.284913] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 303.286076] Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP [ 303.286936] Modules linked in: qrtr tpm_tis tpm_tis_core crct10dif_ce arm_smccc_trng rng_core drm fuse ip_tables x_tables ipv6 [ 303.288586] CPU: 1 PID: 755 Comm: efi-updatevar Not tainted 6.3.0-rc1-00108-gc7d0c4695c68 #1 [ 303.289748] Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.04-00627-g88336918701d 04/01/2023 [ 303.291150] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 303.292123] pc : 0x0 [ 303.292443] lr : efivar_set_variable_locked+0x74/0xec [ 303.293156] sp : ffff800008673c10 [ 303.293619] x29: ffff800008673c10 x28: ffff0000037e8000 x27: 0000000000000000 [ 303.294592] x26: 0000000000000800 x25: ffff000002467400 x24: 0000000000000027 [ 303.295572] x23: ffffd49ea9832000 x22: ffff0000020c9800 x21: ffff000002467000 [ 303.296566] x20: 0000000000000001 x19: 00000000000007fc x18: 0000000000000000 [ 303.297531] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaac807ab54 [ 303.298495] x14: ed37489f673633c0 x13: 71c45c606de13f80 x12: 47464259e219acf4 [ 303.299453] x11: ffff000002af7b01 x10: 0000000000000003 x9 : 0000000000000002 [ 303.300431] x8 : 0000000000000010 x7 : ffffd49ea8973230 x6 : 0000000000a85201 [ 303.301412] x5 : 0000000000000000 x4 : ffff0000020c9800 x3 : 00000000000007fc [ 303.302370] x2 : 0000000000000027 x1 : ffff000002467400 x0 : ffff000002467000 [ 303.303341] Call trace: [ 303.303679] 0x0 [ 303.303938] efivar_entry_set_get_size+0x98/0x16c [ 303.304585] efivarfs_file_write+0xd0/0x1a4 [ 303.305148] vfs_write+0xc4/0x2e4 [ 303.305601] ksys_write+0x70/0x104 [ 303.306073] __arm64_sys_write+0x1c/0x28 [ 303.306622] invoke_syscall+0x48/0x114 [ 303.307156] el0_svc_common.constprop.0+0x44/0xec [ 303.307803] do_el0_svc+0x38/0x98 [ 303.308268] el0_svc+0x2c/0x84 [ 303.308702] el0t_64_sync_handler+0xf4/0x120 [ 303.309293] el0t_64_sync+0x190/0x194 [ 303.309794] Code: ???????? ???????? ???????? ???????? (????????) [ 303.310612] ---[ end trace 0000000000000000 ]--- Fix this by adding a .reconfigure() function to the fs operations which we can use to check the requested flags and deny anything that's not RO if the firmware doesn't implement SetVariable at runtime. Fixes: f88814cc2578 ("efi/efivars: Expose RT service availability via efivars abstraction") Signed-off-by: Ilias Apalodimas <ilias.apalodimas(a)linaro.org> Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> --- fs/efivarfs/super.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c index 15880a68faad..3626816b174a 100644 --- a/fs/efivarfs/super.c +++ b/fs/efivarfs/super.c @@ -13,6 +13,7 @@ #include <linux/ucs2_string.h> #include <linux/slab.h> #include <linux/magic.h> +#include <linux/printk.h> #include "internal.h" @@ -231,8 +232,19 @@ static int efivarfs_get_tree(struct fs_context *fc) return get_tree_single(fc, efivarfs_fill_super); } +static int efivarfs_reconfigure(struct fs_context *fc) +{ + if (!efivar_supports_writes() && !(fc->sb_flags & SB_RDONLY)) { + pr_err("Firmware does not support SetVariableRT. Can not remount with rw\n"); + return -EINVAL; + } + + return 0; +} + static const struct fs_context_operations efivarfs_context_ops = { .get_tree = efivarfs_get_tree, + .reconfigure = efivarfs_reconfigure, }; static int efivarfs_init_fs_context(struct fs_context *fc) -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS] ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()
by Yuntao Liu 26 Feb '24

26 Feb '24

From: Tuo Li <islituo(a)gmail.com> stable inclusion from stable-v5.10.192 commit 9f9eed451176ffcac6b5ba0f6dae1a6b4a1cb0eb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I917HR CVE: CVE-2024-23196 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1f4a08fed450db87fbb5ff5105354158bdbe1a22 ] The variable codec->regmap is often protected by the lock codec->regmap_lock when is accessed. However, it is accessed without holding the lock when is accessed in snd_hdac_regmap_sync(): if (codec->regmap) In my opinion, this may be a harmful race, because if codec->regmap is set to NULL right after the condition is checked, a null-pointer dereference can occur in the called function regcache_sync(): map->lock(map->lock_arg); --> Line 360 in drivers/base/regmap/regcache.c To fix this possible null-pointer dereference caused by data race, the mutex_lock coverage is extended to protect the if statement as well as the function call to regcache_sync(). [ Note: the lack of the regmap_lock itself is harmless for the current codec driver implementations, as snd_hdac_regmap_sync() is only for PM runtime resume that is prohibited during the codec probe. But the change makes the whole code more consistent, so it's merged as is -- tiwai ] Reported-by: BassCheck <bass(a)buaa.edu.cn> Signed-off-by: Tuo Li <islituo(a)gmail.com> Link: https://lore.kernel.org/r/20230703031016.1184711-1-islituo@gmail.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- sound/hda/hdac_regmap.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/sound/hda/hdac_regmap.c b/sound/hda/hdac_regmap.c index f258cb3a6895..9b1bcabd8414 100644 --- a/sound/hda/hdac_regmap.c +++ b/sound/hda/hdac_regmap.c @@ -596,10 +596,9 @@ EXPORT_SYMBOL_GPL(snd_hdac_regmap_update_raw_once); */ void snd_hdac_regmap_sync(struct hdac_device *codec) { - if (codec->regmap) { - mutex_lock(&codec->regmap_lock); + mutex_lock(&codec->regmap_lock); + if (codec->regmap) regcache_sync(codec->regmap); - mutex_unlock(&codec->regmap_lock); - } + mutex_unlock(&codec->regmap_lock); } EXPORT_SYMBOL_GPL(snd_hdac_regmap_sync); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()
by Yuntao Liu 26 Feb '24

26 Feb '24

From: Tuo Li <islituo(a)gmail.com> stable inclusion from stable-v5.10.192 commit 9f9eed451176ffcac6b5ba0f6dae1a6b4a1cb0eb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I917HR CVE: CVE-2024-23196 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1f4a08fed450db87fbb5ff5105354158bdbe1a22 ] The variable codec->regmap is often protected by the lock codec->regmap_lock when is accessed. However, it is accessed without holding the lock when is accessed in snd_hdac_regmap_sync(): if (codec->regmap) In my opinion, this may be a harmful race, because if codec->regmap is set to NULL right after the condition is checked, a null-pointer dereference can occur in the called function regcache_sync(): map->lock(map->lock_arg); --> Line 360 in drivers/base/regmap/regcache.c To fix this possible null-pointer dereference caused by data race, the mutex_lock coverage is extended to protect the if statement as well as the function call to regcache_sync(). [ Note: the lack of the regmap_lock itself is harmless for the current codec driver implementations, as snd_hdac_regmap_sync() is only for PM runtime resume that is prohibited during the codec probe. But the change makes the whole code more consistent, so it's merged as is -- tiwai ] Reported-by: BassCheck <bass(a)buaa.edu.cn> Signed-off-by: Tuo Li <islituo(a)gmail.com> Link: https://lore.kernel.org/r/20230703031016.1184711-1-islituo@gmail.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- sound/hda/hdac_regmap.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/sound/hda/hdac_regmap.c b/sound/hda/hdac_regmap.c index f258cb3a6895..9b1bcabd8414 100644 --- a/sound/hda/hdac_regmap.c +++ b/sound/hda/hdac_regmap.c @@ -596,10 +596,9 @@ EXPORT_SYMBOL_GPL(snd_hdac_regmap_update_raw_once); */ void snd_hdac_regmap_sync(struct hdac_device *codec) { - if (codec->regmap) { - mutex_lock(&codec->regmap_lock); + mutex_lock(&codec->regmap_lock); + if (codec->regmap) regcache_sync(codec->regmap); - mutex_unlock(&codec->regmap_lock); - } + mutex_unlock(&codec->regmap_lock); } EXPORT_SYMBOL_GPL(snd_hdac_regmap_sync); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP2] ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()
by Yuntao Liu 26 Feb '24

26 Feb '24

From: Tuo Li <islituo(a)gmail.com> stable inclusion from stable-v5.10.192 commit 9f9eed451176ffcac6b5ba0f6dae1a6b4a1cb0eb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I917HR CVE: CVE-2024-23196 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1f4a08fed450db87fbb5ff5105354158bdbe1a22 ] The variable codec->regmap is often protected by the lock codec->regmap_lock when is accessed. However, it is accessed without holding the lock when is accessed in snd_hdac_regmap_sync(): if (codec->regmap) In my opinion, this may be a harmful race, because if codec->regmap is set to NULL right after the condition is checked, a null-pointer dereference can occur in the called function regcache_sync(): map->lock(map->lock_arg); --> Line 360 in drivers/base/regmap/regcache.c To fix this possible null-pointer dereference caused by data race, the mutex_lock coverage is extended to protect the if statement as well as the function call to regcache_sync(). [ Note: the lack of the regmap_lock itself is harmless for the current codec driver implementations, as snd_hdac_regmap_sync() is only for PM runtime resume that is prohibited during the codec probe. But the change makes the whole code more consistent, so it's merged as is -- tiwai ] Reported-by: BassCheck <bass(a)buaa.edu.cn> Signed-off-by: Tuo Li <islituo(a)gmail.com> Link: https://lore.kernel.org/r/20230703031016.1184711-1-islituo@gmail.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- sound/hda/hdac_regmap.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/sound/hda/hdac_regmap.c b/sound/hda/hdac_regmap.c index f258cb3a6895..9b1bcabd8414 100644 --- a/sound/hda/hdac_regmap.c +++ b/sound/hda/hdac_regmap.c @@ -596,10 +596,9 @@ EXPORT_SYMBOL_GPL(snd_hdac_regmap_update_raw_once); */ void snd_hdac_regmap_sync(struct hdac_device *codec) { - if (codec->regmap) { - mutex_lock(&codec->regmap_lock); + mutex_lock(&codec->regmap_lock); + if (codec->regmap) regcache_sync(codec->regmap); - mutex_unlock(&codec->regmap_lock); - } + mutex_unlock(&codec->regmap_lock); } EXPORT_SYMBOL_GPL(snd_hdac_regmap_sync); -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] Remove WQ_FLAG_BOOKMARK flag
by Zizhi Wo 26 Feb '24

26 Feb '24

Fix softlockup by removing the wait_queue flag: WQ_FLAG_BOOKMARK. Matthew Wilcox (Oracle) (2): filemap: remove use of wait bookmarks sched: remove wait bookmarks include/linux/wait.h | 2 -- kernel/sched/wait.c | 59 ++++++++------------------------------------ mm/filemap.c | 21 +--------------- 3 files changed, 11 insertions(+), 71 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10 v2] mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path
by Zhengchao Shao 26 Feb '24

26 Feb '24

From: Ido Schimmel <idosch(a)nvidia.com> mainline inclusion from mainline-v6.8-rc1 commit efeb7dfea8ee10cdec11b6b6ba4e405edbe75809 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EE7 CVE: CVE-2024-26595 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When calling mlxsw_sp_acl_tcam_region_destroy() from an error path after failing to attach the region to an ACL group, we hit a NULL pointer dereference upon 'region->group->tcam' [1]. Fix by retrieving the 'tcam' pointer using mlxsw_sp_acl_to_tcam(). [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] RIP: 0010:mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0 [...] Call Trace: mlxsw_sp_acl_tcam_vchunk_get+0x88b/0xa20 mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b Fixes: 22a677661f56 ("mlxsw: spectrum: Introduce ACL core with simple TCAM implementation") Signed-off-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Amit Cohen <amcohen(a)nvidia.com> Reviewed-by: Jiri Pirko <jiri(a)nvidia.com> Signed-off-by: Petr Machata <petrm(a)nvidia.com> Acked-by: Paolo Abeni <pabeni(a)redhat.com> Link: https://lore.kernel.org/r/fb6a4542bbc9fcab5a523802d97059bffbca7126.17055020… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/mellanox/mlxsw/spectrum.h drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 1 + drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c | 5 +++++ drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 4 ++-- 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h index 3e7576e671df..a4e229210b93 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h @@ -850,6 +850,7 @@ enum mlxsw_sp_acl_profile { }; struct mlxsw_afk *mlxsw_sp_acl_afk(struct mlxsw_sp_acl *acl); +struct mlxsw_sp_acl_tcam *mlxsw_sp_acl_to_tcam(struct mlxsw_sp_acl *acl); int mlxsw_sp_acl_ruleset_bind(struct mlxsw_sp *mlxsw_sp, struct mlxsw_sp_flow_block *block, diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c index 8cfa03a75374..9209562a5007 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c @@ -40,6 +40,11 @@ struct mlxsw_afk *mlxsw_sp_acl_afk(struct mlxsw_sp_acl *acl) return acl->afk; } +struct mlxsw_sp_acl_tcam *mlxsw_sp_acl_to_tcam(struct mlxsw_sp_acl *acl) +{ + return &acl->tcam; +} + struct mlxsw_sp_acl_ruleset_ht_key { struct mlxsw_sp_flow_block *block; u32 chain_index; diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c index 7cccc41dd69c..ddf7e03c6b43 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c @@ -744,13 +744,13 @@ static void mlxsw_sp_acl_tcam_region_destroy(struct mlxsw_sp *mlxsw_sp, struct mlxsw_sp_acl_tcam_region *region) { + struct mlxsw_sp_acl_tcam *tcam = mlxsw_sp_acl_to_tcam(mlxsw_sp->acl); const struct mlxsw_sp_acl_tcam_ops *ops = mlxsw_sp->acl_tcam_ops; ops->region_fini(mlxsw_sp, region->priv); mlxsw_sp_acl_tcam_region_disable(mlxsw_sp, region); mlxsw_sp_acl_tcam_region_free(mlxsw_sp, region); - mlxsw_sp_acl_tcam_region_id_put(region->group->tcam, - region->id); + mlxsw_sp_acl_tcam_region_id_put(tcam, region->id); kfree(region); } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP2] ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()
by Yuntao Liu 26 Feb '24

26 Feb '24

From: Tuo Li <islituo(a)gmail.com> stable inclusion from stable-v5.10.192 commit 9f9eed451176ffcac6b5ba0f6dae1a6b4a1cb0eb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I917HR CVE: CVE-2024-23196 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1f4a08fed450db87fbb5ff5105354158bdbe1a22 ] The variable codec->regmap is often protected by the lock codec->regmap_lock when is accessed. However, it is accessed without holding the lock when is accessed in snd_hdac_regmap_sync(): if (codec->regmap) In my opinion, this may be a harmful race, because if codec->regmap is set to NULL right after the condition is checked, a null-pointer dereference can occur in the called function regcache_sync(): map->lock(map->lock_arg); --> Line 360 in drivers/base/regmap/regcache.c To fix this possible null-pointer dereference caused by data race, the mutex_lock coverage is extended to protect the if statement as well as the function call to regcache_sync(). [ Note: the lack of the regmap_lock itself is harmless for the current codec driver implementations, as snd_hdac_regmap_sync() is only for PM runtime resume that is prohibited during the codec probe. But the change makes the whole code more consistent, so it's merged as is -- tiwai ] Reported-by: BassCheck <bass(a)buaa.edu.cn> Signed-off-by: Tuo Li <islituo(a)gmail.com> Link: https://lore.kernel.org/r/20230703031016.1184711-1-islituo@gmail.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/hda/hdac_regmap.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/sound/hda/hdac_regmap.c b/sound/hda/hdac_regmap.c index f258cb3a6895..9b1bcabd8414 100644 --- a/sound/hda/hdac_regmap.c +++ b/sound/hda/hdac_regmap.c @@ -596,10 +596,9 @@ EXPORT_SYMBOL_GPL(snd_hdac_regmap_update_raw_once); */ void snd_hdac_regmap_sync(struct hdac_device *codec) { - if (codec->regmap) { - mutex_lock(&codec->regmap_lock); + mutex_lock(&codec->regmap_lock); + if (codec->regmap) regcache_sync(codec->regmap); - mutex_unlock(&codec->regmap_lock); - } + mutex_unlock(&codec->regmap_lock); } EXPORT_SYMBOL_GPL(snd_hdac_regmap_sync); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()
by Yuntao Liu 26 Feb '24

26 Feb '24

From: Tuo Li <islituo(a)gmail.com> stable inclusion from stable-v5.10.192 commit 9f9eed451176ffcac6b5ba0f6dae1a6b4a1cb0eb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I917HR CVE: CVE-2024-23196 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1f4a08fed450db87fbb5ff5105354158bdbe1a22 ] The variable codec->regmap is often protected by the lock codec->regmap_lock when is accessed. However, it is accessed without holding the lock when is accessed in snd_hdac_regmap_sync(): if (codec->regmap) In my opinion, this may be a harmful race, because if codec->regmap is set to NULL right after the condition is checked, a null-pointer dereference can occur in the called function regcache_sync(): map->lock(map->lock_arg); --> Line 360 in drivers/base/regmap/regcache.c To fix this possible null-pointer dereference caused by data race, the mutex_lock coverage is extended to protect the if statement as well as the function call to regcache_sync(). [ Note: the lack of the regmap_lock itself is harmless for the current codec driver implementations, as snd_hdac_regmap_sync() is only for PM runtime resume that is prohibited during the codec probe. But the change makes the whole code more consistent, so it's merged as is -- tiwai ] Reported-by: BassCheck <bass(a)buaa.edu.cn> Signed-off-by: Tuo Li <islituo(a)gmail.com> Link: https://lore.kernel.org/r/20230703031016.1184711-1-islituo@gmail.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/hda/hdac_regmap.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/sound/hda/hdac_regmap.c b/sound/hda/hdac_regmap.c index f258cb3a6895..9b1bcabd8414 100644 --- a/sound/hda/hdac_regmap.c +++ b/sound/hda/hdac_regmap.c @@ -596,10 +596,9 @@ EXPORT_SYMBOL_GPL(snd_hdac_regmap_update_raw_once); */ void snd_hdac_regmap_sync(struct hdac_device *codec) { - if (codec->regmap) { - mutex_lock(&codec->regmap_lock); + mutex_lock(&codec->regmap_lock); + if (codec->regmap) regcache_sync(codec->regmap); - mutex_unlock(&codec->regmap_lock); - } + mutex_unlock(&codec->regmap_lock); } EXPORT_SYMBOL_GPL(snd_hdac_regmap_sync); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS] ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()
by Yuntao Liu 26 Feb '24

26 Feb '24

From: Tuo Li <islituo(a)gmail.com> stable inclusion from stable-v5.10.192 commit 9f9eed451176ffcac6b5ba0f6dae1a6b4a1cb0eb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I917HR CVE: CVE-2024-23196 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1f4a08fed450db87fbb5ff5105354158bdbe1a22 ] The variable codec->regmap is often protected by the lock codec->regmap_lock when is accessed. However, it is accessed without holding the lock when is accessed in snd_hdac_regmap_sync(): if (codec->regmap) In my opinion, this may be a harmful race, because if codec->regmap is set to NULL right after the condition is checked, a null-pointer dereference can occur in the called function regcache_sync(): map->lock(map->lock_arg); --> Line 360 in drivers/base/regmap/regcache.c To fix this possible null-pointer dereference caused by data race, the mutex_lock coverage is extended to protect the if statement as well as the function call to regcache_sync(). [ Note: the lack of the regmap_lock itself is harmless for the current codec driver implementations, as snd_hdac_regmap_sync() is only for PM runtime resume that is prohibited during the codec probe. But the change makes the whole code more consistent, so it's merged as is -- tiwai ] Reported-by: BassCheck <bass(a)buaa.edu.cn> Signed-off-by: Tuo Li <islituo(a)gmail.com> Link: https://lore.kernel.org/r/20230703031016.1184711-1-islituo@gmail.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/hda/hdac_regmap.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/sound/hda/hdac_regmap.c b/sound/hda/hdac_regmap.c index f258cb3a6895..9b1bcabd8414 100644 --- a/sound/hda/hdac_regmap.c +++ b/sound/hda/hdac_regmap.c @@ -596,10 +596,9 @@ EXPORT_SYMBOL_GPL(snd_hdac_regmap_update_raw_once); */ void snd_hdac_regmap_sync(struct hdac_device *codec) { - if (codec->regmap) { - mutex_lock(&codec->regmap_lock); + mutex_lock(&codec->regmap_lock); + if (codec->regmap) regcache_sync(codec->regmap); - mutex_unlock(&codec->regmap_lock); - } + mutex_unlock(&codec->regmap_lock); } EXPORT_SYMBOL_GPL(snd_hdac_regmap_sync); -- 2.34.1

2 1

[PATCH OLK-5.10 0/6] CVE-2024-26586
by Liu Jian 26 Feb '24

26 Feb '24

backport the fix patches from 5.10lts Amit Cohen (1): mlxsw: spectrum_acl_erp: Fix error flow of pool allocation failure Christophe JAILLET (1): mlxsw: spectrum: Use 'bitmap_zalloc()' when applicable Ido Schimmel (4): mlxsw: spectrum_acl_tcam: Add missing mutex_destroy() mlxsw: spectrum_acl_tcam: Make fini symmetric to init mlxsw: spectrum_acl_tcam: Reorder functions to avoid forward declarations mlxsw: spectrum_acl_tcam: Fix stack corruption .../mellanox/mlxsw/spectrum_acl_atcam.c | 8 +- .../mellanox/mlxsw/spectrum_acl_erp.c | 8 +- .../mellanox/mlxsw/spectrum_acl_tcam.c | 131 +++++++++--------- .../ethernet/mellanox/mlxsw/spectrum_cnt.c | 9 +- .../mellanox/mlxsw/spectrum_switchdev.c | 11 +- .../drivers/net/mlxsw/spectrum-2/tc_flower.sh | 106 +++++++++++++- 6 files changed, 187 insertions(+), 86 deletions(-) -- 2.34.1

2 7

[PATCH OLK-6.6 0/2] Remove WQ_FLAG_BOOKMARK flag
by Zizhi Wo 26 Feb '24

26 Feb '24

Fix softlockup by removing the wait_queue flag: WQ_FLAG_BOOKMARK. Matthew Wilcox (Oracle) (2): filemap: remove use of wait bookmarks sched: remove wait bookmarks include/linux/wait.h | 9 +++---- kernel/sched/wait.c | 60 ++++++++------------------------------------ mm/filemap.c | 21 +--------------- 3 files changed, 14 insertions(+), 76 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10] mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path
by Zhengchao Shao 26 Feb '24

26 Feb '24

From: Ido Schimmel <idosch(a)nvidia.com> mainline inclusion from mainline-v6.8-rc1 commit efeb7dfea8ee10cdec11b6b6ba4e405edbe75809 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EE7 CVE: CVE-2024-26595 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When calling mlxsw_sp_acl_tcam_region_destroy() from an error path after failing to attach the region to an ACL group, we hit a NULL pointer dereference upon 'region->group->tcam' [1]. Fix by retrieving the 'tcam' pointer using mlxsw_sp_acl_to_tcam(). [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] RIP: 0010:mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0 [...] Call Trace: mlxsw_sp_acl_tcam_vchunk_get+0x88b/0xa20 mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b Fixes: 22a677661f56 ("mlxsw: spectrum: Introduce ACL core with simple TCAM implementation") Signed-off-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Amit Cohen <amcohen(a)nvidia.com> Reviewed-by: Jiri Pirko <jiri(a)nvidia.com> Signed-off-by: Petr Machata <petrm(a)nvidia.com> Acked-by: Paolo Abeni <pabeni(a)redhat.com> Link: https://lore.kernel.org/r/fb6a4542bbc9fcab5a523802d97059bffbca7126.17055020… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c index 7cccc41dd69c..a7689cdd1efc 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c @@ -744,13 +744,13 @@ static void mlxsw_sp_acl_tcam_region_destroy(struct mlxsw_sp *mlxsw_sp, struct mlxsw_sp_acl_tcam_region *region) { + struct mlxsw_sp_acl_tcam *tcam = &mlxsw_sp->acl->tcam; const struct mlxsw_sp_acl_tcam_ops *ops = mlxsw_sp->acl_tcam_ops; ops->region_fini(mlxsw_sp, region->priv); mlxsw_sp_acl_tcam_region_disable(mlxsw_sp, region); mlxsw_sp_acl_tcam_region_free(mlxsw_sp, region); - mlxsw_sp_acl_tcam_region_id_put(region->group->tcam, - region->id); + mlxsw_sp_acl_tcam_region_id_put(tcam, region->id); kfree(region); } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path
by Zhengchao Shao 26 Feb '24

26 Feb '24

From: Ido Schimmel <idosch(a)nvidia.com> mainline inclusion from mainline-v6.8-rc1 commit efeb7dfea8ee10cdec11b6b6ba4e405edbe75809 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EE7 CVE: CVE-2024-26595 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When calling mlxsw_sp_acl_tcam_region_destroy() from an error path after failing to attach the region to an ACL group, we hit a NULL pointer dereference upon 'region->group->tcam' [1]. Fix by retrieving the 'tcam' pointer using mlxsw_sp_acl_to_tcam(). [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] RIP: 0010:mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0 [...] Call Trace: mlxsw_sp_acl_tcam_vchunk_get+0x88b/0xa20 mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b Fixes: 22a677661f56 ("mlxsw: spectrum: Introduce ACL core with simple TCAM implementation") Signed-off-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Amit Cohen <amcohen(a)nvidia.com> Reviewed-by: Jiri Pirko <jiri(a)nvidia.com> Signed-off-by: Petr Machata <petrm(a)nvidia.com> Acked-by: Paolo Abeni <pabeni(a)redhat.com> Link: https://lore.kernel.org/r/fb6a4542bbc9fcab5a523802d97059bffbca7126.17055020… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c index 30931a2c025b..7ce670e71a7c 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c @@ -571,12 +571,13 @@ static void mlxsw_sp_acl_tcam_region_destroy(struct mlxsw_sp *mlxsw_sp, struct mlxsw_sp_acl_tcam_region *region) { + struct mlxsw_sp_acl_tcam *tcam = &mlxsw_sp->acl->tcam; const struct mlxsw_sp_acl_tcam_ops *ops = mlxsw_sp->acl_tcam_ops; ops->region_fini(mlxsw_sp, region->priv); mlxsw_sp_acl_tcam_region_disable(mlxsw_sp, region); mlxsw_sp_acl_tcam_region_free(mlxsw_sp, region); - mlxsw_sp_acl_tcam_region_id_put(region->group->tcam, region->id); + mlxsw_sp_acl_tcam_region_id_put(tcam, region->id); mlxsw_afk_key_info_put(region->key_info); kfree(region); } -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 14777/21632] drivers/scsi/huawei/hifc/hifc_hwif.c:517:65: sparse: sparse: incorrect type in argument 4 (different base types)
by kernel test robot 26 Feb '24

26 Feb '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b97b63500af297c36f80416fd1f1193d227cf51a commit: 7fc993d55d1b54ae40e29dfac825a18d04d644c6 [14777/21632] scsi/hifc: add hifc driver FC service module config: x86_64-randconfig-122-20240218 (https://download.01.org/0day-ci/archive/20240226/202402261420.bgeVvnXn-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240226/202402261420.bgeVvnXn-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402261420.bgeVvnXn-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/scsi/huawei/hifc/hifc_hwif.c:27:16: sparse: sparse: cast to restricted __be32 drivers/scsi/huawei/hifc/hifc_hwif.c:32:16: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int val @@ got restricted __be32 [usertype] @@ drivers/scsi/huawei/hifc/hifc_hwif.c:32:16: sparse: expected unsigned int val drivers/scsi/huawei/hifc/hifc_hwif.c:32:16: sparse: got restricted __be32 [usertype] drivers/scsi/huawei/hifc/hifc_hwif.c:453:29: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *cfg_regs_base @@ got void *cfg_reg_base @@ drivers/scsi/huawei/hifc/hifc_hwif.c:453:29: sparse: expected unsigned char [noderef] [usertype] __iomem *cfg_regs_base drivers/scsi/huawei/hifc/hifc_hwif.c:453:29: sparse: got void *cfg_reg_base drivers/scsi/huawei/hifc/hifc_hwif.c:454:30: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *intr_regs_base @@ got void *intr_reg_base @@ drivers/scsi/huawei/hifc/hifc_hwif.c:454:30: sparse: expected unsigned char [noderef] [usertype] __iomem *intr_regs_base drivers/scsi/huawei/hifc/hifc_hwif.c:454:30: sparse: got void *intr_reg_base drivers/scsi/huawei/hifc/hifc_hwif.c:457:23: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *db_base @@ got void *db_base @@ drivers/scsi/huawei/hifc/hifc_hwif.c:457:23: sparse: expected unsigned char [noderef] [usertype] __iomem *db_base drivers/scsi/huawei/hifc/hifc_hwif.c:457:23: sparse: got void *db_base >> drivers/scsi/huawei/hifc/hifc_hwif.c:517:65: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted gfp_t [usertype] flag @@ got unsigned int flag @@ drivers/scsi/huawei/hifc/hifc_hwif.c:517:65: sparse: expected restricted gfp_t [usertype] flag drivers/scsi/huawei/hifc/hifc_hwif.c:517:65: sparse: got unsigned int flag drivers/scsi/huawei/hifc/hifc_hwif.c:532:65: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted gfp_t [usertype] flag @@ got unsigned int flag @@ drivers/scsi/huawei/hifc/hifc_hwif.c:532:65: sparse: expected restricted gfp_t [usertype] flag drivers/scsi/huawei/hifc/hifc_hwif.c:532:65: sparse: got unsigned int flag In file included from drivers/scsi/huawei/hifc/hifc_hwif.c:14: In file included from drivers/scsi/huawei/hifc/hifc_knl_adp.h:30: In file included from include/scsi/scsi_host.h:12: In file included from include/linux/blk-mq.h:5: In file included from include/linux/blkdev.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. drivers/scsi/huawei/hifc/hifc_hwif.c:442: warning: Function parameter or member 'intr_reg_base' not described in 'hifc_init_hwif' drivers/scsi/huawei/hifc/hifc_hwif.c:442: warning: Function parameter or member 'db_base_phy' not described in 'hifc_init_hwif' drivers/scsi/huawei/hifc/hifc_hwif.c:442: warning: Function parameter or member 'db_base' not described in 'hifc_init_hwif' drivers/scsi/huawei/hifc/hifc_hwif.c:442: warning: Function parameter or member 'dwqe_mapping' not described in 'hifc_init_hwif' vim +517 drivers/scsi/huawei/hifc/hifc_hwif.c 218105be120513 Chenguangli 2020-11-16 508 218105be120513 Chenguangli 2020-11-16 509 int hifc_dma_zalloc_coherent_align(void *dev_hdl, u64 size, u64 align, 218105be120513 Chenguangli 2020-11-16 510 unsigned flag, 218105be120513 Chenguangli 2020-11-16 511 struct hifc_dma_addr_align *mem_align) 218105be120513 Chenguangli 2020-11-16 512 { 218105be120513 Chenguangli 2020-11-16 513 void *vaddr, *align_vaddr; 218105be120513 Chenguangli 2020-11-16 514 dma_addr_t paddr, align_paddr; 218105be120513 Chenguangli 2020-11-16 515 u64 real_size = size; 218105be120513 Chenguangli 2020-11-16 516 218105be120513 Chenguangli 2020-11-16 @517 vaddr = dma_zalloc_coherent(dev_hdl, real_size, &paddr, flag); 218105be120513 Chenguangli 2020-11-16 518 if (!vaddr) 218105be120513 Chenguangli 2020-11-16 519 return -ENOMEM; 218105be120513 Chenguangli 2020-11-16 520 218105be120513 Chenguangli 2020-11-16 521 align_paddr = ALIGN(paddr, align); 218105be120513 Chenguangli 2020-11-16 522 /* align */ 218105be120513 Chenguangli 2020-11-16 523 if (align_paddr == paddr) { 218105be120513 Chenguangli 2020-11-16 524 align_vaddr = vaddr; 218105be120513 Chenguangli 2020-11-16 525 goto out; 218105be120513 Chenguangli 2020-11-16 526 } 218105be120513 Chenguangli 2020-11-16 527 218105be120513 Chenguangli 2020-11-16 528 dma_free_coherent(dev_hdl, real_size, vaddr, paddr); 218105be120513 Chenguangli 2020-11-16 529 218105be120513 Chenguangli 2020-11-16 530 /* realloc memory for align */ 218105be120513 Chenguangli 2020-11-16 531 real_size = size + align; 218105be120513 Chenguangli 2020-11-16 532 vaddr = dma_zalloc_coherent(dev_hdl, real_size, &paddr, flag); 218105be120513 Chenguangli 2020-11-16 533 if (!vaddr) 218105be120513 Chenguangli 2020-11-16 534 return -ENOMEM; 218105be120513 Chenguangli 2020-11-16 535 218105be120513 Chenguangli 2020-11-16 536 align_paddr = ALIGN(paddr, align); 218105be120513 Chenguangli 2020-11-16 537 align_vaddr = (void *)((u64)vaddr + (align_paddr - paddr)); 218105be120513 Chenguangli 2020-11-16 538 218105be120513 Chenguangli 2020-11-16 539 out: 218105be120513 Chenguangli 2020-11-16 540 mem_align->real_size = (u32)real_size; 218105be120513 Chenguangli 2020-11-16 541 mem_align->ori_vaddr = vaddr; 218105be120513 Chenguangli 2020-11-16 542 mem_align->ori_paddr = paddr; 218105be120513 Chenguangli 2020-11-16 543 mem_align->align_vaddr = align_vaddr; 218105be120513 Chenguangli 2020-11-16 544 mem_align->align_paddr = align_paddr; 218105be120513 Chenguangli 2020-11-16 545 218105be120513 Chenguangli 2020-11-16 546 return 0; 218105be120513 Chenguangli 2020-11-16 547 } 218105be120513 Chenguangli 2020-11-16 548 :::::: The code at line 517 was first introduced by commit :::::: 218105be120513109ae9ea5418c10586913274d4 scsi/hifc: add hifc driver chip resource module :::::: TO: Chenguangli <chenguangli2(a)huawei.com> :::::: CC: Yang Yingliang <yangyingliang(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] mlxsw: spectrum_acl_tcam: Fix stack corruption
by Liu Jian 26 Feb '24

26 Feb '24

From: Ido Schimmel <idosch(a)nvidia.com> mainline inclusion from mainline-v6.8-rc1 commit 483ae90d8f976f8339cf81066312e1329f2d3706 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932WD CVE: CVE-2024-26586 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- When tc filters are first added to a net device, the corresponding local port gets bound to an ACL group in the device. The group contains a list of ACLs. In turn, each ACL points to a different TCAM region where the filters are stored. During forwarding, the ACLs are sequentially evaluated until a match is found. One reason to place filters in different regions is when they are added with decreasing priorities and in an alternating order so that two consecutive filters can never fit in the same region because of their key usage. In Spectrum-2 and newer ASICs the firmware started to report that the maximum number of ACLs in a group is more than 16, but the layout of the register that configures ACL groups (PAGT) was not updated to account for that. It is therefore possible to hit stack corruption [1] in the rare case where more than 16 ACLs in a group are required. Fix by limiting the maximum ACL group size to the minimum between what the firmware reports and the maximum ACLs that fit in the PAGT register. Add a test case to make sure the machine does not crash when this condition is hit. [1] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: mlxsw_sp_acl_tcam_group_update+0x116/0x120 [...] dump_stack_lvl+0x36/0x50 panic+0x305/0x330 __stack_chk_fail+0x15/0x20 mlxsw_sp_acl_tcam_group_update+0x116/0x120 mlxsw_sp_acl_tcam_group_region_attach+0x69/0x110 mlxsw_sp_acl_tcam_vchunk_get+0x492/0xa20 mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b Fixes: c3ab435466d5 ("mlxsw: spectrum: Extend to support Spectrum-2 ASIC") Reported-by: Orel Hagag <orelh(a)nvidia.com> Signed-off-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Amit Cohen <amcohen(a)nvidia.com> Signed-off-by: Petr Machata <petrm(a)nvidia.com> Acked-by: Paolo Abeni <pabeni(a)redhat.com> Link: https://lore.kernel.org/r/2d91c89afba59c22587b444994ae419dbea8d876.17055020… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> Conflicts: drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh --- .../mellanox/mlxsw/spectrum_acl_tcam.c | 2 + .../drivers/net/mlxsw/spectrum-2/tc_flower.sh | 56 ++++++++++++++++++- 2 files changed, 57 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c index 30931a2c025b..d4ddea426939 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c @@ -57,6 +57,8 @@ int mlxsw_sp_acl_tcam_init(struct mlxsw_sp *mlxsw_sp, tcam->max_groups = max_groups; tcam->max_group_size = MLXSW_CORE_RES_GET(mlxsw_sp->core, ACL_MAX_GROUP_SIZE); + tcam->max_group_size = min_t(unsigned int, tcam->max_group_size, + MLXSW_REG_PAGT_ACL_MAX_NUM); err = ops->init(mlxsw_sp, tcam->priv, tcam); if (err) diff --git a/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh b/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh index 3b75180f455d..61f0ce8454e0 100755 --- a/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh +++ b/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh @@ -8,7 +8,7 @@ lib_dir=$(dirname $0)/../../../../net/forwarding ALL_TESTS="single_mask_test identical_filters_test two_masks_test \ - multiple_masks_test ctcam_edge_cases_test" + multiple_masks_test ctcam_edge_cases_test max_group_size_test" NUM_NETIFS=2 source $lib_dir/tc_common.sh source $lib_dir/lib.sh @@ -324,6 +324,60 @@ ctcam_edge_cases_test() ctcam_no_atcam_masks_test } +max_group_size_test() +{ + # The number of ACLs in an ACL group is limited. Once the maximum + # number of ACLs has been reached, filters cannot be added. This test + # verifies that when this limit is reached, insertion fails without + # crashing. + + RET=0 + + local num_acls=32 + local max_size + local ret + + if [[ "$tcflags" != "skip_sw" ]]; then + return 0; + fi + + for ((i=1; i < $num_acls; i++)); do + if [[ $(( i % 2 )) == 1 ]]; then + tc filter add dev $h2 ingress pref $i proto ipv4 \ + flower $tcflags dst_ip 198.51.100.1/32 \ + ip_proto tcp tcp_flags 0x01/0x01 \ + action drop &> /dev/null + else + tc filter add dev $h2 ingress pref $i proto ipv6 \ + flower $tcflags dst_ip 2001:db8:1::1/128 \ + action drop &> /dev/null + fi + + ret=$? + [[ $ret -ne 0 ]] && max_size=$((i - 1)) && break + done + + # We expect to exceed the maximum number of ACLs in a group, so that + # insertion eventually fails. Otherwise, the test should be adjusted to + # add more filters. + check_fail $ret "expected to exceed number of ACLs in a group" + + for ((; i >= 1; i--)); do + if [[ $(( i % 2 )) == 1 ]]; then + tc filter del dev $h2 ingress pref $i proto ipv4 \ + flower $tcflags dst_ip 198.51.100.1/32 \ + ip_proto tcp tcp_flags 0x01/0x01 \ + action drop &> /dev/null + else + tc filter del dev $h2 ingress pref $i proto ipv6 \ + flower $tcflags dst_ip 2001:db8:1::1/128 \ + action drop &> /dev/null + fi + done + + log_test "max ACL group size test ($tcflags). max size $max_size" +} + setup_prepare() { h1=${NETIFS[p1]} -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS 0/1] backport patch to fix CVE vulnerabilities from olk-6.6
by Yuntao Liu 26 Feb '24

26 Feb '24

patch to fix CVE-2024-23196. Tuo Li (1): ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync() sound/hda/hdac_regmap.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS v3 0/2] CVE-2023-52435
by Ziyang Xuan 26 Feb '24

26 Feb '24

v3: - Add fixes tag for patch 2. v2: - Fix comment head of patch 1. - Fix compile warning of patch 1. Eric Dumazet (1): net: prevent mss overflow in skb_segment() Ziyang Xuan (1): net: Fix compile warning in skb_segment() net/core/skbuff.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH OLK-6.6] kvm: kabi: KABI reservation for RME
by Guangwei Zhou 26 Feb '24

26 Feb '24

driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I92TT5 CVE: NA ---------------------------------------------------------------------- Reserve KABI for struct kvm_arch and struct kvm_vcpu_arch for ARMv9 RME feature. Signed-off-by: Guangwei Zhou <zhouguangwei5(a)huawei.com> --- arch/arm64/include/asm/kvm_host.h | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h index 993b60d7219d..7c34e0b0b875 100644 --- a/arch/arm64/include/asm/kvm_host.h +++ b/arch/arm64/include/asm/kvm_host.h @@ -27,6 +27,7 @@ #include <asm/fpsimd.h> #include <asm/kvm.h> #include <asm/kvm_asm.h> +#include <linux/kabi.h> #define __KVM_HAVE_ARCH_INTC_INITIALIZED @@ -286,6 +287,15 @@ struct kvm_arch { cpumask_var_t sched_cpus; /* Union of all vcpu's cpus_ptr */ u64 tlbi_dvmbm; #endif + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + KABI_RESERVE(8) }; struct kvm_vcpu_fault_info { @@ -604,6 +614,26 @@ struct kvm_vcpu_arch { cpumask_var_t sched_cpus; cpumask_var_t pre_sched_cpus; #endif + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + KABI_RESERVE(8) + KABI_RESERVE(9) + KABI_RESERVE(10) + KABI_RESERVE(11) + KABI_RESERVE(12) + KABI_RESERVE(13) + KABI_RESERVE(14) + KABI_RESERVE(15) + KABI_RESERVE(16) + KABI_RESERVE(17) + KABI_RESERVE(18) + KABI_RESERVE(19) }; /* -- 2.33.0

2 1

[PATCH OLK-6.6] f2fs: fix to avoid dirent corruption
by Zizhi Wo 26 Feb '24

26 Feb '24

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v6.6.14 commit d3c0b49aaa12a61d560528f5d605029ab57f0728 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932VP CVE: CVE-2023-52444 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 53edb549565f55ccd0bdf43be3d66ce4c2d48b28 ] As Al reported in link[1]: f2fs_rename() ... if (old_dir != new_dir && !whiteout) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else f2fs_put_page(old_dir_page, 0); You want correct inumber in the ".." link. And cross-directory rename does move the source to new parent, even if you'd been asked to leave a whiteout in the old place. [1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/ With below testcase, it may cause dirent corruption, due to it missed to call f2fs_set_link() to update ".." link to new directory. - mkdir -p dir/foo - renameat2 -w dir/foo bar [ASSERT] (__chk_dots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3] [FSCK] other corrupted bugs [Fail] Fixes: 7e01e7ad746b ("f2fs: support RENAME_WHITEOUT") Cc: Jan Kara <jack(a)suse.cz> Reported-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Chao Yu <chao(a)kernel.org> Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c index 193b22a2d6bf..02d9c47797be 100644 --- a/fs/f2fs/namei.c +++ b/fs/f2fs/namei.c @@ -1106,7 +1106,7 @@ static int f2fs_rename(struct mnt_idmap *idmap, struct inode *old_dir, } if (old_dir_entry) { - if (old_dir != new_dir && !whiteout) + if (old_dir != new_dir) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else -- 2.39.2

2 1

[PATCH OLK-5.10] f2fs: fix to avoid dirent corruption
by Zizhi Wo 26 Feb '24

26 Feb '24

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v5.10.209 commit 6f866885e147d33efc497f1095f35b2ee5ec7310 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932VP CVE: CVE-2023-52444 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 53edb549565f55ccd0bdf43be3d66ce4c2d48b28 ] As Al reported in link[1]: f2fs_rename() ... if (old_dir != new_dir && !whiteout) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else f2fs_put_page(old_dir_page, 0); You want correct inumber in the ".." link. And cross-directory rename does move the source to new parent, even if you'd been asked to leave a whiteout in the old place. [1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/ With below testcase, it may cause dirent corruption, due to it missed to call f2fs_set_link() to update ".." link to new directory. - mkdir -p dir/foo - renameat2 -w dir/foo bar [ASSERT] (__chk_dots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3] [FSCK] other corrupted bugs [Fail] Fixes: 7e01e7ad746b ("f2fs: support RENAME_WHITEOUT") Cc: Jan Kara <jack(a)suse.cz> Reported-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Chao Yu <chao(a)kernel.org> Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c index 72b109685db4..99e4ec48d2a4 100644 --- a/fs/f2fs/namei.c +++ b/fs/f2fs/namei.c @@ -1066,7 +1066,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry, } if (old_dir_entry) { - if (old_dir != new_dir && !whiteout) + if (old_dir != new_dir) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] f2fs: fix to avoid dirent corruption
by Zizhi Wo 26 Feb '24

26 Feb '24

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v4.19.306 commit 02160112e6d45c2610b049df6eb693d7a2e57b46 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932VP CVE: CVE-2023-52444 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 53edb549565f55ccd0bdf43be3d66ce4c2d48b28 ] As Al reported in link[1]: f2fs_rename() ... if (old_dir != new_dir && !whiteout) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else f2fs_put_page(old_dir_page, 0); You want correct inumber in the ".." link. And cross-directory rename does move the source to new parent, even if you'd been asked to leave a whiteout in the old place. [1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/ With below testcase, it may cause dirent corruption, due to it missed to call f2fs_set_link() to update ".." link to new directory. - mkdir -p dir/foo - renameat2 -w dir/foo bar [ASSERT] (__chk_dots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3] [FSCK] other corrupted bugs [Fail] Fixes: 7e01e7ad746b ("f2fs: support RENAME_WHITEOUT") Cc: Jan Kara <jack(a)suse.cz> Reported-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Chao Yu <chao(a)kernel.org> Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c index 0ace2c2e3de9..98afafe633a2 100644 --- a/fs/f2fs/namei.c +++ b/fs/f2fs/namei.c @@ -968,7 +968,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry, } if (old_dir_entry) { - if (old_dir != new_dir && !whiteout) + if (old_dir != new_dir) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else -- 2.39.2

2 1

[openEuler-1.0-LTS] f2fs: fix to avoid dirent corruption
by Zizhi Wo 26 Feb '24

26 Feb '24

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v4.19.306 commit 02160112e6d45c2610b049df6eb693d7a2e57b46 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932VP CVE: CVE-2023-52444 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 53edb549565f55ccd0bdf43be3d66ce4c2d48b28 ] As Al reported in link[1]: f2fs_rename() ... if (old_dir != new_dir && !whiteout) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else f2fs_put_page(old_dir_page, 0); You want correct inumber in the ".." link. And cross-directory rename does move the source to new parent, even if you'd been asked to leave a whiteout in the old place. [1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/ With below testcase, it may cause dirent corruption, due to it missed to call f2fs_set_link() to update ".." link to new directory. - mkdir -p dir/foo - renameat2 -w dir/foo bar [ASSERT] (__chk_dots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3] [FSCK] other corrupted bugs [Fail] Fixes: 7e01e7ad746b ("f2fs: support RENAME_WHITEOUT") Cc: Jan Kara <jack(a)suse.cz> Reported-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Chao Yu <chao(a)kernel.org> Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c index 0ace2c2e3de9..98afafe633a2 100644 --- a/fs/f2fs/namei.c +++ b/fs/f2fs/namei.c @@ -968,7 +968,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry, } if (old_dir_entry) { - if (old_dir != new_dir && !whiteout) + if (old_dir != new_dir) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else -- 2.39.2

1 0

[openeuler:openEuler-1.0-LTS 13425/21632] drivers/net/ethernet/huawei/hinic/hinic_hwif.c:649:65: sparse: sparse: incorrect type in argument 4 (different base types)
by kernel test robot 25 Feb '24

25 Feb '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b97b63500af297c36f80416fd1f1193d227cf51a commit: 90f09a01314abe26de1a722d1b51c351d84e1f5b [13425/21632] net/hinic: Add support for X86 Arch config: x86_64-randconfig-122-20240218 (https://download.01.org/0day-ci/archive/20240225/202402252031.ls64imy6-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240225/202402252031.ls64imy6-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402252031.ls64imy6-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/huawei/hinic/hinic_hwif.c:40:16: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:46:16: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int val @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:46:16: sparse: expected unsigned int val drivers/net/ethernet/huawei/hinic/hinic_hwif.c:46:16: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_hwif.c:575:29: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *cfg_regs_base @@ got void *cfg_reg_base @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:575:29: sparse: expected unsigned char [noderef] [usertype] __iomem *cfg_regs_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:575:29: sparse: got void *cfg_reg_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:576:30: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *intr_regs_base @@ got void *intr_reg_base @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:576:30: sparse: expected unsigned char [noderef] [usertype] __iomem *intr_regs_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:576:30: sparse: got void *intr_reg_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:579:23: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *db_base @@ got void *db_base @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:579:23: sparse: expected unsigned char [noderef] [usertype] __iomem *db_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:579:23: sparse: got void *db_base >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:649:65: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted gfp_t [usertype] flag @@ got unsigned int flag @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:649:65: sparse: expected restricted gfp_t [usertype] flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:649:65: sparse: got unsigned int flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:664:65: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted gfp_t [usertype] flag @@ got unsigned int flag @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:664:65: sparse: expected restricted gfp_t [usertype] flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:664:65: sparse: got unsigned int flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:970:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:979:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:564: warning: Function parameter or member 'intr_reg_base' not described in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:564: warning: Function parameter or member 'db_base_phy' not described in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:564: warning: Function parameter or member 'db_base' not described in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:564: warning: Function parameter or member 'dwqe_mapping' not described in 'hinic_init_hwif' vim +649 drivers/net/ethernet/huawei/hinic/hinic_hwif.c 746ea35981b1f7 Xue 2019-01-30 640 746ea35981b1f7 Xue 2019-01-30 641 int hinic_dma_zalloc_coherent_align(void *dev_hdl, u64 size, u64 align, 746ea35981b1f7 Xue 2019-01-30 642 unsigned int flag, 746ea35981b1f7 Xue 2019-01-30 643 struct hinic_dma_addr_align *mem_align) 746ea35981b1f7 Xue 2019-01-30 644 { 746ea35981b1f7 Xue 2019-01-30 645 void *vaddr, *align_vaddr; 746ea35981b1f7 Xue 2019-01-30 646 dma_addr_t paddr, align_paddr; 746ea35981b1f7 Xue 2019-01-30 647 u64 real_size = size; 746ea35981b1f7 Xue 2019-01-30 648 746ea35981b1f7 Xue 2019-01-30 @649 vaddr = dma_zalloc_coherent(dev_hdl, real_size, &paddr, flag); 746ea35981b1f7 Xue 2019-01-30 650 if (!vaddr) 746ea35981b1f7 Xue 2019-01-30 651 return -ENOMEM; 746ea35981b1f7 Xue 2019-01-30 652 746ea35981b1f7 Xue 2019-01-30 653 align_paddr = ALIGN(paddr, align); 746ea35981b1f7 Xue 2019-01-30 654 /* align */ 746ea35981b1f7 Xue 2019-01-30 655 if (align_paddr == paddr) { 746ea35981b1f7 Xue 2019-01-30 656 align_vaddr = vaddr; 746ea35981b1f7 Xue 2019-01-30 657 goto out; 746ea35981b1f7 Xue 2019-01-30 658 } 746ea35981b1f7 Xue 2019-01-30 659 746ea35981b1f7 Xue 2019-01-30 660 dma_free_coherent(dev_hdl, real_size, vaddr, paddr); 746ea35981b1f7 Xue 2019-01-30 661 746ea35981b1f7 Xue 2019-01-30 662 /* realloc memory for align */ 746ea35981b1f7 Xue 2019-01-30 663 real_size = size + align; 746ea35981b1f7 Xue 2019-01-30 664 vaddr = dma_zalloc_coherent(dev_hdl, real_size, &paddr, flag); 746ea35981b1f7 Xue 2019-01-30 665 if (!vaddr) 746ea35981b1f7 Xue 2019-01-30 666 return -ENOMEM; 746ea35981b1f7 Xue 2019-01-30 667 746ea35981b1f7 Xue 2019-01-30 668 align_paddr = ALIGN(paddr, align); 746ea35981b1f7 Xue 2019-01-30 669 align_vaddr = (void *)((u64)vaddr + (align_paddr - paddr)); 746ea35981b1f7 Xue 2019-01-30 670 746ea35981b1f7 Xue 2019-01-30 671 out: 746ea35981b1f7 Xue 2019-01-30 672 mem_align->real_size = (u32)real_size; 746ea35981b1f7 Xue 2019-01-30 673 mem_align->ori_vaddr = vaddr; 746ea35981b1f7 Xue 2019-01-30 674 mem_align->ori_paddr = paddr; 746ea35981b1f7 Xue 2019-01-30 675 mem_align->align_vaddr = align_vaddr; 746ea35981b1f7 Xue 2019-01-30 676 mem_align->align_paddr = align_paddr; 746ea35981b1f7 Xue 2019-01-30 677 746ea35981b1f7 Xue 2019-01-30 678 return 0; 746ea35981b1f7 Xue 2019-01-30 679 } 746ea35981b1f7 Xue 2019-01-30 680 :::::: The code at line 649 was first introduced by commit :::::: 746ea35981b1f77e988d48642409d73f0470b3eb net: hinic: Add Hardware Abstract Layer :::::: TO: Xue <xuechaojing(a)huawei.com> :::::: CC: Xie XiuQi <xiexiuqi(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 10454/21632] sound/usb/validate.c:113:26: sparse: sparse: restricted __le16 degrades to integer
by kernel test robot 25 Feb '24

25 Feb '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b97b63500af297c36f80416fd1f1193d227cf51a commit: c6a3607c78f8035db0efc67cb41374fe49e4709d [10454/21632] ALSA: usb-audio: More validations of descriptor units config: x86_64-randconfig-121-20240224 (https://download.01.org/0day-ci/archive/20240225/202402250716.ZS5etOKl-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240225/202402250716.ZS5etOKl-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402250716.ZS5etOKl-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> sound/usb/validate.c:113:26: sparse: sparse: restricted __le16 degrades to integer >> sound/usb/validate.c:113:26: sparse: sparse: restricted __le16 degrades to integer sound/usb/validate.c:128:26: sparse: sparse: restricted __le16 degrades to integer sound/usb/validate.c:128:26: sparse: sparse: restricted __le16 degrades to integer sound/usb/validate.c:145:26: sparse: sparse: restricted __le16 degrades to integer sound/usb/validate.c:145:26: sparse: sparse: restricted __le16 degrades to integer vim +113 sound/usb/validate.c 67 68 /* both for processing and extension units; covering all UACs */ 69 static bool validate_processing_unit(const void *p, 70 const struct usb_desc_validator *v) 71 { 72 const struct uac_processing_unit_descriptor *d = p; 73 const unsigned char *hdr = p; 74 size_t len, m; 75 76 if (d->bLength < sizeof(*d)) 77 return false; 78 len = d->bLength < sizeof(*d) + d->bNrInPins; 79 if (d->bLength < len) 80 return false; 81 switch (v->protocol) { 82 case UAC_VERSION_1: 83 default: 84 /* bNrChannels, wChannelConfig, iChannelNames, bControlSize */ 85 len += 1 + 2 + 1 + 1; 86 if (d->bLength < len) /* bControlSize */ 87 return false; 88 m = hdr[len]; 89 len += 1 + m + 1; /* bControlSize, bmControls, iProcessing */ 90 break; 91 case UAC_VERSION_2: 92 /* bNrChannels, bmChannelConfig, iChannelNames */ 93 len += 1 + 4 + 1; 94 if (v->type == UAC2_PROCESSING_UNIT_V2) 95 len += 2; /* bmControls -- 2 bytes for PU */ 96 else 97 len += 1; /* bmControls -- 1 byte for EU */ 98 len += 1; /* iProcessing */ 99 break; 100 case UAC_VERSION_3: 101 /* wProcessingDescrStr, bmControls */ 102 len += 2 + 4; 103 break; 104 } 105 if (d->bLength < len) 106 return false; 107 108 switch (v->protocol) { 109 case UAC_VERSION_1: 110 default: 111 if (v->type == UAC1_EXTENSION_UNIT) 112 return true; /* OK */ > 113 switch (d->wProcessType) { 114 case UAC_PROCESS_UP_DOWNMIX: 115 case UAC_PROCESS_DOLBY_PROLOGIC: 116 if (d->bLength < len + 1) /* bNrModes */ 117 return false; 118 m = hdr[len]; 119 len += 1 + m * 2; /* bNrModes, waModes(n) */ 120 break; 121 default: 122 break; 123 } 124 break; 125 case UAC_VERSION_2: 126 if (v->type == UAC2_EXTENSION_UNIT_V2) 127 return true; /* OK */ 128 switch (d->wProcessType) { 129 case UAC2_PROCESS_UP_DOWNMIX: 130 case UAC2_PROCESS_DOLBY_PROLOCIC: /* SiC! */ 131 if (d->bLength < len + 1) /* bNrModes */ 132 return false; 133 m = hdr[len]; 134 len += 1 + m * 4; /* bNrModes, daModes(n) */ 135 break; 136 default: 137 break; 138 } 139 break; 140 case UAC_VERSION_3: 141 if (v->type == UAC3_EXTENSION_UNIT) { 142 len += 2; /* wClusterDescrID */ 143 break; 144 } 145 switch (d->wProcessType) { 146 case UAC3_PROCESS_UP_DOWNMIX: 147 if (d->bLength < len + 1) /* bNrModes */ 148 return false; 149 m = hdr[len]; 150 len += 1 + m * 2; /* bNrModes, waClusterDescrID(n) */ 151 break; 152 case UAC3_PROCESS_MULTI_FUNCTION: 153 len += 2 + 4; /* wClusterDescrID, bmAlgorighms */ 154 break; 155 default: 156 break; 157 } 158 break; 159 } 160 if (d->bLength < len) 161 return false; 162 163 return true; 164 } 165 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 13350/21632] ld.lld: error: undefined symbol: kfree_skb
by kernel test robot 24 Feb '24

24 Feb '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b97b63500af297c36f80416fd1f1193d227cf51a commit: 6636f4434a9c5c9c645694db206188ee5a6626dd [13350/21632] ext4: report error to userspace by netlink config: x86_64-buildonly-randconfig-001-20240224 (https://download.01.org/0day-ci/archive/20240224/202402242133.TAc5acto-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240224/202402242133.TAc5acto-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402242133.TAc5acto-lkp@intel.com/ All errors (new ones prefixed by >>): >> ld.lld: error: undefined symbol: __alloc_skb >>> referenced by super.c >>> fs/ext4/super.o:(ext4_netlink_send_info) in archive built-in.a -- >> ld.lld: error: undefined symbol: __nlmsg_put >>> referenced by super.c >>> fs/ext4/super.o:(ext4_netlink_send_info) in archive built-in.a -- >> ld.lld: error: undefined symbol: kfree_skb >>> referenced by super.c >>> fs/ext4/super.o:(ext4_netlink_send_info) in archive built-in.a -- >> ld.lld: error: undefined symbol: netlink_broadcast >>> referenced by super.c >>> fs/ext4/super.o:(ext4_netlink_send_info) in archive built-in.a -- >> ld.lld: error: undefined symbol: init_net >>> referenced by super.c >>> fs/ext4/super.o:(ext4_init_fs) in archive built-in.a -- >> ld.lld: error: undefined symbol: __netlink_kernel_create >>> referenced by super.c >>> fs/ext4/super.o:(ext4_init_fs) in archive built-in.a -- >> ld.lld: error: undefined symbol: netlink_kernel_release >>> referenced by super.c >>> fs/ext4/super.o:(ext4_exit_fs) in archive built-in.a -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 29649/30000] drivers/ub/urma/ubcore/ubcore_device.c:393:23: warning: no previous prototype for function 'ubcore_find_tpf_device_legacy'
by kernel test robot 24 Feb '24

24 Feb '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4fee6fdef7d687d6ce43289fd7e7f96fde039af0 commit: 329bf7f331286ee5d571d374e31ed50d2877b110 [29649/30000] ubcore: fix the bug of tp negotiation concurrency config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240224/202402242102.SLiva8Ut-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240224/202402242102.SLiva8Ut-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402242102.SLiva8Ut-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/ub/urma/ubcore/ubcore_device.c:306:6: warning: no previous prototype for function 'ubcore_destroy_upi_list' [-Wmissing-prototypes] 306 | void ubcore_destroy_upi_list(void) | ^ drivers/ub/urma/ubcore/ubcore_device.c:306:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 306 | void ubcore_destroy_upi_list(void) | ^ | static >> drivers/ub/urma/ubcore/ubcore_device.c:393:23: warning: no previous prototype for function 'ubcore_find_tpf_device_legacy' [-Wmissing-prototypes] 393 | struct ubcore_device *ubcore_find_tpf_device_legacy(void) | ^ drivers/ub/urma/ubcore/ubcore_device.c:393:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 393 | struct ubcore_device *ubcore_find_tpf_device_legacy(void) | ^ | static 2 warnings generated. -- drivers/ub/urma/ubcore/ubcore_tp.c:66:17: warning: no previous prototype for function 'ubcore_get_mtu' [-Wmissing-prototypes] 66 | enum ubcore_mtu ubcore_get_mtu(int mtu) | ^ drivers/ub/urma/ubcore/ubcore_tp.c:66:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 66 | enum ubcore_mtu ubcore_get_mtu(int mtu) | ^ | static >> drivers/ub/urma/ubcore/ubcore_tp.c:392:5: warning: no previous prototype for function 'ubcore_modify_tp_state' [-Wmissing-prototypes] 392 | int ubcore_modify_tp_state(struct ubcore_device *dev, struct ubcore_tp *tp, | ^ drivers/ub/urma/ubcore/ubcore_tp.c:392:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 392 | int ubcore_modify_tp_state(struct ubcore_device *dev, struct ubcore_tp *tp, | ^ | static drivers/ub/urma/ubcore/ubcore_tp.c:894:19: warning: no previous prototype for function 'ubcore_create_vtp' [-Wmissing-prototypes] 894 | struct ubcore_tp *ubcore_create_vtp(struct ubcore_device *dev, union ubcore_eid *remote_eid, | ^ drivers/ub/urma/ubcore/ubcore_tp.c:894:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 894 | struct ubcore_tp *ubcore_create_vtp(struct ubcore_device *dev, union ubcore_eid *remote_eid, | ^ | static drivers/ub/urma/ubcore/ubcore_tp.c:920:5: warning: no previous prototype for function 'ubcore_destroy_vtp' [-Wmissing-prototypes] 920 | int ubcore_destroy_vtp(struct ubcore_tp *vtp) | ^ drivers/ub/urma/ubcore/ubcore_tp.c:920:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 920 | int ubcore_destroy_vtp(struct ubcore_tp *vtp) | ^ | static 4 warnings generated. -- >> drivers/ub/urma/uburma/uburma_main.c:640:6: warning: no previous prototype for function 'uburma_dev_accessible_by_ns' [-Wmissing-prototypes] 640 | bool uburma_dev_accessible_by_ns(struct uburma_device *ubu_dev, struct net *net) | ^ drivers/ub/urma/uburma/uburma_main.c:640:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 640 | bool uburma_dev_accessible_by_ns(struct uburma_device *ubu_dev, struct net *net) | ^ | static >> drivers/ub/urma/uburma/uburma_main.c:665:5: warning: no previous prototype for function 'uburma_set_dev_ns' [-Wmissing-prototypes] 665 | int uburma_set_dev_ns(char *device_name, int ns_fd) | ^ drivers/ub/urma/uburma/uburma_main.c:665:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 665 | int uburma_set_dev_ns(char *device_name, int ns_fd) | ^ | static >> drivers/ub/urma/uburma/uburma_main.c:723:5: warning: no previous prototype for function 'uburma_set_ns_mode' [-Wmissing-prototypes] 723 | int uburma_set_ns_mode(bool shared) | ^ drivers/ub/urma/uburma/uburma_main.c:723:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 723 | int uburma_set_ns_mode(bool shared) | ^ | static 3 warnings generated. vim +/ubcore_find_tpf_device_legacy +393 drivers/ub/urma/ubcore/ubcore_device.c 392 > 393 struct ubcore_device *ubcore_find_tpf_device_legacy(void) 394 { 395 if (g_tpf == NULL) 396 ubcore_log_err("tpf is not registered yet"); 397 398 ubcore_get_device(g_tpf); 399 return g_tpf; 400 } 401 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3269/3388] security/integrity/ima/ima_fs.c:773:6: warning: variable 'ret' is used uninitialized whenever 'if' condition is true
by kernel test robot 24 Feb '24

24 Feb '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 0e6ac87df9e5122747ac5d9e7da9a45555f16374 commit: 0e45634e06109de7611c36f8d25c0ab35baa0624 [3269/3388] ima: Introduce new securityfs files config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240224/202402241932.aJqB4j0N-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240224/202402241932.aJqB4j0N-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402241932.aJqB4j0N-lkp@intel.com/ All warnings (new ones prefixed by >>): >> security/integrity/ima/ima_fs.c:773:6: warning: variable 'ret' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized] 773 | if (IS_ERR(digest_list_data_del)) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ security/integrity/ima/ima_fs.c:791:9: note: uninitialized use occurs here 791 | return ret; | ^~~ security/integrity/ima/ima_fs.c:773:2: note: remove the 'if' if its condition is always false 773 | if (IS_ERR(digest_list_data_del)) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 774 | goto out; | ~~~~~~~~ security/integrity/ima/ima_fs.c:767:6: warning: variable 'ret' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized] 767 | if (IS_ERR(digest_list_data)) | ^~~~~~~~~~~~~~~~~~~~~~~~ security/integrity/ima/ima_fs.c:791:9: note: uninitialized use occurs here 791 | return ret; | ^~~ security/integrity/ima/ima_fs.c:767:2: note: remove the 'if' if its condition is always false 767 | if (IS_ERR(digest_list_data)) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 768 | goto out; | ~~~~~~~~ security/integrity/ima/ima_fs.c:761:6: warning: variable 'ret' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized] 761 | if (IS_ERR(digests_count)) | ^~~~~~~~~~~~~~~~~~~~~ security/integrity/ima/ima_fs.c:791:9: note: uninitialized use occurs here 791 | return ret; | ^~~ security/integrity/ima/ima_fs.c:761:2: note: remove the 'if' if its condition is always false 761 | if (IS_ERR(digests_count)) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ 762 | goto out; | ~~~~~~~~ security/integrity/ima/ima_fs.c:690:9: note: initialize the variable 'ret' to silence this warning 690 | int ret; | ^ | = 0 3 warnings generated. vim +773 security/integrity/ima/ima_fs.c 687 688 int __init ima_fs_init(void) 689 { 690 int ret; 691 692 ima_dir = securityfs_create_dir("ima", integrity_dir); 693 if (IS_ERR(ima_dir)) 694 return PTR_ERR(ima_dir); 695 696 ima_symlink = securityfs_create_symlink("ima", NULL, "integrity/ima", 697 NULL); 698 if (IS_ERR(ima_symlink)) { 699 ret = PTR_ERR(ima_symlink); 700 goto out; 701 } 702 703 binary_runtime_measurements = 704 securityfs_create_file("binary_runtime_measurements", 705 S_IRUSR | S_IRGRP, ima_dir, NULL, 706 &ima_measurements_ops); 707 if (IS_ERR(binary_runtime_measurements)) { 708 ret = PTR_ERR(binary_runtime_measurements); 709 goto out; 710 } 711 712 ascii_runtime_measurements = 713 securityfs_create_file("ascii_runtime_measurements", 714 S_IRUSR | S_IRGRP, ima_dir, NULL, 715 &ima_ascii_measurements_ops); 716 if (IS_ERR(ascii_runtime_measurements)) { 717 ret = PTR_ERR(ascii_runtime_measurements); 718 goto out; 719 } 720 721 runtime_measurements_count = 722 securityfs_create_file("runtime_measurements_count", 723 S_IRUSR | S_IRGRP, ima_dir, NULL, 724 #ifdef CONFIG_IMA_DIGEST_LIST 725 &ima_htable_value_ops); 726 #else 727 &ima_measurements_count_ops); 728 #endif 729 if (IS_ERR(runtime_measurements_count)) { 730 ret = PTR_ERR(runtime_measurements_count); 731 goto out; 732 } 733 734 violations = 735 securityfs_create_file("violations", S_IRUSR | S_IRGRP, 736 #ifdef CONFIG_IMA_DIGEST_LIST 737 ima_dir, NULL, &ima_htable_value_ops); 738 #else 739 ima_dir, NULL, &ima_htable_violations_ops); 740 #endif 741 if (IS_ERR(violations)) { 742 ret = PTR_ERR(violations); 743 goto out; 744 } 745 746 ima_policy = securityfs_create_file("policy", POLICY_FILE_FLAGS, 747 ima_dir, NULL, 748 #ifdef CONFIG_IMA_DIGEST_LIST 749 &ima_data_upload_ops); 750 #else 751 &ima_measure_policy_ops); 752 #endif 753 if (IS_ERR(ima_policy)) { 754 ret = PTR_ERR(ima_policy); 755 goto out; 756 } 757 #ifdef CONFIG_IMA_DIGEST_LIST 758 digests_count = securityfs_create_file("digests_count", 759 S_IRUSR | S_IRGRP, ima_dir, 760 NULL, &ima_htable_value_ops); 761 if (IS_ERR(digests_count)) 762 goto out; 763 764 digest_list_data = securityfs_create_file("digest_list_data", S_IWUSR, 765 ima_dir, NULL, 766 &ima_data_upload_ops); 767 if (IS_ERR(digest_list_data)) 768 goto out; 769 770 digest_list_data_del = securityfs_create_file("digest_list_data_del", 771 S_IWUSR, ima_dir, NULL, 772 &ima_data_upload_ops); > 773 if (IS_ERR(digest_list_data_del)) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 19387/30000] drivers/vdpa/vdpa_sim/vdpa_sim_net.c:36:4: sparse: sparse: symbol 'macaddr_buf' was not declared. Should it be static?
by kernel test robot 24 Feb '24

24 Feb '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4fee6fdef7d687d6ce43289fd7e7f96fde039af0 commit: d4a6c405d07d2c7eb60a781368d94c476ebe24ab [19387/30000] vdpa: split vdpasim to core and net modules config: x86_64-randconfig-122-20240224 (https://download.01.org/0day-ci/archive/20240224/202402241904.fKVDwGyh-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240224/202402241904.fKVDwGyh-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402241904.fKVDwGyh-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/vdpa/vdpa_sim/vdpa_sim_net.c:36:4: sparse: sparse: symbol 'macaddr_buf' was not declared. Should it be static? vim +/macaddr_buf +36 drivers/vdpa/vdpa_sim/vdpa_sim_net.c 35 > 36 u8 macaddr_buf[ETH_ALEN]; 37 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0